dsh-workbuddy-xdpool 1.7.4 → 1.7.6

package/CHANGELOG.md

@@ -4,6 +4,109 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 1.7.6 — 一个读不出来的凭据文件，不再带走整个账号池
+
+> 你切了 4 个账号登录，界面显示 4 个；重启之后只剩 2 个 —— 不是账号没了，是它们被一个文件拖累了。
+
+**你会看到**：用 WorkBuddy Switch 切换登录几个国内版账号后，卡片上账号数对不上——重启少了两个。
+
+**为什么**：认证目录里**同时存在好几种文件**：明文的老格式、5.6.0+ 起的加密格式、写到一半的、还有插件不认识的版本。这些**混在一起是常态**，不是错误。
+
+但旧代码里，只要**碰到一个加密又打不开的文件**（WorkBuddy 没运行、或者取不到它的密钥），就会**抛异常终止整个扫描** —— 于是那些**明明读得好好的账号也被一起丢掉**。一个坏文件，带走整个池。
+
+我复现了这个行为：3 个正常文件 + 1 个打不开的，结果**不是返回 3 个，而是整个扫描抛错、0 个账号**。
+
+**怎么修的**：
+
+- **单个文件失败只跳过它自己**，不会连累其他账号。这是核心修复；
+- **跳过的文件会被记录并显示在卡片上**：现在账号区会明确写「有 N 个凭据文件读不出来」，并**列出文件名和原因**。其中「已加密 — 启动一次 WorkBuddy 才能取到密钥」是可操作的；而"不是凭据文件"就只是个无关文件。区分开很重要，不然你会去修一个压根修不好的东西。
+
+这样账号数就**可信了**：不会再出现「磁盘上 4 个文件，界面显示 2 个账号」这种说不清的落差。
+
+### 顺带修的第二个问题：pi-ai 跨代误用
+
+另一份反馈报的是「每轮对话必崩，报 `Cannot read properties of undefined` 且不可重试」。根因是**同一条调用链上混用了两代 pi-ai** —— 插件用 0.85.x 组装 provider，宿主适配器用 0.87.x 消费事件流，两代对终态消息的形状约定不同，接缝处直接抛异常。而宿主把它归为不可重试的 `PI_AI_ERROR`，栈还被丢弃，所以极难排查。
+
+**为什么 `package.json` 的范围拦不住**：旧的 peer 声明是 `>=0.82.1 <0.85.0`，**上界把宿主的 0.87 代际整个排除在外** —— 等于把「跨代混用」变成了一种**合法的安装组合**。版本范围只能描述"我能接受什么"，描述不了"机器上实际装的是哪一份"。
+
+**所以改成两条**：
+
+- **放开上界**（`>=0.82.1`），不再把宿主代际排除成非法组合；
+- **加载时实测并告警**：比对插件这份与宿主那份 pi-ai 的代际，**不一致就在日志里点名两个版本并给出修法**（用 pnpm `overrides` 把代际对齐宿主）。
+
+只告警、**不阻止启动** —— 版本不一致也可能是无害的，因为一个猜测就让插件拒绝加载会更糟。
+
+### 验证
+
+- 类型检查全绿，测试 **313 项全绿**（+9），**连续两次全量运行稳定**。
+- 新增 `tests/account-discovery.test.ts`（7 项）：单个坏文件不拖垮扫描、**全部文件都坏时也不抛错**、跳过的文件带原因上报、坏文件不会被算成账号、非 JSON / 结构不对的文件同样只跳过。
+- 新增 `tests/pi-ai-generation.test.ts`（9 项）：代际归约（补丁差异不算跨代）、**0.85 / 0.87 分裂能被识别**、任一侧解析不到时判为未知、告警文案包含两个版本与修法。
+- **反向验证**：把「加密错误重新抛出」放回 → 4 项变红，确认测试确实能抓住这个缺陷。
+- 构建后校验产物**已内联**代际检测模块（无外部 `.ts` 引用），并直接加载 `lib/index.js` 确认可运行。
+
+### 已知未覆盖
+
+「每轮必崩」的那份报告里，还建议了**宿主侧**两处加固（`mapStopReason` 对空 `content` 加守卫、`classifyPiAiError` 保留原始 `error.stack`）。那是 DSH 宿主的代码，不在这个插件仓库内，需要另开 issue 到 DSH。
+
+## 1.7.5 — 模型列表会告诉你「现在用哪个不花钱」
+
+> Hy4 preview 晚上 23 点到早上 8 点免费，Hy3 一直在免费期 —— 现在卡片上直接看得出来。
+
+**你会看到**：模型列表里，**当前免费的排在最上面**并带标记：
+
+```
+[免费]              hy3                  x0.00
+                    auto
+(23:00 起免费 · 活动至 10-31)  hy4-preview   x0.29
+                    hy3-x                x0.05
+```
+
+到了晚上 23 点，同一行会变成：
+
+```
+[免费至 08:00 · 活动至 10-31]  hy4-preview   x0.29
+[免费]              hy3                  x0.00
+```
+
+**为什么需要专门做**：因为**上游接口不说这件事**。我拉了真实的国内版接口逐字段核对：
+
+| 信息 | 上游提供吗 |
+|---|---|
+| Hy3 限免 | ✅ 提供 —— `credits: "x0.00"`，倍率本身就是 0，我们一直在正确显示 |
+| Hy4 preview **夜间**限免 | ❌ **不提供** —— 倍率恒为 `x0.29`，**没有任何时段字段** |
+| Hy4 preview **新用户 14 天**额度 | ❌ **不提供** —— 积分包里也没有这类条目 |
+
+所以夜间限免这条规则，只能由插件自己带。我把它写成一张**规则表**（`src/promo.ts`），包含「哪个平台、哪些 id 前缀、哪些小时、有效期到哪天」。
+
+**几个刻意的设计**：
+
+- **规则区分平台**。这是**国内版活动**，所以规则里带 `region: 'cn'`，**国际版完全不受影响** —— 国际版的 `hy4-preview-f` 显示「免费」是因为**上游倍率真的是 0**（客观事实），不是我们套了活动规则；
+- **免费状态是「此刻」的，不是模型固有属性**。所以同一天里 `hy4-preview` 的标记会变 —— 这才是真实情况；
+- **窗口外只给一个低调的虚线提示**（`23:00 起免费`），**不给「免费」徽章**。因为它此刻**确实要花积分**，标成免费会让你花错钱；
+- **只有「此刻免费」的才置顶**。窗口外的模型不置顶，否则就是把一个要花钱的模型举到最前面，误导性更强；
+- **标出活动截止日**（`活动至 10-31`）。方便你安排什么时候用 —— 而且活动一旦延期，改日期就能看到，不用翻更新日志；
+- **规则带过期日期**，到 10 月 31 日之后**自动失效**，不需要有人记得来删代码；
