dsh-workbuddy-xdpool 1.4.0 → 1.5.2

package/lib/index.js

@@ -1,8 +1,10 @@
 import { basename, dirname, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
-import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { readFile, readdir } from "node:fs/promises";
 import { homedir } from "node:os";
+import { execFile } from "node:child_process";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -1681,6 +1683,375 @@ var WorkBuddyUpstreamClient = class {
 	}
 };
 //#endregion
+//#region src/at-rest.ts
+/**
+* WorkBuddy desktop "at-rest" credential decryption.
+*
+* From 5.6.0 the WorkBuddy desktop app no longer stores `auth.accessToken` /
+* `auth.refreshToken` as plain strings. It writes a field wrapper:
+*
+*   { "$wbEncrypted": 1, "envelope": "<base64 of a JSON envelope>" }
+*
+* where the envelope is `{suite, keyId, nonce, authTag, ciphertext}` for
+* AES-256-GCM with a 12-byte nonce and a 16-byte tag. The authenticated
+* additional data is a length-prefixed transcript over the scheme, suite,
+* keyId and framing, so the ciphertext can only be opened for the exact field
+* shape it was sealed for.
+*
+* The field key itself is NOT a user secret: it is a build-time constant
+* compiled into the app's own Electron native module
+* (`electron_browser_workbuddy_storage`). The app fetches it through
+* `loggerGet()` and hashes the returned base64 STRING (not the decoded bytes)
+* to obtain the 32-byte key; `keyId` is the first 16 hex characters of that
+* key's SHA-256.
+*
+* This module re-derives the same key by asking the installed app for the same
+* payload, and caches it in memory for the process lifetime. Nothing is ever
+* written to disk, and the payload is never logged.
+*
+* 溯源：本文件移植自 dingminhua/dsh-connect-workbuddy 的 src/at-rest.ts
+*   （MIT，Copyright (c) 2026 LaoDing）——该模块最先定位并修复了「5.6.0 起
+*   macOS 与 Windows 同样加密凭据」这一问题（其 issue #15 真机取证）。移植时
+*   保留其全部判定逻辑（CFBundleExecutable 向 bundle 自己问、按 bundle id
+*   确认身份后才 exec、field framing 的 AAD 转录、keyId 校验），未作改动。
+*
+* 改动：**「macOS 也加密」这一事实**（issue #15 真机取证）。本模块原先假设该
+*   policy 是 Windows 先行、macOS 只是「将来可能」，于是 macOS 的可执行文件
+*   路径用 App 名拼成 `<bundle>/Contents/MacOS/WorkBuddy`——而两个真实 bundle
+*   的 `CFBundleExecutable` 都是 `Electron`，该路径并不存在。结果是 macOS 上
+*   加密凭据**永远**取不到密钥，用户却被报成「未登录」。现在二进制名向 bundle
+*   自己问（`macosBundleExecutable()`），候选含国际版 `WorkBuddy AI.app`，
+*   并允许 App 被归入 applications 目录的子目录——扫到的候选必须先用
+*   `CFBundleIdentifier` 确认身份才 `execFile`，因为**每个 Electron 应用的
+*   二进制都叫 `Electron`**，只按名字匹配就可能启动另一个产品。
+*
+* @module dsh-workbuddy-xdpool/at-rest
+*/
+/** Envelope framing names, mapped to the single-byte AAD framing code. */
+const FRAMING_CODE = {
+	file: 1,
+	field: 2,
+	record: 3,
+	stream: 4
+};
+/** Standard (symmetric) format identifiers, transcripted into the AAD. */
+const STANDARD_FORMAT_ID = {
+	file: "WBEF1",
+	field: "WBEV1",
+	record: "WBER1",
+	stream: "WBES1"
+};
+/** Domain separator the AAD transcript starts with. */
+const AAD_DOMAIN = Buffer.from("WB-AAD\0", "ascii");
+/** Scheme name of the symmetric envelope this module opens. */
+const SYMMETRIC_SCHEME = "sym-v1";
+/** Env override pointing at the WorkBuddy desktop executable. */
+const WORKBUDDY_APP_EXECUTABLE_ENV = "WORKBUDDY_APP_EXECUTABLE";
+/** How long the app is given to answer with its key payload. */
+const KEY_FETCH_TIMEOUT_MS = 1e4;
+/** File name of the WorkBuddy desktop executable on Windows. */
+const APP_EXECUTABLE_NAME = "WorkBuddy.exe";
+/**
+* macOS bundles the desktop app may be installed as, in probe order.
