dsh-workbuddy-xdpool 1.7.5 → 1.7.6

package/CHANGELOG.md

@@ -4,6 +4,50 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 1.7.6 — 一个读不出来的凭据文件，不再带走整个账号池
+
+> 你切了 4 个账号登录，界面显示 4 个；重启之后只剩 2 个 —— 不是账号没了，是它们被一个文件拖累了。
+
+**你会看到**：用 WorkBuddy Switch 切换登录几个国内版账号后，卡片上账号数对不上——重启少了两个。
+
+**为什么**：认证目录里**同时存在好几种文件**：明文的老格式、5.6.0+ 起的加密格式、写到一半的、还有插件不认识的版本。这些**混在一起是常态**，不是错误。
+
+但旧代码里，只要**碰到一个加密又打不开的文件**（WorkBuddy 没运行、或者取不到它的密钥），就会**抛异常终止整个扫描** —— 于是那些**明明读得好好的账号也被一起丢掉**。一个坏文件，带走整个池。
+
+我复现了这个行为：3 个正常文件 + 1 个打不开的，结果**不是返回 3 个，而是整个扫描抛错、0 个账号**。
+
+**怎么修的**：
+
+- **单个文件失败只跳过它自己**，不会连累其他账号。这是核心修复；
+- **跳过的文件会被记录并显示在卡片上**：现在账号区会明确写「有 N 个凭据文件读不出来」，并**列出文件名和原因**。其中「已加密 — 启动一次 WorkBuddy 才能取到密钥」是可操作的；而"不是凭据文件"就只是个无关文件。区分开很重要，不然你会去修一个压根修不好的东西。
+
+这样账号数就**可信了**：不会再出现「磁盘上 4 个文件，界面显示 2 个账号」这种说不清的落差。
+
+### 顺带修的第二个问题：pi-ai 跨代误用
+
+另一份反馈报的是「每轮对话必崩，报 `Cannot read properties of undefined` 且不可重试」。根因是**同一条调用链上混用了两代 pi-ai** —— 插件用 0.85.x 组装 provider，宿主适配器用 0.87.x 消费事件流，两代对终态消息的形状约定不同，接缝处直接抛异常。而宿主把它归为不可重试的 `PI_AI_ERROR`，栈还被丢弃，所以极难排查。
+
+**为什么 `package.json` 的范围拦不住**：旧的 peer 声明是 `>=0.82.1 <0.85.0`，**上界把宿主的 0.87 代际整个排除在外** —— 等于把「跨代混用」变成了一种**合法的安装组合**。版本范围只能描述"我能接受什么"，描述不了"机器上实际装的是哪一份"。
+
+**所以改成两条**：
+
+- **放开上界**（`>=0.82.1`），不再把宿主代际排除成非法组合；
+- **加载时实测并告警**：比对插件这份与宿主那份 pi-ai 的代际，**不一致就在日志里点名两个版本并给出修法**（用 pnpm `overrides` 把代际对齐宿主）。
+
+只告警、**不阻止启动** —— 版本不一致也可能是无害的，因为一个猜测就让插件拒绝加载会更糟。
+
+### 验证
+
+- 类型检查全绿，测试 **313 项全绿**（+9），**连续两次全量运行稳定**。
+- 新增 `tests/account-discovery.test.ts`（7 项）：单个坏文件不拖垮扫描、**全部文件都坏时也不抛错**、跳过的文件带原因上报、坏文件不会被算成账号、非 JSON / 结构不对的文件同样只跳过。
+- 新增 `tests/pi-ai-generation.test.ts`（9 项）：代际归约（补丁差异不算跨代）、**0.85 / 0.87 分裂能被识别**、任一侧解析不到时判为未知、告警文案包含两个版本与修法。
+- **反向验证**：把「加密错误重新抛出」放回 → 4 项变红，确认测试确实能抓住这个缺陷。
+- 构建后校验产物**已内联**代际检测模块（无外部 `.ts` 引用），并直接加载 `lib/index.js` 确认可运行。
+
+### 已知未覆盖
+
+「每轮必崩」的那份报告里，还建议了**宿主侧**两处加固（`mapStopReason` 对空 `content` 加守卫、`classifyPiAiError` 保留原始 `error.stack`）。那是 DSH 宿主的代码，不在这个插件仓库内，需要另开 issue 到 DSH。
+
 ## 1.7.5 — 模型列表会告诉你「现在用哪个不花钱」
 
 > Hy4 preview 晚上 23 点到早上 8 点免费，Hy3 一直在免费期 —— 现在卡片上直接看得出来。

package/lib/bin.js

@@ -9,6 +9,7 @@ import "@earendil-works/pi-ai";
 import "@earendil-works/pi-ai/api/openai-completions.lazy";
 import "@deepseek-ai/dsh-llm";
 import "@deepseek-ai/dsh-llm-pi-ai";
+import { fileURLToPath } from "node:url";
 //#region src/upstream.ts
 /**
 * Backoff between catalog-fetch attempts.