+- **`hy4-preview` 用前缀匹配**，因为上游有 `hy4-preview` 和 `hy4-preview-x` 两个 id，是同一款产品。
+
+### 关于「新用户 14 天免费额度」——明确没做
+
+你提到「新用户没用过 Hy4 preview，还能免费 14 天，要区分出来」。**这个我做不到，而且硬做会更糟**：
+
+上游**完全不记录**「这个账户有没有用过 Hy4 preview」—— 模型目录里没有、积分包里也没有（我实测过，44 个积分包里没有一个试用额度条目）。
+
+唯一能猜的办法是「插件自己记住第一次调用的时间」。但这有个致命问题：**它只知道「用本插件之后」的历史**。你之前要是在官方客户端用过 Hy4 preview，插件照样会以为你是新用户，然后给你标一个**假的「免费」** —— 而你会因此放心去用，结果**扣了积分**。
+
+**给你一个假的「免费」，比不给你标记更糟**，因为它直接改变你的花钱决定。所以这条留白，不做推测。
+
+如果你确实需要，可行的做法是**你自己确认**：卡片上显示的是客观事实（倍率 + 夜间窗口），你清楚自己是不是新用户，看一眼就知道该不该用。
+
+### 验证
+
+- 类型检查全绿，测试 **297 项全绿**（+19）。
+- 新增 `tests/promo.test.ts`：23:00–08:00 窗口内/外的判定、跨午夜（23 点在窗口内、8 点不在）、窗口关闭时间（`免费至 08:00`）、下次开启时间（`23:00 起免费`）、同族 id（`hy4-preview` 与 `hy4-preview-x`）、零倍率模型全天免费且不误入夜间规则、**到期自动失效**（10/31 有效、11/1 失效）、**免费置顶只认「此刻」免费**、**活动截止日随状态带出**、**国际版不受活动影响**（但零倍率模型在两边都算免费）。
+- **反向验证**：清空夜间小时 → 7 项变红；删掉过期日期 → 2 项变红；**移除平台过滤 → 「国际版不受影响」变红**。确认测试真的能抓住这三类缺陷。
+- 用**两个平台的真实清单**（国内版 16 个 / 国际版 24 个）跑卡片渲染逻辑，在 12:00 与 23:30 核对：国内版 `hy4-preview` 正确显示活动徽章与截止日，**国际版完全不受活动规则影响**。
+
 ## 1.7.4 — 装在中文文件夹里的 WorkBuddy，终于找得到了
 
 > 「腾讯」两个字，让插件整整看不见一个装好、登录着、正在运行的 WorkBuddy。

package/lib/bin.js

@@ -9,6 +9,7 @@ import "@earendil-works/pi-ai";
 import "@earendil-works/pi-ai/api/openai-completions.lazy";
 import "@deepseek-ai/dsh-llm";
 import "@deepseek-ai/dsh-llm-pi-ai";
+import { fileURLToPath } from "node:url";
 //#region src/upstream.ts
 /**
 * Backoff between catalog-fetch attempts.
@@ -2347,10 +2348,6 @@ var WorkBuddyEncryptedCredentialError = class extends Error {
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
-/** True when a thrown value is the encrypted-credential marker (cross-bundle safe). */
-function isEncryptedCredentialError(value) {
-	return typeof value === "object" && value !== null && value.code === "ENCRYPTED_CREDENTIAL";
-}
 function decryptableString(value, decrypt) {
 	if (typeof value === "string") return {
 		value,
@@ -2504,6 +2501,18 @@ async function authFilesIn(dir) {
 	files.sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
 	return files.map((name) => join(dir, name));
 }
+/**
+* One credential file, or undefined when it cannot be used.
+*
+* Returns undefined — rather than throwing — for every failure mode, so ONE bad
+* file cannot empty the pool. That is the whole point: an auth directory blends
+* plain files, encrypted files, half-written files and files from an app version
+* this plugin cannot read, and a scan that aborts on the first unusable one
+* reports "you have 2 accounts" when it means "I could not open the other two".
+*
+* The caller surfaces the ones it skipped, so the count never silently
+* disagrees with what is on disk.
+*/
 async function readCredential(path) {
 	let text;
 	try {
@@ -2514,8 +2523,7 @@ async function readCredential(path) {
 	const decrypt = text.includes("\"$wbEncrypted\"") ? await encryptedFieldOpener() : void 0;
 	try {
 		return parseWorkBuddyAuth(text, path, decrypt);
-	} catch (error) {
-		if (isEncryptedCredentialError(error)) throw error;
+	} catch {
 		return;
 	}
 }
@@ -2555,6 +2563,29 @@ async function cheapIdentityIdFromFile(path) {
 	}
 }
 /**
+* Why a file could not become an account.
