dsh-workbuddy-xdpool 0.3.0 → 0.4.1

package/CHANGELOG.md

@@ -4,6 +4,81 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 0.4.1 (2026-09-19)
+
+这次主要修了三个毛病。
+
+### 一、国际版账号终于能被识别了
+
+之前国际版账号一直检测不到。原因是筛选登录文件时只认「点号」拼出来的文件名，而国际版客户端登录后生成的文件是 `workbuddy-desktop-ai.info`（中间是连字符），于是被整个跳过了。
+
+现在改成只看文件后缀，不管文件名长什么样都能收进来。实测国内版 4 个、国际版 1 个账号都能正常识别。
+
+### 二、国内版和国际版不再共用同一份模型列表
+
+之前两个版本共用同一份模型清单，而且这份清单只从国内版账号拉取 —— 换句话说，国际版看到的其实一直是国内版的模型。
+
+现在两个版本各查各的：
+
+- 国内版：16 个模型
+- 国际版：21 个模型（之前只有凑数的 10 个，而且内容还是国内版的）
+
+国际版独有的 Auto / Fast / Balanced 这些模型现在也能正常显示。
+
+顺带修了国际版读取模型的方式：它的接口地址和客户端标识跟国内版都不一样，之前照搬国内版的写法，国际版那边会直接报错，所以才一直退回那份凑数的清单。
+
+### 三、模型选择器里同一个供应商不再被拆成两组
+
+之前模型选择器里「WorkBuddy XD Pool（国内版）」「（国际版）」会各出现两次，免费模型和付费模型被分到不同的组，中间还夹着别的插件，看着像重复注册了。
+
+根因是插件把每个模型都上报成「不支持图片」。宿主上如果装了图片增强类插件，它会给这些模型再补一条**名字一模一样**的条目，于是同一个名字就出现了两遍。
+
+现在按上游真实的能力上报，分组就合并回来了。
+
+另外卡片里的「图片输入」勾选也改了语义：勾选只表示**额外**支持图片，不会再反过来把没勾选的模型降级成「不支持」。
+
+## 0.4.0 (2026-09-16)
+
+本次更新来自两条用户反馈与一次上游兼容性对齐：账号现在可以**按顺序逐个用尽**（不再平均分摊），积分包**逐条显示具体到期时刻**，并修掉了一处会让所有接口返回 401 的凭据选择缺陷。
+
+### 新增
+
+- **账号使用方式可切换（优先 / 轮换）**：卡片状态行下方新增开关，默认**优先模式**。
+
+  - **优先模式**：始终由同一个账号服务，直到它被限流才顺延到下一个；冷却结束后它**立刻回到队首**接管 —— 该账号的积分在冷却期间并未被消耗，所以无需从头排队。
+  - **轮换模式**：保留原来的平均分摊行为，供希望把额度摊平到各账号的用户选择。
+  - 切换**即时生效**并写入插件设置，**对所有账号、所有切换状态通用**，不需要重启宿主。
+  - 优先级顺序是确定性的：桌面 App 当前登录的账号 → 上游签发时间较新者 → 存储过期时间较晚者。此前顺序取决于文件名字典序，实际会出现 `0, 2, 1` 这类非预期排列。
+
+- **积分包逐条显示到期时刻**：原先只给出「3 天内到期」的合计数，看不到具体时间；现在每个积分包单独标注它的到期时刻（精确到分钟，例如「到期 09/19 15:36」），3 天内到期的以琥珀色高亮。月度周期套餐显示下次刷新时刻（「刷新 10/01 00:00」）。
+
+  - 之所以精确到分钟而不是只给日期：上游发放一次性礼包的到期时刻是**任意的钟点**，并非「过 0 点即失效」，只显示日期会让人误判。
+
+### 布局
+
+- **积分包列表改为两行网格**：包名与数量在首行左右分栏，到期时刻在次行跨栏并与包名左对齐。此前到期时刻被挤到第二行且从容器左边缘起排，列表看起来参差不齐。
+
+### 修复
+
+- **同一账号存在多个凭据文件时会选中已失效的那一个，导致积分 / 签到 / 模型全部返回 401**。此前按**存储的 `expiresAt` 最大**来挑选凭据，但 `expiresAt` 描述的是「签发时有效期有多长」，**不代表上游仍然接受** —— 上游吊销 token 时不会同步改写该字段，于是一个早已失效的备份可以声称比真实可用的文件**更晚过期**，从而被长期选中。
+
+  - 现改用 **`auth.lastRefreshTime`（上游自己的签发时间）** 作为新鲜度判据，并在解析凭据时读入该字段。排序优先级：① 桌面 App 当前登录的 live 文件 → ② 签发时间较新者 → ③ 存储过期时间（仅作为文档缺少签发时间时的回退，保证比较是全序的）。
+
+- **国际版登录域名识别不全**：参考桌面客户端自身的国际域名清单（`workbuddy.ai`、`workbuddy.cc`），并补充 CodeBuddy CLI 使用的 `codebuddy.ai`。此前只识别 `workbuddy.ai`，落在其他拼写上的国际账号会被误判为国内版，token 被发往国内网关而在 openresty 层被拒绝。
+
+- **国际网关写死单一域名**：国际版账号按品牌域名区分且**互不通用**（在 `codebuddy.ai` 签发的 token 会被 `workbuddy.ai` 网关拒绝，反之亦然），因此网关地址改为**跟随凭据自身的域**，未识别的域名回落至桌面端网关。chat / billing / referer / 模型目录四处一并生效。
+
+- **上游以 HTML 页面拒绝凭据时给出可执行提示**：识别 openresty / APISIX 的鉴权拒绝（401/403 且响应体是 HTML），改为提示「凭据已被上游网关拒绝，通常说明用的是旧登录留下的失效凭据；请重新登录 WorkBuddy 桌面端后在卡片中选择该账号」，不再原样抛出 HTML 片段。非鉴权类的非 JSON 响应保持原有的通用提示。
+
+- **部分模型不显示思考档位**：上游部分模型的推理元数据使用**单数形式**（`effort` 而非 `supportedEfforts`），此前该形态会被直接丢弃。现将其规范化为插件已理解的复数形状，并携带声明的档位到 `defaultEffort`。
+
+### 测试
+
+- 新增 `tests/pool-priority.test.ts`（10 例）：优先模式下连续请求命中同一账号、仅在该账号冷却后顺延、冷却结束后回归队首、按模型冷却不影响其他模型；轮换模式的轮转与运行时切换；凭据新鲜度的四类排序（live 优先、签发时间优先、缺失签发时间时回退过期时间、秒/毫秒单位归一化）。
+- 修正 `tests/failover.test.ts` 中依赖轮转顺序的限流桩：改为按**已出现的不同凭据数**计次，不再假设「token 序号即账号位置」，因此与账号排序解耦。
+- 全套 **36 个测试通过**。
+
+
 ## 0.3.0 (2026-09-16)
 
