dsh-xdpool 2.4.3 → 2.4.4

package/CHANGELOG.md

@@ -1,6 +1,34 @@
 # Changelog
 本项目的所有重要变更都会记录在此文件。
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
+## 2.4.4 — 扫码登录后仍显示「登录已被拒绝」，以及侧栏入口
+
+> 两个都不算新功能：一个是**我上一版自己的代码**把刚扫的凭据判成「旧的」；另一个是入口位置——账号池一直只能从「设置」里进。
+
+### 扫了码、账号池还是说「登录已被拒绝」
+
+**你看到的**：某两个账号卡片一直显示「登录已被拒绝 / 上游已不再接受这个登录状态」，提示你去 WorkBuddy 桌面端重新登录。可你的登录途径是这个插件的扫码登录，而且刚刚扫过——扫完还是那句。
+
+**真实原因**（两处，都在本插件自己的代码里，不在上游）：
+
+1. **新鲜度排序把扫码凭据排在最后**。同一个账号可能同时存在两份凭据：桌面 App 留在 `auth` 目录里的快照文件，和你扫码后由本插件铸造的凭据。`compareFreshness` 原先只认三档——桌面 live 文件、`lastRefreshAtMs`、`expiresAtMs`。扫码凭据的 `sourcePath` 是 `channel-pack:<provider>:<ref>`，既不是 live 文件名、也永远没有 `lastRefreshAtMs`，于是**无条件输给任何残留的旧快照**。它输一次，凭据就不被替换；不替换，就走不到「清除死亡标记」那一行——卡片上那句提示于是永远不会消失，反复扫码也没反应。
+
+   现在改为按来源分三级：桌面 live 文件 > 本插件扫码凭据 > 其它残留快照，同级才继续比签发时间和有效期。
+
+2. **渠道包的去重按昵称分组，会删掉刚扫进来的凭据**。本插件对渠道包做过本地补丁：同渠道同昵称视为重复条目，只保留一条。问题有两个——重扫时新凭据遇到未过期的旧条目会被当作重复删掉（连凭据一起删）；而**同一个人的两个账号如果昵称相同，也会被当成同一个人删掉一个**。本机正好有两个都叫「青楫渡」的账号。
+
+   现在改用凭据里的上游身份 `user_id` 判重，并且：认不出身份的一律保留（宁可留一条重复，也不能删掉别人的账号）；登录半成品（昵称还是生成 id、没有有效期）在比较中让位给已完成登录的条目；都可用时按 `createdAt` 留新的。
+
+### 左侧栏可以直接进账号池了
+
+账号池此前只能从「设置 → XD Pool」进。现在侧栏底部（设置按钮附近）多了一个图标，点开就是同一个账号池卡片，`Esc` 或点面板外关闭。
+
+按钮与面板是两个互不相邻的宿主插槽（`sidebar.footer.action` 与 `shell.overlay`），没有共同祖先，因此开合状态放在模块级而不是组件状态里；面板直接渲染同一个 `PoolCard`，不复制一份界面。宿主只给侧栏注册者 `{ wide }`，没有「打开设置」的接口——这也是同类插件都用自己的浮层而不是跳转的原因。老宿主缺少 `shell.overlay` 时只损失这个入口，不影响设置页。
+
+### 测试
+
+账号发现新增 3 例：扫码凭据胜过旧快照、桌面 live 文件仍胜过扫码凭据、凭据被替换后死亡标记清除；另有 1 例钉住「同昵称的两个人不会被合并」。全套 **79 文件 1023 用例**。
+
 ## 2.4.3 — 渠道包补上 11128、粘性绑定跨重启、网关白名单、目录 TTL，外加 CodeArts 重签开关
 
