dsh-workbuddy-xdpool 0.4.5 → 1.0.1

package/CHANGELOG.md

@@ -4,6 +4,67 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 1.0.1 (2026-09-23)
+
+修复两个用号逻辑上的缺陷，并把账号卡片重新排了一遍。
+
+### 一、「当前使用」显示的账号不对
+
+卡片上显示的账号，是你**最近一次实际在用**的那个吗？之前不是 —— 它显示的是「**准备尝试**」的账号。
+
+举个例子：某个账号积分用光了，插件去试它、失败、自动换到另一个号继续服务。但你确实在用（换号成功了），卡片却还显示那个已经废掉的号。
+
+现在改成**只有请求真正成功**才记录，所以显示的永远是你实际在用的那个。
+
+### 二、账号积分用尽时，会直接把错误抛给你
+
+上游有两种"不让用"：
+
+| 情况 | 含义 | 之前的表现 |
+| --- | --- | --- |
+| **频率限制** | 这个号暂时被限流，等会儿能恢复 | 正确：冷却这个号，**自动换号** |
+| **额度用尽** | 这个号这个周期的积分花完了 | ❌ **直接报错给你**，不换号 |
+
+现在额度用尽也会**自动换到有积分的账号**，并把那个号整体停用 30 分钟（不是只停用某个模型）。请求不会再因此失败。
+
+### 三、账号卡片排版重做
+
+- 每个账号的**开关**做成了胶囊按钮（和「账号使用方式」同一套样式），一眼能看出是开还是关
+- 账号卡**分层更清楚**：标题行（名字｜状态｜开关）→ 分隔线 → 信息与积分两栏
+- 去掉了多余的边框和重复信息（不再显示 `www.workbuddy.cn` 这类域名 —— 上面的区域标签已经说明了）
+- 新增顶部「**当前使用**」提示条，一眼看到正在用哪个号
+
+## 1.0.0 (2026-09-21)
+
+这一版把「账号」和「用号方式」都交给你控制。
+
+### 一、可以停用不想用的账号了
+
+账号列表里每个账号右侧新增一个开关，关掉它这个账号就**不再参与请求**。
+
+- 关掉的账号仍然显示在列表里（变灰），随时可以再打开
+- 设置会被保存，**重启 DSH 后依然有效**
+- 只影响路由，不会删除或改动你的登录凭据
+
+### 二、新增「均衡」用号模式
+
+原来的两种方式都保留，另加一种：
+
+| 模式 | 行为 |
+| --- | --- |
+| **优先**（默认，行为不变） | 一直用同一个账号，直到它被限流才换下一个 |
+| **均衡**（新增） | 每个可用账号都参与抽取，**闲置越久权重越高** |
+| **轮换** | 严格轮流，把额度摊平 |
+
+**为什么需要「均衡」**：默认的「优先」会死磕第一个账号，把它打到限流才换 —— 如果你有 5 个号，其余 4 个基本闲着。切到「均衡」后请求会自然分散到各个账号，**更不容易撞限流**，可用时间更长。
+
+在卡片顶部「账号使用方式」里切换，即时生效。
+
+### 其他
+
+- 显式选定的账号（如卡片上「下一个」标记的那个）在三种模式下**都会被优先使用**
+- 处于冷却中的账号在「均衡」模式下**一定不会被选中**，冷却结束自动回到抽取池
+
 ## 0.4.5 (2026-09-21)
 
 本版**功能与 0.4.4 完全相同**，只是换了一条发布通道。

package/lib/bin.js

@@ -758,10 +758,38 @@ function candidateAuthDirs(env = process.env) {
 * Read-only pool of every discovered WorkBuddy account, with rate-limit
 * cooldown and round-robin failover.
 */
+/** Idle bonus per hour an account has been unused (reference-panel default). */
+const IDLE_WEIGHT_PER_HOUR = .5;
+/** Ceiling for the idle bonus, so an idle account cannot dominate forever. */
+const IDLE_WEIGHT_MAX = 5;
+/**
+* Weight one account by how long it has been idle.
+*
+* The base of 1 keeps every eligible account in play: an account that served a
+* moment ago still has a small chance, so a single unhealthy account cannot pin
+* the pool to itself, and the weights never sum to zero.
+*
+* `lastUsedAt === undefined` means "never used in this process", which earns the
+* full bonus: on a fresh start every account ties, and the weighted draw spreads
+* the first requests instead of always picking the first entry.
+*/
+function idleWeight(lastUsedAt, now) {
+	if (lastUsedAt === void 0) return 6;
+	const hours = (now - lastUsedAt) / 36e5;
+	return 1 + Math.min(Math.max(hours, 0) * IDLE_WEIGHT_PER_HOUR, IDLE_WEIGHT_MAX);
+}
+/** Default rest for an account whose credits ran out (packs reset on their own schedule). */
+const EXHAUST_COOLDOWN_MS = 18e5;
 var WorkBuddyAccountPool = class {
 	logger;
 	authDirs;
 	cooldownMs;
+	/**
+	* How long an account stays out of rotation after the upstream reports its
+	* credits are spent. Credit packs reset on their own schedule rather than on a
+	* rate-limit window, so this is much longer than `cooldownMs`.
+	*/
+	exhaustCooldownMs;
 	client;
 	refreshMarginMs;
 	accounts = [];
@@ -770,11 +798,30 @@ var WorkBuddyAccountPool = class {
 	cursor = 0;
 	lastScanAtMs = 0;
 	preferredId;
+	/**
+	* Account ids the user switched off on the card.
+	*
+	* Disabling is a user preference rather than a property of the credential:
+	* `scan()` rebuilds every account object from the auth files, so the set
+	* lives on the pool and is re-applied from settings after each scan.
+	*/
+	disabledIds = /* @__PURE__ */ new Set();
+	/**
+	* Last time each account served a request, epoch ms. Drives the idle term
+	* of the priority-mode weighting below: an account that just served loses to
+	* one that has been idle, so a small pool stops hammering a single account.
+	*
+	* In-memory on purpose: it only biases the next pick, so a cold start that
+	* treats every account as idle is the right default. Not keyed by id lookup
+	* misses because a removed account simply disappears from the map on re-scan.
+	*/
+	lastUsedAt = /* @__PURE__ */ new Map();
 	refreshInflight = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
 		this.logger = options.logger;
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
 		this.cooldownMs = options.cooldownMs ?? 6e4;
+		this.exhaustCooldownMs = options.exhaustCooldownMs ?? EXHAUST_COOLDOWN_MS;
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.distribution = options.distribution ?? "priority";
@@ -787,7 +834,9 @@ var WorkBuddyAccountPool = class {
 	applyConfig(options) {
 		if (options.authDirs !== void 0 && options.authDirs.length > 0) this.authDirs = options.authDirs;
 		if (options.cooldownMs !== void 0 && options.cooldownMs >= 1e3) this.cooldownMs = options.cooldownMs;
+		if (options.exhaustCooldownMs !== void 0 && options.exhaustCooldownMs >= 1e3) this.exhaustCooldownMs = options.exhaustCooldownMs;
 		if (options.distribution !== void 0) this.distribution = options.distribution;
+		if (options.disabledAccountIds !== void 0) this.disabledIds = new Set(options.disabledAccountIds);
 	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
@@ -840,12 +889,47 @@ var WorkBuddyAccountPool = class {
 	*/
 	available(now, modelId, region) {
 		return this.accounts.filter((account) => {
+			if (this.disabledIds.has(account.id)) return false;
 			if (account.cooldownUntilMs > now) return false;
 			if (modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now) return false;
 			if (region !== void 0 && regionOf(account.credential.domain) !== region) return false;
 			return true;
 		});
 	}
+	/** Round-robin: the legacy cursor walk, kept for the distribution that asks for it. */
+	pickRoundRobin(pool) {
+		const index = this.cursor % pool.length;
+		const account = pool[index];
+		if (account === void 0) return void 0;
+		this.cursor = (index + 1) % pool.length;
+		return account;
+	}
+	/**
+	* Priority mode: weighted random over the eligible accounts.
+	*
+	* The weight is an idle bonus — `1 + min(idleHours * perHour, max)` — so an
+	* account that has never served (or has been idle for a while) outranks one
+	* that just answered. Reference panel logic drops its success-rate term
+	* entirely because a lifetime error counter penalises an account forever;
+	* instantaneous health is already handled by cooldowns, which is why those
+	* accounts never reach this list.