 本次更新把卡片界面按参考插件的形态重做了一遍，并补齐了国内版 / 国际版的完整分离。

package/README.en.md

@@ -15,11 +15,11 @@ Merge **every WorkBuddy account** you have ever signed into on this machine into
 
 **Settings card (Settings → Plugins → DSH WorkBuddy XD Pool)**
 
-![WorkBuddy pool settings card: pool health, per-account panels, credit packages, totals](assets/settings-card.png)
+![WorkBuddy pool settings card: domestic/international tab strip, pool health, per-account panels, credit packages and totals, per-account daily check-in, and model management (enable, image input, context window)](assets/settings-card.png)
 
-**Model picker (rate multiplier baked into model.name; DSH 0.1.2 composer only reads name)**
+**Model picker (domestic and international appear as two separate supplier groups; the rate multiplier is baked into model.name because the DSH 0.1.2 composer only reads name)**
 
-![Model picker shows the rate and promo badge next to each model name](assets/model-picker.png)
+![Model picker: the domestic and international suppliers each form their own group, with the credit rate and promo badge shown next to every model name](assets/model-picker.png)
 
 **Domestic / international dual suppliers (each with its own accounts, credits and models, usable at the same time)**
 

package/README.md

@@ -15,11 +15,11 @@
 
 **插件配置卡片（设置 → 插件 → DSH WorkBuddy XD Pool）**
 
-![WorkBuddy 池设置卡片：池健康状态、账号面板、积分包、合计](assets/settings-card.png)
+![WorkBuddy 池设置卡片：国内版 / 国际版切换栏、池健康状态、账号面板、积分包与合计、每账号每日签到、模型管理（启用勾选 / 图片输入 / 上下文窗口）](assets/settings-card.png)
 
