dsh-workbuddy-xdpool 1.4.1 → 1.6.1

package/lib/index.js

@@ -1,8 +1,10 @@
 import { basename, dirname, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
-import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { readFile, readdir } from "node:fs/promises";
 import { homedir } from "node:os";
+import { execFile, execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -1681,6 +1683,489 @@ var WorkBuddyUpstreamClient = class {
 	}
 };
 //#endregion
+//#region src/at-rest.ts
+/**
+* WorkBuddy desktop "at-rest" credential decryption.
+*
+* From 5.6.0 the WorkBuddy desktop app no longer stores `auth.accessToken` /
+* `auth.refreshToken` as plain strings. It writes a field wrapper:
+*
+*   { "$wbEncrypted": 1, "envelope": "<base64 of a JSON envelope>" }
+*
+* where the envelope is `{suite, keyId, nonce, authTag, ciphertext}` for
+* AES-256-GCM with a 12-byte nonce and a 16-byte tag. The authenticated
+* additional data is a length-prefixed transcript over the scheme, suite,
+* keyId and framing, so the ciphertext can only be opened for the exact field
+* shape it was sealed for.
+*
+* The field key itself is NOT a user secret: it is a build-time constant
+* compiled into the app's own Electron native module
+* (`electron_browser_workbuddy_storage`). The app fetches it through
+* `loggerGet()` and hashes the returned base64 STRING (not the decoded bytes)
+* to obtain the 32-byte key; `keyId` is the first 16 hex characters of that
+* key's SHA-256.
+*
+* This module re-derives the same key by asking the installed app for the same
+* payload, and caches it in memory for the process lifetime. Nothing is ever
+* written to disk, and the payload is never logged.
+*
+* 溯源：本文件移植自 dingminhua/dsh-connect-workbuddy 的 src/at-rest.ts
+*   （MIT，Copyright (c) 2026 LaoDing）——该模块最先定位并修复了「5.6.0 起
+*   macOS 与 Windows 同样加密凭据」这一问题（其 issue #15 真机取证）。移植时
+*   保留其全部判定逻辑（CFBundleExecutable 向 bundle 自己问、按 bundle id
+*   确认身份后才 exec、field framing 的 AAD 转录、keyId 校验），未作改动。
+*
+* 改动：**「macOS 也加密」这一事实**（issue #15 真机取证）。本模块原先假设该
+*   policy 是 Windows 先行、macOS 只是「将来可能」，于是 macOS 的可执行文件
+*   路径用 App 名拼成 `<bundle>/Contents/MacOS/WorkBuddy`——而两个真实 bundle
+*   的 `CFBundleExecutable` 都是 `Electron`，该路径并不存在。结果是 macOS 上
+*   加密凭据**永远**取不到密钥，用户却被报成「未登录」。现在二进制名向 bundle
+*   自己问（`macosBundleExecutable()`），候选含国际版 `WorkBuddy AI.app`，
+*   并允许 App 被归入 applications 目录的子目录——扫到的候选必须先用
+*   `CFBundleIdentifier` 确认身份才 `execFile`，因为**每个 Electron 应用的
+*   二进制都叫 `Electron`**，只按名字匹配就可能启动另一个产品。
+*
+* @module dsh-workbuddy-xdpool/at-rest
+*/
+/** Envelope framing names, mapped to the single-byte AAD framing code. */
+const FRAMING_CODE = {
+	file: 1,
+	field: 2,
+	record: 3,
+	stream: 4
+};
+/** Standard (symmetric) format identifiers, transcripted into the AAD. */
+const STANDARD_FORMAT_ID = {
+	file: "WBEF1",
+	field: "WBEV1",
+	record: "WBER1",
+	stream: "WBES1"
+};
+/** Domain separator the AAD transcript starts with. */
+const AAD_DOMAIN = Buffer.from("WB-AAD\0", "ascii");
+/** Scheme name of the symmetric envelope this module opens. */
+const SYMMETRIC_SCHEME = "sym-v1";
+/** Env override pointing at the WorkBuddy desktop executable. */
+const WORKBUDDY_APP_EXECUTABLE_ENV = "WORKBUDDY_APP_EXECUTABLE";
+/** How long the app is given to answer with its key payload. */
+const KEY_FETCH_TIMEOUT_MS = 1e4;
+/**
+* Executable file names the desktop app ships under, in probe order.