+	*
+	* A pool with no idle history (fresh process) hashes to equal weights, which
+	* spreads the very first picks instead of always returning index 0.
+	*/
+	pickByWeight(pool) {
+		if (pool.length === 1) return pool[0];
+		const now = Date.now();
+		const weights = pool.map((account) => idleWeight(this.lastUsedAt.get(account.id), now));
+		const total = weights.reduce((sum, weight) => sum + weight, 0);
+		if (!Number.isFinite(total) || total <= 0) return pool[0];
+		let roll = Math.random() * total;
+		for (let index = 0; index < pool.length; index += 1) {
+			roll -= weights[index] ?? 0;
+			if (roll < 0) return pool[index];
+		}
+		return pool[pool.length - 1];
+	}
 	/**
 	* Pick the account to serve a request.
 	*
@@ -875,16 +959,14 @@ var WorkBuddyAccountPool = class {
 		}
 		if (pool.length === 0) return void 0;
 		if (this.preferredId !== void 0) {
-			const preferredIndex = pool.findIndex((account) => account.id === this.preferredId);
-			if (preferredIndex > 0) {
-				const [preferred] = pool.splice(preferredIndex, 1);
-				if (preferred !== void 0) pool = [preferred, ...pool];
+			const preferred = pool.find((account) => account.id === this.preferredId);
+			if (preferred !== void 0) {
+				await this.ensureFresh(preferred);
+				return preferred;
 			}
 		}
-		const index = this.distribution === "round-robin" ? this.cursor % pool.length : 0;
-		const account = pool[index];
+		const account = this.distribution === "round-robin" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : pool[0];
 		if (account === void 0) return void 0;
-		if (this.distribution === "round-robin") this.cursor = (index + 1) % pool.length;
 		await this.ensureFresh(account);
 		return account;
 	}
@@ -896,6 +978,48 @@ var WorkBuddyAccountPool = class {
 	prefer(accountId) {
 		this.preferredId = accountId;
 	}
+	/** Whether the user switched this account off on the card. */
+	isDisabled(accountId) {
+		return this.disabledIds.has(accountId);
+	}
+	/** Every account id the user switched off, in discovery order. */
+	disabledIdsInOrder() {
+		return this.accounts.filter((account) => this.disabledIds.has(account.id)).map((account) => account.id);
+	}
+	/**
+	* Record that an account actually served a request.
+	*
+	* Called by the shim once the upstream answers 200 — only then is the account
+	* the one the user is really being served by. `balanced` mode reads the same map
+	* for its idle weighting, so a request that failed over to another account must
+	* not count as used for the account that was merely tried.
+	*/
+	noteServed(accountId) {
+		if (!this.accounts.some((account) => account.id === accountId)) return;
+		this.lastUsedAt.set(accountId, Date.now());
+	}
+	/**
+	* The account that served the most recent request, if any.
+	*
+	* Distinct from "who would serve the next one": this is a record of what
+	* actually happened, which is what the card needs to answer "which account am
+	* I using right now?". Under `balanced` there is no deterministic next account
+	* at all, so a recorded fact is the only honest answer.
+	*
+	* Returns undefined before the first request of the process, and after every
+	* known account has been re-scanned away (a login swapped out under us).
+	*/
+	lastServedId() {
+		let newest;
+		for (const [id, at] of this.lastUsedAt) {
+			if (!this.accounts.some((account) => account.id === id)) continue;
+			if (newest === void 0 || at > newest.at) newest = {
+				id,
+				at
+			};
+		}
+		return newest?.id;
+	}
 	/** Best-effort refresh of one account after a session-dead upstream answer. */
 	async refreshAccount(accountId) {
 		const account = this.accounts.find((item) => item.id === accountId);
@@ -946,6 +1070,23 @@ var WorkBuddyAccountPool = class {
 		}
 	}
 	/**
+	* Cool a whole account after the upstream reports its credits are spent.
+	*
+	* Credit exhaustion is an ACCOUNT condition, unlike a model rate limit: every
+	* model on that account is unusable until the quota resets, so this cools the
+	* account as a whole (no `modelId`) for the configured exhaustion window. The
+	* shim then rotates to a different account instead of failing the request.
+	*/
+	penalizeExhausted(accountId) {
+		const until = Date.now() + this.exhaustCooldownMs;
+		this.penalize(accountId, until);
+		this.logger?.warn(`
+dsh-workbuddy-xdpool: account credits exhausted; cooling the whole account until 
+
+${new Date(until).toISOString()}
+`);
+	}
+	/**
 	* Mark an account (or one of its models) rate-limited.
 	*
 	* With `modelId`, only that model on the account is cooled — the account's
@@ -1173,6 +1314,7 @@ z.object({
 	authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app own location)"),
 	cooldownMs: z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds"),
 	distribution: z.union(["priority", "round-robin"]).default("priority").description("How requests are spread: priority (drain one) or round-robin"),
+	disabledAccountIds: z.array(z.string()).default([]).description("Account ids excluded from the pool (empty = every discovered account participates)"),
 	enabledModelIds: z.array(z.string()).default([]).description("Legacy shared model-id list; used by a region that has no per-region selection yet"),
 	imageModelIds: z.array(z.string()).default([]).description("Legacy shared image-id list; used by a region that has no per-region selection yet"),
 	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Legacy shared context budgets; used by a region with no per-region selection yet"),

package/lib/client.js

@@ -128,11 +128,32 @@ window.__ModuleLoader__.load({
 /* Account list (each account = a labeled subpanel, same as dingminhua). */
 .dsm-workbuddy-xdpool-accounts{display:flex;flex-direction:column;gap:14px;border-top:1px solid var(--dsw-alias-border-l2,#36373b);padding-top:14px}
 .dsm-workbuddy-xdpool-accounts-head{display:flex;align-items:center;justify-content:space-between;gap:12px}
+/* "In use now": answers which account is serving without scanning every row. */
+/* A hairline + tint reads as status; a filled bar would read as a call to action. */
+.dsm-workbuddy-xdpool-current{display:flex;align-items:center;gap:9px;flex-wrap:wrap;margin:10px 0 0;padding:9px 13px;border:1px solid color-mix(in oklab, var(--dsw-alias-state-success-primary,#22a06b) 32%, transparent);border-radius:12px;background:color-mix(in oklab, var(--dsw-alias-state-success-primary,#22a06b) 9%, transparent)}
+.dsm-workbuddy-xdpool-current-dot{width:7px;height:7px;border-radius:50%;flex:none;background:var(--dsw-alias-state-success-primary,#22a06b);box-shadow:0 0 0 3px color-mix(in oklab, var(--dsw-alias-state-success-primary,#22a06b) 18%, transparent)}
+.dsm-workbuddy-xdpool-current-label{color:var(--dsw-alias-state-success-primary,#22a06b);font-size:11.5px;line-height:18px;font-weight:600;letter-spacing:.02em;flex:none}
+.dsm-workbuddy-xdpool-current-name{color:var(--dsw-alias-label-primary,#e6e6e6);font-size:13px;line-height:18px;font-weight:600;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dsm-workbuddy-xdpool-current-note{color:var(--dsw-alias-state-warning-primary,#d97706);font-size:11px;line-height:16px}
 .dsm-workbuddy-xdpool-accounts-title{margin:0;color:var(--dsw-alias-label-primary,#e6e6e6);font-size:14px;font-weight:600;line-height:20px}
 .dsm-workbuddy-xdpool-accounts-summary{margin:2px 0 0;color:var(--dsw-alias-label-tertiary,#999);font-size:12px;line-height:18px}
-.dsm-workbuddy-xdpool-account{display:flex;align-items:center;justify-content:space-between;gap:12px;padding:12px 14px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:14px;background:var(--dsw-alias-bg-layer-2,#24262c)}
