dsh-connect-workbuddy 2.3.0 → 3.0.0

package/lib/index.js

@@ -1,6 +1,10 @@
-import { A as WorkBuddyCredentialRejectedError, B as clearAtRestKeyCache, C as hasEncryptedCredentialFields, D as workbuddyAccountId, E as parseWorkBuddyAuth, F as parseReasoning, G as isEncryptedFieldWrapper, H as deriveAtRestKeyId, I as parseUpstreamModel, J as macosNestedAppBundles, K as isWorkbuddyBundle, L as prepareChatBody, M as classifyUpstreamError, N as isCredentialRejectedError, O as workbuddyOwnAuthPath, P as parseCreditMultiplier, R as regionOf, S as defaultDesktopAuthPath, T as legacyWorkbuddyOwnAuthPath, U as fetchAtRestKeyPayload, V as deriveAtRestKey, W as findWorkbuddyAppExecutable, X as readAtRestKey, Y as openEncryptedField, Z as workbuddyAppExecutableCandidates, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WORKBUDDY_AUTH_FILE_ENV, h as WORKBUDDY_AUTH_FILENAME, i as processStartTimeMs, j as WorkBuddyUpstreamClient, k as CREDENTIAL_REJECTED_CODE, l as FALLBACK_WORKBUDDY_MODELS, m as ENCRYPTED_CREDENTIAL_CODE, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, q as macosBundleExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as WorkBuddyEncryptedCredentialError, w as isEncryptedCredentialError, x as defaultDesktopAuthDirs, y as authFileName, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-Uh8JCXqk.js";
+import { A as WorkBuddyCredentialRejectedError, B as clearAtRestKeyCache, C as hasEncryptedCredentialFields, D as workbuddyAccountId, E as parseWorkBuddyAuth, F as parseReasoning, G as isEncryptedFieldWrapper, H as deriveAtRestKeyId, I as parseUpstreamModel, J as macosNestedAppBundles, K as isWorkbuddyBundle, L as prepareChatBody, M as classifyUpstreamError, N as isCredentialRejectedError, O as workbuddyOwnAuthPath, P as parseCreditMultiplier, R as regionOf, S as defaultDesktopAuthPath, T as legacyWorkbuddyOwnAuthPath, U as fetchAtRestKeyPayload, V as deriveAtRestKey, W as findWorkbuddyAppExecutable, X as readAtRestKey, Y as openEncryptedField, Z as workbuddyAppExecutableCandidates, _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as defaultDesktopAuthCandidates, c as WORKBUDDY_CONNECT_VERSION, d as WorkBuddyCatalog, f as deriveCatalog, g as WORKBUDDY_AUTH_FILE_ENV, h as WORKBUDDY_AUTH_FILENAME, i as processStartTimeMs, j as WorkBuddyUpstreamClient, k as CREDENTIAL_REJECTED_CODE, l as FALLBACK_WORKBUDDY_MODELS, m as ENCRYPTED_CREDENTIAL_CODE, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as fallbackModelsFor, q as macosBundleExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS_GLOBAL, v as WorkBuddyEncryptedCredentialError, w as isEncryptedCredentialError, x as defaultDesktopAuthDirs, y as authFileName, z as WORKBUDDY_APP_EXECUTABLE_ENV } from "./host-heartbeat-JODdwFRx.js";
 import z from "@deepseek-ai/schemastery";
+import { readFile } from "node:fs/promises";
 import { randomBytes, timingSafeEqual } from "node:crypto";
+import { join } from "node:path";
+import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
+import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -501,25 +505,63 @@ function createWorkBuddyShim(options) {
 * would report every global model as broken.
 */
 const PROBE_SYSTEM_PROMPT = "You are a connectivity check. Reply with a single word.";
-/** The one-word user turn; the smallest thing a chat endpoint accepts. */
-const PROBE_USER_PROMPT = "ping";
 /**
-* Output cap for a probe. One token is enough to prove the model answers, and
-* keeps the cost negligible: live measurements of `max_tokens: 1` probes
-* reported `credit` between 0 and 0.01, and one such probe left the credit
-* balance unchanged (933 → 933). For scale, a model on that roster bills 0.79+
-* per real reply. The point of the feature is to learn whether a model works
-* while spending as close to nothing as the service allows.
+* Output cap for a probe. One token is enough to prove the model answers.
+*
+* The probe's cost comes from its INPUT, not its output (see
+* {@link PROBE_INPUT_TOKENS}), so paying for a long completion would add money
+* without adding signal.
 */
 const PROBE_MAX_TOKENS = 1;
 /**
+* How much input a probe sends, in tokens.
+*
+* This is the whole point of the probe, and it is NOT a free choice. The
+* upstream's rate limit (business code 6004) fires on request SIZE, measured on
+* 2026-09-29 by varying only the input against one account and one model:
+*
+*   | input     | prompt_tokens the upstream counted | result |
+*   | ---       | ---                                | ---    |
+*   | ~10       | 38                                 | ok     |
+*   | ~1,000    | 1,138                              | ok     |
+*   | ~10,000   | 11,138                             | ok     |
+*   | ~18,000   | 20,018                             | ok     |
+*   | ~25,000   | 25,023                             | ok     |
+*   | ~30,000   | ~32k                               | **429 / 6004** |
+*
+* So the threshold sits between 20k and 30k, a SINGLE large request is enough to
+* trip it (it is not a running total), and each account reports its own reset
+* time (two accounts at the same moment: `22:20:33` and `00:32:51`).
+*
+* A probe that sent a handful of tokens answered "usable" while every real
+* request in a long conversation was refused — the probe was asking too small a
+* question. 25k is sized to be a realistic long-conversation payload.
+*/
+const PROBE_INPUT_TOKENS = 25e3;
+/**
+* Characters per token for the filler text, measured.
+*
+* Filling with a fixed English sentence, the upstream counted about 4.5
+* characters per token. An estimate rather than a bundled tokenizer: the body
+* only needs to be the right SIZE CLASS, and the target has ample margin over
+* the measured threshold, so estimate error cannot change the verdict.
+*/
+const CHARS_PER_TOKEN = 4.5;
+/** Neutral filler; carries no user content, only volume. */
+const FILLER_LINE = "The quick brown fox jumps over the lazy dog. ";
+/**
 * Build the request body for one probe.
 *
 * `stream` is forced because the upstream rejects non-streaming chat requests;
 * `prepareChatBody` enforces that too, but sending it explicitly keeps this
 * function's output valid on its own.
+*
+* Measured on the built artifact: 112,713 bytes of body, and the upstream
+* counted `prompt_tokens: 25023` at a cost of `credit: 0.72`.
 */
 function probeRequestBody(modelId) {
+	const targetChars = Math.ceil(PROBE_INPUT_TOKENS * CHARS_PER_TOKEN);
+	const filler = FILLER_LINE.repeat(Math.ceil(targetChars / 45));
 	return JSON.stringify({
 		model: modelId,
 		messages: [{
@@ -527,7 +569,7 @@ function probeRequestBody(modelId) {
 			content: PROBE_SYSTEM_PROMPT
 		}, {
 			role: "user",
-			content: PROBE_USER_PROMPT
+			content: `${filler}Reply with a single word.`
 		}],
 		max_tokens: 1,
 		stream: true
@@ -558,21 +600,71 @@ function parseRetryAfter(value, nowMs) {
 	return parsed;
 }
 /**
+* The upstream's reset sentence, as its Chinese gateway writes it.
+*
+* Measured on a live 429 (code 6004), verbatim:
+*
+*   `您的使用量已超出频率限制，将在 2026-09-30 02:30:30 UTC+8 重置，您也可以切换其他模型继续使用。`
+*
+* The two halves are captured separately because the second one is the whole
+* reason this parser exists: the upstream DOES name a time, and the plugin was
+* showing "the upstream gave no time" while the answer was sitting right there
+* in the body. The earlier note in this module ("the upstream provides no
+* rate-limit metadata") was drawn from the RESPONSE HEADERS alone — true as far
+* as it went, and wrong as a conclusion, because the time is in the body text.
+*
+* Deliberately loose about the surrounding wording (`[\s\S]*?` on both sides)
+* and strict about the parts that must not be guessed: the keyword 重置, the
+* timestamp shape, and an explicit UTC offset. A message that merely mentions
+* 重置 without a parsable offset yields no time, which is the honest answer.