+*
+* `WorkBuddyAI.exe` is the INTERNATIONAL build; both apps can be installed side
+* by side (observed on a real machine: `D:\\workbuddy\\WorkBuddy.exe` for the
+* domestic one and `D:\\workbuddyai\\WorkBuddyAI.exe` for the international one),
+* so the name cannot be assumed.
+*/
+const APP_EXECUTABLE_NAMES = ["WorkBuddy.exe", "WorkBuddyAI.exe"];
+/**
+* macOS bundles the desktop app may be installed as, in probe order.
+*
+* `WorkBuddy.app` is the domestic build; `WorkBuddy AI.app` is the
+* international one, and a machine may carry either or both. The user-level
+* `~/Applications` location is included because macOS lets an app live there,
+* and installs have been observed under a subdirectory of /Applications too —
+* hence {@link findWorkbuddyAppExecutable}'s parent scan, which covers those
+* without guessing any particular folder name.
+*/
+const MACOS_APP_BUNDLE_NAMES = ["WorkBuddy.app", "WorkBuddy AI.app"];
+function encodeUint32(value) {
+	const bytes = Buffer.allocUnsafe(4);
+	bytes.writeUInt32BE(value);
+	return bytes;
+}
+/** Length-prefixed UTF-8 string: uint32 big-endian length followed by the bytes. */
+function encodeLengthPrefixed(value) {
+	const bytes = Buffer.from(value, "utf8");
+	return Buffer.concat([encodeUint32(bytes.length), bytes]);
+}
+/**
+* The authenticated additional data for one `sym-v1` FIELD-framed envelope.
+*
+* Only the field framing is implemented: it is the shape the desktop app uses
+* for credential fields, and it is also the shape that cannot be confused with
+* a whole-file envelope, so an unexpected framing is a parse error rather than
+* a silently wrong transcript.
+*/
+function fieldAad(keyId, suite, scheme = SYMMETRIC_SCHEME) {
+	if (!/^[0-9a-f]{16}$/u.test(keyId)) throw new Error(`workbuddy: envelope keyId is malformed`);
+	return Buffer.concat([
+		AAD_DOMAIN,
+		Buffer.from([1]),
+		encodeLengthPrefixed(STANDARD_FORMAT_ID["field"]),
+		encodeLengthPrefixed(scheme),
+		encodeUint32(suite),
+		encodeLengthPrefixed(keyId),
+		Buffer.from([FRAMING_CODE["field"]]),
+		Buffer.from([0]),
+		Buffer.from([0])
+	]);
+}
+/** Whether a value is the app's encrypted-field wrapper. */
+function isEncryptedFieldWrapper(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const wrapper = value;
+	const keys = Object.keys(wrapper).sort();
+	return keys.length === 2 && keys[0] === "$wbEncrypted" && keys[1] === "envelope" && wrapper["$wbEncrypted"] === 1 && typeof wrapper["envelope"] === "string";
+}
+/**
+* The at-rest key id for a derived 32-byte key: the first 16 hex characters of
+* its SHA-256. This is what the envelope's `keyId` is checked against, so a
+* mismatched key fails loudly instead of returning garbage.
+*/
+function deriveAtRestKeyId(key) {
+	return createHash("sha256").update(key).digest("hex").slice(0, 16);
+}
+/**
+* Derive the 32-byte field key from the app's key payload JSON.
+*
+* The app hashes the payload's base64 STRING — not its decoded bytes — so the
+* same spelling is required here; hashing the decoded secret would produce a
+* different key and every field would fail to open.