-.dsm-workbuddy-xdpool-account-copy{display:flex;flex-direction:column;gap:3px;min-width:0}
+.dsm-workbuddy-xdpool-account{display:flex;flex-direction:column;gap:0;padding:0;border:1px solid color-mix(in oklab, var(--dsw-alias-border-l2,#3a3d45) 55%, transparent);border-radius:16px;background:var(--dsw-alias-bg-layer-2,#24262c);box-shadow:0 1px 3px rgba(0,0,0,.04);overflow:hidden}
+/* Body row inside a card: identity on the left, credit panels on the right. */
+/* flex-wrap lets the panels drop below on a narrow card instead of squeezing both. */
+.dsm-workbuddy-xdpool-account-body{display:flex;align-items:stretch;gap:0;flex-wrap:wrap}
+.dsm-workbuddy-xdpool-account-copy{display:flex;flex-direction:column;align-items:flex-start;gap:6px;flex:1 1 200px;min-width:0;padding:14px 16px;justify-content:center}
 .dsm-workbuddy-xdpool-account-label{color:var(--dsw-alias-label-primary,#e6e6e6);font-size:14px;font-weight:600;line-height:20px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dsm-workbuddy-xdpool-account-head .dsm-workbuddy-xdpool-account-toggle{margin-left:auto}
+.dsm-workbuddy-xdpool-account-head{display:flex;align-items:center;gap:10px;min-width:0;padding:12px 16px;border-bottom:1px solid color-mix(in oklab, var(--dsw-alias-border-l2,#3a3d45) 45%, transparent)}
+/* Account switched off on the card: still listed (so it can be turned back on) but visually muted. */
+.dsm-workbuddy-xdpool-account-off{opacity:.55}
+/* Small pill switch: "in rotation" vs "off". Native checkbox styled by the label. */
+.dsm-workbuddy-xdpool-account-toggle{appearance:none;font:inherit;display:inline-flex;align-items:center;gap:5px;cursor:pointer;flex:none;border:1px solid color-mix(in oklab, var(--dsw-alias-border-l2,#3a3d45) 70%, transparent);border-radius:999px;padding:3px 10px;font-size:11px;line-height:17px;background:transparent;color:var(--dsw-alias-label-tertiary,#9aa0a8);transition:color .16s,border-color .16s,background .16s}
+.dsm-workbuddy-xdpool-account-toggle:hover:not(:disabled){color:var(--dsw-alias-label-primary,#e6e6e6);border-color:var(--dsw-alias-label-dimmed,#777)}
+.dsm-workbuddy-xdpool-account-toggle:focus-visible{outline:2px solid var(--dsw-alias-brand-primary,#5686fe);outline-offset:1px}
+.dsm-workbuddy-xdpool-account-toggle:disabled{cursor:default;opacity:.6}
+.dsm-workbuddy-xdpool-account-toggle-on{background:color-mix(in oklab, var(--dsw-alias-state-success-primary,#22a06b) 14%, transparent);border-color:color-mix(in oklab, var(--dsw-alias-state-success-primary,#22a06b) 55%, transparent);color:var(--dsw-alias-state-success-primary,#22a06b);font-weight:600}
+.dsm-workbuddy-xdpool-account-toggle-dot{width:6px;height:6px;border-radius:50%;flex:none;background:currentColor;opacity:.9}
 .dsm-workbuddy-xdpool-account-tags{display:flex;align-items:center;gap:6px;flex-wrap:wrap}
 .dsm-workbuddy-xdpool-account-tag{padding:1px 8px;border-radius:999px;font-size:11px;line-height:18px;background:var(--dsw-alias-state-success-subtle,rgba(34,160,107,.12));color:var(--dsw-alias-state-success-primary,#22a06b)}
 .dsm-workbuddy-xdpool-account-tag-cooling{background:var(--dsw-alias-state-warning-subtle,rgba(217,119,6,.15));color:var(--dsw-alias-state-warning-primary,#d97706)}
@@ -143,9 +164,9 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-account-error{margin:0;color:var(--dsw-alias-state-error-primary,#ef4444);font-size:13px;line-height:20px}
 
 /* Two-column stats: packages on the left, total + check-in on the right. */
-.dsm-workbuddy-xdpool-stats{display:grid;grid-template-columns:minmax(0,1.5fr) minmax(170px,.85fr);gap:10px;margin-top:10px}
-.dsm-workbuddy-xdpool-panel{display:flex;flex-direction:column;min-width:0;gap:7px;padding:14px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;background:var(--dsw-alias-bg-layer-2,#24262c)}
-.dsm-workbuddy-xdpool-panel-title{color:var(--dsw-alias-label-tertiary,#999);font-size:12px;line-height:18px}
+.dsm-workbuddy-xdpool-stats{display:grid;grid-template-columns:minmax(0,1.45fr) minmax(168px,.85fr);gap:0;flex:1 1 420px;min-width:0;max-width:660px;border-left:1px solid color-mix(in oklab, var(--dsw-alias-border-l2,#3a3d45) 45%, transparent)}
+.dsm-workbuddy-xdpool-panel{display:flex;flex-direction:column;min-width:0;gap:7px;padding:14px 16px}
+.dsm-workbuddy-xdpool-panel-title{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px;letter-spacing:.03em;text-transform:uppercase;font-weight:600}
 .dsm-workbuddy-xdpool-panel-empty{color:var(--dsw-alias-label-tertiary,#999);font-size:14px;line-height:20px}
 .dsm-workbuddy-xdpool-panel-error{color:var(--dsw-alias-state-error-primary,#ef4444);font-size:12px;line-height:18px;word-break:break-word}
 .dsm-workbuddy-xdpool-panel-foot{display:flex;align-items:baseline;justify-content:space-between;gap:10px;margin-top:9px;padding-top:9px;border-top:1px solid var(--dsw-alias-border-l2,#36373b);color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:12px;line-height:18px}
@@ -163,9 +184,9 @@ window.__ModuleLoader__.load({
    fold onto their own line so a long package name cannot squeeze them out. */
 .dsm-workbuddy-xdpool-packages-when{grid-column:1/-1;color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:11px;line-height:15px;font-variant-numeric:tabular-nums}
 .dsm-workbuddy-xdpool-packages-when-soon{color:var(--dsw-alias-state-warning-primary,#d97706)}
-.dsm-workbuddy-xdpool-panel-total{position:relative;align-items:center;text-align:center;overflow:hidden}
+.dsm-workbuddy-xdpool-panel-total{position:relative;align-items:center;text-align:center;justify-content:center;overflow:hidden;background:color-mix(in oklab, var(--dsw-alias-state-success-primary,#22a06b) 5%, transparent)}
 .dsm-workbuddy-xdpool-panel-total::before{content:"";position:absolute;top:0;left:0;right:0;height:3px;opacity:.9;background:var(--dsw-alias-state-success-primary,#22a06b)}
-.dsm-workbuddy-xdpool-total-value{color:var(--dsw-alias-state-success-primary,#22a06b);font-size:30px;line-height:34px;font-weight:700;letter-spacing:-.5px;white-space:nowrap;font-variant-numeric:tabular-nums}
+.dsm-workbuddy-xdpool-total-value{color:var(--dsw-alias-state-success-primary,#22a06b);font-size:28px;line-height:32px;font-weight:800;letter-spacing:-.02em;white-space:nowrap;font-variant-numeric:tabular-nums}
 
 /* Model directory list. */
 .dsm-workbuddy-xdpool-models{display:flex;flex-direction:column;gap:10px;border-top:1px solid var(--dsw-alias-border-l2,#36373b);padding-top:14px}
@@ -374,6 +395,8 @@ window.__ModuleLoader__.load({
 			const [flash, setFlash] = (0, react.useState)(void 0);
 			/** Account id whose daily claim is currently in flight. */
 			const [checkinBusyId, setCheckinBusyId] = (0, react.useState)(void 0);
+			/** Account id whose enable/disable switch is in flight, if any. */
+			const [accountBusyId, setAccountBusyId] = (0, react.useState)(void 0);
 			/**
 			* Draft model selection. `undefined` means "no local edits"; once a checkbox
 			* is touched the draft takes over and is what the Save button posts. Discard
@@ -509,6 +532,35 @@ window.__ModuleLoader__.load({
 					if (mounted.current) setCheckinBusyId(void 0);
 				}
 			};
+			/**
+			* Switch one account in or out of the pool.
+			*
+			* The id travels in the body and the host validates it against the accounts it
+			* really knows, so a stale tab cannot write an orphan id. Disabling only stops
+			* the account from being picked — it stays listed so it can be turned back on —
+			* and the change is saved through the settings section, so it survives a
+			* restart and is re-applied after every re-scan.