+*/
+const UPSTREAM_RESET_PATTERN = /将在?\s*(\d{4})-(\d{2})-(\d{2})[ T](\d{2}):(\d{2}):(\d{2})\s*UTC\s*([+-])(\d{1,2})(?::?(\d{2}))?[\s\S]*?重置/u;
+/**
+* Parse the reset time out of an upstream failure message.
+*
+* Returns epoch ms, or undefined when the message names no parsable time — the
+* caller must then say "the upstream gave no time", never invent one.
+*
+* THE OFFSET IS HONOURED, NOT ASSUMED. `2026-09-30 02:30:30 UTC+8` is 18:30:30
+* UTC the previous day, and `Date.parse` on the bare string would read it as
+* LOCAL time — on a machine set to UTC+8 that happens to be right, and on any
+* other machine it is silently wrong by the offset. So the components are
+* assembled with `Date.UTC` and the stated offset subtracted, which is correct
+* on every host regardless of its own zone.
+*
+* A whole-second resolution is what the upstream prints; sub-second precision
+* would be fiction in the other direction.
+*/
+function parseUpstreamResetAt(message) {
+	const match = UPSTREAM_RESET_PATTERN.exec(message);
+	if (match === null) return void 0;
+	const [, year, month, day, hour, minute, second, sign, offsetHours, offsetMinutes] = match;
+	const offsetTotalMinutes = (sign === "-" ? -1 : 1) * (Number(offsetHours) * 60 + Number(offsetMinutes ?? "0"));
+	const utcMs = Date.UTC(Number(year), Number(month) - 1, Number(day), Number(hour), Number(minute), Number(second));
+	const parsed = new Date(utcMs);
+	if (parsed.getUTCFullYear() !== Number(year) || parsed.getUTCMonth() !== Number(month) - 1 || parsed.getUTCDate() !== Number(day) || parsed.getUTCHours() !== Number(hour) || parsed.getUTCMinutes() !== Number(minute) || parsed.getUTCSeconds() !== Number(second)) return;
+	if (Math.abs(offsetTotalMinutes) > 840) return void 0;
+	return utcMs - offsetTotalMinutes * 6e4;
+}
+/**
 * The cooldown the upstream stated, if it stated one.
 *
-* Two sources, in order of authority:
+* Three sources, in order of authority:
 *
 * 1. `Retry-After` on the failure response. This is the upstream naming a time
 *    for THIS request, so it wins.
-* 2. The region's monthly quota refresh point, but ONLY for an out-of-credit
+* 2. The reset time the upstream writes into its own failure body (see
+*    {@link parseUpstreamResetAt}). This is the case that actually fires on
+*    this service: a 429 from the Chinese gateway carries code 6004 and a
+*    `将在 … 重置` sentence, with no `Retry-After` header at all.
+* 3. The region's monthly quota refresh point, but ONLY for an out-of-credit
 *    outcome. A quota that resets at a known time is the one case where "when
 *    can I use this again" has a real answer even without a header — and it is
 *    the answer for the most common real limit on this service.
 *
-* A `rate-limited` outcome with neither source returns `{}`, which the card
-* renders as "the upstream did not say when". That is the honest answer: the
-* live probes found no rate-limit metadata in any response at all, so inventing
-* a number here would be pure fiction.
+* A limited outcome with none of the three returns `{}`, which the card renders
+* as "the upstream did not say when". That remains the honest answer for a
+* genuinely timeless failure; inventing a number here would be pure fiction.
 */
 function cooldownOf(input) {
 	const fromHeader = parseRetryAfter(input.retryAfter, input.nowMs);
@@ -580,6 +672,11 @@ function cooldownOf(input) {
 		retryAtMs: fromHeader,
 		retrySource: "retry-after"
 	};
+	const fromBody = input.body === void 0 ? void 0 : parseUpstreamResetAt(input.body);
+	if (fromBody !== void 0) return {
+		retryAtMs: fromBody,
+		retrySource: "upstream-message"
+	};
 	if (input.outcome === "out-of-credit" && input.quotaRefreshAtMs !== void 0) return {
 		retryAtMs: input.quotaRefreshAtMs,
 		retrySource: "quota-refresh"
@@ -640,9 +737,9 @@ function redact(text) {
 * Run one probe for one model and reduce it to the card's row.
 *
 * The successful path drains the SSE stream purely to read the `credit` figure
-* the upstream reports, then discards the rest: the probe's question is "did
-* this model answer", and `max_tokens: 1` means there is nothing else in the
-* stream worth keeping.
+* the upstream reports, then discards the rest: the question is whether this
+* model answers a real-sized request, and `max_tokens: 1` means there is nothing
+* else in the stream worth keeping.
 *
 * Never throws. A probe is a diagnostic the user asked for, so every failure is
 * a RESULT — one dead model must not abort the batch and hide the other rows.
@@ -691,10 +788,558 @@ async function probeModel(input) {
 			outcome,
 			retryAfter: answer.retryAfter,
 			nowMs: input.nowMs,
+			body,
 			...input.quotaRefreshAtMs === void 0 ? {} : { quotaRefreshAtMs: input.quotaRefreshAtMs }
 		})
 	};
 }
+/**
+* Check in every account, one at a time.
+*
+* Idempotent by design (see the module note): an account already checked in
+* today is reported as `already` and NO write is attempted. A failure on one
+* account is recorded on that row and the batch continues.
+*
+* Never throws: every problem becomes a row, because a batch that aborted on
+* its first bad account would hide the state of all the others.
+*/
+async function checkinAllAccounts(targets, deps, nowMs = Date.now) {
+	const rows = [];
+	for (const [index, target] of targets.entries()) {
+		if (index > 0) await (deps.wait ?? defaultWait)(400);
+		rows.push(await checkinOne(target, deps));
+	}
+	return rows;
+}
+/** One account's check-in, reduced to its row. */
+async function checkinOne(target, deps) {
+	const base = {
+		accountId: target.accountId,
+		accountName: target.accountName
+	};
+	let credential;
+	try {
+		credential = await deps.credentialFor(target.accountId);
+	} catch (error) {
+		return {
+			...base,
+			status: "failed",
+			message: messageOf(error)
+		};
+	}
+	if (credential === void 0) return {
+		...base,
+		status: "failed",
+		message: "no stored credential for this account"
+	};
+	try {
+		const status = await deps.fetchCheckinStatus(credential);
+		if (!status.active) return {
+			...base,
+			status: "failed",
+			message: "check-in activity is not active"
+		};
+		if (status.todayCheckedIn) return {
+			...base,
+			status: "already"
+		};
+		const claim = await deps.claimDailyCheckin(credential);
+		return {
+			...base,
+			status: "claimed",
+			credit: claim.credit,
+			streakDays: claim.streakDays
+		};
+	} catch (error) {
+		return {
+			...base,
+			status: "failed",
+			message: messageOf(error)
+		};
+	}
+}
+/**
+* Test every account against one model, one at a time.
+*
+* The model is resolved by the caller (see `resolveTargetModel`) so this
+* function never has to decide "free or not" — an unresolvable target is the
+* caller's problem to report, and testing against a model nobody chose would be
+* exactly the silent spend the plan forbids.
+*
+* Never throws: a failed probe is a ROW, not an aborted batch.
+*/
+async function testAllAccounts(targets, modelId, deps) {
+	const rows = [];
+	for (const [index, target] of targets.entries()) {
+		if (index > 0) await (deps.wait ?? defaultWait)(400);
+		rows.push(await testOne(target, modelId, deps));
+	}
+	return rows;
+}
+/** One account's probe, reduced to its row. */
+async function testOne(target, modelId, deps) {
+	const base = {
+		accountId: target.accountId,
+		accountName: target.accountName
+	};
+	let credential;
+	try {
+		credential = await deps.credentialFor(target.accountId);
+	} catch (error) {
+		return {
+			...base,
+			result: {
+				modelId,
+				outcome: "credential-rejected",
+				message: messageOf(error)
+			}
+		};
+	}
+	if (credential === void 0) return {
+		...base,
+		result: {
+			modelId,
+			outcome: "credential-rejected",
+			message: "no stored credential for this account"
+		}
+	};
+	return {
+		...base,
+		result: await deps.probe(credential, modelId)
+	};
+}
+/**
+* Turn a test batch's rows into the per-account measurements to remember.