+*/
+function deriveAtRestKey(payloadJson) {
+	let payload;
+	try {
+		payload = JSON.parse(payloadJson);
+	} catch {
+		throw new Error("workbuddy: at-rest key payload is not valid JSON");
+	}
+	if (typeof payload !== "object" || payload === null || Array.isArray(payload)) throw new Error("workbuddy: at-rest key payload is not an object");
+	const secret = payload["atRestSecretKey"];
+	if (typeof secret !== "string" || secret === "") throw new Error("workbuddy: at-rest key payload carries no atRestSecretKey");
+	return createHash("sha256").update(secret, "utf8").digest();
+}
+/**
+* Open one encrypted field with a derived key and return its plaintext.
+*
+* Throws when the envelope is malformed, belongs to another key, or fails
+* authentication — a GCM tag mismatch is the signal that the transcript or the
+* key is wrong, and it must never degrade into a truncated token.
+*/
+function openEncryptedField(field, key) {
+	let envelope;
+	try {
+		envelope = JSON.parse(Buffer.from(field.envelope, "base64").toString("utf8"));
+	} catch {
+		throw new Error("workbuddy: encrypted field envelope is not valid JSON");
+	}
+	if (typeof envelope !== "object" || envelope === null || Array.isArray(envelope)) throw new Error("workbuddy: encrypted field envelope is not an object");
+	const record = envelope;
+	const suite = record["suite"];
+	const keyId = record["keyId"];
+	const nonce = record["nonce"];
+	const authTag = record["authTag"];
+	const ciphertext = record["ciphertext"];
+	if (typeof suite !== "number" || typeof keyId !== "string") throw new Error("workbuddy: encrypted field envelope is missing suite or keyId");
+	if (typeof nonce !== "string" || typeof authTag !== "string" || typeof ciphertext !== "string") throw new Error("workbuddy: encrypted field envelope is missing nonce, authTag or ciphertext");
+	const expectedKeyId = deriveAtRestKeyId(key);
+	if (keyId !== expectedKeyId) throw new Error(`workbuddy: encrypted field belongs to key ${keyId}, not the available key ${expectedKeyId}`);
+	const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(nonce, "base64"), { authTagLength: 16 });
+	decipher.setAAD(fieldAad(keyId, suite));
+	decipher.setAuthTag(Buffer.from(authTag, "base64"));
+	return Buffer.concat([decipher.update(Buffer.from(ciphertext, "base64")), decipher.final()]).toString("utf8");
+}
+/**
+* The key id an encrypted field envelope demands, or undefined when the
+* envelope cannot be read.
+*
+* The account pool uses it to pick the right desktop build's key when more
+* than one build (domestic and international) is installed on the same machine:
+* each `.info` file names the key id its fields were sealed under, so the opener
+* must select the matching derived key rather than assume one build exists.
+*/
+function encryptedFieldKeyId(field) {
+	try {
+		const record = JSON.parse(Buffer.from(field.envelope, "base64").toString("utf8"));
+		return typeof record["keyId"] === "string" ? record["keyId"] : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The executable inside a macOS app bundle, read from the bundle's own
+* `Info.plist`.
+*
+* The binary is NOT reliably named after the app: the WorkBuddy bundles ship
+* with `CFBundleExecutable` set to `Electron`, so a path assembled as
+* `<bundle>/Contents/MacOS/WorkBuddy` does not exist and the app looks absent
+* even when it is installed in the default location. Because the bundle
+* documents the real name, asking it is both correct and robust to a future
+* build that renames the binary.
+*
+* Returns undefined when the plist is absent, unreadable, or carries no usable
+* name — never a guessed path, so a caller can keep probing.
+*/
+function macosBundleExecutable(bundle) {
+	let plist;
+	try {
+		plist = readFileSync(join(bundle, "Contents", "Info.plist"), "utf8");
+	} catch {
+		return;
+	}
+	const name = /<key>\s*CFBundleExecutable\s*<\/key>\s*<string>([^<]*)<\/string>/u.exec(plist)?.[1]?.trim();
+	if (name === void 0 || name === "" || name.includes("/") || name.includes("\\") || name === "." || name === "..") return;
+	return join(bundle, "Contents", "MacOS", name);
+}
+/**
+* Windows install locations recorded by the app's own uninstaller.
