dsh-workbuddy-xdpool 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -4,6 +4,48 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 0.4.0 (2026-09-16)
+
+本次更新来自两条用户反馈与一次上游兼容性对齐：账号现在可以**按顺序逐个用尽**（不再平均分摊），积分包**逐条显示具体到期时刻**，并修掉了一处会让所有接口返回 401 的凭据选择缺陷。
+
+### 新增
+
+- **账号使用方式可切换（优先 / 轮换）**：卡片状态行下方新增开关，默认**优先模式**。
+
+  - **优先模式**：始终由同一个账号服务，直到它被限流才顺延到下一个；冷却结束后它**立刻回到队首**接管 —— 该账号的积分在冷却期间并未被消耗，所以无需从头排队。
+  - **轮换模式**：保留原来的平均分摊行为，供希望把额度摊平到各账号的用户选择。
+  - 切换**即时生效**并写入插件设置，**对所有账号、所有切换状态通用**，不需要重启宿主。
+  - 优先级顺序是确定性的：桌面 App 当前登录的账号 → 上游签发时间较新者 → 存储过期时间较晚者。此前顺序取决于文件名字典序，实际会出现 `0, 2, 1` 这类非预期排列。
+
+- **积分包逐条显示到期时刻**：原先只给出「3 天内到期」的合计数，看不到具体时间；现在每个积分包单独标注它的到期时刻（精确到分钟，例如「到期 09/19 15:36」），3 天内到期的以琥珀色高亮。月度周期套餐显示下次刷新时刻（「刷新 10/01 00:00」）。
+
+  - 之所以精确到分钟而不是只给日期：上游发放一次性礼包的到期时刻是**任意的钟点**，并非「过 0 点即失效」，只显示日期会让人误判。
+
+### 布局
+
+- **积分包列表改为两行网格**：包名与数量在首行左右分栏，到期时刻在次行跨栏并与包名左对齐。此前到期时刻被挤到第二行且从容器左边缘起排，列表看起来参差不齐。
+
+### 修复
+
+- **同一账号存在多个凭据文件时会选中已失效的那一个，导致积分 / 签到 / 模型全部返回 401**。此前按**存储的 `expiresAt` 最大**来挑选凭据，但 `expiresAt` 描述的是「签发时有效期有多长」，**不代表上游仍然接受** —— 上游吊销 token 时不会同步改写该字段，于是一个早已失效的备份可以声称比真实可用的文件**更晚过期**，从而被长期选中。
+
+  - 现改用 **`auth.lastRefreshTime`（上游自己的签发时间）** 作为新鲜度判据，并在解析凭据时读入该字段。排序优先级：① 桌面 App 当前登录的 live 文件 → ② 签发时间较新者 → ③ 存储过期时间（仅作为文档缺少签发时间时的回退，保证比较是全序的）。
+
+- **国际版登录域名识别不全**：参考桌面客户端自身的国际域名清单（`workbuddy.ai`、`workbuddy.cc`），并补充 CodeBuddy CLI 使用的 `codebuddy.ai`。此前只识别 `workbuddy.ai`，落在其他拼写上的国际账号会被误判为国内版，token 被发往国内网关而在 openresty 层被拒绝。
+
+- **国际网关写死单一域名**：国际版账号按品牌域名区分且**互不通用**（在 `codebuddy.ai` 签发的 token 会被 `workbuddy.ai` 网关拒绝，反之亦然），因此网关地址改为**跟随凭据自身的域**，未识别的域名回落至桌面端网关。chat / billing / referer / 模型目录四处一并生效。
+
+- **上游以 HTML 页面拒绝凭据时给出可执行提示**：识别 openresty / APISIX 的鉴权拒绝（401/403 且响应体是 HTML），改为提示「凭据已被上游网关拒绝，通常说明用的是旧登录留下的失效凭据；请重新登录 WorkBuddy 桌面端后在卡片中选择该账号」，不再原样抛出 HTML 片段。非鉴权类的非 JSON 响应保持原有的通用提示。
+
+- **部分模型不显示思考档位**：上游部分模型的推理元数据使用**单数形式**（`effort` 而非 `supportedEfforts`），此前该形态会被直接丢弃。现将其规范化为插件已理解的复数形状，并携带声明的档位到 `defaultEffort`。
+
+### 测试
+
+- 新增 `tests/pool-priority.test.ts`（10 例）：优先模式下连续请求命中同一账号、仅在该账号冷却后顺延、冷却结束后回归队首、按模型冷却不影响其他模型；轮换模式的轮转与运行时切换；凭据新鲜度的四类排序（live 优先、签发时间优先、缺失签发时间时回退过期时间、秒/毫秒单位归一化）。
+- 修正 `tests/failover.test.ts` 中依赖轮转顺序的限流桩：改为按**已出现的不同凭据数**计次，不再假设「token 序号即账号位置」，因此与账号排序解耦。
+- 全套 **36 个测试通过**。
+
+
 ## 0.3.0 (2026-09-16)
 
 本次更新把卡片界面按参考插件的形态重做了一遍，并补齐了国内版 / 国际版的完整分离。

package/README.en.md

@@ -15,11 +15,11 @@ Merge **every WorkBuddy account** you have ever signed into on this machine into
 
 **Settings card (Settings → Plugins → DSH WorkBuddy XD Pool)**
 
-![WorkBuddy pool settings card: pool health, per-account panels, credit packages, totals](assets/settings-card.png)
+![WorkBuddy pool settings card: domestic/international tab strip, pool health, per-account panels, credit packages and totals, per-account daily check-in, and model management (enable, image input, context window)](assets/settings-card.png)
 
-**Model picker (rate multiplier baked into model.name; DSH 0.1.2 composer only reads name)**
+**Model picker (domestic and international appear as two separate supplier groups; the rate multiplier is baked into model.name because the DSH 0.1.2 composer only reads name)**
 
-![Model picker shows the rate and promo badge next to each model name](assets/model-picker.png)
+![Model picker: the domestic and international suppliers each form their own group, with the credit rate and promo badge shown next to every model name](assets/model-picker.png)
 
 **Domestic / international dual suppliers (each with its own accounts, credits and models, usable at the same time)**
 

package/README.md

@@ -15,11 +15,11 @@
 
 **插件配置卡片（设置 → 插件 → DSH WorkBuddy XD Pool）**
 
-![WorkBuddy 池设置卡片：池健康状态、账号面板、积分包、合计](assets/settings-card.png)
+![WorkBuddy 池设置卡片：国内版 / 国际版切换栏、池健康状态、账号面板、积分包与合计、每账号每日签到、模型管理（启用勾选 / 图片输入 / 上下文窗口）](assets/settings-card.png)
 
-**模型选择器（倍率直接拼进 model.name：DSH 0.1.2 composer 只读 name）**
+**模型选择器（国内版 / 国际版 两个独立供应商分组；倍率直接拼进 model.name：DSH 0.1.2 composer 只读 name）**
 
-![模型选择器每个模型名后显示倍率与促销标签](assets/model-picker.png)
+![模型选择器：国内版与国际版各占一个分组，每个模型名后显示积分倍率与促销标签](assets/model-picker.png)
 