+*
+* A row is stored only when the probe actually measured the MODEL. A row that
+* failed because the credential could not even be read says nothing about the
+* model, and recording it would exclude a possibly-perfect account from the
+* pool — so those accounts keep their previous measurement instead.
+*
+* `atMs` is stamped here, once for the batch, so the card's "tested N minutes
+* ago" reflects when the batch finished rather than drifting per row.
+*/
+function probeUpdatesOf(rows) {
+	const atMs = Date.now();
+	const updates = {};
+	for (const row of rows) {
+		if (isTransportFailure(row.result)) continue;
+		updates[row.accountId] = {
+			outcome: row.result.outcome,
+			atMs,
+			...row.result.retryAtMs === void 0 ? {} : { retryAtMs: row.result.retryAtMs }
+		};
+	}
+	return updates;
+}
+/**
+* Whether a probe result measures the transport rather than the model.
+*
+* `credential-rejected` with the pool's own "no stored credential" message is
+* the one case we can attribute to ourselves rather than the upstream: the
+* request never left. Every other rejection came from the upstream and IS a
+* statement about this account, so it is kept.
+*/
+function isTransportFailure(result) {
+	return result.outcome === "credential-rejected" && result.message?.startsWith("no stored credential") === true;
+}
+/** The default inter-account pause. */
+function defaultWait(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** A safe message from an unknown throwable, bounded in length. */
+function messageOf(error) {
+	return (error instanceof Error ? error.message : String(error)).slice(0, 300);
+}
+/**
+* Whether one account can be billed at `nowMs`.
+*
+* Returns the exclusion reason, or undefined when the account is a candidate.
+* The order matters and is NOT arbitrary:
+*
+* - A `credential-rejected` account is excluded regardless of any cooldown: its
+*   token is not accepted, so waiting cannot help and the user must re-auth.
+* - A limited outcome is checked against its stated (or fallback) cooldown, so
+*   an account whose limit has already reset is back in the pool without
+*   needing another test first.
+* - An `ok` measurement, and no measurement at all, are both candidates. The
+*   latter matters: a freshly discovered account has never been tested and must
+*   not be invisible.
+*
+* Each unusable outcome keeps its OWN value rather than being folded into
+* `credential-rejected`. The fold made one row state two contradictory things —
+* the name column said "被拒绝" (sign in again) while the probe column, reading
+* the same measurement, said "连不上上游——这是网络问题，不是模型问题" — and it
+* told a user whose upstream had merely blipped that their sign-in was bad.
+* The distinctions are already computed upstream in `outcomeOfFailure`
+* (`src/probe.ts:290-299`); this only stops discarding them.
+*/
+function exclusionOf(probe, nowMs) {
+	if (probe === void 0) return void 0;
+	switch (probe.outcome) {
+		case "ok": return;
+		case "credential-rejected": return "credential-rejected";
+		case "not-found": return "not-found";
+		case "unavailable": return "unavailable";
+		case "failed": return "failed";
+		case "rate-limited": return retryDue(probe, nowMs) ? void 0 : "rate-limited";
+		case "out-of-credit": return retryDue(probe, nowMs) ? void 0 : "out-of-credit";
+		default: return "unusable";
+	}
+}
+/** Whether a limited account's cooldown has elapsed (or was never stated). */
+function retryDue(probe, nowMs) {
+	return nowMs >= (probe.retryAtMs ?? probe.atMs + 18e5);
+}
+/**
+* Rank a pool's members best-first.
+*
+* The rule, in priority order — this is the whole feature:
+*
+* 1. **Usability.** Only accounts that can be billed right now are candidates;
+*    they always outrank every excluded one.
+* 2. **Credits, highest first.** Spend the account that has the most, so an
+*    account running low is conserved rather than drained first.
+* 3. **Credits expiring soonest first.** Points about to expire are worth
+*    exactly zero after they do, so using them earlier is strictly better than
+*    saving them.
+* 4. **Freshest credential.** Tie-break so a stale token never wins a draw.
+* 5. **Account id.** Final tie-break, making the order TOTAL: two accounts
+*    equal on every ranking key would otherwise keep the caller's array order,
+*    so the same pool could rotate differently between two runs.
+*
+* Excluded accounts are still RETURNED (sorted after the candidates) so the
+* card can explain why each is out; they differ from candidates by
+* `excludedBy` being set on them, never by being silently dropped.
+*
+* Pure and total: the same input always yields the same order, and it never
+* throws on missing data (an account with no credits is ranked as 0, not
+* crashed on).
+*/
+function rankPool(members, nowMs) {
+	const rows = members.map((member) => {
+		const excludedBy = exclusionOf(member.probe, nowMs);
+		return {
+			account: member.account,
+			score: scoreOf(member),
+			...excludedBy === void 0 ? {} : { excludedBy },
+			_usable: excludedBy === void 0,
+			_expiring: member.credits?.nearestExpiryMs ?? Number.POSITIVE_INFINITY,
+			_tokenExpiresAtMs: member.tokenExpiresAtMs ?? 0
+		};
+	});
+	rows.sort((left, right) => {
+		if (left._usable !== right._usable) return left._usable ? -1 : 1;
+		if (left.score !== right.score) return right.score - left.score;
+		if (left._expiring !== right._expiring) return left._expiring - right._expiring;
+		if (left._tokenExpiresAtMs !== right._tokenExpiresAtMs) return right._tokenExpiresAtMs - left._tokenExpiresAtMs;
+		return left.account.id < right.account.id ? -1 : left.account.id > right.account.id ? 1 : 0;
+	});
+	return rows.map(({ account, score, excludedBy }) => ({
+		account,
+		score,
+		...excludedBy === void 0 ? {} : { excludedBy }
+	}));
+}
+/**
+* The checked ids that still resolve to a local sign-in, in the caller's order.
+*
+* This is THE definition of "effective members", and it exists because the same
+* predicate was written five separate times: the status document
+* (`web-status.ts`), the batch route's empty-pool guard, the Host dependency the
+* card reads, `poolMemberAccounts` and the browser helper. Five copies of one
+* rule is this project's single most productive bug shape ("fixed one end,
+* missed the other"), so the rule now has one home and every site delegates to
+* it.
+*
+* ORDER IS THE CALLER'S, and comes from `orderedIds`: the answer preserves the
+* order of THAT argument. Callers pass whichever list's order they want to show
+* — the saved list for the user's own order, the store's roster for the account
+* table's. Neither is silently reshuffled by the filter. (The first parameter was
+* once named `saved`, which read as "this must be the saved list" even though
+* `web-status.ts` legitimately passes the roster for store order; the name was
+* the trap, so it now describes the ROLE instead of the source.)
+*
+* Pure, so it is unit-testable without a store, and it never mutates its input.
+*/
+function effectiveMembersOf(orderedIds, listedIds) {
+	return orderedIds.filter((id) => listedIds.has(id));
+}
+/**
+* The account to bill, or undefined when the pool has no usable member.
+*
+* A thin selector over {@link rankPool} so the winner is decided in exactly one
+* place: every caller that needs "who serves now" gets the same answer.
+*/
+function pickAccount(members, nowMs) {
+	return rankPool(members, nowMs).find((row) => row.excludedBy === void 0)?.account;
+}
+/**
+* The credit figure used for ordering.
+*
+* Absent credits rank as zero. Deliberately NOT "unknown ranks first": an
+* account whose balance could not be read must never outrank one we positively
+* know is full, or a failing credits route would capture all the traffic.
+*/
+function scoreOf(member) {
+	return member.credits?.total ?? 0;
+}
+/**
+* Pick the free model to test against, from one region's catalog.
+*
+* "Free" means `creditMultiplier === 0` EXACTLY. An absent multiplier is NOT
+* free — see the module note: the CN static fallback carries no multiplier at
+* all, so treating absence as zero would silently bill real credits.
+*
+* Among the free candidates the LARGEST context window wins, because the probe
+* sends a real-sized payload (25k input) and a long-conversation probe is the
+* point: a small-window model would either reject it or answer a question the
+* user never asked.
+*
+* Returns undefined when the region has no free model, which the caller must
+* render as "none available" — never as a fallback to a paid model.