+*
+* Distinguishing "encrypted" matters most: it is actionable (start the desktop
+* app, or set the executable override), whereas "malformed" means the file is
+* simply not a credential. Reporting them alike would send the user looking for
+* a fix that cannot work.
+*/
+async function skipReasonFor(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return "unreadable";
+	}
+	if (text.includes("\"$wbEncrypted\"")) return "encrypted";
+	try {
+		JSON.parse(text);
+		return "malformed";
+	} catch {
+		return "malformed";
+	}
+}
+/**
 * Build the field opener, or undefined when the app cannot supply its key.
 *
 * Split out so the key lookup is testable without a real desktop install, and so
@@ -2619,6 +2650,13 @@ var WorkBuddyAccountPool = class {
 	client;
 	refreshMarginMs;
 	accounts = [];
+	/**
+	* Files the last scan could not read, with the reason.
+	*
+	* Surfaced so "2 accounts" can be told apart from "4 files, 2 unreadable" —
+	* the difference between accounts being gone and files being unopenable.
+	*/
+	skippedFiles = [];
 	distribution;
 	/** Cursor for round-robin mode; unused under priority distribution. */
 	cursor = 0;
@@ -2720,19 +2758,38 @@ var WorkBuddyAccountPool = class {
 	ignoredIdsInOrder() {
 		return [...this.ignoredIds];
 	}
+	/**
+	* Credential files the last scan could not read, with the reason.
+	*
+	* Exposed because a short account list is otherwise indistinguishable from a
+	* broken one: with this, the card can say "2 accounts, 2 files unreadable"
+	* instead of silently showing half a pool.
+	*/
+	skippedFilesInOrder() {
+		return this.skippedFiles;
+	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
 		const found = [];
+		const skipped = [];
 		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
 			if (this.ignoredIds.size > 0) {
 				const cheapId = await cheapIdentityIdFromFile(file);
 				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
 			}
 			const credential = await readCredential(file);
-			if (credential === void 0) continue;
+			if (credential === void 0) {
+				skipped.push({
+					path: file,
+					reason: await skipReasonFor(file)
+				});
+				continue;
+			}
 			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
 			found.push(credential);
 		}
+		this.skippedFiles = skipped;
+		if (skipped.length > 0) this.logger?.warn?.(`dsh-workbuddy-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
 		for (const credential of found) {
@@ -4899,8 +4956,14 @@ async function unignoreAccount(accountId, path = ignoredIdsPath()) {
 	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
 	return next;
 }
-//#endregion
-//#region src/index.ts
+fileURLToPath(new URL("..", import.meta.url));
+(() => {
+	try {
+		return fileURLToPath(new URL("../../node_modules/@deepseek-ai/dsh-llm-pi-ai/", import.meta.url));
+	} catch {
+		return "";
+	}
+})();
 /**
 * One region's model-selection schema.
 *

package/lib/client.js

@@ -273,6 +273,19 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-model-id{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
 .dsm-workbuddy-xdpool-model-meta{display:flex;align-items:center;gap:8px;flex-wrap:wrap;color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px}
 .dsm-workbuddy-xdpool-model-meta-tag{padding:1px 8px;border-radius:999px;font-size:11px;line-height:16px;background:rgba(174,179,187,.11);color:var(--dsw-alias-label-secondary,#c6c9d0)}
+/* "free from HH:00": quieter than the badge on purpose — the model costs
+   credits right now, so it must not read as a promo the user can spend against. */
+.dsm-workbuddy-xdpool-model-meta-later{padding:1px 8px;border-radius:999px;font-size:11px;line-height:16px;border:1px dashed color-mix(in oklab, var(--dsw-alias-label-dimmed,#9aa0a8) 55%, transparent);color:var(--dsw-alias-label-tertiary,#9aa0a8)}
+/* "活动至 10-31": the campaign's end date. Muted — it is context for planning,
+   not a claim about the current price. */
+.dsm-workbuddy-xdpool-model-meta-promo{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:11px;line-height:16px;opacity:.85}
+/* Unreadable credential files: a warning tint, since it explains a smaller pool
+   and "encrypted" is actionable (start the app once). */
+.dsm-workbuddy-xdpool-skipped{margin:6px 0 0;padding:7px 10px;border-radius:8px;background:var(--dsw-alias-state-warning-subtle,rgba(217,119,6,.12));display:flex;flex-direction:column;gap:3px}
+.dsm-workbuddy-xdpool-skipped-summary{margin:0;font-size:12px;line-height:18px;font-weight:600;color:var(--dsw-alias-state-warning-primary,#d97706)}
+.dsm-workbuddy-xdpool-skipped-row{margin:0;display:flex;gap:8px;align-items:baseline;font-size:11px;line-height:16px;flex-wrap:wrap}
+.dsm-workbuddy-xdpool-skipped-file{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;color:var(--dsw-alias-label-secondary,#c6c9d0);max-width:100%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dsm-workbuddy-xdpool-skipped-reason{color:var(--dsw-alias-label-tertiary,#9aa0a8)}
 .dsm-workbuddy-xdpool-model-cap{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px;font-variant-numeric:tabular-nums}
 /* Model row: checkbox + image toggle + context-budget radios. */
 .dsm-workbuddy-xdpool-model-off{opacity:.55}
@@ -366,6 +379,104 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-reserve-note-ok{color:var(--dsw-alias-state-success-primary,#22a06b)}
 .dsm-workbuddy-xdpool-reserve-note-bad{color:var(--dsw-alias-state-error-primary,#ef4444);font-weight:600}
 `.trim();
+		//#endregion
+		//#region src/promo.ts
+		/**
+		* Promotions in force.