+*
+* `WorkBuddy.app` is the domestic build; `WorkBuddy AI.app` is the
+* international one, and a machine may carry either or both. The user-level
+* `~/Applications` location is included because macOS lets an app live there,
+* and installs have been observed under a subdirectory of /Applications too —
+* hence {@link findWorkbuddyAppExecutable}'s parent scan, which covers those
+* without guessing any particular folder name.
+*/
+const MACOS_APP_BUNDLE_NAMES = ["WorkBuddy.app", "WorkBuddy AI.app"];
+function encodeUint32(value) {
+	const bytes = Buffer.allocUnsafe(4);
+	bytes.writeUInt32BE(value);
+	return bytes;
+}
+/** Length-prefixed UTF-8 string: uint32 big-endian length followed by the bytes. */
+function encodeLengthPrefixed(value) {
+	const bytes = Buffer.from(value, "utf8");
+	return Buffer.concat([encodeUint32(bytes.length), bytes]);
+}
+/**
+* The authenticated additional data for one `sym-v1` FIELD-framed envelope.
+*
+* Only the field framing is implemented: it is the shape the desktop app uses
+* for credential fields, and it is also the shape that cannot be confused with
+* a whole-file envelope, so an unexpected framing is a parse error rather than
+* a silently wrong transcript.
+*/
+function fieldAad(keyId, suite, scheme = SYMMETRIC_SCHEME) {
+	if (!/^[0-9a-f]{16}$/u.test(keyId)) throw new Error(`workbuddy: envelope keyId is malformed`);
+	return Buffer.concat([
+		AAD_DOMAIN,
+		Buffer.from([1]),
+		encodeLengthPrefixed(STANDARD_FORMAT_ID["field"]),
+		encodeLengthPrefixed(scheme),
+		encodeUint32(suite),
+		encodeLengthPrefixed(keyId),
+		Buffer.from([FRAMING_CODE["field"]]),
+		Buffer.from([0]),
+		Buffer.from([0])
+	]);
+}
+/** Whether a value is the app's encrypted-field wrapper. */
+function isEncryptedFieldWrapper(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const wrapper = value;
+	const keys = Object.keys(wrapper).sort();
+	return keys.length === 2 && keys[0] === "$wbEncrypted" && keys[1] === "envelope" && wrapper["$wbEncrypted"] === 1 && typeof wrapper["envelope"] === "string";
+}
+/**
+* The at-rest key id for a derived 32-byte key: the first 16 hex characters of
+* its SHA-256. This is what the envelope's `keyId` is checked against, so a
+* mismatched key fails loudly instead of returning garbage.
+*/
+function deriveAtRestKeyId(key) {
+	return createHash("sha256").update(key).digest("hex").slice(0, 16);
+}
+/**
+* Derive the 32-byte field key from the app's key payload JSON.
+*
+* The app hashes the payload's base64 STRING — not its decoded bytes — so the
+* same spelling is required here; hashing the decoded secret would produce a
+* different key and every field would fail to open.
+*/
+function deriveAtRestKey(payloadJson) {
+	let payload;
+	try {
+		payload = JSON.parse(payloadJson);
+	} catch {
+		throw new Error("workbuddy: at-rest key payload is not valid JSON");
+	}
+	if (typeof payload !== "object" || payload === null || Array.isArray(payload)) throw new Error("workbuddy: at-rest key payload is not an object");
+	const secret = payload["atRestSecretKey"];
+	if (typeof secret !== "string" || secret === "") throw new Error("workbuddy: at-rest key payload carries no atRestSecretKey");
+	return createHash("sha256").update(secret, "utf8").digest();
+}
+/**
+* Open one encrypted field with a derived key and return its plaintext.
+*
+* Throws when the envelope is malformed, belongs to another key, or fails
+* authentication — a GCM tag mismatch is the signal that the transcript or the
+* key is wrong, and it must never degrade into a truncated token.