@@ -2347,10 +2348,6 @@ var WorkBuddyEncryptedCredentialError = class extends Error {
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
-/** True when a thrown value is the encrypted-credential marker (cross-bundle safe). */
-function isEncryptedCredentialError(value) {
-	return typeof value === "object" && value !== null && value.code === "ENCRYPTED_CREDENTIAL";
-}
 function decryptableString(value, decrypt) {
 	if (typeof value === "string") return {
 		value,
@@ -2504,6 +2501,18 @@ async function authFilesIn(dir) {
 	files.sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
 	return files.map((name) => join(dir, name));
 }
+/**
+* One credential file, or undefined when it cannot be used.
+*
+* Returns undefined — rather than throwing — for every failure mode, so ONE bad
+* file cannot empty the pool. That is the whole point: an auth directory blends
+* plain files, encrypted files, half-written files and files from an app version
+* this plugin cannot read, and a scan that aborts on the first unusable one
+* reports "you have 2 accounts" when it means "I could not open the other two".
+*
+* The caller surfaces the ones it skipped, so the count never silently
+* disagrees with what is on disk.
+*/
 async function readCredential(path) {
 	let text;
 	try {
@@ -2514,8 +2523,7 @@ async function readCredential(path) {
 	const decrypt = text.includes("\"$wbEncrypted\"") ? await encryptedFieldOpener() : void 0;
 	try {
 		return parseWorkBuddyAuth(text, path, decrypt);
-	} catch (error) {
-		if (isEncryptedCredentialError(error)) throw error;
+	} catch {
 		return;
 	}
 }
@@ -2555,6 +2563,29 @@ async function cheapIdentityIdFromFile(path) {
 	}
 }
 /**
+* Why a file could not become an account.
+*
+* Distinguishing "encrypted" matters most: it is actionable (start the desktop
+* app, or set the executable override), whereas "malformed" means the file is
+* simply not a credential. Reporting them alike would send the user looking for
+* a fix that cannot work.
+*/
+async function skipReasonFor(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return "unreadable";
+	}
+	if (text.includes("\"$wbEncrypted\"")) return "encrypted";
+	try {
+		JSON.parse(text);
+		return "malformed";
+	} catch {
+		return "malformed";
+	}
+}
+/**
 * Build the field opener, or undefined when the app cannot supply its key.
 *
 * Split out so the key lookup is testable without a real desktop install, and so
@@ -2619,6 +2650,13 @@ var WorkBuddyAccountPool = class {
 	client;
 	refreshMarginMs;
 	accounts = [];
+	/**
+	* Files the last scan could not read, with the reason.
+	*
+	* Surfaced so "2 accounts" can be told apart from "4 files, 2 unreadable" —
+	* the difference between accounts being gone and files being unopenable.
+	*/
+	skippedFiles = [];
 	distribution;
 	/** Cursor for round-robin mode; unused under priority distribution. */
 	cursor = 0;
@@ -2720,19 +2758,38 @@ var WorkBuddyAccountPool = class {
 	ignoredIdsInOrder() {
 		return [...this.ignoredIds];
 	}
+	/**
+	* Credential files the last scan could not read, with the reason.
+	*
+	* Exposed because a short account list is otherwise indistinguishable from a
+	* broken one: with this, the card can say "2 accounts, 2 files unreadable"
+	* instead of silently showing half a pool.