-**模型选择器（倍率直接拼进 model.name：DSH 0.1.2 composer 只读 name）**
+**模型选择器（国内版 / 国际版 两个独立供应商分组；倍率直接拼进 model.name：DSH 0.1.2 composer 只读 name）**
 
-![模型选择器每个模型名后显示倍率与促销标签](assets/model-picker.png)
+![模型选择器：国内版与国际版各占一个分组，每个模型名后显示积分倍率与促销标签](assets/model-picker.png)
 
 **国内版 / 国际版 双供应商（各自独立账号、积分与模型，可同时使用）**
 

package/lib/bin.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { copyFile, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
-import { join, resolve } from "node:path";
+import { basename, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import "@earendil-works/pi-ai";
 import "@earendil-works/pi-ai/api/openai-completions.lazy";
@@ -15,7 +15,18 @@ const CN_BILLING_BASE = "https://www.codebuddy.cn";
 /** Global base for `workbuddy.ai` logins. */
 const GLOBAL_BASE = "https://www.workbuddy.ai";
 /** Client UA the desktop CLI uses. */
+/** Client UA the desktop CLI uses — the CN gateway answers this one. */
 const CLIENT_UA = "CLI/2.63.2 CodeBuddy/2.63.2";
+/**
+* Desktop app UA. The global gateway serves its product config only to this
+* client channel: the CLI UA gets a truncated roster (or an HTTP 500), which
+* is why the international catalog must be read with the desktop spelling.
+*/
+const DESKTOP_UA = "WorkBuddy/5.5.2";
+/** CN model catalog. */
+const MODELS_CATALOG_PATH = "/v2/enterprises/personal/models";
+/** Global product config, which carries the international model roster. */
+const GLOBAL_CONFIG_PATH = "/v3/config";
 const JSON_TIMEOUT_MS = 3e4;
 const ERROR_BODY_LIMIT = 4096;
 /** Insufficient-credit markers, ASCII lowercase plus the original Chinese. */
@@ -38,20 +49,47 @@ const HARD_CREDIT_MARKERS = [
 ];
 /** Session-invalidation markers that mean "sign in again in the WorkBuddy app". */
 const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
+/**
+* Hosts the international product answers on, once each has been stripped of a
+* leading label. The WorkBuddy AI desktop app signs in at `workbuddy.ai` (and
+* the desktop client itself lists `workbuddy.cc` alongside it); the CodeBuddy
+* CLI signs the same international account in at `codebuddy.ai`. All are served
+* by one gateway stack, so all are `global` — missing a spelling sends those
+* tokens to the CN gateway, which rejects them at the openresty layer with an
+* HTML 401 instead of a business JSON error.
+*/
+const GLOBAL_HOSTS = [
+	"workbuddy.ai",
+	"workbuddy.cc",
+	"codebuddy.ai"
+];
+/** Region for a login domain; an empty domain means CN (matching upstream tooling). */
 function regionOf(domain) {
 	const lowered = domain.trim().toLowerCase();
-	if (lowered.endsWith(".workbuddy.ai") || lowered.endsWith(".workbuddy.cc")) return "global";
-	if (lowered === "workbuddy.ai" || lowered === "workbuddy.cc") return "global";
+	for (const host of GLOBAL_HOSTS) if (lowered === host || lowered.endsWith(`.${host}`)) return "global";
 	return "cn";
 }
+/**
+* Gateway for a global credential.
+*
+* International accounts are NOT interchangeable across brand domains: a token
+* issued at `codebuddy.ai` is rejected by the `workbuddy.ai` gateway and vice
+* versa, so the base must follow the credential's own domain rather than one
+* hardcoded host. Anything unrecognised falls back to the desktop app's gateway.
+*/
+function globalBase(credential) {
+	const lowered = credential.domain.trim().toLowerCase();
+	if (lowered === "codebuddy.ai" || lowered.endsWith(".codebuddy.ai")) return "https://www.codebuddy.ai";
+	return GLOBAL_BASE;
+}
 function chatBase(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_CHAT_BASE;
+	return regionOf(credential.domain) === "global" ? globalBase(credential) : CN_CHAT_BASE;
 }
 function billingBase(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_BILLING_BASE;
+	return regionOf(credential.domain) === "global" ? globalBase(credential) : CN_BILLING_BASE;
 }
 function originReferer(credential) {
-	return regionOf(credential.domain) === "global" ? GLOBAL_BASE : CN_BILLING_BASE;
+	return regionOf(credential.domain) === "global" ? globalBase(credential) : CN_BILLING_BASE;