+			*/
+			const toggleAccountDisabled = async (accountId, disabled) => {
+				const write = settingsScope?.set;
+				if (write === void 0) {
+					setError(t?.("row.modelsSaveError", { message: "settings scope is read-only" }) ?? "settings scope is read-only");
+					return;
+				}
+				setAccountBusyId(accountId);
+				setFlash(void 0);
+				try {
+					const current = (status?.accounts ?? []).filter((account) => account.disabled === true).map((account) => account.id);
+					const next = disabled ? current.includes(accountId) ? current : [...current, accountId] : current.filter((id) => id !== accountId);
+					await write.call(settingsScope, "disabledAccountIds", next);
+					await refresh(activeRegion);
+				} catch (cause) {
+					const message = cause instanceof Error ? cause.message : String(cause);
+					if (mounted.current) setError(t?.("row.accountToggleError", { message }) ?? "Could not switch the account: " + message);
+				} finally {
+					if (mounted.current) setAccountBusyId(void 0);
+				}
+			};
 			/** Keep the draft in step with the server copy while nothing is dirty. */
 			const modelDraft = draft ?? (status === void 0 ? {} : draftFromStatus(status));
 			/** Model edits need a writable settings scope; otherwise the rows are read-only. */
@@ -722,17 +774,21 @@ window.__ModuleLoader__.load({
 											children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 												className: "dsm-workbuddy-xdpool-dist-title",
 												children: t?.("row.distTitle") ?? "Account usage"
-											}), ["priority", "round-robin"].map((option) => {
+											}), [
+												"priority",
+												"balanced",
+												"round-robin"
+											].map((option) => {
 												const active = (status.distribution ?? "priority") === option;
-												const label = option === "priority" ? t?.("row.distPriority") ?? "Priority" : t?.("row.distRoundRobin") ?? "Round-robin";
-												const hint = option === "priority" ? t?.("row.distPriorityHint") ?? "" : t?.("row.distRoundRobinHint") ?? "";
+												const label = option === "priority" ? t?.("row.distPriority") ?? "Priority" : option === "balanced" ? t?.("row.distBalanced") ?? "Balanced" : t?.("row.distRoundRobin") ?? "Round-robin";
+												const hint = option === "priority" ? t?.("row.distPriorityHint") ?? "" : option === "balanced" ? t?.("row.distBalancedHint") ?? "" : t?.("row.distRoundRobinHint") ?? "";
 												return /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 													type: "button",
 													role: "radio",
 													"aria-checked": active,
 													title: hint,
 													disabled: !modelsEditable,
-													className: `dsm-workbuddy-xdpool-dist-option${active ? " dsm-workbuddy-xdpool-dist-option-active" : ""}`,
+													className: "dsm-workbuddy-xdpool-dist-option" + (active ? " dsm-workbuddy-xdpool-dist-option-active" : ""),
 													onClick: () => {
 														setDistribution(option);
 													},
@@ -801,27 +857,55 @@ window.__ModuleLoader__.load({
 							accountCount > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 								className: "dsm-workbuddy-xdpool-accounts",
 								"aria-label": t?.("row.accountsTitle") ?? "Accounts",
-								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-									className: "dsm-workbuddy-xdpool-accounts-head",
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
-										className: "dsm-workbuddy-xdpool-accounts-title",
-										children: t?.("row.accountsTitle") ?? "Accounts in the pool"
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
-										className: "dsm-workbuddy-xdpool-accounts-summary",
-										children: t?.("row.accountsSummary", {
-											count: accountCount,
-											cooling
-										}) ?? `${accountCount} account(s) · ${cooling} cooling`
-									})]
-								}), status?.accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountBlock, {
-									account,
-									...status.activeAccountId === void 0 ? {} : { activeAccountId: status.activeAccountId },
-									...checkinBusyId === void 0 ? {} : { checkinBusyId },
-									onClaimCheckin: (accountId) => {
-										claimCheckin(accountId);
-									},
-									t
-								}, account.id))]
+								children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+										className: "dsm-workbuddy-xdpool-accounts-head",
+										children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
+											className: "dsm-workbuddy-xdpool-accounts-title",
+											children: t?.("row.accountsTitle") ?? "Accounts in the pool"
+										}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+											className: "dsm-workbuddy-xdpool-accounts-summary",
+											children: t?.("row.accountsSummary", {
+												count: accountCount,
+												cooling
+											}) ?? `${accountCount} account(s) · ${cooling} cooling`
+										})]
+									}),
+									(() => {
+										const active = status?.activeAccountId === void 0 ? void 0 : status.accounts.find((account) => account.id === status.activeAccountId);
+										if (active === void 0) return null;
+										return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+											className: "dsm-workbuddy-xdpool-current",
+											children: [
+												/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: "dsm-workbuddy-xdpool-current-dot" }),
+												/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+													className: "dsm-workbuddy-xdpool-current-label",
+													children: t?.("row.currentAccount") ?? "In use now"
+												}),
+												/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+													className: "dsm-workbuddy-xdpool-current-name",
+													children: active.label
+												}),
+												active.disabled === true ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+													className: "dsm-workbuddy-xdpool-current-note",
+													children: t?.("row.currentAccountDisabled") ?? "disabled — will switch on the next request"
+												}) : null
+											]
+										});
+									})(),
+									status?.accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountBlock, {
+										account,
+										...checkinBusyId === void 0 ? {} : { checkinBusyId },
+										onClaimCheckin: (accountId) => {
+											claimCheckin(accountId);
+										},
+										onToggleDisabled: (accountId, disabled) => {
+											toggleAccountDisabled(accountId, disabled);
+										},
+										...accountBusyId === void 0 ? {} : { accountBusyId },
+										t
+									}, account.id))
+								]
 							}) : null,
 							(status?.models.length ?? 0) > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 								className: "dsm-workbuddy-xdpool-models",
@@ -880,66 +964,75 @@ window.__ModuleLoader__.load({
 			});
 		}
 		/** One account block: label + status tag + meta + optional credit panels. */
-		function AccountBlock({ account, activeAccountId, t, checkinBusyId, onClaimCheckin }) {
-			const isActive = account.id === activeAccountId;
+		function AccountBlock({ account, t, checkinBusyId, onClaimCheckin, accountBusyId, onToggleDisabled }) {
+			const isDisabled = account.disabled === true;
 			const isCooling = account.cooling === true;
 			const cooldownUntil = account.cooldownUntil !== void 0 ? Date.parse(account.cooldownUntil) : void 0;
 			const modelCooldowns = account.modelCooldowns ?? [];
-			const tag = isActive ? {
-				text: t?.("row.accountNext") ?? "Next up",
-				cls: "dsm-workbuddy-xdpool-account-tag"
-			} : isCooling ? {
+			const tag = isCooling ? {
 				text: t?.("row.cooling") ?? "Cooling",
 				cls: "dsm-workbuddy-xdpool-account-tag dsm-workbuddy-xdpool-account-tag-cooling"
 			} : null;
 			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				className: "dsm-workbuddy-xdpool-account",
+				className: isDisabled ? "dsm-workbuddy-xdpool-account dsm-workbuddy-xdpool-account-off" : "dsm-workbuddy-xdpool-account",
 				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-					className: "dsm-workbuddy-xdpool-account-copy",
+					className: "dsm-workbuddy-xdpool-account-head",
 					children: [
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: "dsm-workbuddy-xdpool-account-label",
 							children: account.label
 						}),
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "dsm-workbuddy-xdpool-account-tags",
-							children: tag === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: tag.cls,
-								children: tag.text
-							})
-						}),
-						account.domain !== "" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: "dsm-workbuddy-xdpool-account-meta",
-							children: account.domain
+						tag === null ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: tag.cls,
+							children: tag.text