 **国内版 / 国际版 双供应商（各自独立账号、积分与模型，可同时使用）**
 

package/lib/bin.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { copyFile, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
-import { join, resolve } from "node:path";
+import { basename, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import "@earendil-works/pi-ai";
 import "@earendil-works/pi-ai/api/openai-completions.lazy";
@@ -38,20 +38,47 @@ const HARD_CREDIT_MARKERS = [
 ];
 /** Session-invalidation markers that mean "sign in again in the WorkBuddy app". */
 const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
+/**
+* Hosts the international product answers on, once each has been stripped of a
+* leading label. The WorkBuddy AI desktop app signs in at `workbuddy.ai` (and
+* the desktop client itself lists `workbuddy.cc` alongside it); the CodeBuddy
+* CLI signs the same international account in at `codebuddy.ai`. All are served
+* by one gateway stack, so all are `global` — missing a spelling sends those
+* tokens to the CN gateway, which rejects them at the openresty layer with an
+* HTML 401 instead of a business JSON error.
+*/
+const GLOBAL_HOSTS = [
+	"workbuddy.ai",
+	"workbuddy.cc",
+	"codebuddy.ai"
+];
+/** Region for a login domain; an empty domain means CN (matching upstream tooling). */
 function regionOf(domain) {
 	const lowered = domain.trim().toLowerCase();
-	if (lowered.endsWith(".workbuddy.ai") || lowered.endsWith(".workbuddy.cc")) return "global";
-	if (lowered === "workbuddy.ai" || lowered === "workbuddy.cc") return "global";
+	for (const host of GLOBAL_HOSTS) if (lowered === host || lowered.endsWith(`.${host}`)) return "global";
 	return "cn";
 }
+/**
+* Gateway for a global credential.
+*
+* International accounts are NOT interchangeable across brand domains: a token
+* issued at `codebuddy.ai` is rejected by the `workbuddy.ai` gateway and vice
+* versa, so the base must follow the credential's own domain rather than one
+* hardcoded host. Anything unrecognised falls back to the desktop app's gateway.
+*/
+function globalBase(credential) {
+	const lowered = credential.domain.trim().toLowerCase();
+	if (lowered === "codebuddy.ai" || lowered.endsWith(".codebuddy.ai")) return "https://www.codebuddy.ai";
+	return GLOBAL_BASE;
+}
 function chatBase(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_CHAT_BASE;
+	return regionOf(credential.domain) === "global" ? globalBase(credential) : CN_CHAT_BASE;
 }
 function billingBase(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_BILLING_BASE;
+	return regionOf(credential.domain) === "global" ? globalBase(credential) : CN_BILLING_BASE;
 }
 function originReferer(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_BILLING_BASE;
+	return regionOf(credential.domain) === "global" ? globalBase(credential) : CN_BILLING_BASE;
 }
 /** Headers every upstream request shares. */
 function commonHeaders(credential) {
@@ -100,8 +127,23 @@ function billingHeaders(credential) {
 	if (credential.domain !== "") headers["X-Domain"] = credential.domain;
 	return headers;
 }
+/**
+* Gateway denials that arrive as an HTML page rather than a JSON envelope.
+*
+* openresty / APISIX reject a request before it reaches the product when the
+* credential is one the gateway no longer honours — most often a stale sign-in
+* left in the auth directory. The status alone (401) is not actionable and the
+* HTML body leaks nothing useful, so this turns it into a sentence the user can
+* act on.
+*/
+function isGatewayHtmlRejection(status, text) {
+	if (status !== 401 && status !== 403) return false;
+	const head = text.slice(0, 512).toLowerCase();
+	return head.includes("<html") || head.includes("openresty") || head.includes("apisix");
+}
 async function readEnvelope(response) {
 	const text = await response.text();
+	if (isGatewayHtmlRejection(response.status, text)) throw new Error("the WorkBuddy gateway rejected this credential (http 401). This usually means the account is using a stale sign-in the upstream no longer accepts: sign in again in the WorkBuddy desktop app, then pick the account on the plugin card. Run `dsh-workbuddy-xdpool doctor` to list every credential found.");
 	let parsed;
 	try {
 		parsed = JSON.parse(text);
@@ -146,12 +188,57 @@ function parseCreditMultiplier(value) {
 	return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
 }
 /** Parse the upstream's `reasoning` object; unknown shapes degrade to `{}`. */
+/**
+* The effort ladder the upstream's plural-form payloads declare across both
+* gateways (the live union of every `supportedEfforts` list seen; `minimal` has
+* never appeared). Both gateways also accept every level of it on
+* singular-form models — medium/xhigh fold into high, low/max answer with their
+* own budgets — so a singular `effort` value is a DEFAULT, never the model's
+* only level.
+*/
+const SINGULAR_EFFORT_LADDER = [
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+/**
+* True when `reasoning` arrives in the singular spelling: an `effort` string,
+* with none of the plural-form fields alongside it. Seen on CN
+* `deepseek-v4.1-flash` / `kimi-k3-1` / `glm-5.2` and global
+* `deepseek-v4.1-flash` / `kimi-k3` / `gemini-3.5-flash`.
+*/
+function isSingularEffortForm(raw) {
+	return typeof raw["effort"] === "string" && !Array.isArray(raw["supportedEfforts"]) && typeof raw["defaultEffort"] !== "string" && typeof raw["canDisableThinking"] !== "boolean";
+}
+/**
+* Fold a singular-form `effort` into the plural shape the rest of the plugin
+* already understands. Probes on both gateways show these models answer with
+* distinct `reasoning_content` across the whole ladder — and do not think at
+* all when no `reasoning_effort` is sent — so the fold widens
+* `supportedEfforts` and carries the declared value into `defaultEffort`. An
+* unrecognized `effort` passes through as the lone level.
+*/
+function singularEffortLadder(raw) {
+	const effort = typeof raw["effort"] === "string" ? raw["effort"] : void 0;
+	if (effort === void 0) return void 0;
+	return SINGULAR_EFFORT_LADDER.includes(effort) ? [...SINGULAR_EFFORT_LADDER] : [effort];
+}
+/**
+* Parse the upstream's `reasoning` object; unknown shapes degrade to
+* `undefined`. Both spellings normalize here: the plural form passes through as
+* declared, and the singular `effort` form folds via
+* {@link singularEffortLadder}.
+*/
 function parseReasoning(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
 	const raw = value;
-	const supportedEfforts = Array.isArray(raw["supportedEfforts"]) ? raw["supportedEfforts"].filter((effort) => typeof effort === "string") : void 0;
-	const defaultEffort = typeof raw["defaultEffort"] === "string" ? raw["defaultEffort"] : void 0;
-	const canDisableThinking = typeof raw["canDisableThinking"] === "boolean" ? raw["canDisableThinking"] : void 0;
+	const singularForm = isSingularEffortForm(raw);
+	const effort = typeof raw["effort"] === "string" ? raw["effort"] : void 0;
+	const supportedEfforts = Array.isArray(raw["supportedEfforts"]) ? raw["supportedEfforts"].filter((entry) => typeof entry === "string") : singularEffortLadder(raw);
+	const defaultEffort = typeof raw["defaultEffort"] === "string" ? raw["defaultEffort"] : effort;
+	const canDisableThinking = typeof raw["canDisableThinking"] === "boolean" ? raw["canDisableThinking"] : singularForm ? true : void 0;
 	if (supportedEfforts === void 0 && defaultEffort === void 0 && canDisableThinking === void 0) return;
 	return {
 		...supportedEfforts === void 0 || supportedEfforts.length === 0 ? {} : { supportedEfforts },
@@ -525,11 +612,13 @@ function parseWorkBuddyAuth(text, sourcePath) {
 	if (accessToken === "") return void 0;
 	const refreshExpiresAtMs = typeof auth["refreshExpiresAt"] === "number" ? expiryToMs(auth["refreshExpiresAt"]) : void 0;
 	if (refreshExpiresAtMs !== void 0 && refreshExpiresAtMs > 0 && refreshExpiresAtMs < Date.now()) return;