+*/
+function pickFreeModel(catalog) {
+	let best;
+	for (const model of catalog) {
+		if (model.creditMultiplier !== 0) continue;
+		if (best === void 0 || model.contextWindow > best.contextWindow) best = model;
+	}
+	return best;
+}
+/**
+* A latest-wins guard for one region's asynchronous work.
+*
+* Exists because `applyRotation` awaits (it fetches credits per member), so two
+* overlapping calls can interleave: a slow call that read "rotation is ON" can
+* resume AFTER a newer call cleared the override for "rotation is OFF" and write
+* the stale account back — leaving the card showing the pool switched off while
+* a rotated account is still billed.
+*
+* `begin()` claims a new generation and returns a probe; the caller must check
+* it after EVERY await and bail when it reports stale. Extracted as a pure
+* factory rather than inlined so the rule is unit-testable: an inlined token is
+* only observable by reproducing a real interleaving, which is slow and easy to
+* get subtly wrong (a harness that never actually overlaps passes either way).
+*/
+function createLatestWins() {
+	const generations = {};
+	return { begin(key) {
+		const generation = (generations[key] ?? 0) + 1;
+		generations[key] = generation;
+		return () => generations[key] !== generation;
+	} };
+}
+/**
+* How often the pool scheduler wakes to check whether a region is due.
+*
+* A fixed, coarse heartbeat rather than one timer per region: the heartbeat
+* itself does no network work (it only reads config and compares timestamps),
+* so it is free, and it makes re-arming on a config change unnecessary — the
+* next tick simply reads the new interval.
+*/
+const POOL_TICK_MS = 6e4;
+/**
+* Whether an automatic test is due for one region.
+*
+* `lastRunMs === undefined` means "never armed", and returns FALSE: the clock
+* starts when the scheduler first sees the region, so enabling the pool does
+* not immediately spend credits at startup or after a restart. Waiting one
+* interval is the least surprising reading of "test every N minutes" — the
+* alternative (fire immediately) would bill the user on every launch.
+*
+* Pure and total so the scheduling rule can be pinned without real timers.
+*/
+function poolDueAt(input) {
+	if (input.lastRunMs === void 0) return false;
+	const minutes = Math.max(5, Math.round(input.intervalMinutes));
+	return input.nowMs - input.lastRunMs >= minutes * 6e4;
+}
+/**
+* Decide which regions a scheduler tick should run.
+*
+* The FIRST sighting of an enabled region ARMS its clock instead of running it.
+* That split is the whole reason this is a function rather than an `if`:
+* {@link poolDueAt} answers "has enough time passed", which is FALSE for a
+* region that has never run — so a scheduler that only armed the clock when it
+* decided to run would never arm it at all, and the scheduled test would
+* silently never fire. Returning the clock state explicitly makes that
+* impossible to get wrong, and testable without real timers.
+*
+* A region that is switched off keeps NO clock: enabling it later must wait a
+* full interval rather than inheriting a stale timestamp and firing at once.
+*/
+function duePoolRegions(input) {
+	const due = [];
+	const next = {};
+	for (const region of input.regions) {
+		if (!input.enabledOf(region)) continue;
+		const last = input.state[region];
+		if (last === void 0) {
+			next[region] = input.nowMs;
+			continue;
+		}
+		if (!poolDueAt({
+			lastRunMs: last,
+			intervalMinutes: input.intervalMinutesOf(region),
+			nowMs: input.nowMs
+		})) {
+			next[region] = last;
+			continue;
+		}
+		next[region] = input.nowMs;
+		due.push(region);
+	}
+	return {
+		due,
+		next
+	};
+}
+/**
+* Resolve the model the pool should test against.
+*
+* A user-specified id always wins (it is a preference, not a computed default),
+* and is returned even when it is a PAID model: the card says so explicitly
+* rather than silently overriding the user's choice.
+*
+* But the choice is now VALIDATED against the region's catalog, because the
+* catalog changes: the CN roster is empty until its first refresh, and models
+* come and go. A saved id that is no longer offered used to be returned as
+* `preferred`, which let the card enable its test button and the Host run a
+* batch against a model nobody offers. It is reported as `stale` instead —
+* never silently replaced by the free model (that would test something the
+* user did not choose) and never run.
+*
+* A catalog that has not loaded yet therefore reads as `stale` for a saved id.
+* That is the safe direction: no credits are spent while the roster is unknown,
+* and the card offers to switch back to automatic.
+*/
+function resolveTargetModel(catalog, preferredId) {
+	if (preferredId !== void 0 && preferredId !== "") return catalog.some((model) => model.id === preferredId) ? {
+		modelId: preferredId,
+		source: "preferred"
+	} : {
+		staleModelId: preferredId,
+		source: "stale"
+	};
+	const free = pickFreeModel(catalog);
+	return free === void 0 ? { source: "none" } : {
+		modelId: free.id,
+		source: "free"
+	};
+}
+//#endregion
+//#region src/account-pool-store.ts
+/**
+* The account pool's RUNTIME store: measured facts, on disk, outside settings.
+*
+* 参考：本仓库 `src/auth.ts` 的插件自有文件约定（`$DSH_HOME` 下的
+*   `.workbuddy-auth.<region>.json`，`withFileLock` + `writeFileAtomic`，
+*   `mode: 0o600`）。本模块沿用同一套写入方式与同一份隐私标准。
+* 改动：存的是**观测结果**而非凭据 —— 因此文件里不含任何 token，
+*   并且它与用户设置**分开落盘**，原因见下。
+*
+* 为什么这些事实不放 settings（`regions[region].pool`）：
+*
+*   卡片对用户偏好用的是「草稿 → 保存 → 丢弃草稿」模式：保存成功会丢弃草稿。
+*   如果探测结果也住在那个槽里，用户手工点一次「保存」就会用**几分钟前的草稿**
+*   覆盖掉定时器刚写进去的结果 —— 那等于把测量结果回退，测试白做。
+*   观测数据由插件高频写入、且不是用户偏好，所以它必须落在自己的文件里。
+*
+* 本模块的读写**从不抛异常给调用方**：池是增强功能，一个损坏的观测文件绝不能让
+* 卡片或 host 启动失败 —— 最坏情况是「回到未测试」，而不是整个插件不可用。
+*
+* @module dsh-connect-workbuddy/account-pool-store
+*/
+/** On-disk format version; readers reject anything else. */
+const STORE_FORMAT_VERSION = 1;
+/** Filename prefix for one region's measured pool facts. */
+const POOL_STORE_PREFIX = ".workbuddy-pool";
+/** Whether a parsed value looks like a stored probe. */
+function isProbe(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number");
+}
+/**
+* One region's path for measured pool facts.
+*
+* Region-keyed for the same reason the credential copies are: the two regions
+* are parallel stacks and must never overwrite each other's measurements.
+*/
+function workbuddyPoolStorePath(region) {
+	return join(resolveDshHome(), `${POOL_STORE_PREFIX}.${region}.json`);
+}
+/**
+* Read one region's measured facts.
+*
+* Contains NO credentials — only outcome words and timestamps — so it is not
+* written with the credential store's stricter secrecy requirements, though it
+* still uses the same atomic-write helpers.
+*
+* Returns an empty map for a missing, unreadable, malformed, or
+* version-mismatched file: all four mean "nothing measured yet", which is a
+* valid state the pool renders as "untested".
+*/
+async function readPoolProbes(region) {
+	let raw;
+	try {
+		raw = await readFile(workbuddyPoolStorePath(region), "utf8");
+	} catch {
+		return {};
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return {};
+	}
+	if (typeof parsed !== "object" || parsed === null) return {};
+	const document = parsed;
+	if (document.version !== STORE_FORMAT_VERSION) return {};
+	if (typeof document.probes !== "object" || document.probes === null) return {};
+	const probes = {};
+	for (const [accountId, probe] of Object.entries(document.probes)) {
+		if (accountId === "" || !isProbe(probe)) continue;
+		probes[accountId] = {
+			outcome: probe.outcome,
+			atMs: probe.atMs,
+			...probe.retryAtMs === void 0 ? {} : { retryAtMs: probe.retryAtMs }
+		};
+	}
+	return probes;
+}
+/**
+* Merge measurements into one region's store and write it atomically.
+*
+* A MERGE rather than a replace, because batches measure one account at a time
+* and a partial failure must not erase what earlier runs learned. An account
+* absent from `updates` keeps its previous measurement.