+*/
+function openEncryptedField(field, key) {
+	let envelope;
+	try {
+		envelope = JSON.parse(Buffer.from(field.envelope, "base64").toString("utf8"));
+	} catch {
+		throw new Error("workbuddy: encrypted field envelope is not valid JSON");
+	}
+	if (typeof envelope !== "object" || envelope === null || Array.isArray(envelope)) throw new Error("workbuddy: encrypted field envelope is not an object");
+	const record = envelope;
+	const suite = record["suite"];
+	const keyId = record["keyId"];
+	const nonce = record["nonce"];
+	const authTag = record["authTag"];
+	const ciphertext = record["ciphertext"];
+	if (typeof suite !== "number" || typeof keyId !== "string") throw new Error("workbuddy: encrypted field envelope is missing suite or keyId");
+	if (typeof nonce !== "string" || typeof authTag !== "string" || typeof ciphertext !== "string") throw new Error("workbuddy: encrypted field envelope is missing nonce, authTag or ciphertext");
+	const expectedKeyId = deriveAtRestKeyId(key);
+	if (keyId !== expectedKeyId) throw new Error(`workbuddy: encrypted field belongs to key ${keyId}, not the available key ${expectedKeyId}`);
+	const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(nonce, "base64"), { authTagLength: 16 });
+	decipher.setAAD(fieldAad(keyId, suite));
+	decipher.setAuthTag(Buffer.from(authTag, "base64"));
+	return Buffer.concat([decipher.update(Buffer.from(ciphertext, "base64")), decipher.final()]).toString("utf8");
+}
+/**
+* The executable inside a macOS app bundle, read from the bundle's own
+* `Info.plist`.
+*
+* The binary is NOT reliably named after the app: the WorkBuddy bundles ship
+* with `CFBundleExecutable` set to `Electron`, so a path assembled as
+* `<bundle>/Contents/MacOS/WorkBuddy` does not exist and the app looks absent
+* even when it is installed in the default location. Because the bundle
+* documents the real name, asking it is both correct and robust to a future
+* build that renames the binary.
+*
+* Returns undefined when the plist is absent, unreadable, or carries no usable
+* name — never a guessed path, so a caller can keep probing.
+*/
+function macosBundleExecutable(bundle) {
+	let plist;
+	try {
+		plist = readFileSync(join(bundle, "Contents", "Info.plist"), "utf8");
+	} catch {
+		return;
+	}
+	const name = /<key>\s*CFBundleExecutable\s*<\/key>\s*<string>([^<]*)<\/string>/u.exec(plist)?.[1]?.trim();
+	if (name === void 0 || name === "" || name.includes("/") || name.includes("\\") || name === "." || name === "..") return;
+	return join(bundle, "Contents", "MacOS", name);
+}
+/**
+* Candidate paths of the WorkBuddy desktop executable, in probe order.
+*
+* The Windows build is the one that encrypts credentials, so Windows leads;
+* the macOS bundles are listed because the same native module ships there and
+* the encryption policy is enabled on macOS builds too (observed from 5.6.x),
+* and `undefined` entries (an unset env variable) are dropped.
+*
+* On macOS the executable name comes from each bundle (see
+* {@link macosBundleExecutable}) rather than being assembled from the app name.
+*
+* `readBundleExecutable` is injectable, in the same spirit as `platform`/`home`/
+* `env`: the macOS branch consults the real filesystem, so without a seam the
+* expected candidates would depend on whether the host machine happens to have
+* the app installed — and the test would pass on a developer's Mac while
+* failing in CI.
+*/
+function workbuddyAppExecutableCandidates(platform = process.platform, home = homedir(), env = process.env, readBundleExecutable = macosBundleExecutable) {
+	const candidates = [env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim()];
+	if (platform === "win32") {
+		const local = env["LOCALAPPDATA"]?.trim();
+		const programFiles = env["ProgramFiles"]?.trim();
+		const programFilesX86 = env["ProgramFiles(x86)"]?.trim();
+		candidates.push(local === void 0 || local === "" ? void 0 : join(local, "Programs", "WorkBuddy", APP_EXECUTABLE_NAME), local === void 0 || local === "" ? void 0 : join(local, "WorkBuddy", APP_EXECUTABLE_NAME), programFiles === void 0 || programFiles === "" ? void 0 : join(programFiles, "WorkBuddy", APP_EXECUTABLE_NAME), programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : join(programFilesX86, "WorkBuddy", APP_EXECUTABLE_NAME));
+	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
+	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
+}
+/**
+* Bundle identifier PREFIXES the desktop app is signed with — `com.tencent.
+* workbuddy` (domestic, observed as `…workbuddy.mac`) and `com.workbuddy`
+* (international, observed as `com.workbuddy.workbuddy-ai`).
+*
+* Used to CONFIRM that a discovered bundle really is WorkBuddy before it is
+* launched. This matters because the discovery below scans directories and then
+* execs what it finds: every Electron app is built around a binary called
+* `Electron`, so a name-only match could pick a different product's bundle and
+* run it. The identifier is the app's own claim about itself, so it is the
+* check that makes the scan safe.
+*/
+const APP_BUNDLE_IDENTIFIER_PREFIXES = ["com.tencent.workbuddy", "com.workbuddy"];
+/**
+* Whether a bundle identifies itself as the WorkBuddy desktop app.
+*
+* The match is on dot boundaries, so a hypothetical `com.workbuddyish` cannot
+* pass as `com.workbuddy`.