+*
+* The registry is the authoritative answer: it survives a non-default drive, a
+* renamed folder and a differently-named executable, none of which any fixed
+* path list can predict. Real machines put the app at `D:\workbuddy\WorkBuddy.exe`
+* and `D:\workbuddyai\WorkBuddyAI.exe` — exactly the layouts a
+* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see, which is why the
+* plugin reported "the desktop app could not provide the key" for an app that was
+* installed and running.
+*
+* `DisplayIcon` is the field that actually carries the path (observed as
+* `D:\workbuddy\WorkBuddy.exe,0`); `InstallLocation` is usually empty for these
+* installers, so both are read and either may contribute.
+*
+* Returns [] on any failure — a missing registry key is the normal case on
+* non-Windows, not an error.
+*/
+function windowsRegistryAppPaths() {
+	if (process.platform !== "win32") return [];
+	const roots = [
+		["HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
+		["HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
+		["HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"]
+	];
+	const out = [];
+	for (const [root] of roots) {
+		let listing;
+		try {
+			listing = execFileSync("reg", [
+				"query",
+				root,
+				"/s",
+				"/v",
+				"DisplayName"
+			], {
+				encoding: "utf8",
+				timeout: 1e4,
+				windowsHide: true,
+				maxBuffer: 8388608
+			});
+		} catch {
+			continue;
+		}
+		const keys = listing.split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
+		for (const key of keys) {
+			const keyPath = /^(HKEY_[^\r\n]+)/u.exec(key)?.[1]?.trim();
+			if (keyPath === void 0) continue;
+			for (const name of ["DisplayIcon", "InstallLocation"]) try {
+				const value = execFileSync("reg", [
+					"query",
+					keyPath,
+					"/v",
+					name
+				], {
+					encoding: "utf8",
+					timeout: 5e3,
+					windowsHide: true
+				});
+				const raw = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(value)?.[1]?.trim();
+				if (raw === void 0 || raw === "") continue;
+				const cleaned = raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
+				out.push(cleaned);
+			} catch {}
+		}
+	}
+	return out;
+}
+/**
+* Windows fallbacks for an app the registry did not cover: the well-known
+* per-user and machine-wide locations, plus every fixed drive's `Program Files`.
+*
+* Drive enumeration matters because installing to a non-system drive is common
+* on Windows and no environment variable points there.
+*/
+function windowsFallbackAppPaths(env) {
+	const out = [];
+	const roots = /* @__PURE__ */ new Set();
+	for (const key of [
+		"ProgramFiles",
+		"ProgramW6432",
+		"ProgramFiles(x86)",
+		"LOCALAPPDATA"
+	]) {
+		const value = env[key]?.trim();
+		if (value !== void 0 && value !== "") roots.add(value);
+	}
+	for (let code = 67; code <= 90; code += 1) {
+		const drive = String.fromCharCode(code) + ":\\";
+		try {
+			if (!existsSync(drive)) continue;
+		} catch {
+			continue;
+		}
+		roots.add(join(drive, "Program Files"));
+		roots.add(join(drive, "Program Files (x86)"));
+	}
+	for (const root of roots) for (const name of APP_EXECUTABLE_NAMES) {
+		out.push(join(root, "WorkBuddy", name));
+		out.push(join(root, "WorkBuddy AI", name));
+		out.push(join(root, "Programs", "WorkBuddy", name));
+	}
+	for (const root of roots) try {
+		for (const entry of readdirSync(root)) {
+			if (!/^(workbuddy|codebuddy)/iu.test(entry)) continue;
+			for (const name of APP_EXECUTABLE_NAMES) out.push(join(root, entry, name));
+		}
+	} catch {}
+	return out;
+}
+/**
+* Candidate paths of the WorkBuddy desktop executable, in probe order.
+*
+* Order is deliberate:
+*  1. the explicit override, because a user who set it knows where the app is;
+*  2. the registry, which is what the installer itself recorded;
+*  3. derived fallbacks (per-user, machine-wide, every fixed drive).
+*
+* Only the Windows branch consults the registry (it is the only platform with
+* one). macOS asks each bundle for its own `CFBundleExecutable` instead, because
+* the WorkBuddy bundles ship a binary named `Electron`, not after the app.