+	*/
+	skippedFilesInOrder() {
+		return this.skippedFiles;
+	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
 		const found = [];
+		const skipped = [];
 		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
 			if (this.ignoredIds.size > 0) {
 				const cheapId = await cheapIdentityIdFromFile(file);
 				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
 			}
 			const credential = await readCredential(file);
-			if (credential === void 0) continue;
+			if (credential === void 0) {
+				skipped.push({
+					path: file,
+					reason: await skipReasonFor(file)
+				});
+				continue;
+			}
 			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
 			found.push(credential);
 		}
+		this.skippedFiles = skipped;
+		if (skipped.length > 0) this.logger?.warn?.(`dsh-workbuddy-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
 		for (const credential of found) {
@@ -4899,8 +4956,14 @@ async function unignoreAccount(accountId, path = ignoredIdsPath()) {
 	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
 	return next;
 }
-//#endregion
-//#region src/index.ts
+fileURLToPath(new URL("..", import.meta.url));
+(() => {
+	try {
+		return fileURLToPath(new URL("../../node_modules/@deepseek-ai/dsh-llm-pi-ai/", import.meta.url));
+	} catch {
+		return "";
+	}
+})();
 /**
 * One region's model-selection schema.
 *

package/lib/client.js

@@ -279,6 +279,13 @@ window.__ModuleLoader__.load({
 /* "活动至 10-31": the campaign's end date. Muted — it is context for planning,
    not a claim about the current price. */
 .dsm-workbuddy-xdpool-model-meta-promo{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:11px;line-height:16px;opacity:.85}
+/* Unreadable credential files: a warning tint, since it explains a smaller pool
+   and "encrypted" is actionable (start the app once). */
+.dsm-workbuddy-xdpool-skipped{margin:6px 0 0;padding:7px 10px;border-radius:8px;background:var(--dsw-alias-state-warning-subtle,rgba(217,119,6,.12));display:flex;flex-direction:column;gap:3px}
+.dsm-workbuddy-xdpool-skipped-summary{margin:0;font-size:12px;line-height:18px;font-weight:600;color:var(--dsw-alias-state-warning-primary,#d97706)}
+.dsm-workbuddy-xdpool-skipped-row{margin:0;display:flex;gap:8px;align-items:baseline;font-size:11px;line-height:16px;flex-wrap:wrap}
+.dsm-workbuddy-xdpool-skipped-file{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;color:var(--dsw-alias-label-secondary,#c6c9d0);max-width:100%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dsm-workbuddy-xdpool-skipped-reason{color:var(--dsw-alias-label-tertiary,#9aa0a8)}
 .dsm-workbuddy-xdpool-model-cap{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px;font-variant-numeric:tabular-nums}
 /* Model row: checkbox + image toggle + context-budget radios. */
 .dsm-workbuddy-xdpool-model-off{opacity:.55}
@@ -1504,6 +1511,22 @@ window.__ModuleLoader__.load({
 									}) ?? `${accountCount} account(s) · ${cooling} cooling`
 								})]
 							}),
+							status?.skippedFiles === void 0 || status.skippedFiles.length === 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsm-workbuddy-xdpool-skipped",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: "dsm-workbuddy-xdpool-skipped-summary",
+									children: t?.("row.skippedFiles", { count: status.skippedFiles.length }) ?? `${status.skippedFiles.length} credential file(s) could not be read`
+								}), status.skippedFiles.slice(0, 4).map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+									className: "dsm-workbuddy-xdpool-skipped-row",
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-xdpool-skipped-file",
+										children: entry.file
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-xdpool-skipped-reason",
+										children: entry.reason === "encrypted" ? t?.("row.skippedEncrypted") ?? "encrypted — start WorkBuddy once" : entry.reason === "unreadable" ? t?.("row.skippedUnreadable") ?? "file could not be read" : t?.("row.skippedMalformed") ?? "not a credential file"
+									})]
+								}, entry.file))]
+							}),
 							(() => {
 								const active = status?.activeAccountId === void 0 ? void 0 : status.accounts.find((account) => account.id === status.activeAccountId);
 								if (active === void 0) return null;
@@ -2244,6 +2267,10 @@ window.__ModuleLoader__.load({
 			"row.nightFreeNow": "free until {time}",
 			"row.nightFreeLater": "free from {time}",