+		*
+		* Source: the WorkBuddy announcement extending Hy3's free tier and
+		* Hy4-preview's night window to **2026-10-31**. Hy3 needs no entry here (its
+		* CN price is already zero upstream); only Hy4-preview's time window does,
+		* because the gateway charges for it around the clock.
+		*
+		* When a promotion is extended or a new one starts, edit this table. When one
+		* ends, either delete the row or let `until` lapse — both stop the badge.
+		*/
+		const PROMO_RULES = [{
+			idPrefix: "hy4-preview",
+			region: "cn",
+			hours: [
+				23,
+				0,
+				1,
+				2,
+				3,
+				4,
+				5,
+				6,
+				7
+			],
+			until: "2026-10-31",
+			label: "night"
+		}];
+		/** `YYYY-MM-DD` for a Date in LOCAL time (the promotions are announced locally). */
+		function localDayKey(date) {
+			const p = (n) => String(n).padStart(2, "0");
+			return `${date.getFullYear()}-${p(date.getMonth() + 1)}-${p(date.getDate())}`;
+		}
+		/** Whether a rule is still in force on `date`. */
+		function ruleActive(rule, date) {
+			return localDayKey(date) <= rule.until;
+		}
+		/** The first hour the window reopens, searching forward from `hour`. */
+		function nextWindowHour(rule, hour) {
+			for (let step = 1; step <= 24; step += 1) {
+				const candidate = (hour + step) % 24;
+				if (rule.hours.includes(candidate)) return candidate;
+			}
+		}
+		/** The hour the CURRENT window closes, searching forward from `hour`. */
+		function windowEndHour(rule, hour) {
+			for (let step = 1; step <= 24; step += 1) {
+				const candidate = (hour + step) % 24;
+				if (!rule.hours.includes(candidate)) return candidate;
+			}
+		}
+		/**
+		* The promotion status of one model at `now`, for one region.
+		*
+		* `now` is injected so the behaviour is testable without freezing the clock —
+		* a time-dependent badge that can only be tested by waiting is a badge nobody
+		* tests. `region` is required for the same reason the rules carry one: these
+		* campaigns are regional, and applying a domestic rule to the international
+		* roster would invent a discount that gateway does not offer.
+		*/
+		function promoStatusFor(model, now = /* @__PURE__ */ new Date(), region = "cn") {
+			if (model.multiplier === 0) return { kind: "free" };
+			for (const rule of PROMO_RULES) {
+				if (rule.region !== region) continue;
+				if (!model.id.startsWith(rule.idPrefix)) continue;
+				if (!ruleActive(rule, now)) continue;
+				const hour = now.getHours();
+				if (rule.hours.includes(hour)) {
+					const untilHour = windowEndHour(rule, hour);
+					return {
+						kind: "night",
+						label: rule.label,
+						untilHour: untilHour ?? hour,
+						promoUntil: rule.until
+					};
+				}
+				const nextHour = nextWindowHour(rule, hour);
+				if (nextHour !== void 0) return {
+					kind: "night-later",
+					label: rule.label,
+					nextHour,
+					promoUntil: rule.until
+				};
+			}
+		}
+		/**
+		* Whether a model is free RIGHT NOW, for sorting.
+		*
+		* Only the two "currently free" kinds count. `night-later` deliberately does
+		* NOT sort to the top: it costs credits at this moment, and floating a
+		* credit-priced model above cheaper ones would misrepresent the list.
+		*/
+		function isFreeNow(model, now = /* @__PURE__ */ new Date(), region = "cn") {
+			const status = promoStatusFor(model, now, region);
+			return status?.kind === "free" || status?.kind === "night";
+		}
 		//#endregion
 		//#region src/client/PoolCard.tsx
 		/**
@@ -546,17 +657,23 @@ window.__ModuleLoader__.load({
 		/**
 		* The promo badge for one model, or undefined when it has none.
 		*
-		* `free` is read off the CREDIT MULTIPLIER, not off a tag. Neither gateway ever
-		* sends a literal `free` tag: the global roster marks its zero-cost models
-		* (`hy3`, `hy4-preview-f`, `deepseek-v4.1-flash`) as `credits: "x0.00"`, so
-		* waiting for a tag meant the badge NEVER appeared — including on models that
-		* genuinely cost nothing.
+		* Two sources, because the gateway models one of them and not the other:
 		*
-		* An explicit free-ish tag still wins when present, so a gateway that starts
-		* tagging them keeps working without another change.
+		*  - `free` comes from the CREDIT MULTIPLIER. Neither gateway ever sends a
+		*    literal `free` tag, but it does price its free models at `credits: "x0.00"`
+		*    (CN `hy3`), so the multiplier is the honest signal.
+		*  - the NIGHT window comes from {@link promoStatusFor}, because the gateway
+		*    charges `x0.29` for `hy4-preview` around the clock and has no field for a
+		*    time-of-day rule. See that module for why the 14-day newcomer allowance is
+		*    deliberately not modelled.
+		*
+		* `region` is threaded through because the campaigns are REGIONAL: the
+		* Hy3 / Hy4-preview extension is a domestic promotion, so a global roster must
+		* not pick up a discount that gateway does not offer.
 		*/
-		function tagFor(model) {
+		function tagFor(model, now, region) {
 			const tags = model.tags ?? [];
+			if (promoStatusFor(model, now, region)?.kind === "night") return "night";
 			if (tags.includes("free") || model.multiplier === 0) return "free";
 			if (tags.includes("limited-free")) return "limited";
 			if (tags.includes("night-discount")) return "night";
@@ -837,6 +954,17 @@ window.__ModuleLoader__.load({
 			const modelsEditable = settingsWritable;
 			const modelsDirty = draft !== void 0 && status !== void 0 && draftIsDirty(status, draft);
 			const enabledCount = Object.values(modelDraft).filter((entry) => entry.enabled).length;
+			/**
+			* One clock reading per render, shared by the sort and every row.