+*
+* `readBundleExecutable` and `registryPaths` are injectable in the same spirit as
+* `platform`/`home`/`env`: both consult the real machine, so without a seam the
+* expected candidates would depend on what happens to be installed where the
+* suite runs — passing on a developer's box and failing in CI.
+*/
+function workbuddyAppExecutableCandidates(platform = process.platform, home = homedir(), env = process.env, readBundleExecutable = macosBundleExecutable, registryPaths = windowsRegistryAppPaths) {
+	const candidates = [env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim()];
+	if (platform === "win32") {
+		candidates.push(...registryPaths());
+		candidates.push(...windowsFallbackAppPaths(env));
+	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
+	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
+}
+/**
+* Ask the installed desktop app for its key payload by running its own binary
+* as plain Node (`ELECTRON_RUN_AS_NODE`) and calling the native binding.
+*
+* The binding is the app's own public surface for this value, so the plugin
+* never has to carry a copy of a build-specific constant: it asks the very
+* build that wrote the file. The child is given no stdin and a hard timeout,
+* and its stdout is the only thing read.
+*/
+function fetchAtRestKeyPayload(executable) {
+	return new Promise((resolve, reject) => {
+		execFile(executable, ["-e", "try{process.stdout.write(process._linkedBinding('electron_browser_workbuddy_storage').loggerGet())}catch(e){process.exitCode=3;process.stderr.write(String(e&&e.message||e))}"], {
+			env: {
+				...process.env,
+				ELECTRON_RUN_AS_NODE: "1"
+			},
+			timeout: KEY_FETCH_TIMEOUT_MS,
+			windowsHide: true,
+			maxBuffer: 1048576
+		}, (error, stdout, stderr) => {
+			if (error !== null) {
+				reject(/* @__PURE__ */ new Error(`workbuddy: the desktop app did not provide its at-rest key (${stderr.trim() || error.message})`));
+				return;
+			}
+			const payload = stdout.trim();
+			if (payload === "") {
+				reject(/* @__PURE__ */ new Error("workbuddy: the desktop app returned an empty at-rest key payload"));
+				return;
+			}
+			resolve(payload);
+		});
+	});
+}
+/**
+* The desktop app's at-rest keys, indexed by the key id each derived key
+* reports (the first 16 hex of its SHA-256).
+*
+* More than one build can be installed on one machine — the domestic
+* `WorkBuddy.exe` and the international `WorkBuddyAI.exe` share a key id on the
+* builds seen here, but a future build may rotate it, and the discovery below
+* must keep working if they ever diverge. A field envelope names the key id it
+* was sealed under, so the opener selects the matching derived key instead of
+* assuming a single build exists. Cached per process and never persisted.
+*/
+const atRestKeyById = /* @__PURE__ */ new Map();
+let inflightKeys;
+/**
+* When the last full key sweep failed, and how long that failure is trusted.
+*
+* Without this, EVERY credential read spawned the app and waited out the
+* 10-second timeout before giving up — which is what made "rescan accounts" and
+* every status poll crawl on a machine where the app could not be found. A
+* failure is negative-cached briefly: long enough that a burst of reads costs
+* one sweep, short enough that installing or starting the app is picked up
+* without restarting DSH.
+*/
+let lastKeyFailureAtMs = 0;
+const KEY_FAILURE_BACKOFF_MS = 6e4;
+/**
+* Load every desktop build's key id into {@link atRestKeyById}.
+*
+* Mirrors the reference `provideTheKey` shape: probe EVERY candidate executable
+* (not just the first that exists) and keep the key each one yields. A build
+* that fails to answer — a timeout, a single-instance lock, an older build
+* without the native module — is skipped on its own and does NOT poison the
+* other builds, which is exactly the failure mode the single-candidate path
+* had: one bad spawn cached `undefined` for the whole process and every
+* encrypted field then reported "no app could be located".