+*
+* Never throws: a failed write loses only the newest measurements, and the
+* caller's results are still returned to the user. Surfacing a disk error here
+* would fail an operation that actually succeeded.
+*/
+async function writePoolProbes(region, updates) {
+	if (Object.keys(updates).length === 0) return;
+	const path = workbuddyPoolStorePath(region);
+	try {
+		await withFileLock(path, async () => {
+			const existing = await readPoolProbes(region);
+			const document = {
+				version: STORE_FORMAT_VERSION,
+				probes: {
+					...existing,
+					...updates
+				}
+			};
+			await writeFileAtomic(path, `${JSON.stringify(document, null, 2)}\n`, {
+				mode: 384,
+				dirMode: 448
+			});
+		});
+	} catch {}
+}
 //#endregion
 //#region src/status-paths.ts
 /**
@@ -727,6 +1372,28 @@ const WORKBUDDY_CHECKIN_PATH = "/plugins/dsh-connect-workbuddy/checkin";
 * browser half.
 */
 const WORKBUDDY_PROBE_PATH = "/plugins/dsh-connect-workbuddy/probe";
+/**
+* Plugin-owned account-pool endpoint: one batch action per call.
+*
+* `?action=checkin` claims the daily reward for every account of a region;
+* `?action=test` probes every account against the region's target model. Both
+* are POST and loopback-only because both cost something real — check-in writes
+* to the user's account, a probe spends credits.
+*
+* Deliberately ONE endpoint rather than two: the two actions share every
+* guard (method, origin, region, pool-enabled) and differ only in the work, so
+* splitting them would duplicate the guards and invite them to drift apart.
+*/
+const WORKBUDDY_POOL_PATH = "/plugins/dsh-connect-workbuddy/pool";
+/** Query parameter selecting which pool batch action a request means. */
+const WORKBUDDY_POOL_ACTION_PARAM = "action";
+/** Read the pool action off a request URL; unknown/absent means undefined. */
+function poolActionOf(url) {
+	const at = url.indexOf("?");
+	if (at === -1) return void 0;
+	const value = new URLSearchParams(url.slice(at + 1)).get(WORKBUDDY_POOL_ACTION_PARAM);
+	return value === "checkin" || value === "test" ? value : void 0;
+}
 /** Query parameter naming the region a card request addresses. */
 const WORKBUDDY_REGION_PARAM = "region";
 /** Every region, in card tab order. */
@@ -798,22 +1465,6 @@ function nextRegionSlots(regions, region, slot) {
 		[region]: slot
 	};
 }
-/**
-* Build the next `regions` settings value for a provider on/off toggle. ONLY
-* the target region's `enabled` flag changes: every other field of that slot
-* (its directory, selection, image opt-ins, context budgets) and every other
-* region's slot are carried over verbatim, so switching a provider off never
-* discards the user's model picks and switching it back on restores them.
-*
-* This is deliberately separate from {@link nextRegionSlots}: that helper
-* writes a whole slot from a signed-in tab's draft, while this one must work
-* for a region that is signed OUT — which is precisely the region a user wants
-* to switch off (no international install, no international account).
-*
-* `value` may be the whole settings section or the `regions` map; the RETURN
-* value is always the `regions` map, i.e. exactly what `settingsScope.set(
-* 'regions', ...)` needs.
-*/
 function nextRegionEnabled(value, region, enabled) {
 	return nextRegionSlots(regionsMapOf(value), region, {
 		...regionSlotOf(value, region),
@@ -897,14 +1548,6 @@ function json(res, status, body) {
 	});
 	res.end(payload);
 }
-/**
-* Cap on how many models one probe request may name.
-*
-* A probe is a real (if tiny) request against a metered service, and the batch
-* runs sequentially, so an unbounded list would let one click hold the route for
-* minutes. The card never sends more than the models on its own screen.
-*/
-const PROBE_BATCH_LIMIT = 64;
 /** Request-body cap for the probe route: model ids only, never content. */
 const PROBE_BODY_LIMIT = 65536;
 /**
@@ -1103,7 +1746,90 @@ async function workBuddyWebStatus(deps, region) {
 		...creditsResult.status === "fulfilled" ? { credits: toCredits(creditsResult.value) } : { creditsError: safeMessage(creditsResult.reason) },
 		...checkinResult.status === "fulfilled" ? { checkin: checkinResult.value } : { checkinError: safeMessage(checkinResult.reason) },
 		...!rejected ? {} : { credentialRejected: true },
-		...recovery === void 0 ? {} : { recovery }
+		...recovery === void 0 ? {} : { recovery },
+		...await poolSectionOf(deps, region)
+	};
+}
+/** The pool block for a status document, or nothing when it cannot be built. */
+async function poolSectionOf(deps, region) {
+	if (deps.pool === void 0) return {};
+	try {
+		const pool = await workBuddyWebPool(deps, region);
+		return pool === void 0 ? {} : { pool };
+	} catch {
+		return {};
+	}
+}
+/**
+* Assemble one region's pool state for the card.
+*
+* The ranking is computed HERE, on the Host, and shipped as an ordered,
+* annotated list. The card therefore never re-derives "who is eligible" — it
+* renders the Host's answer, so the account the user sees marked as current is
+* decided by the same rule that would actually bill.
+*
+* `current` is answered by the Host too (`currentAccountId`), not inferred from
+* the ranking, because those are different questions: the ranking says who
+* SHOULD serve, `current` says who IS serving. Marking the winner as current
+* would make the card claim a switch that may not have been applied yet.
+*/
+async function workBuddyWebPool(deps, region) {
+	const pool = deps.pool;
+	if (pool === void 0) return void 0;
+	const preferences = pool.preferences(region);
+	const members = await pool.members(region);
+	const ranked = rankPool(members, Date.now());
+	const target = resolveTargetModel(pool.catalog?.(region) ?? [], preferences.targetModelId);
+	const currentAccountId = await pool.currentAccountId?.(region);
+	const byId = new Map(members.map((member) => [member.account.id, member]));
+	const rankedIds = new Set(ranked.map((row) => row.account.id));
+	const others = await pool.otherAccounts?.(region) ?? [];
+	const rotatedTo = await pool.rotatedToAccountId?.(region).catch(() => void 0);
+	const checkedIn = await pool.checkedInToday?.(region).catch(() => ({})) ?? {};
+	const accounts = [...ranked.map((row) => ({
+		account: row.account,
+		member: true,
+		ranked: row
+	})), ...others.filter((account) => !rankedIds.has(account.id)).map((account) => ({
+		account,
+		member: false
+	}))].map(({ account, member, ranked: row }) => {
+		const measured = byId.get(account.id);
+		return {
+			accountId: account.id,
+			accountName: account.accountName,
+			...measured?.credits === void 0 ? {} : {
+				credits: measured.credits.total,
+				expiringSoon: measured.credits.expiringSoon,
+				...measured.credits.nearestExpiryMs === void 0 ? {} : { nearestExpiryMs: measured.credits.nearestExpiryMs }
+			},
+			...measured?.probe === void 0 ? {} : { probe: {
+				outcome: measured.probe.outcome,
+				atMs: measured.probe.atMs,
+				...measured.probe.retryAtMs === void 0 ? {} : { retryAtMs: measured.probe.retryAtMs }
+			} },
+			...row?.excludedBy === void 0 ? {} : { excludedBy: row.excludedBy },
+			current: account.id === currentAccountId,
+			member,
+			...checkedIn[account.id] === void 0 ? {} : { checkedInToday: checkedIn[account.id] }
+		};
+	});
+	return {
+		enabled: preferences.enabled,
+		rotateByCredits: preferences.rotateByCredits,
+		autoTestIntervalMinutes: preferences.autoTestIntervalMinutes,
+		...target.modelId === void 0 ? {} : { targetModelId: target.modelId },
+		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
+		targetModelSource: target.source,
+		memberAccountIds: preferences.memberAccountIds,
+		effectiveMemberAccountIds: effectiveMembersOf(accounts.map((account) => account.accountId), new Set(preferences.memberAccountIds)),
+		...rotatedTo === void 0 ? {} : { rotatedToAccountId: rotatedTo },
+		accounts,
+		catalog: deps.displayModels(region).map((model) => ({
+			id: model.id,
+			name: model.name,
+			...model.creditMultiplier === void 0 ? {} : { creditMultiplier: model.creditMultiplier }
+		}))
 	};
 }
 /**
@@ -1218,7 +1944,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 					const body = await readJsonBody(req);