+	const lastRefreshAtMs = typeof auth["lastRefreshTime"] === "number" ? expiryToMs(auth["lastRefreshTime"]) : void 0;
 	return {
 		accessToken,
 		refreshToken: typeof auth["refreshToken"] === "string" ? auth["refreshToken"] : "",
 		expiresAtMs: typeof auth["expiresAt"] === "number" ? expiryToMs(auth["expiresAt"]) : 0,
 		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
+		...lastRefreshAtMs === void 0 ? {} : { lastRefreshAtMs },
 		...optionalString(identity["nickname"]) === void 0 ? {} : { nickname: optionalString(identity["nickname"]) },
 		...optionalString(identity["uin"]) === void 0 ? {} : { uin: optionalString(identity["uin"]) },
 		...optionalString(identity["uid"]) === void 0 ? {} : { uid: optionalString(identity["uid"]) },
@@ -542,6 +631,42 @@ function parseWorkBuddyAuth(text, sourcePath) {
 * Stable account id. `uin` is the billing identity the upstream keys on and
 * survives re-login; `uid` is the fallback.
 */
+/**
+* True when `path` is the desktop app's live sign-in (as opposed to a backup
+* snapshot it left behind). The live file always wins: it is the session the
+* app itself is using.
+*/
+function isLiveAuthFile(path) {
+	return basename(path) === WORKBUDDY_LIVE_FILENAME;
+}
+/**
+* Which of two credentials for the same account the pool should keep.
+*
+* Ordering, highest first:
+*
+* 1. the live file the desktop app is signed in with;
+* 2. the credential the upstream issued most recently (`lastRefreshAtMs`);
+* 3. the longer stored expiry, as a fallback for documents that carry no issue
+*    time (the plugin's own refreshed copy, older builds).
+*
+* The stored expiry alone is NOT a freshness signal: the upstream does not
+* rewrite it when it revokes a token, so a long-dead backup can claim to expire
+* later than the token that actually works. Selecting on it made every upstream
+* call return 401 while a perfectly good credential sat in the same directory.
+*/
+function compareFreshness(a, b) {
+	const aLive = isLiveAuthFile(a.sourcePath) ? 1 : 0;
+	const bLive = isLiveAuthFile(b.sourcePath) ? 1 : 0;
+	if (aLive !== bLive) return bLive - aLive;
+	const aIssued = a.lastRefreshAtMs ?? 0;
+	const bIssued = b.lastRefreshAtMs ?? 0;
+	if (aIssued !== bIssued) return bIssued - aIssued;
+	return b.expiresAtMs - a.expiresAtMs;
+}
+/** True when `candidate` should replace `incumbent` for the same account. */
+function isFresher(candidate, incumbent) {
+	return compareFreshness(candidate, incumbent) < 0;
+}
 function workbuddyAccountId(credential) {
 	const stable = credential.uin ?? credential.uid ?? credential.nickname ?? "unknown";
 	return createHash("sha256").update(`workbuddy\0${stable}`).digest("hex").slice(0, 16);
@@ -593,6 +718,8 @@ var WorkBuddyAccountPool = class {
 	client;
 	refreshMarginMs;
 	accounts = [];
+	distribution;
+	/** Cursor for round-robin mode; unused under priority distribution. */
 	cursor = 0;
 	lastScanAtMs = 0;
 	preferredId;
@@ -603,6 +730,7 @@ var WorkBuddyAccountPool = class {
 		this.cooldownMs = options.cooldownMs ?? 6e4;
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
+		this.distribution = options.distribution ?? "priority";
 	}
 	/**
 	* Re-apply configuration that only affects discovery and cooldown policy,
@@ -612,6 +740,7 @@ var WorkBuddyAccountPool = class {
 	applyConfig(options) {
 		if (options.authDirs !== void 0 && options.authDirs.length > 0) this.authDirs = options.authDirs;
 		if (options.cooldownMs !== void 0 && options.cooldownMs >= 1e3) this.cooldownMs = options.cooldownMs;
+		if (options.distribution !== void 0) this.distribution = options.distribution;
 	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
@@ -636,13 +765,15 @@ var WorkBuddyAccountPool = class {
 				});
 				continue;
 			}
-			if ((credential.expiresAtMs ?? 0) > (existing.credential.expiresAtMs ?? 0)) byId.set(id, {
+			if (isFresher(credential, existing.credential)) byId.set(id, {
 				...existing,
 				credential,
 				label: accountLabel(credential)
 			});
 		}
-		this.accounts = [...byId.values()];
+		const ordered = [...byId.values()];
+		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
+		this.accounts = ordered;
 		this.lastScanAtMs = Date.now();
 		return this.accounts;
 	}
@@ -669,12 +800,24 @@ var WorkBuddyAccountPool = class {
 		});
 	}
 	/**
-	* Pick the next usable account for an optional model. Scans on first use,
-	* and rescans when every known account is cooling down — a fresh desktop
-	* login is the usual way out of an exhausted pool. A preferred
-	* (user-selected) account that is healthy is tried first; otherwise the
-	* cursor round-robins so consecutive requests spread across accounts and a
-	* still-cooling preferred account is skipped.
+	* Pick the account to serve a request.
+	*
+	* Two distributions, chosen by the `distribution` setting:
+	*
+	* - **priority** (default, and what the card ships with): one account serves
+	*   every request until it is rate-limited, then the next in order takes over.
+	*   Credits drain one account at a time, and a cooling account returns to the
+	*   head of the queue the moment its window resets — it was never consumed, so
+	*   it resumes straight away.
+	* - **round-robin**: consecutive requests rotate through the pool so spend
+	*   spreads evenly across every account.
+	*
+	* In both modes an explicit user selection (`prefer`) heads the list, a
+	* cooling account is skipped for that model only, and an unrecognised setting
+	* falls back to priority.
+	*
+	* Scans on first use, and rescans when every known account is cooling down: a
+	* fresh desktop login is the usual way out of an exhausted pool.
 	*/
 	async acquire(modelId, region) {
 		if (this.accounts.length === 0) await this.scan();
@@ -684,21 +827,25 @@ var WorkBuddyAccountPool = class {
 			pool = this.available(Date.now(), modelId, region);
 		}
 		if (pool.length === 0) return void 0;
-		let start = this.cursor % pool.length;
 		if (this.preferredId !== void 0) {
 			const preferredIndex = pool.findIndex((account) => account.id === this.preferredId);
-			if (preferredIndex !== -1) start = preferredIndex;
-		}
-		for (let step = 0; step < pool.length; step += 1) {
-			const account = pool[(start + step) % pool.length];
-			if (account === void 0) continue;
-			await this.ensureFresh(account);
-			this.cursor = (start + step + 1) % pool.length;
-			return account;
+			if (preferredIndex > 0) {
+				const [preferred] = pool.splice(preferredIndex, 1);
+				if (preferred !== void 0) pool = [preferred, ...pool];
+			}
 		}
-		return pool[0];
+		const index = this.distribution === "round-robin" ? this.cursor % pool.length : 0;
+		const account = pool[index];
+		if (account === void 0) return void 0;
+		if (this.distribution === "round-robin") this.cursor = (index + 1) % pool.length;
+		await this.ensureFresh(account);
+		return account;
 	}
 	/** Pin the account the plugin card should prefer; tokens stay out of settings. */
+	/** How the pool currently spreads requests. Shown on the card. */
+	currentDistribution() {
+		return this.distribution;
+	}
 	prefer(accountId) {
 		this.preferredId = accountId;
 	}
@@ -963,6 +1110,7 @@ function formatRates(status) {
 z.object({
 	authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app own location)"),
 	cooldownMs: z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds"),
+	distribution: z.union(["priority", "round-robin"]).default("priority").description("How requests are spread: priority (drain one) or round-robin"),
 	enabledModelIds: z.array(z.string()).default([]).description("Model ids enabled in the picker (empty = all)"),
 	imageModelIds: z.array(z.string()).default([]).description("Model ids accepting image input (empty = follow upstream)"),
 	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Per-model context-window override, keyed by model id")