 > 2.4.1 与 2.4.2 修的是**池车道**（`src/upstream.ts`）；这一版把同一套 11128 规则补进**渠道车道**自己那份 channel pack，并顺带解决三件独立的事：会话粘性绑定不该止于进程边界、网关页面的勾选该是真开关、远端模型目录该会过期。四个 PR 来自社区（[@GIGIGIGIbaby](https://github.com/GIGIGIGIbaby)），复核与发布由维护者完成。另附一个默认关闭的 CodeArts 重签开关（见末节）。

package/lib/bin.js

@@ -3084,24 +3084,49 @@ function isLiveAuthFile(path) {
 	return basename(path) === WORKBUDDY_LIVE_FILENAME;
 }
 /**
+* True for a credential this plugin minted from the channel-pack sign-in flow.
+*
+* `packCredentialToWorkBuddy` stamps `channel-pack:<provider>:<ref>` here, so the
+* prefix is the only thing distinguishing a scanned credential from a file the
+* desktop app wrote. Nothing about it is a path on disk — there is no file to
+* stat and no mtime to read.
+*/
+function isChannelPackSource(path) {
+	return path.startsWith("channel-pack:");
+}
+/**
 * Which of two credentials for the same account the pool should keep.
 *
 * Ordering, highest first:
 *
 * 1. the live file the desktop app is signed in with;
-* 2. the credential the upstream issued most recently (`lastRefreshAtMs`);
-* 3. the longer stored expiry, as a fallback for documents that carry no issue
+* 2. a credential minted by our own channel-pack sign-in;
+* 3. the credential the upstream issued most recently (`lastRefreshAtMs`);
+* 4. the longer stored expiry, as a fallback for documents that carry no issue
 *    time (the plugin's own refreshed copy, older builds).
 *
 * The stored expiry alone is NOT a freshness signal: the upstream does not
 * rewrite it when it revokes a token, so a long-dead backup can claim to expire
 * later than the token that actually works. Selecting on it made every upstream
 * call return 401 while a perfectly good credential sat in the same directory.
+*
+* Rank 2 exists because a scanned credential loses both of the lower tests by
+* construction: it is not the live filename, and the sign-in flow records no
+* `lastRefreshAtMs`. Ranking it below a leftover snapshot meant a user who had
+* just scanned a fresh sign-in still saw "sign-in was rejected", because the
+* abandoned file kept winning the comparison and the dead mark was never
+* cleared. The live file stays on top: that is the session the running desktop
+* app is genuinely using right now, and it is newer than anything we mint.
 */
 function compareFreshness(a, b) {
-	const aLive = isLiveAuthFile(a.sourcePath) ? 1 : 0;
-	const bLive = isLiveAuthFile(b.sourcePath) ? 1 : 0;
-	if (aLive !== bLive) return bLive - aLive;
+	const rankOf = (credential) => {
+		if (isLiveAuthFile(credential.sourcePath)) return 2;
+		if (isChannelPackSource(credential.sourcePath)) return 1;
+		return 0;
+	};
+	const aRank = rankOf(a);
+	const bRank = rankOf(b);
+	if (aRank !== bRank) return bRank - aRank;
 	const aIssued = a.lastRefreshAtMs ?? 0;
 	const bIssued = b.lastRefreshAtMs ?? 0;
 	if (aIssued !== bIssued) return bIssued - aIssued;

package/lib/client.js

@@ -1670,6 +1670,39 @@ window.__ModuleLoader__.load({
 ):active:not(:disabled){transform:none}
 }
 