 						}),
-						account.expiresAt !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: "dsm-workbuddy-xdpool-account-meta",
-							children: t?.("row.tokenExpiry", { time: formatDateTime(account.expiresAt) }) ?? `token ${formatDateTime(account.expiresAt)}`
-						}) : null,
-						isCooling && cooldownUntil !== void 0 && !Number.isNaN(cooldownUntil) ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
-							className: "dsm-workbuddy-xdpool-account-meta",
-							children: [
-								t?.("row.cooldownUntil", { time: formatTime(cooldownUntil) }) ?? `until ${formatTime(cooldownUntil)}`,
-								" · ",
-								t?.("row.cooldownHits", { hits: account.rateLimitHits ?? 0 }) ?? `${account.rateLimitHits ?? 0} hit(s)`
-							]
-						}) : null,
-						modelCooldowns.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-							className: "dsm-workbuddy-xdpool-account-modelcool",
-							children: modelCooldowns.map((mc) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-								className: "dsm-workbuddy-xdpool-account-modelcool-chip",
-								children: t?.("row.modelCooling", {
-									model: mc.modelId,
-									time: formatDateTime(mc.until)
-								}) ?? `${mc.modelId} cooling to ${formatDateTime(mc.until)}`
-							}, mc.modelId))
-						}) : null
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+							type: "button",
+							role: "switch",
+							"aria-checked": !isDisabled,
+							className: isDisabled ? "dsm-workbuddy-xdpool-account-toggle" : "dsm-workbuddy-xdpool-account-toggle dsm-workbuddy-xdpool-account-toggle-on",
+							title: t?.("row.accountToggleHint") ?? "Enable this account (uncheck to keep it out of the pool)",
+							disabled: accountBusyId === account.id,
+							onClick: () => {
+								onToggleDisabled(account.id, !isDisabled);
+							},
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", { className: "dsm-workbuddy-xdpool-account-toggle-dot" }), isDisabled ? t?.("row.accountOff") ?? "Disabled" : t?.("row.accountInRotation") ?? "Enabled"]
+						})
 					]
-				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountStats, {
-					account,
-					t,
-					checkinBusy: checkinBusyId === account.id,
-					onClaim: onClaimCheckin
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+					className: "dsm-workbuddy-xdpool-account-body",
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: "dsm-workbuddy-xdpool-account-copy",
+						children: [
+							account.expiresAt !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "dsm-workbuddy-xdpool-account-meta",
+								children: t?.("row.tokenExpiry", { time: formatDateTime(account.expiresAt) }) ?? `token ${formatDateTime(account.expiresAt)}`
+							}) : null,
+							isCooling && cooldownUntil !== void 0 && !Number.isNaN(cooldownUntil) ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "dsm-workbuddy-xdpool-account-meta",
+								children: [
+									t?.("row.cooldownUntil", { time: formatTime(cooldownUntil) }) ?? `until ${formatTime(cooldownUntil)}`,
+									" · ",
+									t?.("row.cooldownHits", { hits: account.rateLimitHits ?? 0 }) ?? `${account.rateLimitHits ?? 0} hit(s)`
+								]
+							}) : null,
+							modelCooldowns.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: "dsm-workbuddy-xdpool-account-modelcool",
+								children: modelCooldowns.map((mc) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dsm-workbuddy-xdpool-account-modelcool-chip",
+									children: t?.("row.modelCooling", {
+										model: mc.modelId,
+										time: formatDateTime(mc.until)
+									}) ?? `${mc.modelId} cooling to ${formatDateTime(mc.until)}`
+								}, mc.modelId))
+							}) : null
+						]
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountStats, {
+						account,
+						t,
+						checkinBusy: checkinBusyId === account.id,
+						onClaim: onClaimCheckin
+					})]
 				})]
 			});
 		}
@@ -1185,7 +1278,12 @@ window.__ModuleLoader__.load({
 			"row.accountsSummary": "{count} account(s) · {cooling} cooling",
 			"row.ok": "Healthy — requests auto-rotate across accounts",
 			"row.allCooling": "Every account is rate-limited right now; requests pause until a cooldown lifts.",
-			"row.accountNext": "Next up",
+			"row.accountInRotation": "Enabled",
+			"row.accountOff": "Disabled",
+			"row.accountToggleHint": "Enable this account (uncheck to keep it out of the pool)",
+			"row.accountToggleError": "Could not switch the account: {message}",
+			"row.currentAccount": "In use now",
+			"row.currentAccountDisabled": "switched off — the next request moves on",
 			"row.cooling": "Cooling (rate-limited)",
 			"row.cooldownHits": "{hits} hit(s)",
 			"row.cooldownUntil": "until {time}",
@@ -1238,6 +1336,8 @@ window.__ModuleLoader__.load({
 			"row.distPriorityHint": "Drain one account before moving to the next",
 			"row.distRoundRobin": "Round-robin",
 			"row.distRoundRobinHint": "Spread the spend evenly across accounts",
+			"row.distBalanced": "Balanced",
+			"row.distBalancedHint": "Draw from every account, favouring whichever has been idle longest",
 			"row.accountsScanning": "Detecting…",
 			"row.resetCooldowns": "Clear all cooldowns",
 			"row.resetCooldownsBusy": "Clearing…",
@@ -1271,7 +1371,12 @@ window.__ModuleLoader__.load({
 			"row.accountsSummary": "{count} 个账号 · {cooling} 个冷却中",
 			"row.ok": "运行健康 —— 请求会在各账号间自动轮换",
 			"row.allCooling": "当前所有账号都处于限流冷却，请求会暂停直到某个冷却结束。",
-			"row.accountNext": "下一个",
+			"row.accountInRotation": "已启用",
+			"row.accountOff": "已停用",
+			"row.accountToggleHint": "启用该账号（取消勾选则不参与池子）",
+			"row.accountToggleError": "切换账号失败：{message}",
+			"row.currentAccount": "当前使用",
+			"row.currentAccountDisabled": "已停用 —— 下次请求会换号",
 			"row.cooling": "冷却中（被限流）",
 			"row.cooldownHits": "触发 {hits} 次",
 			"row.cooldownUntil": "至 {time}",
@@ -1324,6 +1429,8 @@ window.__ModuleLoader__.load({
 			"row.distPriorityHint": "优先用完一个账号再换下一个",
 			"row.distRoundRobin": "轮换模式",
 			"row.distRoundRobinHint": "积分平均分摊到各账号",
+			"row.distBalanced": "均衡",
+			"row.distBalancedHint": "每个账号都参与抽取，闲置越久权重越高",
 			"row.accountsScanning": "正在检测…",
 			"row.resetCooldowns": "清除所有冷却",
 			"row.resetCooldownsBusy": "正在清除…",

package/lib/index.d.ts

@@ -228,7 +228,7 @@ export declare function workbuddyAccountId(credential: Pick<WorkBuddyCredential,
 /** Every directory the pool should scan, in probe order. */
 export declare function candidateAuthDirs(env?: NodeJS.ProcessEnv): string[];
 /** How the pool chooses which account serves the next request. */
-type AccountDistribution = 'priority' | 'round-robin';
+type AccountDistribution = 'priority' | 'round-robin' | 'balanced';
 interface AccountPoolOptions {
   /** Logger for discovery and rotation events. */
   logger?: {
@@ -240,6 +240,8 @@ interface AccountPoolOptions {
   authDirs?: readonly string[];
   /** How long a rate-limited account stays out of rotation. */
   cooldownMs?: number;
+  /** How long an account rests after its credits run out (default 30 minutes). */
+  exhaustCooldownMs?: number;
   /** Upstream client used to refresh near-expiry tokens. */
   client?: TokenRefresher;
   /** Refresh this long before actual expiry; default five minutes. */
@@ -256,14 +258,16 @@ interface AccountPoolOptions {
    */
   distribution?: AccountDistribution;
 }
-/**
- * Read-only pool of every discovered WorkBuddy account, with rate-limit
- * cooldown and round-robin failover.
- */
 export declare class WorkBuddyAccountPool {
   private readonly logger;
   private authDirs;
   private cooldownMs;
+  /**
+   * How long an account stays out of rotation after the upstream reports its
+   * credits are spent. Credit packs reset on their own schedule rather than on a
+   * rate-limit window, so this is much longer than `cooldownMs`.
+   */
+  private exhaustCooldownMs;
   private readonly client;
   private readonly refreshMarginMs;
   private accounts;
@@ -272,6 +276,24 @@ export declare class WorkBuddyAccountPool {
   private cursor;
   private lastScanAtMs;
   private preferredId;
+  /**
+   * Account ids the user switched off on the card.
+   *
+   * Disabling is a user preference rather than a property of the credential:
+   * `scan()` rebuilds every account object from the auth files, so the set
+   * lives on the pool and is re-applied from settings after each scan.
+   */
+  private disabledIds;
+  /**
+   * Last time each account served a request, epoch ms. Drives the idle term
+   * of the priority-mode weighting below: an account that just served loses to
+   * one that has been idle, so a small pool stops hammering a single account.
+   *
+   * In-memory on purpose: it only biases the next pick, so a cold start that
+   * treats every account as idle is the right default. Not keyed by id lookup
+   * misses because a removed account simply disappears from the map on re-scan.