+*
+* An unreadable or identifier-less plist is treated as NOT WorkBuddy: refusing
+* a candidate only costs a fallback to another path, whereas accepting the
+* wrong one would execute an unrelated application.
+*/
+function isWorkbuddyBundle(bundle) {
+	let plist;
+	try {
+		plist = readFileSync(join(bundle, "Contents", "Info.plist"), "utf8");
+	} catch {
+		return false;
+	}
+	const identifier = /<key>\s*CFBundleIdentifier\s*<\/key>\s*<string>([^<]*)<\/string>/u.exec(plist)?.[1]?.trim().toLowerCase();
+	if (identifier === void 0 || identifier === "") return false;
+	return APP_BUNDLE_IDENTIFIER_PREFIXES.some((prefix) => identifier === prefix || identifier.startsWith(`${prefix}.`));
+}
+/**
+* Bundles of the desktop app found one level BELOW a macOS applications
+* directory.
+*
+* Users do file apps into subfolders (`/Applications/IDE/WorkBuddy.app`), and
+* a hardcoded `/Applications/<name>` then reports the app as missing while it
+* is installed and signed in. The scan is deliberately ONE level deep and
+* matches the known bundle names only, so it stays predictable and cheap; each
+* candidate is then confirmed by {@link isWorkbuddyBundle} before use.
+*
+* Returns [] when the parent is absent or unreadable — a missing directory is
+* the normal case, not an error.
+*/
+function macosNestedAppBundles(parent) {
+	let entries;
+	try {
+		entries = readdirSync(parent);
+	} catch {
+		return [];
+	}
+	const bundles = [];
+	for (const entry of entries) {
+		const nested = join(parent, entry);
+		for (const name of MACOS_APP_BUNDLE_NAMES) {
+			const bundle = join(nested, name);
+			try {
+				if (!statSync(bundle).isDirectory()) continue;
+			} catch {
+				continue;
+			}
+			if (isWorkbuddyBundle(bundle)) bundles.push(bundle);
+		}
+	}
+	return bundles;
+}
+/**
+* The first candidate that exists as a file, or undefined when the desktop app
+* is not installed where this platform expects it.
+*/
+function findWorkbuddyAppExecutable(platform = process.platform, home = homedir(), env = process.env) {
+	for (const candidate of workbuddyAppExecutableCandidates(platform, home, env)) try {
+		if (existsSync(candidate)) return candidate;
+	} catch {}
+	if (platform === "darwin") for (const parent of ["/Applications", join(home, "Applications")]) for (const bundle of macosNestedAppBundles(parent)) {
+		const executable = macosBundleExecutable(bundle);
+		if (executable === void 0) continue;
+		try {
+			if (existsSync(executable)) return executable;
+		} catch {}
+	}
+}
+/**
+* Ask the installed desktop app for its key payload by running its own binary
+* as plain Node (`ELECTRON_RUN_AS_NODE`) and calling the native binding.
+*
+* The binding is the app's own public surface for this value, so the plugin
+* never has to carry a copy of a build-specific constant: it asks the very
+* build that wrote the file. The child is given no stdin and a hard timeout,
+* and its stdout is the only thing read.
+*/
+function fetchAtRestKeyPayload(executable) {
+	return new Promise((resolve, reject) => {
+		execFile(executable, ["-e", "try{process.stdout.write(process._linkedBinding('electron_browser_workbuddy_storage').loggerGet())}catch(e){process.exitCode=3;process.stderr.write(String(e&&e.message||e))}"], {
+			env: {
+				...process.env,
+				ELECTRON_RUN_AS_NODE: "1"
+			},
+			timeout: KEY_FETCH_TIMEOUT_MS,
+			windowsHide: true,
+			maxBuffer: 1048576
+		}, (error, stdout, stderr) => {
+			if (error !== null) {
+				reject(/* @__PURE__ */ new Error(`workbuddy: the desktop app did not provide its at-rest key (${stderr.trim() || error.message})`));
+				return;
+			}
+			const payload = stdout.trim();
+			if (payload === "") {
+				reject(/* @__PURE__ */ new Error("workbuddy: the desktop app returned an empty at-rest key payload"));
+				return;
+			}
+			resolve(payload);
+		});
+	});
+}
+/** Process-lifetime cache of the derived key; never persisted. */
+let cachedKey;
+let inflightKey;
+/**
+* The desktop app's at-rest field key, or undefined when it cannot be obtained
+* (app not installed, an older build without the native module, or a future
+* build that rotates the payload). Cached after the first success so the app is
+* spawned at most once per process; a failure is retried on the next call,
+* because the user may install or start the app between reads.