 			"row.promoUntil": "promo to {date}",
+			"row.skippedFiles": "{count} credential file(s) could not be read",
+			"row.skippedEncrypted": "encrypted — start WorkBuddy once so its key can be read",
+			"row.skippedUnreadable": "file could not be read",
+			"row.skippedMalformed": "not a credential file",
 			"row.imageCapable": "image input",
 			"row.rate": "{rate}x credits",
 			"row.accountsRescan": "Detect accounts again",
@@ -2392,6 +2419,10 @@ window.__ModuleLoader__.load({
 			"row.nightFreeNow": "免费至 {time}",
 			"row.nightFreeLater": "{time} 起免费",
 			"row.promoUntil": "活动至 {date}",
+			"row.skippedFiles": "有 {count} 个凭据文件读不出来",
+			"row.skippedEncrypted": "已加密 —— 启动一次 WorkBuddy 才能取到密钥",
+			"row.skippedUnreadable": "文件读不出来",
+			"row.skippedMalformed": "不是凭据文件",
 			"row.imageCapable": "图片输入",
 			"row.rate": "{rate}x 积分",
 			"row.accountsRescan": "重新检测账号",

package/lib/index.d.ts

@@ -752,6 +752,18 @@ export declare const WORKBUDDY_LIVE_FILENAME = "workbuddy-desktop.info";
 /** Env override for the auth file or its directory. */
 export declare const WORKBUDDY_AUTH_FILE_ENV = "WORKBUDDY_AUTH_FILE";
 /** One parsed WorkBuddy credential. */
+/**
+ * A credential file the pool could not turn into an account.
+ *
+ * Reported (not swallowed) because the count is otherwise a lie: a directory
+ * holding four files that yields two accounts looks like two accounts were
+ * deleted, when in fact two files were unreadable. Naming the file and the
+ * reason is what makes the difference visible.
+ */
+interface WorkBuddySkippedFile {
+  path: string;
+  reason: 'encrypted' | 'unreadable' | 'malformed';
+}
 interface WorkBuddyCredential {
   accessToken: string;
   refreshToken: string;
@@ -862,6 +874,13 @@ export declare class WorkBuddyAccountPool {
   private readonly client;
   private readonly refreshMarginMs;
   private accounts;
+  /**
+   * Files the last scan could not read, with the reason.
+   *
+   * Surfaced so "2 accounts" can be told apart from "4 files, 2 unreadable" —
+   * the difference between accounts being gone and files being unopenable.
+   */
+  private skippedFiles;
   private distribution;
   /** Cursor for round-robin mode; unused under priority distribution. */
   private cursor;
@@ -948,6 +967,14 @@ export declare class WorkBuddyAccountPool {
   isIgnored(accountId: string): boolean;
   /** Every ignored id currently in force, in insertion order. */
   ignoredIdsInOrder(): string[];
+  /**
+   * Credential files the last scan could not read, with the reason.
+   *
+   * Exposed because a short account list is otherwise indistinguishable from a
+   * broken one: with this, the card can say "2 accounts, 2 files unreadable"
+   * instead of silently showing half a pool.
+   */
+  skippedFilesInOrder(): readonly WorkBuddySkippedFile[];
   /** Rescan the auth directories and merge newly discovered accounts. */
   scan(): Promise<WorkBuddyAccount[]>;
   /** All accounts, cooldown state included. */
@@ -1345,6 +1372,21 @@ interface PoolWebStatus {
   catalogUpdatedAt?: string;
   /** Why the last fetch failed, when it did. Redacted and length-capped. */
   catalogError?: string;
+  /**
+   * Credential files on disk that did NOT become accounts.
+   *
+   * Reported so the account count can be trusted: without this, a directory
+   * holding four files that yields two accounts looks like two accounts were
+   * deleted, when really two files could not be opened (most often an encrypted
+   * credential the desktop app was not running to unlock).
+   */
+  skippedFiles?: readonly PoolWebSkippedFile[];
+}
+/** A credential file the pool could not read. */
+interface PoolWebSkippedFile {
+  /** Basename only; the full path lives in the desktop app's auth directory. */
+  file: string;
+  reason: 'encrypted' | 'unreadable' | 'malformed';
 }
 /** How a region's model list was obtained. */
 type PoolWebCatalogSource = 'live' | 'fallback';

package/lib/index.js

@@ -1,3 +1,4 @@
+import { createRequire } from "node:module";
 import { basename, dirname, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -11,6 +12,7 @@ import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/d
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
+import { fileURLToPath } from "node:url";
 //#region src/upstream.ts
 /**
 * Backoff between catalog-fetch attempts.