 					const modelIds = Array.isArray(body.modelIds) ? body.modelIds.filter((id) => typeof id === "string" && id !== "") : [];
 					if (modelIds.length === 0) return json(res, 400, { error: "modelIds must be a non-empty array of strings" });
-					if (modelIds.length > PROBE_BATCH_LIMIT) return json(res, 400, { error: `at most ${String(PROBE_BATCH_LIMIT)} models per probe` });
+					if (modelIds.length > 1) return json(res, 400, { error: "a probe accepts exactly one model" });
 					const results = [];
 					for (const modelId of modelIds) results.push(...await deps.probeModels(region, [modelId]));
 					json(res, 200, { results });
@@ -1227,6 +1953,70 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 				}
 			}
 		});
+		const disposePool = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_POOL_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				const region = requestRegion(req, res);
+				if (region === void 0) return;
+				const action = poolActionOf(req.url ?? "/");
+				if (action === void 0) return json(res, 400, { error: "action must be checkin or test" });
+				const pool = deps.pool;
+				if (pool === void 0) return json(res, 503, {
+					reason: "pool-unavailable",
+					error: "account pool unavailable"
+				});
+				try {
+					if (!pool.preferences(region).enabled) return json(res, 409, {
+						reason: "pool-disabled",
+						error: "account pool is disabled for this region"
+					});
+					const savedMembers = pool.preferences(region).memberAccountIds;
+					if ((await pool.effectiveMemberAccountIds?.(region).catch(() => void 0) ?? savedMembers).length === 0) {
+						const noneChecked = savedMembers.length === 0;
+						return json(res, 409, {
+							reason: noneChecked ? "no-members" : "no-live-members",
+							error: noneChecked ? "no accounts are checked into this region's pool" : "no checked account still has a local sign-in"
+						});
+					}
+					if (action === "checkin") {
+						if (pool.checkin === void 0) return json(res, 503, {
+							reason: "pool-unavailable",
+							error: "pool check-in unavailable"
+						});
+						return json(res, 200, {
+							action: "checkin",
+							rows: await pool.checkin(region)
+						});
+					}
+					if (pool.test === void 0) return json(res, 503, {
+						reason: "pool-unavailable",
+						error: "pool test unavailable"
+					});
+					const target = resolveTargetModel(pool.catalog?.(region) ?? [], pool.preferences(region).targetModelId);
+					if (target.modelId === void 0) return json(res, 409, {
+						action: "test",
+						modelId: void 0,
+						rows: [],
+						reason: target.source === "stale" ? "target-model-stale" : "no-free-model",
+						error: target.source === "stale" ? "the saved target model is no longer offered by this region; pick another or switch back to automatic" : "no zero-multiplier model in this region; refresh the catalog or set a target model"
+					});
+					const rows = await pool.test(region, target.modelId);
+					return json(res, 200, {
+						action: "test",
+						modelId: target.modelId,
+						rows
+					});
+				} catch (error) {
+					json(res, 500, {
+						reason: "pool-failed",
+						error: safeMessage(error)
+					});
+				}
+			}
+		});
 		const disposeDiagWrite = ctx.webServer.register({
 			kind: "exact",
 			path: "/plugins/dsh-connect-workbuddy/__save",
@@ -1283,6 +2073,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 			disposeAccounts();
 			disposeUsage();
 			disposeProbe();
+			disposePool();
 			disposeDiagWrite();
 		};
 	}, "dsh-connect-workbuddy: Web status route");
@@ -1375,12 +2166,29 @@ const modelConfig = z.object({
 	contextWindow: z.number().step(1).min(1),
 	maxTokens: z.number().step(1).min(1)
 });
+/**
+* One region's account-pool PREFERENCES.
+*
+* Only user choices live here. The pool's MEASURED facts (probe outcomes,
+* cooldowns, the account currently billed) are deliberately NOT part of this
+* schema — see `src/account-pool-store.ts`. The card saves preferences with a
+* draft-and-discard write, so storing measurements in the same slot would let
+* one "Save" press overwrite results the timer had just written.
+*/
+const poolConfig = z.object({
+	enabled: z.boolean().default(false).description("Whether the account pool is active for this region (opt-in)"),
+	rotateByCredits: z.boolean().default(false).description("Whether the plugin may switch the billed account by credits (opt-in; disables manual selection)"),
+	autoTestIntervalMinutes: z.number().step(1).min(5).max(1440).default(30).description("Minutes between automatic pool tests (5..1440)"),
+	targetModelId: z.string().default("").description("Model id to test; empty means pick a zero-multiplier model from this region's catalog"),
+	memberAccountIds: z.array(z.string()).default([]).description("Account ids checked into this pool (opt-in; empty means the pool covers nothing)")
+});
 const regionStateConfig = z.object({
 	enabled: z.boolean().default(true).description("Whether this region's provider is offered to DSH (opt-out; false withdraws it entirely)"),
 	lastCatalog: z.array(modelConfig).default([]),
 	enabledModelIds: z.array(z.string()).default([]),
 	imageModelIds: z.array(z.string()).default([]),
-	contextBudgets: z.dict(z.number().step(1).min(1)).default({})
+	contextBudgets: z.dict(z.number().step(1).min(1)).default({}),
+	pool: poolConfig.default({})
 });
 const accountSelectionConfig = z.object({
 	cn: z.string().description("Selected domestic (CN) account id (never a token)"),
@@ -1541,6 +2349,31 @@ async function legacyAttributionRegion(value, accountsFor) {
 */
 function apply(ctx, config) {
 	const client = new WorkBuddyUpstreamClient();
+	/**
+	* How long a check-in reading is reused before asking the upstream again.
+	*
+	* The card polls the usage route every 60 seconds, but "did this account
+	* check in today" changes only when a check-in runs or the day rolls over.
+	* Without a cache, a 10-account pool cost ~14,400 upstream requests a day for
+	* an answer that was almost always identical.
+	*/
+	const CHECKIN_CACHE_MS = 6e5;
+	/**
+	* Per-region, per-account check-in readings.
+	*
+	* Invalidated by this plugin's own check-in batch (the only writer that can
+	* change the answer during a session), so the user sees their result
+	* immediately instead of waiting out the TTL.
+	*/
+	const checkinStateCache = {};
+	/**
+	* Latest-wins guard for `applyRotation`, keyed by region.
+	*
+	* Declared here (near the top of `apply`) rather than beside `applyRotation`
+	* itself: that function is CALLED from the startup path above its definition,
+	* so a `const` declared down there would be in its temporal dead zone.
+	*/
+	const rotationGuard = createLatestWins();
 	const settingsNs = settingsNamespaceOf(ctx);
 	const stacks = {};
 	for (const region of REGION_KEYS) {
@@ -1687,7 +2520,7 @@ function apply(ctx, config) {
 		* out-of-credit result. Every other limited outcome has no time anywhere, and
 		* the probe reports exactly that instead of inventing one.
 		*/
-		async probeModels(region, modelIds, signal) {
+		async probeModels(region, modelIds, options) {
 			let credential;
 			try {
 				credential = await stacks[region].store.resolve();
@@ -1706,12 +2539,112 @@ function apply(ctx, config) {
 				modelId,
 				nowMs: Date.now(),
 				...quotaRefreshAtMs === void 0 ? {} : { quotaRefreshAtMs },
-				...signal === void 0 ? {} : { signal }
+				...options?.signal === void 0 ? {} : { signal: options.signal }
 			}));
 			return results;
 		},
 		regionUsable(region, usable) {
 			if (stacks[region].catalog.setRegionUsable(usable)) invalidateCatalog();
+		},
+		/**
+		* The account pool, resolved per region.
+		*
+		* Region-scoped throughout: the CN and international pools are separate
+		* stacks of accounts, so one region's pool can never rank or bill the
+		* other's accounts.
+		*
+		* `rotateByCredits` is consumed HERE, by the credential store's selection
+		* hook, rather than by writing `config.accounts[region]`. That separation
+		* is the whole reason "turn rotation off" cleanly restores the user's own
+		* choice: rotation decides who serves at runtime and never overwrites the
+		* record of what the user picked.