+*/
+function readAtRestKey() {
+	if (cachedKey !== void 0) return Promise.resolve(cachedKey);
+	inflightKey ??= (async () => {
+		const executable = findWorkbuddyAppExecutable();
+		if (executable === void 0) return void 0;
+		const key = deriveAtRestKey(await fetchAtRestKeyPayload(executable));
+		cachedKey = key;
+		return key;
+	})().finally(() => {
+		inflightKey = void 0;
+	});
+	return inflightKey;
+}
+//#endregion
 //#region src/accounts.ts
 /**
 * Account pool: discovers every WorkBuddy credential snapshot the desktop app
@@ -1728,11 +2099,81 @@ function optionalString(value) {
 	return typeof value === "string" && value !== "" ? value : void 0;
 }
 /**
+* Read one string-valued field that may arrive as a plain string (older builds)
+* or as the desktop app's `$wbEncrypted` envelope. The app started encrypting
+* `accessToken` / `refreshToken` / `nickname` in 5.6.0 on BOTH macOS and Windows
+* — the earlier "Windows first" reading was wrong, and it is why a signed-in Mac
+* showed no account at all: the value is an object, `typeof === 'string'` failed,
+* and the parser reported "no credential" for a perfectly good sign-in.
+*
+* `decrypt` is injected rather than called here so this parser stays synchronous
+* and testable; the async key fetch lives in `readCredential`. A field that IS
+* encrypted but could not be opened is reported as `failed` rather than as an
+* empty string — the caller must tell the user the app is missing or unreachable,
+* not send them to sign in again (the one action that cannot help).
+*/
+/**
+* Marker for "the credential is encrypted and we could not obtain the key".
+*
+* Carried as a `code` rather than left to `instanceof` because the value crosses
+* the packaged-plugin boundary; the same convention the sibling error types use.
+* This is deliberately NOT "not signed in": the user IS signed in, and telling
+* them to sign in again sends them to the one action that cannot help.
+*/
+const ENCRYPTED_CREDENTIAL_CODE = "ENCRYPTED_CREDENTIAL";
+var WorkBuddyEncryptedCredentialError = class extends Error {
+	code = ENCRYPTED_CREDENTIAL_CODE;
+	constructor(sourcePath) {
+		super(`workbuddy: ${sourcePath} holds encrypted credentials but the desktop app could not provide the key. Install the WorkBuddy desktop app (or point WORKBUDDY_APP_EXECUTABLE at it) — signing in again will not help.`);
+		this.name = "WorkBuddyEncryptedCredentialError";
+	}
+};
+/** True when a thrown value is the encrypted-credential marker (cross-bundle safe). */
+function isEncryptedCredentialError(value) {
+	return typeof value === "object" && value !== null && value.code === "ENCRYPTED_CREDENTIAL";
+}
+function decryptableString(value, decrypt) {
+	if (typeof value === "string") return {
+		value,
+		encrypted: false,
+		failed: false
+	};
+	if (isEncryptedFieldWrapper(value)) {
+		if (decrypt === void 0) return {
+			value: "",
+			encrypted: true,
+			failed: true
+		};
+		try {
+			return {
+				value: decrypt(value),
+				encrypted: true,
+				failed: false
+			};
+		} catch {
+			return {
+				value: "",
+				encrypted: true,
+				failed: true
+			};
+		}
+	}
+	return {
+		value: "",
+		encrypted: false,
+		failed: false
+	};
+}
+/**
 * Parse a WorkBuddy auth document. Accepts the nested desktop shape
 * `{"auth":{...},"account":{...}}` and the flat panel shape; returns undefined
 * when there is no usable access token.
+*
+* `decrypt` opens the desktop app's `$wbEncrypted` field wrapper (5.6.0+, both
+* platforms). Absent means "plain-string builds only", which is what every
+* caller without an at-rest key should pass.