@@ -2454,10 +2456,6 @@ var WorkBuddyEncryptedCredentialError = class extends Error {
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
-/** True when a thrown value is the encrypted-credential marker (cross-bundle safe). */
-function isEncryptedCredentialError(value) {
-	return typeof value === "object" && value !== null && value.code === "ENCRYPTED_CREDENTIAL";
-}
 function decryptableString(value, decrypt) {
 	if (typeof value === "string") return {
 		value,
@@ -2611,6 +2609,18 @@ async function authFilesIn(dir) {
 	files.sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
 	return files.map((name) => join(dir, name));
 }
+/**
+* One credential file, or undefined when it cannot be used.
+*
+* Returns undefined — rather than throwing — for every failure mode, so ONE bad
+* file cannot empty the pool. That is the whole point: an auth directory blends
+* plain files, encrypted files, half-written files and files from an app version
+* this plugin cannot read, and a scan that aborts on the first unusable one
+* reports "you have 2 accounts" when it means "I could not open the other two".
+*
+* The caller surfaces the ones it skipped, so the count never silently
+* disagrees with what is on disk.
+*/
 async function readCredential(path) {
 	let text;
 	try {
@@ -2621,8 +2631,7 @@ async function readCredential(path) {
 	const decrypt = text.includes("\"$wbEncrypted\"") ? await encryptedFieldOpener() : void 0;
 	try {
 		return parseWorkBuddyAuth(text, path, decrypt);
-	} catch (error) {
-		if (isEncryptedCredentialError(error)) throw error;
+	} catch {
 		return;
 	}
 }
@@ -2662,6 +2671,29 @@ async function cheapIdentityIdFromFile(path) {
 	}
 }
 /**
+* Why a file could not become an account.
+*
+* Distinguishing "encrypted" matters most: it is actionable (start the desktop
+* app, or set the executable override), whereas "malformed" means the file is
+* simply not a credential. Reporting them alike would send the user looking for
+* a fix that cannot work.
+*/
+async function skipReasonFor(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return "unreadable";
+	}
+	if (text.includes("\"$wbEncrypted\"")) return "encrypted";
+	try {
+		JSON.parse(text);
+		return "malformed";
+	} catch {
+		return "malformed";
+	}
+}
+/**
 * Build the field opener, or undefined when the app cannot supply its key.
 *
 * Split out so the key lookup is testable without a real desktop install, and so
@@ -2726,6 +2758,13 @@ var WorkBuddyAccountPool = class {
 	client;
 	refreshMarginMs;
 	accounts = [];
+	/**
+	* Files the last scan could not read, with the reason.
+	*
+	* Surfaced so "2 accounts" can be told apart from "4 files, 2 unreadable" —
+	* the difference between accounts being gone and files being unopenable.
+	*/
+	skippedFiles = [];
 	distribution;
 	/** Cursor for round-robin mode; unused under priority distribution. */
 	cursor = 0;
@@ -2827,19 +2866,38 @@ var WorkBuddyAccountPool = class {
 	ignoredIdsInOrder() {
 		return [...this.ignoredIds];
 	}
+	/**
+	* Credential files the last scan could not read, with the reason.
+	*
+	* Exposed because a short account list is otherwise indistinguishable from a
+	* broken one: with this, the card can say "2 accounts, 2 files unreadable"
+	* instead of silently showing half a pool.