+   */
+  private lastUsedAt;
   private refreshInflight;
   constructor(options?: AccountPoolOptions);
   /**
@@ -282,7 +304,9 @@ export declare class WorkBuddyAccountPool {
   applyConfig(options: {
     authDirs?: readonly string[];
     cooldownMs?: number;
+    exhaustCooldownMs?: number;
     distribution?: AccountDistribution;
+    disabledAccountIds?: readonly string[];
   }): void;
   /** Rescan the auth directories and merge newly discovered accounts. */
   scan(): Promise<WorkBuddyAccount[]>;
@@ -298,6 +322,22 @@ export declare class WorkBuddyAccountPool {
    * model, e.g. CLI diagnostics).
    */
   private available;
+  /** Round-robin: the legacy cursor walk, kept for the distribution that asks for it. */
+  private pickRoundRobin;
+  /**
+   * Priority mode: weighted random over the eligible accounts.
+   *
+   * The weight is an idle bonus — `1 + min(idleHours * perHour, max)` — so an
+   * account that has never served (or has been idle for a while) outranks one
+   * that just answered. Reference panel logic drops its success-rate term
+   * entirely because a lifetime error counter penalises an account forever;
+   * instantaneous health is already handled by cooldowns, which is why those
+   * accounts never reach this list.
+   *
+   * A pool with no idle history (fresh process) hashes to equal weights, which
+   * spreads the very first picks instead of always returning index 0.
+   */
+  private pickByWeight;
   /**
    * Pick the account to serve a request.
    *
@@ -323,6 +363,31 @@ export declare class WorkBuddyAccountPool {
   /** How the pool currently spreads requests. Shown on the card. */
   currentDistribution(): AccountDistribution;
   prefer(accountId: string | undefined): void;
+  /** Whether the user switched this account off on the card. */
+  isDisabled(accountId: string): boolean;
+  /** Every account id the user switched off, in discovery order. */
+  disabledIdsInOrder(): string[];
+  /**
+   * Record that an account actually served a request.
+   *
+   * Called by the shim once the upstream answers 200 — only then is the account
+   * the one the user is really being served by. `balanced` mode reads the same map
+   * for its idle weighting, so a request that failed over to another account must
+   * not count as used for the account that was merely tried.
+   */
+  noteServed(accountId: string): void;
+  /**
+   * The account that served the most recent request, if any.
+   *
+   * Distinct from "who would serve the next one": this is a record of what
+   * actually happened, which is what the card needs to answer "which account am
+   * I using right now?". Under `balanced` there is no deterministic next account
+   * at all, so a recorded fact is the only honest answer.
+   *
+   * Returns undefined before the first request of the process, and after every
+   * known account has been re-scanned away (a login swapped out under us).
+   */
+  lastServedId(): string | undefined;
   /** Best-effort refresh of one account after a session-dead upstream answer. */
   refreshAccount(accountId: string): Promise<void>;
   /**
@@ -332,6 +397,15 @@ export declare class WorkBuddyAccountPool {
    * endpoint never takes down a working session.
    */
   private ensureFresh;
+  /**
+   * Cool a whole account after the upstream reports its credits are spent.
+   *
+   * Credit exhaustion is an ACCOUNT condition, unlike a model rate limit: every
+   * model on that account is unusable until the quota resets, so this cools the
+   * account as a whole (no `modelId`) for the configured exhaustion window. The
+   * shim then rotates to a different account instead of failing the request.
+   */
+  penalizeExhausted(accountId: string): void;
   /**
    * Mark an account (or one of its models) rate-limited.
    *
@@ -572,6 +646,11 @@ interface PoolWebAccount {
     modelId: string;
     until: string;
   }>;
+  /**
+   * Whether the user switched this account off. A disabled account never
+   * serves a request, but it stays listed so the card can switch it back on.
+   */
+  disabled: boolean;
   rateLimitHits: number;
   /** ISO timestamp of the last successful use (best-effort pool bookkeeping). */
   lastUsedAt?: string;
@@ -657,7 +736,6 @@ interface PoolWebModel {
   /** Whether this model is currently enabled in the picker. */
   enabled: boolean;
 }
-/** The user's saved model selection, echoed back so the card can diff a draft. */
 interface PoolWebModelSelection {
   /** Absent = every model is enabled. */
   enabledModelIds?: readonly string[];
@@ -697,7 +775,7 @@ interface PoolWebStatus {
  */
 type PoolRegion = 'cn' | 'global';
 /** How the pool spreads requests across its accounts. */
-type PoolDistribution = 'priority' | 'round-robin';
+type PoolDistribution = 'priority' | 'round-robin' | 'balanced';
 //#endregion
 //#region src/index.d.ts
 /** Stable Cordis plugin name. */
@@ -725,6 +803,13 @@ export interface Config {
    * spend evenly instead. Absent reads as `priority`.
    */
   distribution?: 'priority' | 'round-robin';
+  /**
+   * Account ids switched off on the card. A disabled account is never picked
+   * to serve a request, but it stays in the pool and on the card so it can be
+   * switched back on. Ids are the pool's stable per-credential keys, which
+   * survive re-scans (see WorkBuddyAccountPool.disabledIds).
+   */
+  disabledAccountIds?: string[];
   /**
    * Model ids enabled in the picker. Absent means "every model the catalog
    * advertises" — an unconfigured install should never present an empty model

package/lib/index.js

@@ -774,10 +774,38 @@ function candidateAuthDirs(env = process.env) {
 * Read-only pool of every discovered WorkBuddy account, with rate-limit
 * cooldown and round-robin failover.
 */
+/** Idle bonus per hour an account has been unused (reference-panel default). */
+const IDLE_WEIGHT_PER_HOUR = .5;
+/** Ceiling for the idle bonus, so an idle account cannot dominate forever. */
+const IDLE_WEIGHT_MAX = 5;
+/**
+* Weight one account by how long it has been idle.
+*
+* The base of 1 keeps every eligible account in play: an account that served a
+* moment ago still has a small chance, so a single unhealthy account cannot pin
+* the pool to itself, and the weights never sum to zero.
+*
+* `lastUsedAt === undefined` means "never used in this process", which earns the
+* full bonus: on a fresh start every account ties, and the weighted draw spreads
+* the first requests instead of always picking the first entry.
+*/
+function idleWeight(lastUsedAt, now) {
+	if (lastUsedAt === void 0) return 6;
+	const hours = (now - lastUsedAt) / 36e5;
+	return 1 + Math.min(Math.max(hours, 0) * IDLE_WEIGHT_PER_HOUR, IDLE_WEIGHT_MAX);
+}
+/** Default rest for an account whose credits ran out (packs reset on their own schedule). */
+const EXHAUST_COOLDOWN_MS = 18e5;
 var WorkBuddyAccountPool = class {
 	logger;
 	authDirs;
 	cooldownMs;
+	/**
+	* How long an account stays out of rotation after the upstream reports its
+	* credits are spent. Credit packs reset on their own schedule rather than on a
+	* rate-limit window, so this is much longer than `cooldownMs`.
+	*/
+	exhaustCooldownMs;
 	client;
 	refreshMarginMs;
 	accounts = [];
@@ -786,11 +814,30 @@ var WorkBuddyAccountPool = class {
 	cursor = 0;
 	lastScanAtMs = 0;
 	preferredId;
+	/**
+	* Account ids the user switched off on the card.
+	*
+	* Disabling is a user preference rather than a property of the credential:
+	* `scan()` rebuilds every account object from the auth files, so the set
+	* lives on the pool and is re-applied from settings after each scan.
+	*/
+	disabledIds = /* @__PURE__ */ new Set();
+	/**
+	* Last time each account served a request, epoch ms. Drives the idle term
+	* of the priority-mode weighting below: an account that just served loses to
+	* one that has been idle, so a small pool stops hammering a single account.
+	*
+	* In-memory on purpose: it only biases the next pick, so a cold start that
+	* treats every account as idle is the right default. Not keyed by id lookup
+	* misses because a removed account simply disappears from the map on re-scan.