 }
 /** Headers every upstream request shares. */
 function commonHeaders(credential) {
@@ -100,8 +138,23 @@ function billingHeaders(credential) {
 	if (credential.domain !== "") headers["X-Domain"] = credential.domain;
 	return headers;
 }
+/**
+* Gateway denials that arrive as an HTML page rather than a JSON envelope.
+*
+* openresty / APISIX reject a request before it reaches the product when the
+* credential is one the gateway no longer honours — most often a stale sign-in
+* left in the auth directory. The status alone (401) is not actionable and the
+* HTML body leaks nothing useful, so this turns it into a sentence the user can
+* act on.
+*/
+function isGatewayHtmlRejection(status, text) {
+	if (status !== 401 && status !== 403) return false;
+	const head = text.slice(0, 512).toLowerCase();
+	return head.includes("<html") || head.includes("openresty") || head.includes("apisix");
+}
 async function readEnvelope(response) {
 	const text = await response.text();
+	if (isGatewayHtmlRejection(response.status, text)) throw new Error("the WorkBuddy gateway rejected this credential (http 401). This usually means the account is using a stale sign-in the upstream no longer accepts: sign in again in the WorkBuddy desktop app, then pick the account on the plugin card. Run `dsh-workbuddy-xdpool doctor` to list every credential found.");
 	let parsed;
 	try {
 		parsed = JSON.parse(text);
@@ -146,12 +199,57 @@ function parseCreditMultiplier(value) {
 	return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
 }
 /** Parse the upstream's `reasoning` object; unknown shapes degrade to `{}`. */
+/**
+* The effort ladder the upstream's plural-form payloads declare across both
+* gateways (the live union of every `supportedEfforts` list seen; `minimal` has
+* never appeared). Both gateways also accept every level of it on
+* singular-form models — medium/xhigh fold into high, low/max answer with their
+* own budgets — so a singular `effort` value is a DEFAULT, never the model's
+* only level.
+*/
+const SINGULAR_EFFORT_LADDER = [
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+];
+/**
+* True when `reasoning` arrives in the singular spelling: an `effort` string,
+* with none of the plural-form fields alongside it. Seen on CN
+* `deepseek-v4.1-flash` / `kimi-k3-1` / `glm-5.2` and global
+* `deepseek-v4.1-flash` / `kimi-k3` / `gemini-3.5-flash`.
+*/
+function isSingularEffortForm(raw) {
+	return typeof raw["effort"] === "string" && !Array.isArray(raw["supportedEfforts"]) && typeof raw["defaultEffort"] !== "string" && typeof raw["canDisableThinking"] !== "boolean";
+}
+/**
+* Fold a singular-form `effort` into the plural shape the rest of the plugin
+* already understands. Probes on both gateways show these models answer with
+* distinct `reasoning_content` across the whole ladder — and do not think at
+* all when no `reasoning_effort` is sent — so the fold widens
+* `supportedEfforts` and carries the declared value into `defaultEffort`. An
+* unrecognized `effort` passes through as the lone level.
+*/
+function singularEffortLadder(raw) {
+	const effort = typeof raw["effort"] === "string" ? raw["effort"] : void 0;
+	if (effort === void 0) return void 0;
+	return SINGULAR_EFFORT_LADDER.includes(effort) ? [...SINGULAR_EFFORT_LADDER] : [effort];
+}
+/**
+* Parse the upstream's `reasoning` object; unknown shapes degrade to
+* `undefined`. Both spellings normalize here: the plural form passes through as
+* declared, and the singular `effort` form folds via
+* {@link singularEffortLadder}.
+*/
 function parseReasoning(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
 	const raw = value;
-	const supportedEfforts = Array.isArray(raw["supportedEfforts"]) ? raw["supportedEfforts"].filter((effort) => typeof effort === "string") : void 0;
-	const defaultEffort = typeof raw["defaultEffort"] === "string" ? raw["defaultEffort"] : void 0;
-	const canDisableThinking = typeof raw["canDisableThinking"] === "boolean" ? raw["canDisableThinking"] : void 0;