+	*/
+	skippedFilesInOrder() {
+		return this.skippedFiles;
+	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
 		const found = [];
+		const skipped = [];
 		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
 			if (this.ignoredIds.size > 0) {
 				const cheapId = await cheapIdentityIdFromFile(file);
 				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
 			}
 			const credential = await readCredential(file);
-			if (credential === void 0) continue;
+			if (credential === void 0) {
+				skipped.push({
+					path: file,
+					reason: await skipReasonFor(file)
+				});
+				continue;
+			}
 			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
 			found.push(credential);
 		}
+		this.skippedFiles = skipped;
+		if (skipped.length > 0) this.logger?.warn?.(`dsh-workbuddy-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
 		for (const credential of found) {
@@ -6275,7 +6333,11 @@ async function poolWebStatus(deps, region = "cn") {
 		ignored: deps.ignoredAccounts?.() ?? [],
 		catalogSource: deps.catalogs[region].currentSource(),
 		...deps.catalogs[region].catalogUpdatedAt() === void 0 ? {} : { catalogUpdatedAt: deps.catalogs[region].catalogUpdatedAt() },
-		...deps.catalogs[region].lastFetchError() === void 0 ? {} : { catalogError: safeMessage(deps.catalogs[region].lastFetchError()) }
+		...deps.catalogs[region].lastFetchError() === void 0 ? {} : { catalogError: safeMessage(deps.catalogs[region].lastFetchError()) },
+		...deps.pool.skippedFilesInOrder().length === 0 ? {} : { skippedFiles: deps.pool.skippedFilesInOrder().map((entry) => ({
+			file: basename(entry.path),
+			reason: entry.reason
+		})) }
 	};
 }
 /**
@@ -6682,6 +6744,95 @@ async function unignoreAccount(accountId, path = ignoredIdsPath()) {
 	return next;
 }
 //#endregion
+//#region pi-ai-generation.ts
+/**
+* Cross-generation guard for `@earendil-works/pi-ai`.
+*
+* The failure this exists to catch: the plugin assembles its provider with ONE
+* copy of pi-ai while the host's `PiAiAdapter` consumes the event stream with
+* ANOTHER. The two generations disagree on the shape of the terminal message,
+* and the seam between them throws `Cannot read properties of undefined
+* (reading 'length')` inside the host adapter — which the host then classifies
+* as a non-retryable `PI_AI_ERROR`. From the user's side it is "every turn
+* fails, immediately, with no content and no useful error".
+*
+* A `package.json` range cannot prevent this. The old peer range was
+* `>=0.82.1 <0.85.0` while the host shipped 0.87.x: the upper bound excluded the
+* host's generation outright, which turned a cross-generation mix into a
+* legitimate install. Ranges describe what a package tolerates; they cannot
+* describe what the OTHER resolved copy on the same machine happens to be.
+*
+* So this checks the resolved reality at load time and says so, loudly, in the
+* log. It does NOT refuse to start: a version mismatch might well be benign, and
+* a plugin that hard-fails on a guess would be worse than one that warns.
+*
+* @module dsh-workbuddy-xdpool/pi-ai-generation
+*/
+/** The package whose generation must agree between plugin and host. */
+const PI_AI_PACKAGE = "@earendil-works/pi-ai";
+/**
+* The major.minor of a version string, which is what "generation" means here.
+*
+* Patch differences are expected and harmless; two copies differing in
+* minor — 0.85 vs 0.87 — is exactly the split that broke the adapter seam.
+*/
+function generationOf(version) {
+	const trimmed = version.trim();
+	const parts = /^(\d+)\.(\d+)/u.exec(trimmed);
+	if (parts === null || parts === void 0 || parts[1] === void 0 || parts[2] === void 0) return trimmed;
+	return `${parts[1]}.${parts[2]}`;
+}
+/**
+* Read the version of a resolved pi-ai, starting the lookup from `fromDir`.
+*
+* Using `require.resolve` with an explicit anchor is what makes the two sides
+* distinguishable: resolving plainly would return whichever copy this module
+* happens to see, the same one for both, and the comparison would always pass.
+*/
+function piAiGenerationFrom(fromDir) {
+	try {
+		const require_ = createRequire(`${fromDir.replace(/[\\/]+$/u, "")}/`);
+		const pkgPath = require_.resolve(`${PI_AI_PACKAGE}/package.json`);
+		const pkg = require_(pkgPath);
+		if (typeof pkg.version !== "string") return void 0;
+		return {
+			version: pkg.version,
+			resolvedFrom: pkgPath
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Compare the copy the plugin assembled with against the copy the host adapter
+* will use.
+*
+* `hostDir` should be a directory inside the host install (its own
+* `node_modules`), so the two resolutions walk different trees.
+*/
+function checkPiAiGeneration(pluginDir, hostDir) {
+	const plugin = piAiGenerationFrom(pluginDir);
+	const host = piAiGenerationFrom(hostDir);
+	if (plugin === void 0 || host === void 0) return { kind: "unknown" };
+	if (generationOf(plugin.version) === generationOf(host.version)) return {
+		kind: "aligned",
+		generation: generationOf(plugin.version)
+	};
+	return {
+		kind: "mismatched",
+		plugin,
+		host
+	};
+}
+/**
+* A warning message for a mismatched pair, or undefined when there is nothing
+* to say.