package/lib/client.js

@@ -115,6 +115,14 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-usage-status{display:flex;align-items:center;gap:10px;font-size:15px;font-weight:500;color:var(--dsw-alias-label-primary,#e6e6e6)}
 .dsm-workbuddy-xdpool-usage-dot{width:9px;height:9px;border-radius:50%;flex:0 0 auto}
 .dsm-workbuddy-xdpool-usage-hint{padding-left:19px;color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
+/* Distribution switch: priority (drain one) vs round-robin (spread). */
+.dsm-workbuddy-xdpool-dist{display:flex;align-items:center;gap:8px;padding-left:19px;flex-wrap:wrap}
+.dsm-workbuddy-xdpool-dist-title{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px}
+.dsm-workbuddy-xdpool-dist-option{appearance:none;font:inherit;cursor:pointer;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:999px;padding:2px 10px;font-size:11px;line-height:18px;background:transparent;color:var(--dsw-alias-label-tertiary,#9aa0a8);transition:color .16s,border-color .16s,background .16s}
+.dsm-workbuddy-xdpool-dist-option:hover:not(:disabled):not(.dsm-workbuddy-xdpool-dist-option-active){color:var(--dsw-alias-label-primary,#e6e6e6);border-color:var(--dsw-alias-label-dimmed,#777)}
+.dsm-workbuddy-xdpool-dist-option:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#5686fe);outline-offset:1px}
+.dsm-workbuddy-xdpool-dist-option-active{background:var(--dsw-alias-state-success-subtle,rgba(34,160,107,.14));border-color:var(--dsw-alias-state-success-primary,#22a06b);color:var(--dsw-alias-state-success-primary,#22a06b)}
+.dsm-workbuddy-xdpool-dist-option:disabled{cursor:default;opacity:.6}
 .dsm-workbuddy-xdpool-usage-actions{display:flex;align-items:center;gap:8px;flex-wrap:wrap}
 