 */
-function parseWorkBuddyAuth(text, sourcePath) {
+function parseWorkBuddyAuth(text, sourcePath, decrypt) {
 	let parsed;
 	try {
 		parsed = JSON.parse(text);
@@ -1750,18 +2191,20 @@ function parseWorkBuddyAuth(text, sourcePath) {
 		auth = document;
 		identity = document;
 	}
-	const accessToken = typeof auth["accessToken"] === "string" ? auth["accessToken"] : "";
+	const accessField = decryptableString(auth["accessToken"], decrypt);
+	if (accessField.encrypted && accessField.failed) throw new WorkBuddyEncryptedCredentialError(sourcePath);
+	const accessToken = accessField.value;
 	if (accessToken === "") return void 0;
 	const refreshExpiresAtMs = typeof auth["refreshExpiresAt"] === "number" ? expiryToMs(auth["refreshExpiresAt"]) : void 0;
 	if (refreshExpiresAtMs !== void 0 && refreshExpiresAtMs > 0 && refreshExpiresAtMs < Date.now()) return;
 	const lastRefreshAtMs = typeof auth["lastRefreshTime"] === "number" ? expiryToMs(auth["lastRefreshTime"]) : void 0;
 	return {
 		accessToken,
-		refreshToken: typeof auth["refreshToken"] === "string" ? auth["refreshToken"] : "",
+		refreshToken: decryptableString(auth["refreshToken"], decrypt).value,
 		expiresAtMs: typeof auth["expiresAt"] === "number" ? expiryToMs(auth["expiresAt"]) : 0,
 		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
 		...lastRefreshAtMs === void 0 ? {} : { lastRefreshAtMs },
-		...optionalString(identity["nickname"]) === void 0 ? {} : { nickname: optionalString(identity["nickname"]) },
+		...optionalString(decryptableString(identity["nickname"], decrypt).value) === void 0 ? {} : { nickname: optionalString(decryptableString(identity["nickname"], decrypt).value) },
 		...optionalString(identity["uin"]) === void 0 ? {} : { uin: optionalString(identity["uin"]) },
 		...optionalString(identity["uid"]) === void 0 ? {} : { uid: optionalString(identity["uid"]) },
 		...optionalString(identity["enterpriseId"]) === void 0 ? {} : { enterpriseId: optionalString(identity["enterpriseId"]) },
@@ -1843,11 +2286,34 @@ async function authFilesIn(dir) {
 	return files.map((name) => join(dir, name));
 }
 async function readCredential(path) {
+	let text;
 	try {
-		return parseWorkBuddyAuth(await readFile(path, "utf8"), path);
+		text = await readFile(path, "utf8");
 	} catch {
 		return;
 	}
+	const decrypt = text.includes("\"$wbEncrypted\"") ? await encryptedFieldOpener() : void 0;
+	try {
+		return parseWorkBuddyAuth(text, path, decrypt);
+	} catch (error) {
+		if (isEncryptedCredentialError(error)) throw error;
+		return;
+	}
+}
+/**
+* Build the field opener, or undefined when the app cannot supply its key.
+*
+* Split out so the key lookup is testable without a real desktop install, and so
+* a lookup failure degrades to "encrypted, unopenable" rather than to a parse
+* error that would look like a corrupt file.
+*/
+async function encryptedFieldOpener() {
+	const key = await readAtRestKey().catch(() => void 0);
+	if (key === void 0) return void 0;
+	return (field) => {
+		if (!isEncryptedFieldWrapper(field)) throw new Error("workbuddy: not an encrypted field wrapper");
+		return openEncryptedField(field, key);
+	};
 }
 /** Every directory the pool should scan, in probe order. */
 function candidateAuthDirs(env = process.env) {
@@ -2368,8 +2834,8 @@ const FALLBACK_WORKBUDDY_MODELS = [
 	{
 		id: "hy3",
 		name: "Hy3",
-		contextWindow: 2e5,
-		maxOutputTokens: 128e3,
+		contextWindow: 32e3,
+		maxOutputTokens: 8e3,
 		supportsImages: true
 	},
 	{
@@ -3165,10 +3631,37 @@ function diffEarnings(before, after) {
 		accounts
 	};
 }
-function dayKey(date) {
-	const month = String(date.getMonth() + 1).padStart(2, "0");
-	const day = String(date.getDate()).padStart(2, "0");
-	return `${date.getFullYear()}-${month}-${day}`;
+/**
+* The timezone every hour in this file is interpreted in.
+*
+* The activity windows these jobs target are defined in Beijing time, but the
+* scheduler used `getHours()`, which answers in the host machine's local zone.
+* On a machine set to anything else, "09:00" was 09:00 local — a check-in that
+* simply never came due. Naming the zone makes the hour mean the same instant
+* everywhere DSH runs, and is also what lets a test pin the behaviour.
+*/
+const AUTOMATION_TIME_ZONE = "Asia/Shanghai";
+/** Calendar parts of `date` in `timeZone`, all as zero-padded strings. */
+function zonedParts(date, timeZone = AUTOMATION_TIME_ZONE) {
+	const parts = new Intl.DateTimeFormat("en-CA", {
+		timeZone,
+		year: "numeric",
+		month: "2-digit",
+		day: "2-digit",
+		hour: "2-digit",
+		hourCycle: "h23"
+	}).formatToParts(date);
+	const pick = (type) => parts.find((part) => part.type === type)?.value ?? "00";
+	return {
+		year: pick("year"),
+		month: pick("month"),
+		day: pick("day"),
+		hour: pick("hour")
+	};
+}
+function dayKey(date, timeZone = AUTOMATION_TIME_ZONE) {
+	const { year, month, day } = zonedParts(date, timeZone);
+	return `${year}-${month}-${day}`;
 }
 /**
 * The scheduled SLOT `date` falls in, as `YYYY-MM-DDTHH`.