+		*/
+		pool: {
+			preferences: (region) => poolPreferencesOf(current(), region),
+			members: (region) => poolMembersOf(region),
+			/**
+			* The checked accounts that resolve to a local sign-in.
+			*
+			* A local scan only — no upstream calls — so the route's empty-pool guard
+			* can use it on every batch. {@link poolMembersOf} is the expensive one
+			* (it fetches credits per account) and is not suitable there.
+			*/
+			effectiveMemberAccountIds: async (region) => {
+				const saved = poolPreferencesOf(current(), region).memberAccountIds;
+				if (saved.length === 0) return [];
+				const accounts = await stacks[region].store.accounts();
+				return effectiveMembersOf(saved, new Set(accounts.map((account) => account.id)));
+			},
+			/**
+			* Local sign-ins the pool does NOT cover.
+			*
+			* Sent so the card can offer them to check in. Membership is an explicit
+			* opt-in, and a user cannot opt in to an account the card never shows.
+			*/
+			async otherAccounts(region) {
+				const wanted = new Set(poolPreferencesOf(current(), region).memberAccountIds);
+				return (await stacks[region].store.accounts()).filter((account) => !wanted.has(account.id)).map((account) => ({
+					id: account.id,
+					accountName: account.accountName
+				}));
+			},
+			/**
+			* Today's check-in state per account, for the pool table.
+			*
+			* Read per account through `credentialFor` (never `resolve`), so asking
+			* about an account cannot change which one is billing. A per-account
+			* failure is simply omitted, which the card renders as unknown.
+			*/
+			async checkedInToday(region) {
+				if (!poolPreferencesOf(current(), region).enabled) return {};
+				const store = stacks[region].store;
+				const accounts = await store.accounts();
+				const now = Date.now();
+				const entries = await Promise.all(accounts.map(async (account) => {
+					const cached = checkinStateCache[region]?.[account.id];
+					if (cached !== void 0 && now - cached.atMs < CHECKIN_CACHE_MS) return [account.id, cached.checkedIn];
+					const credential = await store.credentialFor(account.id).catch(() => void 0);
+					if (credential === void 0) return void 0;
+					const status = await client.fetchCheckinStatus(credential).catch(() => void 0);
+					if (status === void 0) return void 0;
+					checkinStateCache[region] = {
+						...checkinStateCache[region],
+						[account.id]: {
+							checkedIn: status.todayCheckedIn,
+							atMs: now
+						}
+					};
+					return [account.id, status.todayCheckedIn];
+				}));
+				return Object.fromEntries(entries.filter((entry) => entry !== void 0));
+			},
+			/**
+			* The account rotation last moved to, read from the store's runtime
+			* override. Absent means rotation is not currently redirecting billing.
+			*/
+			async rotatedToAccountId(region) {
+				return stacks[region].store.rotatedAccount();
+			},
+			async currentAccountId(region) {
+				const credential = await stacks[region].store.current().catch(() => void 0);
+				return credential === void 0 ? void 0 : workbuddyAccountId(credential);
+			},
+			checkin: async (region) => {
+				const rows = await checkinAllAccounts(await poolTargets(region), poolRunnerDeps(region));
+				for (const row of rows) {
+					if (row.status === "failed") continue;
+					const cached = checkinStateCache[region];
+					if (cached !== void 0) delete cached[row.accountId];
+				}
+				return rows;
+			},
+			test: async (region, modelId) => {
+				const rows = await testAllAccounts(await poolTargets(region), modelId, poolRunnerDeps(region));
+				await writePoolProbes(region, probeUpdatesOf(rows));
+				await applyRotation(region);
+				return rows;
+			},
+			catalog: (region) => displayModels(current(), region)
 		}
 	}));
 	/**
@@ -1731,14 +2664,142 @@ function apply(ctx, config) {
 			return;
 		}
 	};
+	/**
+	* Apply the pool's rotation to one region's store.
+	*
+	* The store's runtime override is set only when rotation is switched ON and a
+	* usable account exists; otherwise it is CLEARED, which restores the user's
+	* own selection immediately. Clearing on every non-rotating path is what
+	* makes "turn rotation off" complete rather than leaving a stale override
+	* billing under a switch that reads as off.
+	*
+	* Never writes settings: the user's saved choice is untouched throughout.
+	*/
+	const applyRotation = async (region) => {
+		const store = stacks[region].store;
+		const stale = rotationGuard.begin(region);
+		const preferences = poolPreferencesOf(current(), region);
+		if (!preferences.enabled || !preferences.rotateByCredits) {
+			store.setRotatedAccount(void 0);
+			return;
+		}
+		const members = await poolMembersOf(region);
+		if (stale()) return;
+		const picked = pickAccount(members, Date.now());
+		const latest = poolPreferencesOf(current(), region);
+		if (!latest.enabled || !latest.rotateByCredits) {
+			store.setRotatedAccount(void 0);
+			return;
+		}
+		store.setRotatedAccount(picked?.id);
+	};
+	/**
+	* One region's POOL members, each with its credits and last measurement.
+	*
+	* Only CHECKED accounts: an unchecked account is not a candidate to bill, so
+	* it must not reach the ranking that decides who serves.
+	*
+	* Read through `credentialFor()` — never `resolve()` — so no account's
+	* selection state is touched: a batch must measure every member without
+	* changing which one is billing. Credits are fetched per account and a
+	* failure degrades to "unknown" for that row only — one unreadable balance
+	* must not blank the whole pool.
+	*/
+	async function poolMembersOf(region) {
+		const store = stacks[region].store;
+		const accounts = await poolMemberAccounts(region);
+		const probes = await readPoolProbes(region);
+		return await Promise.all(accounts.map(async (account) => {
+			const credential = await store.credentialFor(account.id).catch(() => void 0);
+			const credits = credential === void 0 ? void 0 : await client.fetchCredits(credential).catch(() => void 0);
+			return {
+				account: {
+					id: account.id,
+					accountName: account.accountName
+				},
+				...credits === void 0 ? {} : { credits: {
+					total: credits.total,
+					expiringSoon: credits.expiringSoon,
+					...credits.nearestExpiryMs === void 0 ? {} : { nearestExpiryMs: credits.nearestExpiryMs }
+				} },
+				...probes[account.id] === void 0 ? {} : { probe: probes[account.id] },
+				tokenExpiresAtMs: account.tokenExpiresAtMs
+			};
+		}));
+	}
+	/** One region's pool preferences, with the schema's defaults applied. */
+	const poolPreferencesOf = (config, region) => {
+		const pool = regionStateOf(config, region).pool;
+		return {
+			enabled: pool?.enabled === true,
+			rotateByCredits: pool?.rotateByCredits === true,
+			autoTestIntervalMinutes: pool?.autoTestIntervalMinutes ?? 30,
+			targetModelId: pool?.targetModelId ?? "",
+			memberAccountIds: pool?.memberAccountIds ?? []
+		};
+	};
+	/**
+	* The accounts the user has checked into this region's pool.
+	*
+	* Membership is an EXPLICIT opt-in list, not "every local sign-in": the two
+	* batch actions spend real credits and claim real rewards, so which accounts
+	* they touch has to be the user's decision rather than a side effect of
+	* having signed in on this machine. An account that is not checked is
+	* untouched by check-in, testing, and rotation alike.
+	*/
+	async function poolMemberAccounts(region) {
+		const saved = poolPreferencesOf(current(), region).memberAccountIds;
+		if (saved.length === 0) return [];
+		const accounts = await stacks[region].store.accounts();
+		const byId = new Map(accounts.map((account) => [account.id, account]));
+		return effectiveMembersOf(accounts.map((account) => account.id), new Set(saved)).flatMap((id) => {
+			const account = byId.get(id);
+			return account === void 0 ? [] : [account];
+		});
+	}
+	/** The batch runner's view of one region's pool members. */
+	async function poolTargets(region) {
+		return (await poolMemberAccounts(region)).map((account) => ({
+			accountId: account.id,
+			accountName: account.accountName
+		}));
+	}
+	/**
+	* The two actions' shared dependency set.
+	*
+	* `credentialFor` — never `resolve()` — is what makes a batch possible at
+	* all: it fetches any account's credential WITHOUT changing the region's
+	* selection, so testing every account cannot switch the account that bills
+	* the user's live traffic.