+	*/
+	lastUsedAt = /* @__PURE__ */ new Map();
 	refreshInflight = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
 		this.logger = options.logger;
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
 		this.cooldownMs = options.cooldownMs ?? 6e4;
+		this.exhaustCooldownMs = options.exhaustCooldownMs ?? EXHAUST_COOLDOWN_MS;
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.distribution = options.distribution ?? "priority";
@@ -803,7 +850,9 @@ var WorkBuddyAccountPool = class {
 	applyConfig(options) {
 		if (options.authDirs !== void 0 && options.authDirs.length > 0) this.authDirs = options.authDirs;
 		if (options.cooldownMs !== void 0 && options.cooldownMs >= 1e3) this.cooldownMs = options.cooldownMs;
+		if (options.exhaustCooldownMs !== void 0 && options.exhaustCooldownMs >= 1e3) this.exhaustCooldownMs = options.exhaustCooldownMs;
 		if (options.distribution !== void 0) this.distribution = options.distribution;
+		if (options.disabledAccountIds !== void 0) this.disabledIds = new Set(options.disabledAccountIds);
 	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
@@ -856,12 +905,47 @@ var WorkBuddyAccountPool = class {
 	*/
 	available(now, modelId, region) {
 		return this.accounts.filter((account) => {
+			if (this.disabledIds.has(account.id)) return false;
 			if (account.cooldownUntilMs > now) return false;
 			if (modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now) return false;
 			if (region !== void 0 && regionOf(account.credential.domain) !== region) return false;
 			return true;
 		});
 	}
+	/** Round-robin: the legacy cursor walk, kept for the distribution that asks for it. */
+	pickRoundRobin(pool) {
+		const index = this.cursor % pool.length;
+		const account = pool[index];
+		if (account === void 0) return void 0;
+		this.cursor = (index + 1) % pool.length;
+		return account;
+	}
+	/**
+	* Priority mode: weighted random over the eligible accounts.
+	*
+	* The weight is an idle bonus — `1 + min(idleHours * perHour, max)` — so an
+	* account that has never served (or has been idle for a while) outranks one
+	* that just answered. Reference panel logic drops its success-rate term
+	* entirely because a lifetime error counter penalises an account forever;
+	* instantaneous health is already handled by cooldowns, which is why those
+	* accounts never reach this list.
+	*
+	* A pool with no idle history (fresh process) hashes to equal weights, which
+	* spreads the very first picks instead of always returning index 0.
+	*/
+	pickByWeight(pool) {
+		if (pool.length === 1) return pool[0];
+		const now = Date.now();
+		const weights = pool.map((account) => idleWeight(this.lastUsedAt.get(account.id), now));
+		const total = weights.reduce((sum, weight) => sum + weight, 0);
+		if (!Number.isFinite(total) || total <= 0) return pool[0];
+		let roll = Math.random() * total;
+		for (let index = 0; index < pool.length; index += 1) {
+			roll -= weights[index] ?? 0;
+			if (roll < 0) return pool[index];
+		}
+		return pool[pool.length - 1];
+	}
 	/**
 	* Pick the account to serve a request.
 	*
@@ -891,16 +975,14 @@ var WorkBuddyAccountPool = class {
 		}
 		if (pool.length === 0) return void 0;
 		if (this.preferredId !== void 0) {
-			const preferredIndex = pool.findIndex((account) => account.id === this.preferredId);
-			if (preferredIndex > 0) {
-				const [preferred] = pool.splice(preferredIndex, 1);
-				if (preferred !== void 0) pool = [preferred, ...pool];
+			const preferred = pool.find((account) => account.id === this.preferredId);
+			if (preferred !== void 0) {
+				await this.ensureFresh(preferred);
+				return preferred;
 			}
 		}
-		const index = this.distribution === "round-robin" ? this.cursor % pool.length : 0;
-		const account = pool[index];
+		const account = this.distribution === "round-robin" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : pool[0];
 		if (account === void 0) return void 0;
-		if (this.distribution === "round-robin") this.cursor = (index + 1) % pool.length;
 		await this.ensureFresh(account);
 		return account;
 	}
@@ -912,6 +994,48 @@ var WorkBuddyAccountPool = class {
 	prefer(accountId) {
 		this.preferredId = accountId;
 	}
+	/** Whether the user switched this account off on the card. */
+	isDisabled(accountId) {
+		return this.disabledIds.has(accountId);
+	}
+	/** Every account id the user switched off, in discovery order. */
+	disabledIdsInOrder() {
+		return this.accounts.filter((account) => this.disabledIds.has(account.id)).map((account) => account.id);
+	}
+	/**
+	* Record that an account actually served a request.
+	*
+	* Called by the shim once the upstream answers 200 — only then is the account
+	* the one the user is really being served by. `balanced` mode reads the same map
+	* for its idle weighting, so a request that failed over to another account must
+	* not count as used for the account that was merely tried.
+	*/
+	noteServed(accountId) {
+		if (!this.accounts.some((account) => account.id === accountId)) return;
+		this.lastUsedAt.set(accountId, Date.now());
+	}
+	/**
+	* The account that served the most recent request, if any.
+	*
+	* Distinct from "who would serve the next one": this is a record of what
+	* actually happened, which is what the card needs to answer "which account am
+	* I using right now?". Under `balanced` there is no deterministic next account
+	* at all, so a recorded fact is the only honest answer.
+	*
+	* Returns undefined before the first request of the process, and after every
+	* known account has been re-scanned away (a login swapped out under us).
+	*/
+	lastServedId() {
+		let newest;
+		for (const [id, at] of this.lastUsedAt) {
+			if (!this.accounts.some((account) => account.id === id)) continue;
+			if (newest === void 0 || at > newest.at) newest = {
+				id,
+				at
+			};
+		}
+		return newest?.id;
+	}
 	/** Best-effort refresh of one account after a session-dead upstream answer. */
 	async refreshAccount(accountId) {
 		const account = this.accounts.find((item) => item.id === accountId);
@@ -962,6 +1086,23 @@ var WorkBuddyAccountPool = class {
 		}
 	}
 	/**
+	* Cool a whole account after the upstream reports its credits are spent.
+	*
+	* Credit exhaustion is an ACCOUNT condition, unlike a model rate limit: every
+	* model on that account is unusable until the quota resets, so this cools the
+	* account as a whole (no `modelId`) for the configured exhaustion window. The
+	* shim then rotates to a different account instead of failing the request.
+	*/
+	penalizeExhausted(accountId) {
+		const until = Date.now() + this.exhaustCooldownMs;
+		this.penalize(accountId, until);
+		this.logger?.warn(`
+dsh-workbuddy-xdpool: account credits exhausted; cooling the whole account until 
+
+${new Date(until).toISOString()}
+`);
+	}
+	/**
 	* Mark an account (or one of its models) rate-limited.
 	*
 	* With `modelId`, only that model on the account is cooled — the account's
@@ -1333,10 +1474,10 @@ function createWorkBuddyAdapter(options) {
 		streamIdleTimeoutMs: WORKBUDDY_STREAM_IDLE_TIMEOUT_MS,
 		retryPolicy: resolveRetryPolicy(void 0, "dsh-workbuddy-xdpool retryPolicy"),
 		configuredMaxTokens: /* @__PURE__ */ new Map(),
-		modelErrors: /* @__PURE__ */ new Map(),
 		...REQUEST_IMAGE_BUDGETS,
 		piProvider: provider
 	};
+	Object.assign(profile, { modelErrors: /* @__PURE__ */ new Map() });
 	let profiles = /* @__PURE__ */ new Map([[providerId, profile]]);
 	return {
 		providerId,
@@ -1573,6 +1714,7 @@ function createWorkBuddyShim(options) {
 			const result = await client.chatStream(account.credential, prepared, controller.signal);
 			if (result.ok) {
 				logger?.info?.(`dsh-workbuddy-xdpool: served by ${account.label}`);
+				pool.noteServed(account.id);
 				res.writeHead(200, {
 					"Content-Type": "text/event-stream",
 					"Cache-Control": "no-cache",
@@ -1601,6 +1743,11 @@ function createWorkBuddyShim(options) {
 				await pool.refreshAccount(account.id);
 				continue;
 			}
+			if (result.kind === "hard_credit") {
+				pool.penalizeExhausted(account.id);
+				logger?.warn(`dsh-workbuddy-xdpool: ${account.label} has no credits left (attempt ${attempt + 1}/${maxAttempts}); rotating`);
+				continue;
+			}
 			if (result.kind !== "soft_rate") break;
 			exhaustedByRateLimit = true;
 			pool.penalize(account.id, parseRateLimitReset(result.message), modelId);
@@ -1739,6 +1886,8 @@ const POOL_RESET_COOLDOWN_PATH = "/plugins/dsh-workbuddy-xdpool/cooldowns/reset"
 const POOL_CHECKIN_PATH = "/plugins/dsh-workbuddy-xdpool/checkin";
 /** Plugin-owned model-selection save endpoint (writes the settings section). */
 const POOL_MODELS_SAVE_PATH = "/plugins/dsh-workbuddy-xdpool/models/save";
+/** Switch one account in or out of the pool (card toggle). */
+const POOL_ACCOUNT_DISABLE_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/disabled";
 //#endregion
 //#region src/web-status.ts
 /** Redact token-like content before it crosses to the browser. */
@@ -1830,7 +1979,25 @@ function parseSelection(body) {
 	}
 	return out;
 }
-function toWebAccount(account) {
+/**
+* Validate the account-toggle body. Returns undefined for anything malformed so
+* the route answers 400 instead of writing a half-applied switch.