@@ -3177,8 +3670,9 @@ function dayKey(date) {
 * for several hours runs in each of them while a second tick inside the same
 * hour is still refused.
 */
-function slotKey(date) {
-	return `${dayKey(date)}T${String(date.getHours()).padStart(2, "0")}`;
+function slotKey(date, timeZone = AUTOMATION_TIME_ZONE) {
+	const { hour } = zonedParts(date, timeZone);
+	return `${dayKey(date, timeZone)}T${hour}`;
 }
 /**
 * Whether `now`'s local hour is one of `hours`.
@@ -3190,7 +3684,8 @@ function slotKey(date) {
 * moment it wakes, on the same day.
 */
 function isFireHour(now, hours) {
-	return hours.includes(now.getHours());
+	const { hour } = zonedParts(now);
+	return hours.includes(Number(hour));
 }
 /** Whether this account may be used: not switched off, not cooling. */
 function eligible(account, now) {
@@ -3453,6 +3948,22 @@ var WorkBuddyScheduler = class {
 	* rate-limits per account, so overlapping passes would only trip that limit.
 	* A job that throws is recorded and the loop continues.
 	*/
+	/**
+	* Whether `kind` is due at `now`: its earliest configured hour has passed in
+	* the scheduling timezone, and no hour of today has been consumed yet.
+	*
+	* Hours are consumed per SLOT (one entry per configured hour), so a job with
+	* two hours still runs twice a day — but a job whose hour passed while DSH was
+	* closed runs immediately on the next tick instead of waiting for tomorrow.
+	*/
+	isDue(kind, now) {
+		const hours = this.hoursOf(kind);
+		if (hours.length === 0) return false;
+		const { hour } = zonedParts(now);
+		const current = Number(hour);
+		const today = dayKey(now);
+		return hours.some((candidate) => candidate <= current && this.states[kind].lastRunSlot !== `${today}T${String(candidate).padStart(2, "0")}`);
+	}
 	async tick() {
 		if (!this.enabled || this.stopped || this.busy) return;
 		this.busy = true;
@@ -3463,7 +3974,7 @@ var WorkBuddyScheduler = class {
 			for (const kind of JOB_KINDS) {
 				if (this.stopped) return;
 				if (this.states[kind].lastRunSlot === slot) continue;
-				if (!isFireHour(now, this.hoursOf(kind))) continue;
+				if (!this.isDue(kind, now)) continue;
 				await this.runJob(kind, today);
 			}
 		} catch (error) {
@@ -4495,7 +5006,8 @@ function createWorkBuddyShim(options) {
 				logger,
 				client,
 				pool,
-				maxAttempts
+				maxAttempts,
+				contextWindow: modelId === void 0 ? void 0 : catalog.current().find((m) => m.id === modelId)?.contextWindow
 			});
 			if (recovered.ok) {
 				await serveSuccessfulStream(res, recovered.account, recovered.result, logger, refreshBalance, pool);
@@ -4599,7 +5111,8 @@ async function recoverFromContextOverrun(options) {
 		detail: "request carried no usable messages"
 	};
 	const overrunTokens = estimateMessagesTokens(messages);
-	const budget = Math.max(512, Math.floor(overrunTokens / 2));
+	const realWindow = options.contextWindow;
+	const budget = realWindow !== void 0 && realWindow > 0 ? Math.max(512, Math.floor(realWindow * .8) - 2048) : Math.max(512, Math.floor(overrunTokens / 2));
 	logger?.warn(`dsh-workbuddy-xdpool: context overrun on ${modelId ?? "(no model)"} (~${overrunTokens} tokens); compacting to ~${budget} and retrying once`);
 	let summary;
 	let compacted = messages;
@@ -5480,33 +5993,47 @@ function apply(ctx, config = {}) {
 	* the browser; the catalog re-reads through `onChange` either way.
 	*/
 	/**
-	* Write one key of the plugin's own settings section. Only ever called with the
-	* model-selection keys, the distribution, and the disabled-account list, so the
-	* settings file cannot be steered from the browser; the catalogs and the pool
-	* re-read through `onChange` either way.