+			*
+			* Taken once so the list cannot disagree with itself: calling `new Date()`
+			* per row would let a model be "free" for the badge and "not free" for the
+			* sort if the window boundary happened to fall between two rows.
+			*
+			* A promotion boundary is not a re-render trigger — the card refreshes on its
+			* own poll, which is frequent enough for a badge that changes twice a day.
+			*/
+			const now = /* @__PURE__ */ new Date();
 			const toggleModel = (id) => {
 				if (status === void 0) return;
 				const base = draft ?? draftFromStatus(status);
@@ -1383,6 +1511,22 @@ window.__ModuleLoader__.load({
 									}) ?? `${accountCount} account(s) · ${cooling} cooling`
 								})]
 							}),
+							status?.skippedFiles === void 0 || status.skippedFiles.length === 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsm-workbuddy-xdpool-skipped",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: "dsm-workbuddy-xdpool-skipped-summary",
+									children: t?.("row.skippedFiles", { count: status.skippedFiles.length }) ?? `${status.skippedFiles.length} credential file(s) could not be read`
+								}), status.skippedFiles.slice(0, 4).map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+									className: "dsm-workbuddy-xdpool-skipped-row",
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-xdpool-skipped-file",
+										children: entry.file
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-xdpool-skipped-reason",
+										children: entry.reason === "encrypted" ? t?.("row.skippedEncrypted") ?? "encrypted — start WorkBuddy once" : entry.reason === "unreadable" ? t?.("row.skippedUnreadable") ?? "file could not be read" : t?.("row.skippedMalformed") ?? "not a credential file"
+									})]
+								}, entry.file))]
+							}),
 							(() => {
 								const active = status?.activeAccountId === void 0 ? void 0 : status.accounts.find((account) => account.id === status.activeAccountId);
 								if (active === void 0) return null;
@@ -1510,8 +1654,9 @@ window.__ModuleLoader__.load({
 							})]
 						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 							className: "dsm-workbuddy-xdpool-model-list",
-							children: status?.models.map((model) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelRow, {
+							children: [...status?.models ?? []].sort((a, b) => Number(isFreeNow(b, now, activeRegion)) - Number(isFreeNow(a, now, activeRegion))).map((model) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelRow, {
 								model,
+								region: activeRegion,
 								t,
 								draft: modelDraft[model.id] ?? {
 									enabled: model.enabled,
@@ -1865,9 +2010,26 @@ window.__ModuleLoader__.load({
 		* context radios stay disabled rather than pretending an edit took hold. The
 		* draft lives in the parent, so this component only ever reports intent.
 		*/
-		function ModelRow({ model, t, draft, editable, onToggle, onToggleImage, onBudget }) {
-			const tag = tagFor(model);
-			const tagText = tag === "free" ? t?.("row.free") ?? "free" : tag === "limited" ? t?.("row.limitedFree") ?? "limited free" : tag === "night" ? t?.("row.nightDiscount") ?? "night" : null;
+		function ModelRow({ model, region, t, draft, editable, onToggle, onToggleImage, onBudget }) {
+			const now = /* @__PURE__ */ new Date();
+			const tag = tagFor(model, now, region);
+			const promo = promoStatusFor(model, now, region);
+			const tagText = tag === "free" ? t?.("row.free") ?? "free" : tag === "limited" ? t?.("row.limitedFree") ?? "limited free" : tag === "night" ? t?.("row.nightFreeNow", { time: `${String(promo?.kind === "night" ? promo.untilHour : 0).padStart(2, "0")}:00` }) ?? "free until 08:00" : null;
+			/**
+			* The "cheaper later" hint: the model is on a promotion but the window is
+			* closed. Deliberately NOT a "free" badge — it costs credits at this moment,
+			* and telling the user otherwise would change what they spend.
+			*/
+			const laterHint = promo?.kind === "night-later" ? t?.("row.nightFreeLater", { time: `${String(promo.nextHour).padStart(2, "0")}:00` }) ?? `free from ${String(promo.nextHour).padStart(2, "0")}:00` : null;
+			/**
+			* How long the campaign itself runs, e.g. "活动至 10-31".
+			*
+			* Shown on both the free and the not-yet-free row, because the useful question
+			* is not only "is it free now" but "until when is this offer good at all" —
+			* an extension changes that date, and a user planning around the promotion
+			* needs it visible rather than buried in a changelog.