+/* ── Docked entry beside the settings control ────────────────────────────────
+   The sidebar button and the overlay are two separate registrations with no
+   shared ancestor, so neither can carry the shell's own custom properties: the
+   easing curves are re-declared here rather than inherited. Everything below is
+   scoped to .dsm-xdpool-dock so it cannot reach into the host's sidebar. */
+.dsm-xdpool-dock{--ease-instrument:cubic-bezier(.16,1,.3,1);position:relative;z-index:1;display:flex;align-items:center;gap:8px;width:100%;min-width:0;padding:6px 8px;border:1px solid transparent;border-radius:9px;background:transparent;color:var(--dsw-alias-label-secondary,#c6c9d0);font:inherit;font-size:12px;line-height:17px;font-weight:560;text-align:left;cursor:pointer;overflow:hidden;transition:color .2s var(--ease-instrument),background .2s var(--ease-instrument),border-color .2s var(--ease-instrument)}
+.dsm-xdpool-dock:hover{color:var(--dsw-alias-label-primary,#e8e8ea);background:color-mix(in srgb, var(--dsw-alias-label-primary,#e8e8ea) 7%, transparent);border-color:color-mix(in srgb, var(--dsw-alias-border-l2,#ffffff1f) 70%, transparent)}
+.dsm-xdpool-dock-on{color:var(--dsw-alias-label-primary,#e8e8ea);background:color-mix(in srgb, var(--dsw-alias-state-business-primary,#5686fe) 14%, transparent);border-color:color-mix(in srgb, var(--dsw-alias-state-business-primary,#5686fe) 40%, transparent)}
+/* The sweep is the same gesture the card's own buttons make, so the dock reads
+   as part of the plugin rather than a host control. */
+.dsm-xdpool-dock::after{content:"";position:absolute;top:0;bottom:0;left:-60%;width:42%;pointer-events:none;background:linear-gradient(100deg,transparent,rgb(255 255 255 / 12%),transparent);transform:skewX(-18deg);transition:left .5s var(--ease-instrument)}
+.dsm-xdpool-dock:hover::after{left:118%}
+.dsm-xdpool-dockicon{flex:none;width:16px;height:16px;background-color:currentColor;-webkit-mask-image:var(--dsm-xdpool-dock-glyph);mask-image:var(--dsm-xdpool-dock-glyph);-webkit-mask-repeat:no-repeat;mask-repeat:no-repeat;-webkit-mask-position:center;mask-position:center;-webkit-mask-size:16px 16px;mask-size:16px 16px}
+.dsm-xdpool-docklabel{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+/* No dark backdrop: the panel is a companion to the conversation, not a modal,
+   and dimming the whole host for a settings card reads as a page navigation.
+   Clicking outside still closes it — the scrim covers the viewport and is
+   transparent, so only the click is caught. */
+.dsm-xdpool-dockscrim{position:fixed;inset:0;z-index:60;display:flex;align-items:stretch;justify-content:flex-end;background:transparent}
+.dsm-xdpool-dockpanel{--ease-instrument:cubic-bezier(.16,1,.3,1);display:flex;flex-direction:column;width:min(760px, 92vw);margin:14px;border:1px solid color-mix(in srgb, var(--dsw-alias-border-l2,#ffffff1f) 82%, transparent);border-radius:16px;background:color-mix(in srgb, var(--dsw-alias-bg-layer-1,#141517) 96%, transparent);box-shadow:0 20px 60px rgb(0 0 0 / 45%);overflow:hidden;animation:dsm-xdpool-dock-in .3s var(--ease-instrument)}
+@keyframes dsm-xdpool-dock-in{from{opacity:0;transform:translateX(18px)}to{opacity:1;transform:none}}
+.dsm-xdpool-dockhead{display:flex;align-items:center;gap:10px;padding:10px 12px;border-bottom:1px solid color-mix(in srgb, var(--dsw-alias-border-l1,#ffffff14) 80%, transparent)}
+.dsm-xdpool-docktitle{flex:1 1 auto;font-size:12px;line-height:17px;font-weight:640;color:var(--dsw-alias-label-primary,#e8e8ea)}
+.dsm-xdpool-dockclose{appearance:none;flex:none;width:22px;height:22px;padding:0;border:1px solid transparent;border-radius:7px;background:transparent;color:var(--dsw-alias-label-tertiary,#8a90a0);font:inherit;font-size:15px;line-height:1;cursor:pointer;transition:color .16s ease,background .16s ease}
+.dsm-xdpool-dockclose:hover{color:var(--dsw-alias-label-primary,#e8e8ea);background:color-mix(in srgb, var(--dsw-alias-label-primary,#e8e8ea) 9%, transparent)}
+/* The card inside the panel was built for the settings dialog's width; scroll
+   the panel body, never the card, so its own sticky header keeps working. */
+.dsm-xdpool-dockbody{flex:1 1 auto;min-height:0;overflow:auto;padding:14px}
+@media (prefers-reduced-motion:reduce){
+.dsm-xdpool-dock::after{display:none}
+.dsm-xdpool-dockpanel{animation:none}
+}
+
 `.trim();
 		//#endregion
 		//#region src/client/avatar.ts
@@ -12325,7 +12358,7 @@ window.__ModuleLoader__.load({
 		*
 		* @module dsh-xdpool/version
 		*/
-		const POOL_VERSION = "2.4.3";
+		const POOL_VERSION = "2.4.4";
 		//#endregion
 		//#region src/client/PoolCard.tsx
 		/**
@@ -14719,6 +14752,138 @@ window.__ModuleLoader__.load({
 		*/
 		const POOL_NAV_ICON_MASK_URL = `data:image/svg+xml;utf8,${encodeURIComponent(POOL_NAV_ICON_SVG)}`;
 		//#endregion
+		//#region src/client/dock.tsx
+		/**
+		* The docked entry: a `sidebar.footer.action` button that opens the pool card in
+		* a `shell.overlay` panel.
+		*
+		* Why not link to the Settings page the card already lives on: the host's
+		* sidebar slot hands a registrant exactly `{ wide }` — no `openSettings`, no
+		* navigation seat. dsh-purge, dshmarket and everything else third-party solve it