 /* Account list (each account = a labeled subpanel, same as dingminhua). */
@@ -143,9 +151,18 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-panel-foot{display:flex;align-items:baseline;justify-content:space-between;gap:10px;margin-top:9px;padding-top:9px;border-top:1px solid var(--dsw-alias-border-l2,#36373b);color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:12px;line-height:18px}
 .dsm-workbuddy-xdpool-panel-foot strong{color:var(--dsw-alias-label-primary,#e6e6e6);font-size:15px;font-variant-numeric:tabular-nums}
 .dsm-workbuddy-xdpool-packages{display:flex;flex-direction:column;gap:5px;margin:0;padding:0;list-style:none}
-.dsm-workbuddy-xdpool-packages li{display:flex;align-items:baseline;justify-content:space-between;gap:10px;color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:12px;line-height:18px}
-.dsm-workbuddy-xdpool-packages-name{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
-.dsm-workbuddy-xdpool-packages-value{flex:none;color:var(--dsw-alias-label-tertiary,#999);font-size:11px;font-variant-numeric:tabular-nums}
+/* One credit package: name + amount on the first line, its deadline beneath.
+   A two-row grid keeps the columns aligned across rows; a wrapping flex row
+   dropped the deadline onto a second line that started at the container edge,
+   so the list read as ragged text rather than a table. */
+.dsm-workbuddy-xdpool-packages li{display:grid;grid-template-columns:minmax(0,1fr) auto;column-gap:10px;row-gap:1px;align-items:baseline;color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:12px;line-height:18px}
+.dsm-workbuddy-xdpool-packages-name{grid-column:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dsm-workbuddy-xdpool-packages-value{grid-column:2;justify-self:end;color:var(--dsw-alias-label-tertiary,#999);font-size:11px;font-variant-numeric:tabular-nums}
+/* Per-package deadline: the upstream grants one-off packs at arbitrary clock
+   times, so each row carries its own timestamp; the soon ones are tinted and
+   fold onto their own line so a long package name cannot squeeze them out. */
+.dsm-workbuddy-xdpool-packages-when{grid-column:1/-1;color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:11px;line-height:15px;font-variant-numeric:tabular-nums}
+.dsm-workbuddy-xdpool-packages-when-soon{color:var(--dsw-alias-state-warning-primary,#d97706)}
 .dsm-workbuddy-xdpool-panel-total{position:relative;align-items:center;text-align:center;overflow:hidden}
 .dsm-workbuddy-xdpool-panel-total::before{content:"";position:absolute;top:0;left:0;right:0;height:3px;opacity:.9;background:var(--dsw-alias-state-success-primary,#22a06b)}
 .dsm-workbuddy-xdpool-total-value{color:var(--dsw-alias-state-success-primary,#22a06b);font-size:30px;line-height:34px;font-weight:700;letter-spacing:-.5px;white-space:nowrap;font-variant-numeric:tabular-nums}
@@ -307,6 +324,30 @@ window.__ModuleLoader__.load({
 			}
 			return false;
 		}
+		/** Absolute expiry with the time of day: the upstream grants one-off packages at
+		*  arbitrary clock times, so "expires 09/19 15:36" is what the user needs — a
+		*  date alone would read as if it lapsed at midnight. */
+		function formatExpiry(ms) {
+			if (ms === void 0 || !Number.isFinite(ms)) return "";
+			return new Intl.DateTimeFormat(void 0, {
+				month: "2-digit",
+				day: "2-digit",
+				hour: "2-digit",
+				minute: "2-digit",
+				hour12: false
+			}).format(new Date(ms));
+		}
+		/** Whole days until `ms`, floored at 0; undefined when there is no deadline. */
+		function daysUntil(ms) {
+			if (ms === void 0 || !Number.isFinite(ms)) return void 0;
+			return Math.max(0, Math.floor((ms - Date.now()) / 864e5));
+		}
+		/** True when a one-off package lapses inside the "expiring soon" window. */
+		function isExpiringSoon(pack) {
+			if (pack.monthly === true) return false;
+			const days = daysUntil(pack.expiresAtMs);
+			return days !== void 0 && days <= 3;
+		}
 		function tagFor(model) {
 			const tags = model.tags ?? [];
 			if (tags.includes("free")) return "free";
@@ -522,6 +563,25 @@ window.__ModuleLoader__.load({
 			* The card refuses an empty enable-list: saving one would leave the picker
 			* with nothing to offer and no obvious way back.
 			*/
+			/**
+			* Switch how the pool spreads requests. Written straight through the
+			* settings scope (that is where the host keeps the pool options), so the
+			* change lands without a restart and survives the next card refresh.
+			*/
+			const setDistribution = async (next) => {
+				const write = settingsScope?.set;
+				if (write === void 0) {
+					setError(t?.("row.modelsSaveError", { message: "settings scope is read-only" }) ?? "settings scope is read-only");
+					return;
+				}
+				setFlash(void 0);
+				try {
+					await write.call(settingsScope, "distribution", next);
+					await refresh(activeRegion);
+				} catch (cause) {
+					if (mounted.current) setError(String(cause));
+				}
+			};
 			const saveModels = async () => {
 				if (draft === void 0 || status === void 0) return;
 				if (enabledCount === 0) {
@@ -639,6 +699,31 @@ window.__ModuleLoader__.load({
 										shimHint === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 											className: "dsm-workbuddy-xdpool-usage-hint",
 											children: shimHint
+										}),
+										status === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+											className: "dsm-workbuddy-xdpool-dist",
+											role: "radiogroup",
+											"aria-label": t?.("row.distTitle") ?? "Account usage",
+											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "dsm-workbuddy-xdpool-dist-title",
+												children: t?.("row.distTitle") ?? "Account usage"
+											}), ["priority", "round-robin"].map((option) => {
+												const active = (status.distribution ?? "priority") === option;
+												const label = option === "priority" ? t?.("row.distPriority") ?? "Priority" : t?.("row.distRoundRobin") ?? "Round-robin";
+												const hint = option === "priority" ? t?.("row.distPriorityHint") ?? "" : t?.("row.distRoundRobinHint") ?? "";
+												return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+													type: "button",
+													role: "radio",
+													"aria-checked": active,
+													title: hint,
+													disabled: !modelsEditable,
+													className: `dsm-workbuddy-xdpool-dist-option${active ? " dsm-workbuddy-xdpool-dist-option-active" : ""}`,
+													onClick: () => {
+														setDistribution(option);
+													},
+													children: label
+												}, option);
+											})]
 										})
 									]
 								}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
@@ -878,16 +963,30 @@ window.__ModuleLoader__.load({
 							children: "–"
 						}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
 							className: "dsm-workbuddy-xdpool-packages",
-							children: packages.map((pack, index) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: "dsm-workbuddy-xdpool-packages-name",
-								children: pack.packageName
-							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: "dsm-workbuddy-xdpool-packages-value",
-								children: t?.("row.creditsPackage", {
-									remain: formatNumber(pack.remain),
-									size: formatNumber(pack.size)
-								}) ?? `${formatNumber(pack.remain)} / ${formatNumber(pack.size)}`
-							})] }, `${pack.packageName}-${String(index)}`))
+							children: packages.map((pack, index) => {
+								const expiry = formatExpiry(pack.expiresAtMs);
+								const refresh = formatExpiry(pack.cycleRefreshMs);
+								const soon = isExpiringSoon(pack);
+								const when = pack.monthly === true ? refresh === "" ? null : t?.("row.creditsRefreshAt", { time: refresh }) ?? `Refreshes ${refresh}` : expiry === "" ? null : t?.("row.creditsExpiresAt", { time: expiry }) ?? `Expires ${expiry}`;
+								return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", { children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-xdpool-packages-name",
+										children: pack.packageName
+									}),
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-xdpool-packages-value",
+										children: t?.("row.creditsPackage", {
+											remain: formatNumber(pack.remain),
+											size: formatNumber(pack.size)
+										}) ?? `${formatNumber(pack.remain)} / ${formatNumber(pack.size)}`
+									}),
+									when === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: `dsm-workbuddy-xdpool-packages-when${soon ? " dsm-workbuddy-xdpool-packages-when-soon" : ""}`,
+										title: t?.("row.creditsExpiresSoonTitle") ?? "Expiring within 3 days",
+										children: when
+									})
+								] }, `${pack.packageName}-${String(index)}`);
+							})
 						}),
 						credits?.expiringSoon !== void 0 && credits.expiringSoon > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 							className: "dsm-workbuddy-xdpool-panel-foot",
@@ -1082,6 +1181,9 @@ window.__ModuleLoader__.load({
 			"row.creditsPackage": "{remain} / {size}",
 			"row.creditsError": "credits unavailable",
 			"row.creditsSoon": "Expiring in 3 days",
+			"row.creditsExpiresAt": "Expires {time}",
+			"row.creditsExpiresSoonTitle": "Expiring within 3 days",
+			"row.creditsRefreshAt": "Refreshes {time}",
 			"row.checkinTitle": "Daily check-in",
 			"row.checkinClaim": "Check in",
 			"row.checkinClaiming": "Checking in…",
@@ -1116,6 +1218,11 @@ window.__ModuleLoader__.load({
 			"row.imageCapable": "image input",
 			"row.rate": "{rate}x credits",
 			"row.accountsRescan": "Detect accounts again",
+			"row.distTitle": "Account usage",
+			"row.distPriority": "Priority",
+			"row.distPriorityHint": "Drain one account before moving to the next",
+			"row.distRoundRobin": "Round-robin",
+			"row.distRoundRobinHint": "Spread the spend evenly across accounts",
 			"row.accountsScanning": "Detecting…",
 			"row.resetCooldowns": "Clear all cooldowns",
 			"row.resetCooldownsBusy": "Clearing…",
@@ -1160,6 +1267,9 @@ window.__ModuleLoader__.load({
 			"row.creditsPackage": "{remain} / {size}",
 			"row.creditsError": "积分不可用",
 			"row.creditsSoon": "3 天内到期",
+			"row.creditsExpiresAt": "到期 {time}",
+			"row.creditsExpiresSoonTitle": "3 天内到期",
+			"row.creditsRefreshAt": "刷新 {time}",
 			"row.checkinTitle": "每日签到",
 			"row.checkinClaim": "签到",
 			"row.checkinClaiming": "签到中…",
@@ -1194,6 +1304,11 @@ window.__ModuleLoader__.load({
 			"row.imageCapable": "图片输入",
 			"row.rate": "{rate}x 积分",
 			"row.accountsRescan": "重新检测账号",
+			"row.distTitle": "账号使用方式",
+			"row.distPriority": "优先模式",
+			"row.distPriorityHint": "优先用完一个账号再换下一个",
+			"row.distRoundRobin": "轮换模式",
+			"row.distRoundRobinHint": "积分平均分摊到各账号",
 			"row.accountsScanning": "正在检测…",
 			"row.resetCooldowns": "清除所有冷却",
 			"row.resetCooldownsBusy": "正在清除…",