+	const singularForm = isSingularEffortForm(raw);
+	const effort = typeof raw["effort"] === "string" ? raw["effort"] : void 0;
+	const supportedEfforts = Array.isArray(raw["supportedEfforts"]) ? raw["supportedEfforts"].filter((entry) => typeof entry === "string") : singularEffortLadder(raw);
+	const defaultEffort = typeof raw["defaultEffort"] === "string" ? raw["defaultEffort"] : effort;
+	const canDisableThinking = typeof raw["canDisableThinking"] === "boolean" ? raw["canDisableThinking"] : singularForm ? true : void 0;
 	if (supportedEfforts === void 0 && defaultEffort === void 0 && canDisableThinking === void 0) return;
 	return {
 		...supportedEfforts === void 0 || supportedEfforts.length === 0 ? {} : { supportedEfforts },
@@ -174,6 +272,7 @@ function parseUpstreamModel(value) {
 	const creditMultiplier = parseCreditMultiplier(raw["credits"]);
 	const reasoning = parseReasoning(raw["reasoning"]);
 	const supportsToolCall = typeof raw["supportsToolCall"] === "boolean" ? raw["supportsToolCall"] : void 0;
+	const supportsImages = typeof raw["supportsImages"] === "boolean" ? raw["supportsImages"] : void 0;
 	return {
 		id,
 		name,
@@ -183,7 +282,8 @@ function parseUpstreamModel(value) {
 		...reasoning === void 0 ? {} : { reasoning },
 		...descriptionZh === void 0 ? {} : { descriptionZh },
 		...descriptionEn === void 0 ? {} : { descriptionEn },
-		...supportsToolCall === void 0 ? {} : { supportsToolCall }
+		...supportsToolCall === void 0 ? {} : { supportsToolCall },
+		...supportsImages === void 0 ? {} : { supportsImages }
 	};
 }
 var WorkBuddyUpstreamClient = class {
@@ -287,16 +387,43 @@ var WorkBuddyUpstreamClient = class {
 		if (typeof data["domain"] === "string" && data["domain"] !== "") outcome.domain = data["domain"];
 		return outcome;
 	}
-	/** GET the personal model catalog, keeping the `cli` agent's models only. */
+	/**
+	* Fetch the model catalog, keeping the `cli` agent's models only.
+	*
+	* The two gateways are read differently, because they answer differently:
+	*
+	* - **CN** serves the roster at `/v2/enterprises/personal/models` and expects
+	*   the CLI client spelling.
+	* - **Global** serves it as part of the product config at `/v3/config`, and
+	*   only to the DESKTOP client channel. Asking the global host with the CLI UA
+	*   yields a truncated roster, and the CN path answers HTTP 500 there — which
+	*   is what left the international provider on its static fallback.
+	*
+	* Both documents share the `{ models, agents }` entry shape, so the parsing
+	* below is common to the two branches.
+	*/
 	async fetchModels(credential, signal) {
-		const response = await this.fetchImpl(`${chatBase(credential)}/console/enterprises/personal/models`, {
-			headers: {
-				"Authorization": `Bearer ${credential.accessToken}`,
-				"Accept": "application/json",
-				"Origin": originReferer(credential),
-				"Referer": `${originReferer(credential)}/`,
-				"User-Agent": CLIENT_UA
-			},
+		const global = regionOf(credential.domain) === "global";
+		const url = global ? `${globalBase(credential)}${GLOBAL_CONFIG_PATH}` : `${chatBase(credential)}${MODELS_CATALOG_PATH}`;
+		const headers = global ? {
+			"Authorization": `Bearer ${credential.accessToken}`,
+			"Accept": "application/json",
+			...credential.uid === void 0 || credential.uid === "" ? {} : { "X-User-Id": credential.uid },
+			...credential.domain === "" ? {} : { "X-Domain": credential.domain },
+			"X-Product": "SaaS",
+			"X-Requested-With": "XMLHttpRequest",
+			"Connection": "close",
+			"User-Agent": DESKTOP_UA
+		} : {
+			"Authorization": `Bearer ${credential.accessToken}`,
+			"Accept": "application/json",
+			"Origin": originReferer(credential),
+			"Referer": `${originReferer(credential)}/`,
+			"User-Agent": CLIENT_UA
+		};
+		if (!global && credential.enterpriseId !== void 0 && credential.enterpriseId !== "") headers["X-Enterprise-Id"] = credential.enterpriseId;
+		const response = await this.fetchImpl(url, {
+			headers,