+		* the same way, by owning the surface: a button that toggles an overlay of its
+		* own. Re-implementing the card for the overlay would mean two copies to keep in
+		* step, so the overlay renders the very same `PoolCard` the settings section
+		* renders, page state and all.
+		*
+		* The open flag lives at module scope rather than in React state because the
+		* button and the panel are two separate slot registrations with no common
+		* ancestor; module state plus a subscription is the only channel between them.
+		*/
+		/** Subscribers re-read {@link dockedOpen}; the setter notifies them. */
+		const listeners = /* @__PURE__ */ new Set();
+		let dockedOpen = false;
+		/** Read whether the docked panel is showing. */
+		function isDockedOpen() {
+			return dockedOpen;
+		}
+		/** Show or hide the docked panel, notifying every registrant. */
+		function setDockedOpen(open) {
+			if (dockedOpen === open) return;
+			dockedOpen = open;
+			for (const listener of [...listeners]) listener();
+		}
+		/** Subscribe to {@link setDockedOpen}. Returns the unsubscribe. */
+		function subscribeDockedOpen(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		}
+		/** Subscribe a component to the open flag. */
+		function useDockedOpen() {
+			const [open, setOpen] = (0, react.useState)(isDockedOpen);
+			(0, react.useEffect)(() => {
+				setOpen(isDockedOpen());
+				return subscribeDockedOpen(() => {
+					setOpen(isDockedOpen());
+				});
+			}, []);
+			return open;
+		}
+		/**
+		* The sidebar button.
+		*
+		* Renders a glyph and, only when the rail is wide, the product name: a label in
+		* the collapsed 56px rail is clipped mid-word, which reads as a layout bug.
+		*/
+		function SidebarEntry({ wide }) {
+			const open = useDockedOpen();
+			const label = "XD Pool";
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+				type: "button",
+				className: `dsm-xdpool-dock${open ? " dsm-xdpool-dock-on" : ""}`,
+				title: open ? "收起 XD Pool" : "打开 XD Pool",
+				"aria-expanded": open,
+				"aria-label": label,
+				style: { "--dsm-xdpool-dock-glyph": `url("${POOL_NAV_ICON_MASK_URL}")` },
+				onClick: () => {
+					setDockedOpen(!isDockedOpen());
+				},
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					className: "dsm-xdpool-dockicon",
+					"aria-hidden": "true"
+				}), wide === true ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					className: "dsm-xdpool-docklabel",
+					children: label
+				}) : null]
+			});
+		}
+		/**
+		* The panel, rendered into `shell.overlay`.
+		*
+		* `children` is the card itself, passed in rather than imported so this module
+		* stays free of the card's dependency graph (the overlay must not drag the
+		* settings scope in with it when the host line has no scope to hand out).
+		*/
+		function DockedPanel({ children }) {
+			const open = useDockedOpen();
+			(0, react.useEffect)(() => {
+				if (!open) return;
+				const onKeyDown = (event) => {
+					if (event.key === "Escape") setDockedOpen(false);
+				};
+				window.addEventListener("keydown", onKeyDown);
+				return () => {
+					window.removeEventListener("keydown", onKeyDown);
+				};
+			}, [open]);
+			if (!open) return null;
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "dsm-xdpool-dockscrim",
+				role: "presentation",
+				onClick: () => {
+					setDockedOpen(false);
+				},
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dsm-xdpool-dockpanel",
+					role: "dialog",
+					"aria-modal": "false",
+					"aria-label": "XD Pool",
+					onClick: (event) => {
+						event.stopPropagation();
+					},
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsm-xdpool-dockhead",
+						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-xdpool-docktitle",
+							children: "XD Pool"
+						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+							type: "button",
+							className: "dsm-xdpool-dockclose",
+							"aria-label": "关闭",
+							onClick: () => {
+								setDockedOpen(false);
+							},
+							children: "×"
+						})]
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+						className: "dsm-xdpool-dockbody",
+						children
+					})]
+				})
+			});
+		}
+		//#endregion
 		//#region src/client/locales.ts
 		/**
 		* Plugin-card copy registered under the `settings.xdpool` locale
@@ -15795,6 +15960,24 @@ window.__ModuleLoader__.load({
 					}
 				}, PoolCard));
 				installNavIcon(ctx, () => t("row.navLabel"));
+				try {
+					ctx.slots.inject("sidebar.footer.action", () => ctx.slots.register({
+						name: "sidebar.footer.action",
+						id: "xdpool-dock",
+						order: 60,
+						label: "XD Pool"
+					}, SidebarEntry));
+					ctx.slots.inject("shell.overlay", () => ctx.slots.register({
+						name: "shell.overlay",
+						id: "xdpool-dock-panel",
+						order: 60
+					}, () => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(DockedPanel, { children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)(PoolCard, { ...settingsScope === void 0 ? { t } : {
+						t,
+						settingsScope
+					} }) })));
+				} catch (error) {
+					console.error("[dsh-xdpool] docked entry unavailable (settings page unaffected):", error);
+				}
 			} catch (error) {
 				console.error("[dsh-xdpool] client page failed to load (host provider unaffected):", error);
 			}