+			*/
+			const promoUntil = promo === void 0 || promo.kind === "free" ? null : t?.("row.promoUntil", { date: promo.promoUntil.slice(5).replace("-", "-") }) ?? `promo until ${promo.promoUntil}`;
 			const native = model.nativeContextWindow;
 			const capped = native > DEFAULT_CONTEXT_BUDGET;
 			const currentBudget = draft.budget ?? native;
@@ -1939,6 +2101,14 @@ window.__ModuleLoader__.load({
 							className: "dsm-workbuddy-xdpool-model-meta-tag",
 							children: tagText
 						}),
+						laterHint === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-xdpool-model-meta-later",
+							children: laterHint
+						}),
+						promoUntil === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-xdpool-model-meta-promo",
+							children: promoUntil
+						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: "dsm-workbuddy-xdpool-model-cap",
 							children: t?.("row.modelOutput", { size: formatCapacity(model.maxOutputTokens) }) ?? `out ${formatCapacity(model.maxOutputTokens)}`
@@ -2094,6 +2264,13 @@ window.__ModuleLoader__.load({
 			"row.free": "free",
 			"row.limitedFree": "limited free",
 			"row.nightDiscount": "night",
+			"row.nightFreeNow": "free until {time}",
+			"row.nightFreeLater": "free from {time}",
+			"row.promoUntil": "promo to {date}",
+			"row.skippedFiles": "{count} credential file(s) could not be read",
+			"row.skippedEncrypted": "encrypted — start WorkBuddy once so its key can be read",
+			"row.skippedUnreadable": "file could not be read",
+			"row.skippedMalformed": "not a credential file",
 			"row.imageCapable": "image input",
 			"row.rate": "{rate}x credits",
 			"row.accountsRescan": "Detect accounts again",
@@ -2239,6 +2416,13 @@ window.__ModuleLoader__.load({
 			"row.free": "免费",
 			"row.limitedFree": "限量免费",
 			"row.nightDiscount": "夜间",
+			"row.nightFreeNow": "免费至 {time}",
+			"row.nightFreeLater": "{time} 起免费",
+			"row.promoUntil": "活动至 {date}",
+			"row.skippedFiles": "有 {count} 个凭据文件读不出来",
+			"row.skippedEncrypted": "已加密 —— 启动一次 WorkBuddy 才能取到密钥",
+			"row.skippedUnreadable": "文件读不出来",
+			"row.skippedMalformed": "不是凭据文件",
 			"row.imageCapable": "图片输入",
 			"row.rate": "{rate}x 积分",
 			"row.accountsRescan": "重新检测账号",

package/lib/index.d.ts

@@ -752,6 +752,18 @@ export declare const WORKBUDDY_LIVE_FILENAME = "workbuddy-desktop.info";
 /** Env override for the auth file or its directory. */
 export declare const WORKBUDDY_AUTH_FILE_ENV = "WORKBUDDY_AUTH_FILE";
 /** One parsed WorkBuddy credential. */
+/**
+ * A credential file the pool could not turn into an account.
+ *
+ * Reported (not swallowed) because the count is otherwise a lie: a directory
+ * holding four files that yields two accounts looks like two accounts were
+ * deleted, when in fact two files were unreadable. Naming the file and the
+ * reason is what makes the difference visible.
+ */
+interface WorkBuddySkippedFile {
+  path: string;
+  reason: 'encrypted' | 'unreadable' | 'malformed';
+}
 interface WorkBuddyCredential {
   accessToken: string;
   refreshToken: string;
@@ -862,6 +874,13 @@ export declare class WorkBuddyAccountPool {
   private readonly client;
   private readonly refreshMarginMs;
   private accounts;
+  /**
+   * Files the last scan could not read, with the reason.
+   *
+   * Surfaced so "2 accounts" can be told apart from "4 files, 2 unreadable" —
+   * the difference between accounts being gone and files being unopenable.
+   */
+  private skippedFiles;
   private distribution;
   /** Cursor for round-robin mode; unused under priority distribution. */
   private cursor;
@@ -948,6 +967,14 @@ export declare class WorkBuddyAccountPool {
   isIgnored(accountId: string): boolean;
   /** Every ignored id currently in force, in insertion order. */
   ignoredIdsInOrder(): string[];
+  /**
+   * Credential files the last scan could not read, with the reason.
+   *
+   * Exposed because a short account list is otherwise indistinguishable from a
+   * broken one: with this, the card can say "2 accounts, 2 files unreadable"
+   * instead of silently showing half a pool.
+   */
+  skippedFilesInOrder(): readonly WorkBuddySkippedFile[];
   /** Rescan the auth directories and merge newly discovered accounts. */
   scan(): Promise<WorkBuddyAccount[]>;
   /** All accounts, cooldown state included. */
@@ -1345,6 +1372,21 @@ interface PoolWebStatus {
   catalogUpdatedAt?: string;
   /** Why the last fetch failed, when it did. Redacted and length-capped. */
   catalogError?: string;
+  /**
+   * Credential files on disk that did NOT become accounts.
+   *
+   * Reported so the account count can be trusted: without this, a directory
+   * holding four files that yields two accounts looks like two accounts were
+   * deleted, when really two files could not be opened (most often an encrypted
+   * credential the desktop app was not running to unlock).
+   */
+  skippedFiles?: readonly PoolWebSkippedFile[];
+}
+/** A credential file the pool could not read. */
+interface PoolWebSkippedFile {
+  /** Basename only; the full path lives in the desktop app's auth directory. */
+  file: string;
+  reason: 'encrypted' | 'unreadable' | 'malformed';
 }
 /** How a region's model list was obtained. */
 type PoolWebCatalogSource = 'live' | 'fallback';

package/lib/index.js

@@ -1,3 +1,4 @@
+import { createRequire } from "node:module";
 import { basename, dirname, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -11,6 +12,7 @@ import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/d
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
+import { fileURLToPath } from "node:url";
 //#region src/upstream.ts
 /**
 * Backoff between catalog-fetch attempts.
@@ -2454,10 +2456,6 @@ var WorkBuddyEncryptedCredentialError = class extends Error {
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
-/** True when a thrown value is the encrypted-credential marker (cross-bundle safe). */
-function isEncryptedCredentialError(value) {
-	return typeof value === "object" && value !== null && value.code === "ENCRYPTED_CREDENTIAL";
-}
 function decryptableString(value, decrypt) {
 	if (typeof value === "string") return {
 		value,
@@ -2611,6 +2609,18 @@ async function authFilesIn(dir) {
 	files.sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
 	return files.map((name) => join(dir, name));
 }
+/**
+* One credential file, or undefined when it cannot be used.
+*
+* Returns undefined — rather than throwing — for every failure mode, so ONE bad
+* file cannot empty the pool. That is the whole point: an auth directory blends
+* plain files, encrypted files, half-written files and files from an app version
+* this plugin cannot read, and a scan that aborts on the first unusable one
+* reports "you have 2 accounts" when it means "I could not open the other two".
+*
+* The caller surfaces the ones it skipped, so the count never silently
+* disagrees with what is on disk.