 			...signal === void 0 ? {} : { signal }
 		});
 		const envelope = await readEnvelope(response);
@@ -466,7 +593,6 @@ var WorkBuddyUpstreamClient = class {
 /** Live auth file name the WorkBuddy desktop app writes. */
 const WORKBUDDY_LIVE_FILENAME = "workbuddy-desktop.info";
 /** Snapshot files left behind by previous logins share this prefix. */
-const SNAPSHOT_PREFIX = "workbuddy-desktop.";
 /** Env override for the auth file or its directory. */
 const WORKBUDDY_AUTH_FILE_ENV = "WORKBUDDY_AUTH_FILE";
 function nonEmptyEnv(value) {
@@ -525,11 +651,13 @@ function parseWorkBuddyAuth(text, sourcePath) {
 	if (accessToken === "") return void 0;
 	const refreshExpiresAtMs = typeof auth["refreshExpiresAt"] === "number" ? expiryToMs(auth["refreshExpiresAt"]) : void 0;
 	if (refreshExpiresAtMs !== void 0 && refreshExpiresAtMs > 0 && refreshExpiresAtMs < Date.now()) return;
+	const lastRefreshAtMs = typeof auth["lastRefreshTime"] === "number" ? expiryToMs(auth["lastRefreshTime"]) : void 0;
 	return {
 		accessToken,
 		refreshToken: typeof auth["refreshToken"] === "string" ? auth["refreshToken"] : "",
 		expiresAtMs: typeof auth["expiresAt"] === "number" ? expiryToMs(auth["expiresAt"]) : 0,
 		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
+		...lastRefreshAtMs === void 0 ? {} : { lastRefreshAtMs },
 		...optionalString(identity["nickname"]) === void 0 ? {} : { nickname: optionalString(identity["nickname"]) },
 		...optionalString(identity["uin"]) === void 0 ? {} : { uin: optionalString(identity["uin"]) },
 		...optionalString(identity["uid"]) === void 0 ? {} : { uid: optionalString(identity["uid"]) },
@@ -542,6 +670,42 @@ function parseWorkBuddyAuth(text, sourcePath) {
 * Stable account id. `uin` is the billing identity the upstream keys on and
 * survives re-login; `uid` is the fallback.
 */
+/**
+* True when `path` is the desktop app's live sign-in (as opposed to a backup
+* snapshot it left behind). The live file always wins: it is the session the
+* app itself is using.
+*/
+function isLiveAuthFile(path) {
+	return basename(path) === WORKBUDDY_LIVE_FILENAME;
+}
+/**
+* Which of two credentials for the same account the pool should keep.
+*
+* Ordering, highest first:
+*
+* 1. the live file the desktop app is signed in with;
+* 2. the credential the upstream issued most recently (`lastRefreshAtMs`);
+* 3. the longer stored expiry, as a fallback for documents that carry no issue
+*    time (the plugin's own refreshed copy, older builds).
+*
+* The stored expiry alone is NOT a freshness signal: the upstream does not
+* rewrite it when it revokes a token, so a long-dead backup can claim to expire
+* later than the token that actually works. Selecting on it made every upstream
+* call return 401 while a perfectly good credential sat in the same directory.
+*/
+function compareFreshness(a, b) {
+	const aLive = isLiveAuthFile(a.sourcePath) ? 1 : 0;
+	const bLive = isLiveAuthFile(b.sourcePath) ? 1 : 0;
+	if (aLive !== bLive) return bLive - aLive;
+	const aIssued = a.lastRefreshAtMs ?? 0;
+	const bIssued = b.lastRefreshAtMs ?? 0;
+	if (aIssued !== bIssued) return bIssued - aIssued;
+	return b.expiresAtMs - a.expiresAtMs;
+}
+/** True when `candidate` should replace `incumbent` for the same account. */
+function isFresher(candidate, incumbent) {
+	return compareFreshness(candidate, incumbent) < 0;
+}
 function workbuddyAccountId(credential) {
 	const stable = credential.uin ?? credential.uid ?? credential.nickname ?? "unknown";
 	return createHash("sha256").update(`workbuddy\0${stable}`).digest("hex").slice(0, 16);
@@ -553,6 +717,17 @@ function accountLabel(credential) {
 	return discriminator === "" ? name : `${name}#${discriminator}`;
 }
 /** List the auth files in one directory: the live file plus every snapshot. */
+/**
+* Credential files in one auth directory, freshest first.
+*
+* Every `*.info` file counts, not just the timestamped `workbuddy-desktop.*`
+* snapshots: the international client signs in as `workbuddy-desktop-ai.info`