package/lib/index.d.ts

@@ -150,6 +150,16 @@ interface WorkBuddyCredential {
   refreshToken: string;
   expiresAtMs: number;
   refreshExpiresAtMs?: number;
+  /**
+   * When the upstream says it issued this token (`auth.lastRefreshTime`).
+   *
+   * This, not `expiresAtMs`, is the reliable freshness signal: the upstream
+   * never rewrites a stored expiry when it revokes a token, so a long-dead
+   * backup can claim to expire later than the token that actually works.
+   * Absent on documents the desktop app did not write (the plugin's own
+   * refreshed copy, older builds).
+   */
+  lastRefreshAtMs?: number;
   nickname?: string;
   uin?: string;
   uid?: string;
@@ -194,13 +204,11 @@ export declare function defaultDesktopAuthDirs(platform?: NodeJS.Platform, home?
  * when there is no usable access token.
  */
 export declare function parseWorkBuddyAuth(text: string, sourcePath: string): WorkBuddyCredential | undefined;
-/**
- * Stable account id. `uin` is the billing identity the upstream keys on and
- * survives re-login; `uid` is the fallback.
- */
 export declare function workbuddyAccountId(credential: Pick<WorkBuddyCredential, 'uin' | 'uid' | 'nickname'>): string;
 /** Every directory the pool should scan, in probe order. */
 export declare function candidateAuthDirs(env?: NodeJS.ProcessEnv): string[];
+/** How the pool chooses which account serves the next request. */
+type AccountDistribution = 'priority' | 'round-robin';
 interface AccountPoolOptions {
   /** Logger for discovery and rotation events. */
   logger?: {
@@ -216,6 +224,17 @@ interface AccountPoolOptions {
   client?: TokenRefresher;
   /** Refresh this long before actual expiry; default five minutes. */
   refreshMarginMs?: number;
+  /**
+   * How requests are spread across the pool.
+   *
+   * - `priority` (default): one account serves every request until it is
+   *   rate-limited, then the next in order takes over. Credits drain one
+   *   account at a time, and a cooled account resumes at the head of the
+   *   queue the moment its window resets.
+   * - `round-robin`: consecutive requests rotate through the pool so the
+   *   spend spreads evenly.
+   */
+  distribution?: AccountDistribution;
 }
 /**
  * Read-only pool of every discovered WorkBuddy account, with rate-limit
@@ -228,6 +247,8 @@ export declare class WorkBuddyAccountPool {
   private readonly client;
   private readonly refreshMarginMs;
   private accounts;
+  private distribution;
+  /** Cursor for round-robin mode; unused under priority distribution. */
   private cursor;
   private lastScanAtMs;
   private preferredId;
@@ -241,6 +262,7 @@ export declare class WorkBuddyAccountPool {
   applyConfig(options: {
     authDirs?: readonly string[];
     cooldownMs?: number;
+    distribution?: AccountDistribution;
   }): void;
   /** Rescan the auth directories and merge newly discovered accounts. */
   scan(): Promise<WorkBuddyAccount[]>;
@@ -257,15 +279,29 @@ export declare class WorkBuddyAccountPool {
    */
   private available;
   /**
-   * Pick the next usable account for an optional model. Scans on first use,
-   * and rescans when every known account is cooling down — a fresh desktop
-   * login is the usual way out of an exhausted pool. A preferred
-   * (user-selected) account that is healthy is tried first; otherwise the
-   * cursor round-robins so consecutive requests spread across accounts and a
-   * still-cooling preferred account is skipped.
+   * Pick the account to serve a request.
+   *
+   * Two distributions, chosen by the `distribution` setting:
+   *
+   * - **priority** (default, and what the card ships with): one account serves
+   *   every request until it is rate-limited, then the next in order takes over.
+   *   Credits drain one account at a time, and a cooling account returns to the
+   *   head of the queue the moment its window resets — it was never consumed, so
+   *   it resumes straight away.
+   * - **round-robin**: consecutive requests rotate through the pool so spend
+   *   spreads evenly across every account.
+   *
+   * In both modes an explicit user selection (`prefer`) heads the list, a
+   * cooling account is skipped for that model only, and an unrecognised setting
+   * falls back to priority.
+   *
+   * Scans on first use, and rescans when every known account is cooling down: a
+   * fresh desktop login is the usual way out of an exhausted pool.
    */
   acquire(modelId?: string, region?: WorkBuddyRegion): Promise<WorkBuddyAccount | undefined>;
   /** Pin the account the plugin card should prefer; tokens stay out of settings. */
+  /** How the pool currently spreads requests. Shown on the card. */
+  currentDistribution(): AccountDistribution;
   prefer(accountId: string | undefined): void;
   /** Best-effort refresh of one account after a session-dead upstream answer. */
   refreshAccount(accountId: string): Promise<void>;
@@ -351,7 +387,7 @@ interface ModelSelection {
   /** Absent = each model follows its upstream image capability. */
   imageModelIds?: readonly string[];
   /** Per-model context-window cap, keyed by model id. */
-  contextBudgets?: Readonly<Record<string, number>>;
+  contextBudgets?: Readonly<Record<string, number | undefined>>;
 }
 //#endregion
 //#region src/shim.d.ts
@@ -605,7 +641,7 @@ interface PoolWebModelSelection {
   /** Absent = each model follows its upstream image capability. */
   imageModelIds?: readonly string[];
   /** Per-model context-window cap, keyed by model id. */
-  contextBudgets?: Readonly<Record<string, number>>;
+  contextBudgets?: Readonly<Record<string, number | undefined>>;
 }
 /** The JSON document the pool card renders. */
 interface PoolWebStatus {
@@ -617,6 +653,11 @@ interface PoolWebStatus {
   models: readonly PoolWebModel[];
   /** The saved selection the card diffs its draft against. */
   selection: PoolWebModelSelection;
+  /**
+   * How the pool spreads requests: `priority` drains one account before
+   * moving on, `round-robin` splits the spend evenly.
+   */
+  distribution: PoolDistribution;
   /** Which region this document describes. */
   region: PoolRegion;
   /** Every region holding at least one account, in display order. */
@@ -632,6 +673,8 @@ interface PoolWebStatus {
  * international one (`workbuddy.ai`).
  */
 type PoolRegion = 'cn' | 'global';
+/** How the pool spreads requests across its accounts. */
+type PoolDistribution = 'priority' | 'round-robin';
 //#endregion
 //#region src/index.d.ts
 /** Stable Cordis plugin name. */
@@ -651,6 +694,14 @@ export interface Config {
   authFile?: string;
   /** Rate-limit cooldown per account, milliseconds. */
   cooldownMs?: number;
+  /**
+   * How the pool spreads requests across accounts.
+   *
+   * `priority` (default) drains one account before moving to the next, which
+   * is what a pool of your own accounts is for. `round-robin` splits the
+   * spend evenly instead. Absent reads as `priority`.
+   */
+  distribution?: 'priority' | 'round-robin';
   /**
    * Model ids enabled in the picker. Absent means "every model the catalog
    * advertises" — an unconfigured install should never present an empty model
@@ -668,7 +719,7 @@ export interface Config {
    * advertise more than DSH wants to hand a single turn, so the card lets the
    * user cap a model without touching the catalog.
    */
-  contextBudgets?: Partial<Record<string, number>>;
+  contextBudgets?: Record<string, number>;
 }
 /** Upper bound the card offers as the "default" context window, in tokens. */
 export declare const DEFAULT_CONTEXT_BUDGET = 200000;