package/lib/index.js

@@ -3260,24 +3260,49 @@ function isLiveAuthFile(path) {
 	return basename(path) === WORKBUDDY_LIVE_FILENAME;
 }
 /**
+* True for a credential this plugin minted from the channel-pack sign-in flow.
+*
+* `packCredentialToWorkBuddy` stamps `channel-pack:<provider>:<ref>` here, so the
+* prefix is the only thing distinguishing a scanned credential from a file the
+* desktop app wrote. Nothing about it is a path on disk — there is no file to
+* stat and no mtime to read.
+*/
+function isChannelPackSource(path) {
+	return path.startsWith("channel-pack:");
+}
+/**
 * Which of two credentials for the same account the pool should keep.
 *
 * Ordering, highest first:
 *
 * 1. the live file the desktop app is signed in with;
-* 2. the credential the upstream issued most recently (`lastRefreshAtMs`);
-* 3. the longer stored expiry, as a fallback for documents that carry no issue
+* 2. a credential minted by our own channel-pack sign-in;
+* 3. the credential the upstream issued most recently (`lastRefreshAtMs`);
+* 4. the longer stored expiry, as a fallback for documents that carry no issue
 *    time (the plugin's own refreshed copy, older builds).
 *
 * The stored expiry alone is NOT a freshness signal: the upstream does not
 * rewrite it when it revokes a token, so a long-dead backup can claim to expire
 * later than the token that actually works. Selecting on it made every upstream
 * call return 401 while a perfectly good credential sat in the same directory.
+*
+* Rank 2 exists because a scanned credential loses both of the lower tests by
+* construction: it is not the live filename, and the sign-in flow records no
+* `lastRefreshAtMs`. Ranking it below a leftover snapshot meant a user who had
+* just scanned a fresh sign-in still saw "sign-in was rejected", because the
+* abandoned file kept winning the comparison and the dead mark was never
+* cleared. The live file stays on top: that is the session the running desktop
+* app is genuinely using right now, and it is newer than anything we mint.
 */
 function compareFreshness(a, b) {
-	const aLive = isLiveAuthFile(a.sourcePath) ? 1 : 0;
-	const bLive = isLiveAuthFile(b.sourcePath) ? 1 : 0;
-	if (aLive !== bLive) return bLive - aLive;
+	const rankOf = (credential) => {
+		if (isLiveAuthFile(credential.sourcePath)) return 2;
+		if (isChannelPackSource(credential.sourcePath)) return 1;
+		return 0;
+	};
+	const aRank = rankOf(a);
+	const bRank = rankOf(b);
+	if (aRank !== bRank) return bRank - aRank;
 	const aIssued = a.lastRefreshAtMs ?? 0;
 	const bIssued = b.lastRefreshAtMs ?? 0;
 	if (aIssued !== bIssued) return bIssued - aIssued;