+* (a hyphen, not a dot), so a prefix test silently dropped every global
+* credential and the global provider then saw an empty pool.
+*
+* Filenames are plain strings, and the ordering here is only a first pass —
+* `isFresher` makes the real call once each file has been parsed.
+*/
 async function authFilesIn(dir) {
 	let entries;
 	try {
@@ -560,10 +735,7 @@ async function authFilesIn(dir) {
 	} catch {
 		return [];
 	}
-	const files = entries.filter((name) => {
-		if (name === "workbuddy-desktop.info") return true;
-		return name.startsWith(SNAPSHOT_PREFIX) && name.endsWith(".info");
-	});
+	const files = entries.filter((name) => name.endsWith(".info"));
 	files.sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
 	return files.map((name) => join(dir, name));
 }
@@ -593,6 +765,8 @@ var WorkBuddyAccountPool = class {
 	client;
 	refreshMarginMs;
 	accounts = [];
+	distribution;
+	/** Cursor for round-robin mode; unused under priority distribution. */
 	cursor = 0;
 	lastScanAtMs = 0;
 	preferredId;
@@ -603,6 +777,7 @@ var WorkBuddyAccountPool = class {
 		this.cooldownMs = options.cooldownMs ?? 6e4;
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
+		this.distribution = options.distribution ?? "priority";
 	}
 	/**
 	* Re-apply configuration that only affects discovery and cooldown policy,
@@ -612,6 +787,7 @@ var WorkBuddyAccountPool = class {
 	applyConfig(options) {
 		if (options.authDirs !== void 0 && options.authDirs.length > 0) this.authDirs = options.authDirs;
 		if (options.cooldownMs !== void 0 && options.cooldownMs >= 1e3) this.cooldownMs = options.cooldownMs;
+		if (options.distribution !== void 0) this.distribution = options.distribution;
 	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
@@ -636,13 +812,15 @@ var WorkBuddyAccountPool = class {
 				});
 				continue;
 			}
-			if ((credential.expiresAtMs ?? 0) > (existing.credential.expiresAtMs ?? 0)) byId.set(id, {
+			if (isFresher(credential, existing.credential)) byId.set(id, {
 				...existing,
 				credential,
 				label: accountLabel(credential)
 			});
 		}
-		this.accounts = [...byId.values()];
+		const ordered = [...byId.values()];
+		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
+		this.accounts = ordered;
 		this.lastScanAtMs = Date.now();
 		return this.accounts;
 	}
@@ -669,12 +847,24 @@ var WorkBuddyAccountPool = class {
 		});
 	}
 	/**
-	* Pick the next usable account for an optional model. Scans on first use,
-	* and rescans when every known account is cooling down — a fresh desktop
-	* login is the usual way out of an exhausted pool. A preferred
-	* (user-selected) account that is healthy is tried first; otherwise the
-	* cursor round-robins so consecutive requests spread across accounts and a
-	* still-cooling preferred account is skipped.
+	* Pick the account to serve a request.
+	*
+	* Two distributions, chosen by the `distribution` setting:
+	*
+	* - **priority** (default, and what the card ships with): one account serves
+	*   every request until it is rate-limited, then the next in order takes over.
+	*   Credits drain one account at a time, and a cooling account returns to the
+	*   head of the queue the moment its window resets — it was never consumed, so
+	*   it resumes straight away.
+	* - **round-robin**: consecutive requests rotate through the pool so spend
+	*   spreads evenly across every account.
+	*
+	* In both modes an explicit user selection (`prefer`) heads the list, a
+	* cooling account is skipped for that model only, and an unrecognised setting
+	* falls back to priority.
+	*
+	* Scans on first use, and rescans when every known account is cooling down: a
+	* fresh desktop login is the usual way out of an exhausted pool.
 	*/
 	async acquire(modelId, region) {
 		if (this.accounts.length === 0) await this.scan();
@@ -684,21 +874,25 @@ var WorkBuddyAccountPool = class {
 			pool = this.available(Date.now(), modelId, region);
 		}
 		if (pool.length === 0) return void 0;
-		let start = this.cursor % pool.length;