package/lib/index.js

@@ -1,4 +1,4 @@
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { readFile, readdir } from "node:fs/promises";
@@ -40,20 +40,47 @@ const HARD_CREDIT_MARKERS = [
 ];
 /** Session-invalidation markers that mean "sign in again in the WorkBuddy app". */
 const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
+/**
+* Hosts the international product answers on, once each has been stripped of a
+* leading label. The WorkBuddy AI desktop app signs in at `workbuddy.ai` (and
+* the desktop client itself lists `workbuddy.cc` alongside it); the CodeBuddy
+* CLI signs the same international account in at `codebuddy.ai`. All are served
+* by one gateway stack, so all are `global` — missing a spelling sends those
+* tokens to the CN gateway, which rejects them at the openresty layer with an
+* HTML 401 instead of a business JSON error.
+*/
+const GLOBAL_HOSTS = [
+	"workbuddy.ai",
+	"workbuddy.cc",
+	"codebuddy.ai"
+];
+/** Region for a login domain; an empty domain means CN (matching upstream tooling). */
 function regionOf(domain) {
 	const lowered = domain.trim().toLowerCase();
-	if (lowered.endsWith(".workbuddy.ai") || lowered.endsWith(".workbuddy.cc")) return "global";
-	if (lowered === "workbuddy.ai" || lowered === "workbuddy.cc") return "global";
+	for (const host of GLOBAL_HOSTS) if (lowered === host || lowered.endsWith(`.${host}`)) return "global";
 	return "cn";
 }
+/**
+* Gateway for a global credential.
+*
+* International accounts are NOT interchangeable across brand domains: a token
+* issued at `codebuddy.ai` is rejected by the `workbuddy.ai` gateway and vice
+* versa, so the base must follow the credential's own domain rather than one
+* hardcoded host. Anything unrecognised falls back to the desktop app's gateway.
+*/
+function globalBase(credential) {
+	const lowered = credential.domain.trim().toLowerCase();
+	if (lowered === "codebuddy.ai" || lowered.endsWith(".codebuddy.ai")) return "https://www.codebuddy.ai";
+	return GLOBAL_BASE;
+}
 function chatBase(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_CHAT_BASE;
+	return regionOf(credential.domain) === "global" ? globalBase(credential) : CN_CHAT_BASE;
 }
 function billingBase(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_BILLING_BASE;
+	return regionOf(credential.domain) === "global" ? globalBase(credential) : CN_BILLING_BASE;
 }
 function originReferer(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_BILLING_BASE;
+	return regionOf(credential.domain) === "global" ? globalBase(credential) : CN_BILLING_BASE;
 }
 /** Headers every upstream request shares. */
 function commonHeaders(credential) {
@@ -102,8 +129,23 @@ function billingHeaders(credential) {
 	if (credential.domain !== "") headers["X-Domain"] = credential.domain;
 	return headers;
 }
+/**
+* Gateway denials that arrive as an HTML page rather than a JSON envelope.
+*
+* openresty / APISIX reject a request before it reaches the product when the
+* credential is one the gateway no longer honours — most often a stale sign-in
+* left in the auth directory. The status alone (401) is not actionable and the
+* HTML body leaks nothing useful, so this turns it into a sentence the user can
+* act on.
+*/
+function isGatewayHtmlRejection(status, text) {
+	if (status !== 401 && status !== 403) return false;
+	const head = text.slice(0, 512).toLowerCase();
+	return head.includes("<html") || head.includes("openresty") || head.includes("apisix");
+}
 async function readEnvelope(response) {
 	const text = await response.text();
+	if (isGatewayHtmlRejection(response.status, text)) throw new Error("the WorkBuddy gateway rejected this credential (http 401). This usually means the account is using a stale sign-in the upstream no longer accepts: sign in again in the WorkBuddy desktop app, then pick the account on the plugin card. Run `dsh-workbuddy-xdpool doctor` to list every credential found.");
 	let parsed;
 	try {
 		parsed = JSON.parse(text);
@@ -162,12 +204,57 @@ function parseCreditMultiplier(value) {
 	return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
 }
 /** Parse the upstream's `reasoning` object; unknown shapes degrade to `{}`. */
+/**
+* The effort ladder the upstream's plural-form payloads declare across both
+* gateways (the live union of every `supportedEfforts` list seen; `minimal` has
+* never appeared). Both gateways also accept every level of it on
+* singular-form models — medium/xhigh fold into high, low/max answer with their
+* own budgets — so a singular `effort` value is a DEFAULT, never the model's
+* only level.
+*/
+const SINGULAR_EFFORT_LADDER = [
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+/**
+* True when `reasoning` arrives in the singular spelling: an `effort` string,
+* with none of the plural-form fields alongside it. Seen on CN
+* `deepseek-v4.1-flash` / `kimi-k3-1` / `glm-5.2` and global
+* `deepseek-v4.1-flash` / `kimi-k3` / `gemini-3.5-flash`.
+*/
+function isSingularEffortForm(raw) {
+	return typeof raw["effort"] === "string" && !Array.isArray(raw["supportedEfforts"]) && typeof raw["defaultEffort"] !== "string" && typeof raw["canDisableThinking"] !== "boolean";
+}
+/**
+* Fold a singular-form `effort` into the plural shape the rest of the plugin
+* already understands. Probes on both gateways show these models answer with
+* distinct `reasoning_content` across the whole ladder — and do not think at
+* all when no `reasoning_effort` is sent — so the fold widens
+* `supportedEfforts` and carries the declared value into `defaultEffort`. An
+* unrecognized `effort` passes through as the lone level.
+*/
+function singularEffortLadder(raw) {
+	const effort = typeof raw["effort"] === "string" ? raw["effort"] : void 0;
+	if (effort === void 0) return void 0;
+	return SINGULAR_EFFORT_LADDER.includes(effort) ? [...SINGULAR_EFFORT_LADDER] : [effort];
+}
+/**
+* Parse the upstream's `reasoning` object; unknown shapes degrade to
+* `undefined`. Both spellings normalize here: the plural form passes through as
+* declared, and the singular `effort` form folds via
+* {@link singularEffortLadder}.
+*/
 function parseReasoning(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
 	const raw = value;
-	const supportedEfforts = Array.isArray(raw["supportedEfforts"]) ? raw["supportedEfforts"].filter((effort) => typeof effort === "string") : void 0;
-	const defaultEffort = typeof raw["defaultEffort"] === "string" ? raw["defaultEffort"] : void 0;
-	const canDisableThinking = typeof raw["canDisableThinking"] === "boolean" ? raw["canDisableThinking"] : void 0;
+	const singularForm = isSingularEffortForm(raw);
+	const effort = typeof raw["effort"] === "string" ? raw["effort"] : void 0;
+	const supportedEfforts = Array.isArray(raw["supportedEfforts"]) ? raw["supportedEfforts"].filter((entry) => typeof entry === "string") : singularEffortLadder(raw);
+	const defaultEffort = typeof raw["defaultEffort"] === "string" ? raw["defaultEffort"] : effort;
+	const canDisableThinking = typeof raw["canDisableThinking"] === "boolean" ? raw["canDisableThinking"] : singularForm ? true : void 0;
 	if (supportedEfforts === void 0 && defaultEffort === void 0 && canDisableThinking === void 0) return;
 	return {
 		...supportedEfforts === void 0 || supportedEfforts.length === 0 ? {} : { supportedEfforts },
@@ -541,11 +628,13 @@ function parseWorkBuddyAuth(text, sourcePath) {
 	if (accessToken === "") return void 0;
 	const refreshExpiresAtMs = typeof auth["refreshExpiresAt"] === "number" ? expiryToMs(auth["refreshExpiresAt"]) : void 0;
 	if (refreshExpiresAtMs !== void 0 && refreshExpiresAtMs > 0 && refreshExpiresAtMs < Date.now()) return;
+	const lastRefreshAtMs = typeof auth["lastRefreshTime"] === "number" ? expiryToMs(auth["lastRefreshTime"]) : void 0;
 	return {
 		accessToken,
 		refreshToken: typeof auth["refreshToken"] === "string" ? auth["refreshToken"] : "",
 		expiresAtMs: typeof auth["expiresAt"] === "number" ? expiryToMs(auth["expiresAt"]) : 0,
 		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
+		...lastRefreshAtMs === void 0 ? {} : { lastRefreshAtMs },
 		...optionalString(identity["nickname"]) === void 0 ? {} : { nickname: optionalString(identity["nickname"]) },
 		...optionalString(identity["uin"]) === void 0 ? {} : { uin: optionalString(identity["uin"]) },
 		...optionalString(identity["uid"]) === void 0 ? {} : { uid: optionalString(identity["uid"]) },