+*/
 async function readCredential(path) {
 	let text;
 	try {
@@ -2621,8 +2631,7 @@ async function readCredential(path) {
 	const decrypt = text.includes("\"$wbEncrypted\"") ? await encryptedFieldOpener() : void 0;
 	try {
 		return parseWorkBuddyAuth(text, path, decrypt);
-	} catch (error) {
-		if (isEncryptedCredentialError(error)) throw error;
+	} catch {
 		return;
 	}
 }
@@ -2662,6 +2671,29 @@ async function cheapIdentityIdFromFile(path) {
 	}
 }
 /**
+* Why a file could not become an account.
+*
+* Distinguishing "encrypted" matters most: it is actionable (start the desktop
+* app, or set the executable override), whereas "malformed" means the file is
+* simply not a credential. Reporting them alike would send the user looking for
+* a fix that cannot work.
+*/
+async function skipReasonFor(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return "unreadable";
+	}
+	if (text.includes("\"$wbEncrypted\"")) return "encrypted";
+	try {
+		JSON.parse(text);
+		return "malformed";
+	} catch {
+		return "malformed";
+	}
+}
+/**
 * Build the field opener, or undefined when the app cannot supply its key.
 *
 * Split out so the key lookup is testable without a real desktop install, and so
@@ -2726,6 +2758,13 @@ var WorkBuddyAccountPool = class {
 	client;
 	refreshMarginMs;
 	accounts = [];
+	/**
+	* Files the last scan could not read, with the reason.
+	*
+	* Surfaced so "2 accounts" can be told apart from "4 files, 2 unreadable" —
+	* the difference between accounts being gone and files being unopenable.
+	*/
+	skippedFiles = [];
 	distribution;
 	/** Cursor for round-robin mode; unused under priority distribution. */
 	cursor = 0;
@@ -2827,19 +2866,38 @@ var WorkBuddyAccountPool = class {
 	ignoredIdsInOrder() {
 		return [...this.ignoredIds];
 	}
+	/**
+	* Credential files the last scan could not read, with the reason.
+	*
+	* Exposed because a short account list is otherwise indistinguishable from a
+	* broken one: with this, the card can say "2 accounts, 2 files unreadable"
+	* instead of silently showing half a pool.
+	*/
+	skippedFilesInOrder() {
+		return this.skippedFiles;
+	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
 		const found = [];
+		const skipped = [];
 		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
 			if (this.ignoredIds.size > 0) {
 				const cheapId = await cheapIdentityIdFromFile(file);
 				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
 			}
 			const credential = await readCredential(file);
-			if (credential === void 0) continue;
+			if (credential === void 0) {
+				skipped.push({
+					path: file,
+					reason: await skipReasonFor(file)
+				});
+				continue;
+			}
 			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
 			found.push(credential);
 		}
+		this.skippedFiles = skipped;
+		if (skipped.length > 0) this.logger?.warn?.(`dsh-workbuddy-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
 		for (const credential of found) {
@@ -6275,7 +6333,11 @@ async function poolWebStatus(deps, region = "cn") {
 		ignored: deps.ignoredAccounts?.() ?? [],
 		catalogSource: deps.catalogs[region].currentSource(),
 		...deps.catalogs[region].catalogUpdatedAt() === void 0 ? {} : { catalogUpdatedAt: deps.catalogs[region].catalogUpdatedAt() },
-		...deps.catalogs[region].lastFetchError() === void 0 ? {} : { catalogError: safeMessage(deps.catalogs[region].lastFetchError()) }
+		...deps.catalogs[region].lastFetchError() === void 0 ? {} : { catalogError: safeMessage(deps.catalogs[region].lastFetchError()) },
+		...deps.pool.skippedFilesInOrder().length === 0 ? {} : { skippedFiles: deps.pool.skippedFilesInOrder().map((entry) => ({
+			file: basename(entry.path),
+			reason: entry.reason
+		})) }
 	};
 }
 /**
@@ -6682,6 +6744,95 @@ async function unignoreAccount(accountId, path = ignoredIdsPath()) {
 	return next;
 }
 //#endregion
+//#region pi-ai-generation.ts
+/**
+* Cross-generation guard for `@earendil-works/pi-ai`.
+*
+* The failure this exists to catch: the plugin assembles its provider with ONE
+* copy of pi-ai while the host's `PiAiAdapter` consumes the event stream with
+* ANOTHER. The two generations disagree on the shape of the terminal message,
+* and the seam between them throws `Cannot read properties of undefined
+* (reading 'length')` inside the host adapter — which the host then classifies
+* as a non-retryable `PI_AI_ERROR`. From the user's side it is "every turn
+* fails, immediately, with no content and no useful error".
+*
+* A `package.json` range cannot prevent this. The old peer range was
+* `>=0.82.1 <0.85.0` while the host shipped 0.87.x: the upper bound excluded the
+* host's generation outright, which turned a cross-generation mix into a
+* legitimate install. Ranges describe what a package tolerates; they cannot
+* describe what the OTHER resolved copy on the same machine happens to be.
+*
+* So this checks the resolved reality at load time and says so, loudly, in the
+* log. It does NOT refuse to start: a version mismatch might well be benign, and
+* a plugin that hard-fails on a guess would be worse than one that warns.
+*
+* @module dsh-workbuddy-xdpool/pi-ai-generation
+*/
+/** The package whose generation must agree between plugin and host. */
+const PI_AI_PACKAGE = "@earendil-works/pi-ai";
+/**
+* The major.minor of a version string, which is what "generation" means here.
+*
+* Patch differences are expected and harmless; two copies differing in
+* minor — 0.85 vs 0.87 — is exactly the split that broke the adapter seam.