+	* Persist one settings key, then VERIFY it landed.
+	*
+	* The settings service resolves `set()` even when the write did not stick, so a
+	* fire-and-forget call reports success while the file keeps the old value — and
+	* the card then shows a value that silently reverts on the next read. That is
+	* exactly the "I typed a reserve, reopened, and it still says 0" report: the
+	* write was reported as saved but never reached the document. Every write now
+	* awaits the setter and re-reads the document; a mismatch throws so the caller
+	* surfaces a real error instead of claiming success.
+	*
+	* `expected` is what the caller believes it just wrote. Comparison goes through
+	* a JSON round-trip so key order cannot cause a false mismatch.
+	*/
+	/**
+	* Deep equality that ignores key order, used to verify a settings write.
 	*
-	* `set` returns a promise, so a rejection must be caught explicitly: a bare
-	* `void write.call(...)` swallows it, and the card then looks like it saved
-	* while the value never reached the settings file.
+	* `JSON.stringify` is key-order sensitive, so comparing two equal objects whose
+	* keys were inserted in a different order would report a false "not persisted"
+	* failure — and a false failure on a write that DID land is as harmful as a
+	* false success: it sends the user chasing a bug that is not there.
 	*/
-	const setSetting = (key, value) => {
+	function stableJsonEqual(left, right) {
+		return canonicalJson(left) === canonicalJson(right);
+	}
+	function canonicalJson(value) {
+		if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+		if (typeof value === "object" && value !== null) return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+		return JSON.stringify(value);
+	}
+	const setSetting = async (key, value, expected) => {
 		if (value === void 0) return;
 		const write = settingsService?.set;
-		if (write === void 0) {
-			ctx.logger.warn?.(`dsh-workbuddy-xdpool: no settings writer; ` + key + ` was not saved`);
-			return;
-		}
-		try {
-			const result = write.call(settingsService, key, value);
-			if (result !== void 0 && typeof result.then === "function") result.catch((error) => {
-				ctx.logger.warn?.(`dsh-workbuddy-xdpool: failed to persist ` + key, error);
-			});
-		} catch (error) {
-			ctx.logger.warn?.(`dsh-workbuddy-xdpool: failed to persist ` + key, error);
+		if (write === void 0) throw new Error(`settings service unavailable; ${key} was not saved`);
+		await write.call(settingsService, key, value);
+		if (expected !== void 0) {
+			const stored = current()[key];
+			if (!stableJsonEqual(stored, expected)) throw new Error(`settings field "${key}" was not persisted`);
 		}
 	};
-	core.scheduler.setEarningsPersistence((ledger) => {
-		setSetting("automationEarnings", ledger);
+	core.scheduler.setEarningsPersistence(async (ledger) => {
+		await setSetting("automationEarnings", ledger, ledger);
 	});
 	const storedLedger = current().automationEarnings;
 	if (storedLedger !== void 0) core.scheduler.applyEarningsLedger(storedLedger);
@@ -5552,23 +6079,24 @@ function apply(ctx, config = {}) {
 		shim: () => shimInfo("cn"),
 		scheduler: () => core.scheduler.status(),
 		runAutomation: (_job, _force) => core.scheduler.startRunAll(),
-		saveSelection: (region, selection) => {
-			setSetting(modelSelectionKeyFor(region), {
+		saveSelection: async (region, selection) => {
+			const payload = {
 				...selection.enabledModelIds === void 0 ? {} : { enabledModelIds: [...selection.enabledModelIds] },
 				...selection.imageModelIds === void 0 ? {} : { imageModelIds: [...selection.imageModelIds] },
 				...selection.contextBudgets === void 0 ? {} : { contextBudgets: { ...selection.contextBudgets } }
-			});
+			};
+			await setSetting(modelSelectionKeyFor(region), payload, payload);
 		},
-		setAccountDisabled: (accountId, disabled) => {
+		setAccountDisabled: async (accountId, disabled) => {
 			const currentIds = current().disabledAccountIds ?? [];
 			const next = disabled ? currentIds.includes(accountId) ? currentIds : [...currentIds, accountId] : currentIds.filter((id) => id !== accountId);
-			setSetting("disabledAccountIds", next);
+			await setSetting("disabledAccountIds", next, next);
 		},
-		setCreditReserve: (accountId, reserve) => {
+		setCreditReserve: async (accountId, reserve) => {
 			const next = { ...current().creditReserves ?? {} };
 			if (reserve > 0) next[accountId] = reserve;
 			else delete next[accountId];
-			setSetting("creditReserves", next);
+			await setSetting("creditReserves", next, next);
 		}
 	}));
 	api = {