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-xdpool",
   "displayName": "DSH XD Pool",
   "description": "One DSH model pool for every free quota you have: merge all locally signed-in WorkBuddy accounts with auto-failover, sign in to 13 vendors by QR/web, aggregate 76 vendors' free tiers, plus a usage dashboard, model routing, a local OpenAI-compatible gateway and a points-automation suite.",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-xdpool#readme",

package/vendor/channel-pack/pack.js

@@ -68043,50 +68043,86 @@ function apply(ctx, config = {}) {
   //   非空（用户勾选的模型已被移出黑名单），不会重复静音。
   let channelPackModelAdaptersRef;
   const rawAddAccount = pool.addAccount.bind(pool);
-  // ── 本地适配（dsh-xdpool）：清掉同渠道同昵称的重复账号 ──
+  // ── 本地适配（dsh-xdpool）：清掉同一账号的重复条目 ──
   // 需求（2026-10-16）：用户在扫码登录页反复点「添加账号」，上游 `addAccount`
-  // 是纯追加（无任何去重），于是同一渠道攒出多条同号账号，账号池页一张卡里
-  // 显示 3-4 个一模一样的人。判定键取 (provider, nickname)：同一渠道里昵称
-  // 相同即视为同一个账号（上游所有渠道在凭据落定后都用 `updateAccount` 把
-  // nickname 改成真实显示名，所以昵称才是稳定身份，id 每次都是新随机值）。
+  // 是纯追加（无任何去重），于是同一账号攒出多条，账号池页一张卡里显示
+  // 3-4 个一模一样的人。
   //
-  // ⚠️ 保留哪一条不能只看 createdAt newest。反复点「添加账号」时，**新加的
-  // 那条是登录还没走完的半成品**（expiresAt 缺失），而**旧的那条是完整可用
-  // 的旧凭据**（zcode 的凭据甚至不带过期时间）。按 newest 保留会留下半成品、
-  // 删掉能用的 —— 这正是本机 zcode 的实际形态（10-16 15:15 的三条无
-  // expiresAt，16:15 新加的那条也无 expiresAt，而其它渠道都有）。所以判定
-  // 优先级改成「可用性」：
-  //   ① expiresAt 为空视为长期凭据、可用；有值时必须晚于「现在」才算可用；
-  //   ② 双方都可用 → 留旧的（先登录的那条，凭据久经使用）；
-  //      旧的已过期而新的可用 → 换新；其余 → 留旧。
-  const channelAccountIsUsable = (account, now) => {
+  // ⚠️ 判定键必须是上游身份（凭据里的 `user_id`），不能是昵称。
+  //   2026-10-23 实测教训：按 (provider, nickname) 分组会把**两位不同的人**
+  //   误判成同一个 —— 本机有两个账号昵称都叫「青楫渡」（uid 29890334 与
+  //   8e606182），结果扫进来的第二个被当成重复条目删掉。
+  //   同一份代码还有第二个更严重的后果：新扫进来的凭据只要遇到一条
+  //   「还没过期」的旧条目就会被删（旧规则「双方都可用 → 留旧的」），
+  //   用户重新扫码后账号池毫无变化，卡片继续显示「登录已被拒绝」。
+  //
+  // 保留哪一条：优先「真实条目」而非登录半成品（半成品的 nickname 还是
+  // 随机 id，因为上游要到 `updateAccount` 才写入真实显示名），再优先
+  // 未过期的，最后取最新创建的那条 —— 用户刚完成的那次登录才是他此刻
+  // 在用的凭据。
+  const channelAccountUsable = (account, now) => {
     const expiresAt = Number(account.expiresAt);
     if (!Number.isFinite(expiresAt) || expiresAt <= 0) return true;
     return expiresAt > now;
   };
+  const channelAccountIsPlaceholder = (account) =>
+    typeof account.nickname !== "string" || account.nickname === "" || account.nickname === account.id;
+  const channelAccountCreatedAt = (account) => {
+    const createdAt = Number(account.createdAt);
+    return Number.isFinite(createdAt) ? createdAt : 0;
+  };
+  /** True when `candidate` should survive and `incumbent` should be dropped. */
+  const channelAccountBeats = (candidate, incumbent, now) => {
+    const candidatePlaceholder = channelAccountIsPlaceholder(candidate);
+    const incumbentPlaceholder = channelAccountIsPlaceholder(incumbent);
+    if (candidatePlaceholder !== incumbentPlaceholder) return incumbentPlaceholder;
+    const candidateUsable = channelAccountUsable(candidate, now);