+	*/
+	function poolRunnerDeps(region) {
+		const store = stacks[region].store;
+		return {
+			credentialFor: (accountId) => store.credentialFor(accountId),
+			fetchCheckinStatus: (credential) => client.fetchCheckinStatus(credential),
+			claimDailyCheckin: (credential) => client.claimDailyCheckin(credential),
+			probe: async (credential, modelId) => {
+				const quotaRefreshAtMs = await quotaRefreshOf(region, credential);
+				return probeModel({
+					client,
+					credential,
+					modelId,
+					nowMs: Date.now(),
+					...quotaRefreshAtMs === void 0 ? {} : { quotaRefreshAtMs }
+				});
+			}
+		};
+	}
 	ctx.inject(["settings"], (sctx) => {
 		const settings = sctx.settings;
 		ctx.effect(() => settings.configure({ auto: true }, ctx.fiber));
 	});
 	ctx.on("loader/volatile-update", () => {
 		applySelection(current());
+		for (const region of REGION_KEYS) applyRotation(region).catch(() => {});
 	});
 	applySelection(config);
+	for (const region of REGION_KEYS) applyRotation(region).catch(() => {});
 	(async () => {
 		try {
 			const region = await legacyAttributionRegion(current(), async (candidate) => stacks[candidate].store.accounts());
@@ -1748,6 +2809,85 @@ function apply(ctx, config) {
 		} catch {}
 	})();
 	let stopped = false;
+	/**
+	* When each region's automatic test last ran, in epoch ms.
+	*
+	* In-memory only, and deliberately NOT persisted: it exists to space out
+	* runs within one session. Persisting it would make a restart skip a test the
+	* user was owed, and losing it only costs one interval.
+	*/
+	const poolLastRunMs = {};
+	/**
+	* The pool scheduler: ONE heartbeat for both regions.
+	*
+	* A single timer rather than one per region, because the tick does no network
+	* work of its own — it reads the config, compares timestamps, and only then
+	* runs a batch. That also means a settings change needs no re-arming: the next
+	* tick reads whatever interval is now saved.
+	*
+	* This is what makes the "自动测试间隔" setting real. Before it existed the
+	* interval was stored and never consumed, so the card promised a behaviour the
+	* plugin did not have.
+	*/
+	ctx.effect(() => {
+		const timer = setInterval(() => {
+			(async () => {
+				if (stopped) return;
+				const schedule = duePoolRegions({
+					state: poolLastRunMs,
+					regions: REGION_KEYS,
+					enabledOf: (region) => poolPreferencesOf(current(), region).enabled && regionEnabled(current(), region),
+					intervalMinutesOf: (region) => poolPreferencesOf(current(), region).autoTestIntervalMinutes,
+					nowMs: Date.now()
+				});
+				for (const region of REGION_KEYS) {
+					const next = schedule.next[region];
+					if (next === void 0) delete poolLastRunMs[region];
+					else poolLastRunMs[region] = next;
+				}
+				for (const region of schedule.due) await runScheduledPoolTest(region).catch(() => {});
+			})();
+		}, POOL_TICK_MS);
+		return () => {
+			clearInterval(timer);
+		};
+	}, "dsh-connect-workbuddy: account pool scheduler");
+	/**
+	* One scheduled pass for a region: test the pool's members, then re-rank.
+	*
+	* Never bills a paid model on a timer: the target is the user's saved model
+	* when it resolves, and the region's FREE model when the saved one has left
+	* the catalog. An unresolvable target with no free model available stops the
+	* pass — the free-target rule is what stops a timer from spending credits.
+	*
+	* The free FALLBACK for a stale saved model is D3's fix, not a convenience.
+	* The scheduler's job is to keep MEASUREMENTS fresh, and a measurement is
+	* what keeps rotation off a dead account. It used to return early whenever
+	* `resolveTargetModel` produced no id — which is exactly what a saved model
+	* that left the catalog produces — so a stale *display preference* froze the
+	* measurement loop for the whole region. The two exclusions then behaved
+	* asymmetrically: a `rate-limited` member clears by the clock alone
+	* (`exclusionOf` consults `retryAtMs`), while an `unavailable` member can
+	* only be cleared by a NEW probe — and no probe was ever written. The member
+	* hung in the pool's "excluded" state indefinitely, until the user noticed
+	* the stale model and fixed it by hand.
+	*
+	* The manual batch route keeps refusing a stale target (`reason:
+	* 'target-model-stale'`): there the user asked to test THAT model, so
+	* substituting another one would answer a question they did not ask. Here
+	* nobody asked for anything; the pass exists to refresh the pool's own
+	* picture, so it must not be starved by a configuration error it can work
+	* around without spending anything.
+	*/
+	async function runScheduledPoolTest(region) {
+		const targets = await poolTargets(region);
+		if (targets.length === 0) return;
+		const catalog = displayModels(current(), region);
+		const modelId = resolveTargetModel(catalog, poolPreferencesOf(current(), region).targetModelId).modelId ?? pickFreeModel(catalog)?.id;
+		if (modelId === void 0) return;
+		await writePoolProbes(region, probeUpdatesOf(await testAllAccounts(targets, modelId, poolRunnerDeps(region))));
+		await applyRotation(region);
+	}
 	ctx.effect(() => () => {
 		stopped = true;
 		for (const region of REGION_KEYS) stacks[region].shim.close();
@@ -1847,4 +2987,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, PROBE_USER_PROMPT, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };
+export { CREDENTIAL_REJECTED_CODE, Config, ENCRYPTED_CREDENTIAL_CODE, FALLBACK_WORKBUDDY_MODELS, FALLBACK_WORKBUDDY_MODELS_GLOBAL, NATIVE_MODALITY_BY_MODEL_ID, PROBE_INPUT_TOKENS, PROBE_MAX_TOKENS, PROBE_SYSTEM_PROMPT, WORKBUDDY_ACCOUNTS_REFRESH_PATH, WORKBUDDY_APP_EXECUTABLE_ENV, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_CHECKIN_PATH, WORKBUDDY_CONNECT_VERSION, WORKBUDDY_GLOBAL_PROVIDER, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_MODELS_REFRESH_PATH, WORKBUDDY_PROBE_PATH, WORKBUDDY_PROVIDER, WORKBUDDY_PROVIDERS, WORKBUDDY_PROVIDER_DISPLAY_NAMES, WORKBUDDY_REGIONS, WORKBUDDY_REGION_PARAM, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WORKBUDDY_USAGE_PATH, WorkBuddyCatalog, WorkBuddyCredentialRejectedError, WorkBuddyCredentialStore, WorkBuddyEncryptedCredentialError, WorkBuddyUpstreamClient, apply, asVolatile, authFileName, classifyUpstreamError, clearAtRestKeyCache, clearHostHeartbeat, cooldownOf, createAccountUsabilityProbe, createWorkBuddyAdapter, createWorkBuddyShim, creditOfStream, defaultDesktopAuthCandidates, defaultDesktopAuthDirs, defaultDesktopAuthPath, deriveAtRestKey, deriveAtRestKeyId, deriveCatalog, fallbackModelsFor, fetchAtRestKeyPayload, findWorkbuddyAppExecutable, hasEncryptedCredentialFields, imageDefaultFor, inject, isCredentialRejectedError, isEncryptedCredentialError, isEncryptedFieldWrapper, isHeartbeatProcessAlive, isWorkbuddyBundle, legacyAttributionRegion, legacyWorkbuddyOwnAuthPath, macosBundleExecutable, macosNestedAppBundles, name, nativeModalityOf, nextRegionEnabled, nextRegionSlots, openEncryptedField, outcomeOfFailure, parseCreditMultiplier, parseReasoning, parseRetryAfter, parseUpstreamModel, parseWorkBuddyAuth, prepareChatBody, probeModel, probeRequestBody, probeSucceeded, processStartTimeMs, readAtRestKey, readHostHeartbeat, regionCleared, regionEnabled, regionEnabledOf, regionOf, regionOfProvider, regionOfStatusUrl, regionStateOf, registerWorkBuddyStatusRoute, resolveCredentialRecovery, selectAccountFor, settingsNamespaceOf, toPersistedWorkBuddyModel, unwrapVolatileDeep, withWorkBuddyRegion, workBuddyDisplayName, workBuddyModelInput, workBuddyThinkingLevelMap, workBuddyWebStatus, workbuddyAccountId, workbuddyAppExecutableCandidates, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath, writeHostHeartbeat };