+*/
+function ensureAtRestKeys() {
+	if (atRestKeyById.size > 0) return Promise.resolve();
+	if (Date.now() - lastKeyFailureAtMs < KEY_FAILURE_BACKOFF_MS) return Promise.resolve();
+	inflightKeys ??= (async () => {
+		const candidates = workbuddyAppExecutableCandidates().filter((candidate) => {
+			try {
+				return existsSync(candidate);
+			} catch {
+				return false;
+			}
+		});
+		if (candidates.length === 0) {
+			lastKeyFailureAtMs = Date.now();
+			return;
+		}
+		let anySuccess = false;
+		await Promise.all(candidates.map(async (executable) => {
+			try {
+				const key = deriveAtRestKey(await fetchAtRestKeyPayload(executable));
+				atRestKeyById.set(deriveAtRestKeyId(key), key);
+				anySuccess = true;
+			} catch {}
+		}));
+		if (anySuccess) lastKeyFailureAtMs = 0;
+		else lastKeyFailureAtMs = Date.now();
+	})().finally(() => {
+		inflightKeys = void 0;
+	});
+	return inflightKeys;
+}
+/**
+* Synchronous key lookup for a key id already loaded by {@link ensureAtRestKeys}.
+*
+* The account pool warms the cache up front (via {@link readAtRestKey}) and then
+* opens each encrypted field through a synchronous closure, because the parser
+* runs `decrypt` inline. Lookups that race the warm-up, or ask for a key id no
+* installed build produced, return undefined and are reported as the
+* encrypted-but-unavailable error rather than a silently empty token.
+*/
+function atRestKeyFor(keyId) {
+	return atRestKeyById.get(keyId);
+}
+/**
+* Backwards-compatible single-key view: the first key any build provided.
+*
+* Kept so callers that do not yet carry a key id (and the legacy tests) still
+* resolve to a usable key on single-build machines. Multi-build callers should
+* prefer {@link readAtRestKeyById} and select by the field's own key id.
+*/
+function readAtRestKey() {
+	return ensureAtRestKeys().then(() => {
+		for (const key of atRestKeyById.values()) return key;
+	});
+}
+//#endregion
 //#region src/accounts.ts
 /**
 * Account pool: discovers every WorkBuddy credential snapshot the desktop app
@@ -1728,11 +2213,81 @@ function optionalString(value) {
 	return typeof value === "string" && value !== "" ? value : void 0;
 }
 /**
+* Read one string-valued field that may arrive as a plain string (older builds)
+* or as the desktop app's `$wbEncrypted` envelope. The app started encrypting
+* `accessToken` / `refreshToken` / `nickname` in 5.6.0 on BOTH macOS and Windows
+* — the earlier "Windows first" reading was wrong, and it is why a signed-in Mac
+* showed no account at all: the value is an object, `typeof === 'string'` failed,
+* and the parser reported "no credential" for a perfectly good sign-in.
+*
+* `decrypt` is injected rather than called here so this parser stays synchronous
+* and testable; the async key fetch lives in `readCredential`. A field that IS
+* encrypted but could not be opened is reported as `failed` rather than as an
+* empty string — the caller must tell the user the app is missing or unreachable,
+* not send them to sign in again (the one action that cannot help).
+*/
+/**
+* Marker for "the credential is encrypted and we could not obtain the key".
+*
+* Carried as a `code` rather than left to `instanceof` because the value crosses
+* the packaged-plugin boundary; the same convention the sibling error types use.
+* This is deliberately NOT "not signed in": the user IS signed in, and telling
+* them to sign in again sends them to the one action that cannot help.