@@ -558,6 +647,42 @@ function parseWorkBuddyAuth(text, sourcePath) {
 * Stable account id. `uin` is the billing identity the upstream keys on and
 * survives re-login; `uid` is the fallback.
 */
+/**
+* True when `path` is the desktop app's live sign-in (as opposed to a backup
+* snapshot it left behind). The live file always wins: it is the session the
+* app itself is using.
+*/
+function isLiveAuthFile(path) {
+	return basename(path) === WORKBUDDY_LIVE_FILENAME;
+}
+/**
+* Which of two credentials for the same account the pool should keep.
+*
+* Ordering, highest first:
+*
+* 1. the live file the desktop app is signed in with;
+* 2. the credential the upstream issued most recently (`lastRefreshAtMs`);
+* 3. the longer stored expiry, as a fallback for documents that carry no issue
+*    time (the plugin's own refreshed copy, older builds).
+*
+* The stored expiry alone is NOT a freshness signal: the upstream does not
+* rewrite it when it revokes a token, so a long-dead backup can claim to expire
+* later than the token that actually works. Selecting on it made every upstream
+* call return 401 while a perfectly good credential sat in the same directory.
+*/
+function compareFreshness(a, b) {
+	const aLive = isLiveAuthFile(a.sourcePath) ? 1 : 0;
+	const bLive = isLiveAuthFile(b.sourcePath) ? 1 : 0;
+	if (aLive !== bLive) return bLive - aLive;
+	const aIssued = a.lastRefreshAtMs ?? 0;
+	const bIssued = b.lastRefreshAtMs ?? 0;
+	if (aIssued !== bIssued) return bIssued - aIssued;
+	return b.expiresAtMs - a.expiresAtMs;
+}
+/** True when `candidate` should replace `incumbent` for the same account. */
+function isFresher(candidate, incumbent) {
+	return compareFreshness(candidate, incumbent) < 0;
+}
 function workbuddyAccountId(credential) {
 	const stable = credential.uin ?? credential.uid ?? credential.nickname ?? "unknown";
 	return createHash("sha256").update(`workbuddy\0${stable}`).digest("hex").slice(0, 16);
@@ -609,6 +734,8 @@ var WorkBuddyAccountPool = class {
 	client;
 	refreshMarginMs;
 	accounts = [];
+	distribution;
+	/** Cursor for round-robin mode; unused under priority distribution. */
 	cursor = 0;
 	lastScanAtMs = 0;
 	preferredId;
@@ -619,6 +746,7 @@ var WorkBuddyAccountPool = class {
 		this.cooldownMs = options.cooldownMs ?? 6e4;
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
+		this.distribution = options.distribution ?? "priority";
 	}
 	/**
 	* Re-apply configuration that only affects discovery and cooldown policy,
@@ -628,6 +756,7 @@ var WorkBuddyAccountPool = class {
 	applyConfig(options) {
 		if (options.authDirs !== void 0 && options.authDirs.length > 0) this.authDirs = options.authDirs;
 		if (options.cooldownMs !== void 0 && options.cooldownMs >= 1e3) this.cooldownMs = options.cooldownMs;
+		if (options.distribution !== void 0) this.distribution = options.distribution;
 	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
@@ -652,13 +781,15 @@ var WorkBuddyAccountPool = class {
 				});
 				continue;
 			}
-			if ((credential.expiresAtMs ?? 0) > (existing.credential.expiresAtMs ?? 0)) byId.set(id, {
+			if (isFresher(credential, existing.credential)) byId.set(id, {
 				...existing,
 				credential,
 				label: accountLabel(credential)
 			});
 		}
-		this.accounts = [...byId.values()];
+		const ordered = [...byId.values()];
+		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
+		this.accounts = ordered;
 		this.lastScanAtMs = Date.now();
 		return this.accounts;
 	}
@@ -685,12 +816,24 @@ var WorkBuddyAccountPool = class {
 		});
 	}
 	/**
-	* Pick the next usable account for an optional model. Scans on first use,
-	* and rescans when every known account is cooling down — a fresh desktop
-	* login is the usual way out of an exhausted pool. A preferred
-	* (user-selected) account that is healthy is tried first; otherwise the
-	* cursor round-robins so consecutive requests spread across accounts and a
-	* still-cooling preferred account is skipped.
+	* Pick the account to serve a request.
+	*
+	* Two distributions, chosen by the `distribution` setting:
+	*
+	* - **priority** (default, and what the card ships with): one account serves
+	*   every request until it is rate-limited, then the next in order takes over.
+	*   Credits drain one account at a time, and a cooling account returns to the
+	*   head of the queue the moment its window resets — it was never consumed, so
+	*   it resumes straight away.
+	* - **round-robin**: consecutive requests rotate through the pool so spend
+	*   spreads evenly across every account.
+	*
+	* In both modes an explicit user selection (`prefer`) heads the list, a
+	* cooling account is skipped for that model only, and an unrecognised setting
+	* falls back to priority.
+	*
+	* Scans on first use, and rescans when every known account is cooling down: a
+	* fresh desktop login is the usual way out of an exhausted pool.
 	*/
 	async acquire(modelId, region) {
 		if (this.accounts.length === 0) await this.scan();
@@ -700,21 +843,25 @@ var WorkBuddyAccountPool = class {
 			pool = this.available(Date.now(), modelId, region);
 		}
 		if (pool.length === 0) return void 0;
-		let start = this.cursor % pool.length;
 		if (this.preferredId !== void 0) {
 			const preferredIndex = pool.findIndex((account) => account.id === this.preferredId);
-			if (preferredIndex !== -1) start = preferredIndex;
-		}
-		for (let step = 0; step < pool.length; step += 1) {
-			const account = pool[(start + step) % pool.length];
-			if (account === void 0) continue;
-			await this.ensureFresh(account);
-			this.cursor = (start + step + 1) % pool.length;
-			return account;
+			if (preferredIndex > 0) {
+				const [preferred] = pool.splice(preferredIndex, 1);
+				if (preferred !== void 0) pool = [preferred, ...pool];
+			}
 		}
-		return pool[0];
+		const index = this.distribution === "round-robin" ? this.cursor % pool.length : 0;
+		const account = pool[index];
+		if (account === void 0) return void 0;
+		if (this.distribution === "round-robin") this.cursor = (index + 1) % pool.length;
+		await this.ensureFresh(account);
+		return account;
 	}
 	/** Pin the account the plugin card should prefer; tokens stay out of settings. */
+	/** How the pool currently spreads requests. Shown on the card. */
+	currentDistribution() {
+		return this.distribution;
+	}
 	prefer(accountId) {
 		this.preferredId = accountId;
 	}
@@ -1741,6 +1888,7 @@ async function poolWebStatus(deps, region = "cn") {
 		}, selection)),
 		selection,
 		region,
+		distribution: deps.pool.currentDistribution(),
 		regions,
 		shim
 	};
@@ -1884,6 +2032,7 @@ const DEFAULT_CONTEXT_BUDGET = 2e5;
 const Config = z.object({
 	authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app own location)"),
 	cooldownMs: z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds"),
+	distribution: z.union(["priority", "round-robin"]).default("priority").description("How requests are spread: priority (drain one) or round-robin"),
 	enabledModelIds: z.array(z.string()).default([]).description("Model ids enabled in the picker (empty = all)"),
 	imageModelIds: z.array(z.string()).default([]).description("Model ids accepting image input (empty = follow upstream)"),
 	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Per-model context-window override, keyed by model id")
@@ -1940,10 +2089,11 @@ function apply(ctx, config = {}) {
 		}
 	};
 	const applyConfigFromSource = () => {
-		const { authFile, cooldownMs, enabledModelIds, imageModelIds, contextBudgets } = current();
+		const { authFile, cooldownMs, distribution, enabledModelIds, imageModelIds, contextBudgets } = current();
 		core.pool.applyConfig({
 			...authFile === void 0 ? {} : { authDirs: [dirname(authFile)] },
-			...cooldownMs === void 0 ? {} : { cooldownMs }
+			...cooldownMs === void 0 ? {} : { cooldownMs },
+			distribution: distribution ?? "priority"
 		});
 		core.catalog.applySelection({
 			...enabledModelIds === void 0 ? {} : { enabledModelIds },

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-xdpool",
   "displayName": "DSH WorkBuddy XD Pool",
   "description": "Merge every locally signed-in WorkBuddy account into DeepSeek Harness as one auto-failing-over model pool (multi-account rotation, live credits, daily check-in and model catalog).",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "license": "MIT",
   "author": "aosi526",
   "repository": {