+    const incumbentUsable = channelAccountUsable(incumbent, now);
+    if (candidateUsable !== incumbentUsable) return candidateUsable;
+    return channelAccountCreatedAt(candidate) > channelAccountCreatedAt(incumbent);
+  };
+  /**
+   * Resolve the upstream identity a row belongs to.
+   *
+   * Returns undefined when the credential cannot be read: an unresolvable row
+   * cannot be proven to be a duplicate of anything, and deleting it would trade
+   * one bug for a worse one.
+   */
+  const channelAccountIdentity = async (account) => {
+    const refName = typeof account.credentialRef === "string" ? account.credentialRef : "";
+    if (refName === "") return void 0;
+    try {
+      const credential = await pool.resolveCredentialByRef(refName);
+      if (credential === void 0 || credential === null || typeof credential !== "object") return void 0;
+      const userId = credential.user_id;
+      return typeof userId === "string" && userId !== "" ? userId : void 0;
+    } catch {
+      return void 0;
+    }
+  };
   const dedupeChannelAccounts = async () => {
     try {
       const all = await pool.listAllAccounts();
       const now = Date.now();
-      const groups = new Map();
+      const groups = /* @__PURE__ */ new Map();
       for (const account of all) {
-        const nickname = typeof account.nickname === "string" ? account.nickname : "";
-        // 昵称为空的条目无从判断是否重复（登录尚未落定的中间态），一律保留。
-        if (account.provider === "" || nickname === "") continue;
-        const key = `${account.provider}\u0000${nickname}`;
+        const provider = typeof account.provider === "string" ? account.provider : "";
+        if (provider === "") continue;
+        const identity = await channelAccountIdentity(account);
+        // 认不出身份的条目一律保留：宁可留一条重复，也不能删掉别人的账号。
+        if (identity === void 0) continue;
+        const key = `${provider}\u0000${identity}`;
         const kept = groups.get(key);
-        if (kept === undefined) {
+        if (kept === void 0) {
           groups.set(key, account);
           continue;
         }
-        const keptUsable = channelAccountIsUsable(kept, now);
-        const accountUsable = channelAccountIsUsable(account, now);
-        const replace = !keptUsable && accountUsable;
+        const replace = channelAccountBeats(account, kept, now);
         const drop = replace ? kept : account;
         if (replace) groups.set(key, account);
         await pool.removeAccount(drop.id);
         ctx.logger.info(
-          `[channel-pack] ${drop.provider} 重复账号 ${drop.nickname}（${drop.id}）：已清理，保留 ${(replace ? account : kept).id}`
+          `[channel-pack] ${drop.provider} 重复账号 ${drop.nickname ?? drop.id}（${drop.id}）：已清理，保留 ${(replace ? account : kept).id}`
         );
       }
     } catch (error) {
@@ -68095,6 +68131,7 @@ function apply(ctx, config = {}) {
       );
     }
   };
+
   // 启动时先扫一遍：用户升级前攒下的重复只能靠这一次清掉。
   void Promise.resolve().then(() => dedupeChannelAccounts());
   // ── 本地适配（dsh-xdpool）：启动时补静音「黑名单为空但已有账号」的渠道 ──