+*/
+const ENCRYPTED_CREDENTIAL_CODE = "ENCRYPTED_CREDENTIAL";
+var WorkBuddyEncryptedCredentialError = class extends Error {
+	code = ENCRYPTED_CREDENTIAL_CODE;
+	constructor(sourcePath) {
+		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed.`);
+		this.name = "WorkBuddyEncryptedCredentialError";
+	}
+};
+/** True when a thrown value is the encrypted-credential marker (cross-bundle safe). */
+function isEncryptedCredentialError(value) {
+	return typeof value === "object" && value !== null && value.code === "ENCRYPTED_CREDENTIAL";
+}
+function decryptableString(value, decrypt) {
+	if (typeof value === "string") return {
+		value,
+		encrypted: false,
+		failed: false
+	};
+	if (isEncryptedFieldWrapper(value)) {
+		if (decrypt === void 0) return {
+			value: "",
+			encrypted: true,
+			failed: true
+		};
+		try {
+			return {
+				value: decrypt(value),
+				encrypted: true,
+				failed: false
+			};
+		} catch {
+			return {
+				value: "",
+				encrypted: true,
+				failed: true
+			};
+		}
+	}
+	return {
+		value: "",
+		encrypted: false,
+		failed: false
+	};
+}
+/**
 * Parse a WorkBuddy auth document. Accepts the nested desktop shape
 * `{"auth":{...},"account":{...}}` and the flat panel shape; returns undefined
 * when there is no usable access token.
+*
+* `decrypt` opens the desktop app's `$wbEncrypted` field wrapper (5.6.0+, both
+* platforms). Absent means "plain-string builds only", which is what every
+* caller without an at-rest key should pass.
 */
-function parseWorkBuddyAuth(text, sourcePath) {
+function parseWorkBuddyAuth(text, sourcePath, decrypt) {
 	let parsed;
 	try {
 		parsed = JSON.parse(text);
@@ -1750,18 +2305,20 @@ function parseWorkBuddyAuth(text, sourcePath) {
 		auth = document;
 		identity = document;
 	}
-	const accessToken = typeof auth["accessToken"] === "string" ? auth["accessToken"] : "";
+	const accessField = decryptableString(auth["accessToken"], decrypt);
+	if (accessField.encrypted && accessField.failed) throw new WorkBuddyEncryptedCredentialError(sourcePath);
+	const accessToken = accessField.value;
 	if (accessToken === "") return void 0;
 	const refreshExpiresAtMs = typeof auth["refreshExpiresAt"] === "number" ? expiryToMs(auth["refreshExpiresAt"]) : void 0;
 	if (refreshExpiresAtMs !== void 0 && refreshExpiresAtMs > 0 && refreshExpiresAtMs < Date.now()) return;
 	const lastRefreshAtMs = typeof auth["lastRefreshTime"] === "number" ? expiryToMs(auth["lastRefreshTime"]) : void 0;
 	return {
 		accessToken,
-		refreshToken: typeof auth["refreshToken"] === "string" ? auth["refreshToken"] : "",
+		refreshToken: decryptableString(auth["refreshToken"], decrypt).value,
 		expiresAtMs: typeof auth["expiresAt"] === "number" ? expiryToMs(auth["expiresAt"]) : 0,
 		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
 		...lastRefreshAtMs === void 0 ? {} : { lastRefreshAtMs },
-		...optionalString(identity["nickname"]) === void 0 ? {} : { nickname: optionalString(identity["nickname"]) },
+		...optionalString(decryptableString(identity["nickname"], decrypt).value) === void 0 ? {} : { nickname: optionalString(decryptableString(identity["nickname"], decrypt).value) },
 		...optionalString(identity["uin"]) === void 0 ? {} : { uin: optionalString(identity["uin"]) },
 		...optionalString(identity["uid"]) === void 0 ? {} : { uid: optionalString(identity["uid"]) },
 		...optionalString(identity["enterpriseId"]) === void 0 ? {} : { enterpriseId: optionalString(identity["enterpriseId"]) },
@@ -1843,11 +2400,37 @@ async function authFilesIn(dir) {
 	return files.map((name) => join(dir, name));
 }
 async function readCredential(path) {
+	let text;
 	try {
-		return parseWorkBuddyAuth(await readFile(path, "utf8"), path);
+		text = await readFile(path, "utf8");
 	} catch {
 		return;
 	}
+	const decrypt = text.includes("\"$wbEncrypted\"") ? await encryptedFieldOpener() : void 0;
+	try {
+		return parseWorkBuddyAuth(text, path, decrypt);
+	} catch (error) {
+		if (isEncryptedCredentialError(error)) throw error;
+		return;
+	}
+}
+/**
+* Build the field opener, or undefined when the app cannot supply its key.