+*/
+function generationOf(version) {
+	const trimmed = version.trim();
+	const parts = /^(\d+)\.(\d+)/u.exec(trimmed);
+	if (parts === null || parts === void 0 || parts[1] === void 0 || parts[2] === void 0) return trimmed;
+	return `${parts[1]}.${parts[2]}`;
+}
+/**
+* Read the version of a resolved pi-ai, starting the lookup from `fromDir`.
+*
+* Using `require.resolve` with an explicit anchor is what makes the two sides
+* distinguishable: resolving plainly would return whichever copy this module
+* happens to see, the same one for both, and the comparison would always pass.
+*/
+function piAiGenerationFrom(fromDir) {
+	try {
+		const require_ = createRequire(`${fromDir.replace(/[\\/]+$/u, "")}/`);
+		const pkgPath = require_.resolve(`${PI_AI_PACKAGE}/package.json`);
+		const pkg = require_(pkgPath);
+		if (typeof pkg.version !== "string") return void 0;
+		return {
+			version: pkg.version,
+			resolvedFrom: pkgPath
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Compare the copy the plugin assembled with against the copy the host adapter
+* will use.
+*
+* `hostDir` should be a directory inside the host install (its own
+* `node_modules`), so the two resolutions walk different trees.
+*/
+function checkPiAiGeneration(pluginDir, hostDir) {
+	const plugin = piAiGenerationFrom(pluginDir);
+	const host = piAiGenerationFrom(hostDir);
+	if (plugin === void 0 || host === void 0) return { kind: "unknown" };
+	if (generationOf(plugin.version) === generationOf(host.version)) return {
+		kind: "aligned",
+		generation: generationOf(plugin.version)
+	};
+	return {
+		kind: "mismatched",
+		plugin,
+		host
+	};
+}
+/**
+* A warning message for a mismatched pair, or undefined when there is nothing
+* to say.
+*/
+function piAiMismatchMessage(check) {
+	if (check.kind !== "mismatched") return void 0;
+	return `dsh-workbuddy-xdpool: @earendil-works/pi-ai generation mismatch — this plugin assembled its provider with ${check.plugin.version} while the host adapter resolves ${check.host.version}. Two generations on one call chain produce a TypeError at the adapter seam ("Cannot read properties of undefined"), which the host reports as a non-retryable PI_AI_ERROR, so every turn fails with no content. Align the two by pinning pi-ai to the host generation (for example a pnpm \`overrides\` entry in the profile) and restart DSH.`;
+}
+//#endregion
 //#region src/index.ts
 /**
 * Host-side plugin entry. Registers the `workbuddy-xdpool` provider into the
@@ -6690,6 +6841,28 @@ async function unignoreAccount(accountId, path = ignoredIdsPath()) {
 *
 * @module dsh-workbuddy-xdpool/index
 */
+/**
+* This plugin's install root, the tree its own provider is assembled from.
+*
+* Two directories up from `lib/` — the built bundle sits in `lib/`, so the
+* package root is its parent. Used as one side of the pi-ai generation check.
+*/
+const PLUGIN_ROOT = fileURLToPath(new URL("..", import.meta.url));
+/**
+* The host's own module directory, the tree its `PiAiAdapter` resolves from.
+*
+* Reached from the host package this plugin is loaded by: walking up from a
+* `@deepseek-ai/dsh-llm-pi-ai` import lands in the host's `node_modules`, which
+* is where the HOST generation actually lives. The plugin's own tree is the
+* other side; comparing one tree with itself would always agree.
+*/
+const HOST_MODULE_ROOT = (() => {
+	try {
+		return fileURLToPath(new URL("../../node_modules/@deepseek-ai/dsh-llm-pi-ai/", import.meta.url));
+	} catch {
+		return "";
+	}
+})();
 /** Stable Cordis plugin name. */
 const name = "llm-workbuddy-xdpool";
 /** The model registry required before the provider can register. */
@@ -6878,12 +7051,30 @@ function createCore(logger) {
 	};
 }
 /**
+* Log a warning when the plugin and the host resolve different pi-ai
+* generations.
+*
+* Never throws and never blocks startup: the check is a filesystem lookup, and
+* a plugin that refused to load because of a version guess would be worse than
+* one that merely warns. The two directories are THIS plugin's install root and
+* the host's own module directory, so the two resolutions walk different trees —
+* resolving from one place only would compare a copy with itself and always
+* agree.
+*/
+function warnOnPiAiGenerationMismatch(ctx) {
+	try {
+		const message = piAiMismatchMessage(checkPiAiGeneration(PLUGIN_ROOT, HOST_MODULE_ROOT));
+		if (message !== void 0) ctx.logger.warn(message);
+	} catch {}
+}
+/**
 * Start the loopback endpoint, register the `workbuddy-xdpool` provider, and
 * discover accounts. The provider registers only after `shim.ready` resolves,
 * because its models read the shim origin at construction time.
 */
 function apply(ctx, config = {}) {
 	const core = createCore(ctx.logger);
+	warnOnPiAiGenerationMismatch(ctx);
 	const ignoredPath = ignoredIdsPath();
 	let ignoredAccounts = readIgnoredAccountsSync(ignoredPath);
 	core.pool.applyIgnored(ignoredAccounts.map((entry) => entry.id));

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-xdpool",
   "displayName": "DSH WorkBuddy XD Pool",
   "description": "Merge every locally signed-in WorkBuddy account into DeepSeek Harness as one auto-failing-over model pool (multi-account rotation, live credits, daily check-in and model catalog).",
-  "version": "1.7.4",
+  "version": "1.7.6",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-workbuddy-xdpool#readme",
@@ -103,7 +103,7 @@
     "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.1-rc.1 <0.2.0",
     "@deepseek-ai/dsh-settings": ">=0.1.1-rc.1 <0.2.0",
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@earendil-works/pi-ai": ">=0.82.1 <0.85.0"
+    "@earendil-works/pi-ai": ">=0.82.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-llm": {