+*
+* The id must name a currently known account: accepting an arbitrary string
+* would let a stale tab (or a renamed credential) leave orphan ids in the
+* settings file that no card can ever switch back off.
+*/
+function parseAccountToggle(body, known) {
+	const accountId = typeof body["accountId"] === "string" ? body["accountId"].trim() : "";
+	const disabled = body["disabled"];
+	if (accountId === "" || typeof disabled !== "boolean") return void 0;
+	if (!known(accountId)) return void 0;
+	return {
+		accountId,
+		disabled
+	};
+}
+function toWebAccount(account, disabled) {
 	const now = Date.now();
 	const cooling = account.cooldownUntilMs > now;
 	const modelCooldowns = Object.entries(account.modelCooldowns).filter(([, until]) => until > now).sort((a, b) => a[1] - b[1]).map(([modelId, until]) => ({
@@ -1846,6 +2013,7 @@ function toWebAccount(account) {
 		cooling,
 		...cooling ? { cooldownUntil: new Date(account.cooldownUntilMs).toISOString() } : {},
 		...modelCooldowns.length === 0 ? {} : { modelCooldowns },
+		disabled,
 		rateLimitHits: account.rateLimitHits
 	};
 }
@@ -1878,7 +2046,7 @@ async function poolWebStatus(deps, region = "cn") {
 	const rows = [];
 	const now = Date.now();
 	for (const account of accounts) {
-		const row = toWebAccount(account);
+		const row = toWebAccount(account, deps.pool.isDisabled(account.id));
 		if (!row.cooling) {
 			try {
 				const credits = await deps.client.fetchCredits(account.credential);
@@ -1911,7 +2079,8 @@ async function poolWebStatus(deps, region = "cn") {
 		rows.push(row);
 	}
 	const cooling = rows.filter((row) => row.cooling).length;
-	const firstUsable = accounts.find((account) => account.cooldownUntilMs <= now);
+	const lastServed = deps.pool.lastServedId();
+	const firstUsable = lastServed !== void 0 ? accounts.find((account) => account.id === lastServed) : accounts.find((account) => account.cooldownUntilMs <= now);
 	let shim;
 	if (deps.shim === void 0) shim = { running: false };
 	else try {
@@ -2040,8 +2209,31 @@ function registerPoolStatusRoute(ctx, deps) {
 				}
 			}
 		});
+		const disposeAccountDisable = ctx.webServer.register({
+			kind: "exact",
+			path: POOL_ACCOUNT_DISABLE_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (deps.setAccountDisabled === void 0) return json(res, 503, { error: "settings service unavailable; the account switch cannot be saved" });
+				try {
+					const body = await readJsonBody(req);
+					const known = new Set(deps.pool.list().map((account) => account.id));
+					const toggle = parseAccountToggle(body, (id) => known.has(id));
+					if (toggle === void 0) return json(res, 400, { error: "invalid account toggle payload" });
+					await deps.setAccountDisabled(toggle.accountId, toggle.disabled);
+					json(res, 200, {
+						ok: true,
+						...toggle
+					});
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
 		return () => {
 			disposeCheckin();
+			disposeAccountDisable();
 			disposeModelsSave();
 			disposeReset();
 			disposeRescan();
@@ -2100,6 +2292,7 @@ const Config = z.object({
 	authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app own location)"),
 	cooldownMs: z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds"),
 	distribution: z.union(["priority", "round-robin"]).default("priority").description("How requests are spread: priority (drain one) or round-robin"),
+	disabledAccountIds: z.array(z.string()).default([]).description("Account ids excluded from the pool (empty = every discovered account participates)"),
 	enabledModelIds: z.array(z.string()).default([]).description("Legacy shared model-id list; used by a region that has no per-region selection yet"),
 	imageModelIds: z.array(z.string()).default([]).description("Legacy shared image-id list; used by a region that has no per-region selection yet"),
 	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Legacy shared context budgets; used by a region with no per-region selection yet"),
@@ -2169,11 +2362,12 @@ function apply(ctx, config = {}) {
 		}
 	};
 	const applyConfigFromSource = () => {
-		const { authFile, cooldownMs, distribution, enabledModelIds, imageModelIds, contextBudgets, modelSelectionCn, modelSelectionGlobal } = current();
+		const { authFile, cooldownMs, distribution, disabledAccountIds, enabledModelIds, imageModelIds, contextBudgets, modelSelectionCn, modelSelectionGlobal } = current();
 		core.pool.applyConfig({
 			...authFile === void 0 ? {} : { authDirs: [dirname(authFile)] },
 			...cooldownMs === void 0 ? {} : { cooldownMs },
-			distribution: distribution ?? "priority"
+			distribution: distribution ?? "priority",
+			...disabledAccountIds === void 0 ? {} : { disabledAccountIds }
 		});
 		const legacySelection = {
 			...enabledModelIds === void 0 ? {} : { enabledModelIds },
@@ -2191,14 +2385,30 @@ function apply(ctx, config = {}) {
 	* the three model-selection keys, so the settings file cannot be steered from
 	* the browser; the catalog re-reads through `onChange` either way.
 	*/
+	/**
+	* Write one key of the plugin's own settings section. Only ever called with the
+	* model-selection keys, the distribution, and the disabled-account list, so the
+	* settings file cannot be steered from the browser; the catalogs and the pool
+	* re-read through `onChange` either way.
+	*
+	* `set` returns a promise, so a rejection must be caught explicitly: a bare
+	* `void write.call(...)` swallows it, and the card then looks like it saved
+	* while the value never reached the settings file.
+	*/
 	const setSetting = (key, value) => {
 		if (value === void 0) return;
 		const write = settingsService?.set;
-		if (write === void 0) return;
+		if (write === void 0) {
+			ctx.logger.warn?.(`dsh-workbuddy-xdpool: no settings writer; ` + key + ` was not saved`);
+			return;
+		}
 		try {
-			write.call(settingsService, key, value);
+			const result = write.call(settingsService, key, value);
+			if (result !== void 0 && typeof result.then === "function") result.catch((error) => {
+				ctx.logger.warn?.(`dsh-workbuddy-xdpool: failed to persist ` + key, error);
+			});
 		} catch (error) {
-			ctx.logger.warn?.(`dsh-workbuddy-xdpool: failed to persist ${key}`, error);
+			ctx.logger.warn?.(`dsh-workbuddy-xdpool: failed to persist ` + key, error);
 		}
 	};
 	const shims = {
@@ -2246,6 +2456,11 @@ function apply(ctx, config = {}) {
 				...selection.imageModelIds === void 0 ? {} : { imageModelIds: [...selection.imageModelIds] },
 				...selection.contextBudgets === void 0 ? {} : { contextBudgets: { ...selection.contextBudgets } }
 			});
+		},
+		setAccountDisabled: (accountId, disabled) => {
+			const currentIds = current().disabledAccountIds ?? [];
+			const next = disabled ? currentIds.includes(accountId) ? currentIds : [...currentIds, accountId] : currentIds.filter((id) => id !== accountId);
+			setSetting("disabledAccountIds", next);
 		}
 	}));
 	api = {

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-xdpool",
   "displayName": "DSH WorkBuddy XD Pool",
   "description": "Merge every locally signed-in WorkBuddy account into DeepSeek Harness as one auto-failing-over model pool (multi-account rotation, live credits, daily check-in and model catalog).",
-  "version": "0.4.5",
+  "version": "1.0.1",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-workbuddy-xdpool#readme",