+*/
+function piAiMismatchMessage(check) {
+	if (check.kind !== "mismatched") return void 0;
+	return `dsh-workbuddy-xdpool: @earendil-works/pi-ai generation mismatch — this plugin assembled its provider with ${check.plugin.version} while the host adapter resolves ${check.host.version}. Two generations on one call chain produce a TypeError at the adapter seam ("Cannot read properties of undefined"), which the host reports as a non-retryable PI_AI_ERROR, so every turn fails with no content. Align the two by pinning pi-ai to the host generation (for example a pnpm \`overrides\` entry in the profile) and restart DSH.`;
+}
+//#endregion
 //#region src/index.ts
 /**
 * Host-side plugin entry. Registers the `workbuddy-xdpool` provider into the
@@ -6690,6 +6841,28 @@ async function unignoreAccount(accountId, path = ignoredIdsPath()) {
 *
 * @module dsh-workbuddy-xdpool/index
 */
+/**
+* This plugin's install root, the tree its own provider is assembled from.
+*
+* Two directories up from `lib/` — the built bundle sits in `lib/`, so the
+* package root is its parent. Used as one side of the pi-ai generation check.
+*/
+const PLUGIN_ROOT = fileURLToPath(new URL("..", import.meta.url));
+/**
+* The host's own module directory, the tree its `PiAiAdapter` resolves from.
+*
+* Reached from the host package this plugin is loaded by: walking up from a
+* `@deepseek-ai/dsh-llm-pi-ai` import lands in the host's `node_modules`, which
+* is where the HOST generation actually lives. The plugin's own tree is the
+* other side; comparing one tree with itself would always agree.
+*/
+const HOST_MODULE_ROOT = (() => {
+	try {
+		return fileURLToPath(new URL("../../node_modules/@deepseek-ai/dsh-llm-pi-ai/", import.meta.url));
+	} catch {
+		return "";
+	}
+})();
 /** Stable Cordis plugin name. */
 const name = "llm-workbuddy-xdpool";
 /** The model registry required before the provider can register. */
@@ -6878,12 +7051,30 @@ function createCore(logger) {
 	};
 }
 /**
+* Log a warning when the plugin and the host resolve different pi-ai
+* generations.
+*
+* Never throws and never blocks startup: the check is a filesystem lookup, and
+* a plugin that refused to load because of a version guess would be worse than
+* one that merely warns. The two directories are THIS plugin's install root and
+* the host's own module directory, so the two resolutions walk different trees —
+* resolving from one place only would compare a copy with itself and always
+* agree.
+*/
+function warnOnPiAiGenerationMismatch(ctx) {
+	try {
+		const message = piAiMismatchMessage(checkPiAiGeneration(PLUGIN_ROOT, HOST_MODULE_ROOT));
+		if (message !== void 0) ctx.logger.warn(message);
+	} catch {}
+}
+/**
 * Start the loopback endpoint, register the `workbuddy-xdpool` provider, and
 * discover accounts. The provider registers only after `shim.ready` resolves,
 * because its models read the shim origin at construction time.
 */
 function apply(ctx, config = {}) {
 	const core = createCore(ctx.logger);
+	warnOnPiAiGenerationMismatch(ctx);
 	const ignoredPath = ignoredIdsPath();
 	let ignoredAccounts = readIgnoredAccountsSync(ignoredPath);
 	core.pool.applyIgnored(ignoredAccounts.map((entry) => entry.id));

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-xdpool",
   "displayName": "DSH WorkBuddy XD Pool",
   "description": "Merge every locally signed-in WorkBuddy account into DeepSeek Harness as one auto-failing-over model pool (multi-account rotation, live credits, daily check-in and model catalog).",
-  "version": "1.7.5",
+  "version": "1.7.6",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-workbuddy-xdpool#readme",
@@ -103,7 +103,7 @@
     "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.1-rc.1 <0.2.0",
     "@deepseek-ai/dsh-settings": ">=0.1.1-rc.1 <0.2.0",
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@earendil-works/pi-ai": ">=0.82.1 <0.85.0"
+    "@earendil-works/pi-ai": ">=0.82.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-llm": {