 		if (this.preferredId !== void 0) {
 			const preferredIndex = pool.findIndex((account) => account.id === this.preferredId);
-			if (preferredIndex !== -1) start = preferredIndex;
-		}
-		for (let step = 0; step < pool.length; step += 1) {
-			const account = pool[(start + step) % pool.length];
-			if (account === void 0) continue;
-			await this.ensureFresh(account);
-			this.cursor = (start + step + 1) % pool.length;
-			return account;
+			if (preferredIndex > 0) {
+				const [preferred] = pool.splice(preferredIndex, 1);
+				if (preferred !== void 0) pool = [preferred, ...pool];
+			}
 		}
-		return pool[0];
+		const index = this.distribution === "round-robin" ? this.cursor % pool.length : 0;
+		const account = pool[index];
+		if (account === void 0) return void 0;
+		if (this.distribution === "round-robin") this.cursor = (index + 1) % pool.length;
+		await this.ensureFresh(account);
+		return account;
 	}
 	/** Pin the account the plugin card should prefer; tokens stay out of settings. */
+	/** How the pool currently spreads requests. Shown on the card. */
+	currentDistribution() {
+		return this.distribution;
+	}
 	prefer(accountId) {
 		this.preferredId = accountId;
 	}
@@ -891,7 +1085,7 @@ var WorkBuddyCatalog = class {
 		const budgets = this.selection.contextBudgets;
 		return this.models.filter((model) => allow === void 0 || allow.has(model.id)).map((model) => {
 			const next = { ...model };
-			if (imageSet !== void 0) next.supportsImages = imageSet.has(model.id);
+			if (imageSet !== void 0) next.supportsImages = next.supportsImages || imageSet.has(model.id);
 			const budget = budgets?.[model.id];
 			if (budget !== void 0 && budget > 0 && budget < next.contextWindow) next.contextWindow = budget;
 			return next;
@@ -939,7 +1133,7 @@ function toModelInfo(model) {
 		name: model.name,
 		contextWindow: model.contextWindow,
 		maxOutputTokens: model.maxTokens,
-		supportsImages: model.multimodal ?? false,
+		supportsImages: model.supportsImages ?? false,
 		...model.creditMultiplier === void 0 ? {} : { multiplier: model.creditMultiplier },
 		...model.reasoning?.supportedEfforts === void 0 ? {} : { supportedEfforts: model.reasoning.supportedEfforts }
 	};
@@ -963,11 +1157,20 @@ function formatRates(status) {
 z.object({
 	authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app own location)"),
 	cooldownMs: z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds"),
+	distribution: z.union(["priority", "round-robin"]).default("priority").description("How requests are spread: priority (drain one) or round-robin"),
 	enabledModelIds: z.array(z.string()).default([]).description("Model ids enabled in the picker (empty = all)"),
 	imageModelIds: z.array(z.string()).default([]).description("Model ids accepting image input (empty = follow upstream)"),
 	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Per-model context-window override, keyed by model id")
 });
 /** Assemble the runtime objects without registering anything. */
+/**
+* Assemble the runtime objects without registering anything.
+*
+* One catalog per region, mirroring the two shims: the CN and global gateways
+* do not advertise the same roster, and a shared catalog meant the picker showed
+* whichever list happened to be fetched first (always the CN one, since the
+* seeding step read `accounts[0]`).
+*/
 function createCore(logger) {
 	const client = new WorkBuddyUpstreamClient();
 	return {
@@ -975,7 +1178,10 @@ function createCore(logger) {
 			...logger === void 0 ? {} : { logger },
 			client
 		}),
-		catalog: new WorkBuddyCatalog(),
+		catalogs: {
+			cn: new WorkBuddyCatalog(),
+			global: new WorkBuddyCatalog()
+		},
 		client
 	};
 }
@@ -1064,7 +1270,7 @@ async function commandStatus(args) {
 			};
 		}),
 		cooling: accounts.filter((account) => account.cooldownUntilMs > Date.now()).length,
-		models: core.catalog.current().map((model) => ({
+		models: core.catalogs.cn.current().map((model) => ({
 			id: model.id,
 			name: model.name,
 			multiplier: model.multiplier