+*
+* Split out so the key lookup is testable without a real desktop install, and so
+* a lookup failure degrades to "encrypted, unopenable" rather than to a parse
+* error that would look like a corrupt file.
+*/
+async function encryptedFieldOpener() {
+	await readAtRestKey().catch(() => void 0);
+	return (field) => {
+		if (!isEncryptedFieldWrapper(field)) throw new Error("workbuddy: not an encrypted field wrapper");
+		const keyId = encryptedFieldKeyId(field);
+		if (keyId === void 0) throw new Error("workbuddy: encrypted field has no key id");
+		const key = atRestKeyFor(keyId);
+		if (key === void 0) throw new Error("workbuddy: no at-rest key available for this encrypted field");
+		return openEncryptedField(field, key);
+	};
 }
 /** Every directory the pool should scan, in probe order. */
 function candidateAuthDirs(env = process.env) {
@@ -2637,10 +3220,10 @@ function createWorkBuddyAdapter(options) {
 		streamIdleTimeoutMs: WORKBUDDY_STREAM_IDLE_TIMEOUT_MS,
 		retryPolicy: resolveRetryPolicy(void 0, "dsh-workbuddy-xdpool retryPolicy"),
 		configuredMaxTokens: /* @__PURE__ */ new Map(),
+		modelErrors: /* @__PURE__ */ new Map(),
 		...REQUEST_IMAGE_BUDGETS,
 		piProvider: provider
 	};
-	Object.assign(profile, { modelErrors: /* @__PURE__ */ new Map() });
 	let profiles = /* @__PURE__ */ new Map([[providerId, profile]]);
 	return {
 		providerId,
@@ -3165,10 +3748,37 @@ function diffEarnings(before, after) {
 		accounts
 	};
 }
-function dayKey(date) {
-	const month = String(date.getMonth() + 1).padStart(2, "0");
-	const day = String(date.getDate()).padStart(2, "0");
-	return `${date.getFullYear()}-${month}-${day}`;
+/**
+* The timezone every hour in this file is interpreted in.
+*
+* The activity windows these jobs target are defined in Beijing time, but the
+* scheduler used `getHours()`, which answers in the host machine's local zone.
+* On a machine set to anything else, "09:00" was 09:00 local — a check-in that
+* simply never came due. Naming the zone makes the hour mean the same instant
+* everywhere DSH runs, and is also what lets a test pin the behaviour.
+*/
+const AUTOMATION_TIME_ZONE = "Asia/Shanghai";
+/** Calendar parts of `date` in `timeZone`, all as zero-padded strings. */
+function zonedParts(date, timeZone = AUTOMATION_TIME_ZONE) {
+	const parts = new Intl.DateTimeFormat("en-CA", {
+		timeZone,
+		year: "numeric",
+		month: "2-digit",
+		day: "2-digit",
+		hour: "2-digit",
+		hourCycle: "h23"
+	}).formatToParts(date);
+	const pick = (type) => parts.find((part) => part.type === type)?.value ?? "00";
+	return {
+		year: pick("year"),
+		month: pick("month"),
+		day: pick("day"),
+		hour: pick("hour")
+	};
+}
+function dayKey(date, timeZone = AUTOMATION_TIME_ZONE) {
+	const { year, month, day } = zonedParts(date, timeZone);
+	return `${year}-${month}-${day}`;
 }
 /**
 * The scheduled SLOT `date` falls in, as `YYYY-MM-DDTHH`.
@@ -3177,8 +3787,9 @@ function dayKey(date) {
 * for several hours runs in each of them while a second tick inside the same
 * hour is still refused.
 */
-function slotKey(date) {
-	return `${dayKey(date)}T${String(date.getHours()).padStart(2, "0")}`;
+function slotKey(date, timeZone = AUTOMATION_TIME_ZONE) {
+	const { hour } = zonedParts(date, timeZone);
+	return `${dayKey(date, timeZone)}T${hour}`;
 }
 /**
 * Whether `now`'s local hour is one of `hours`.
@@ -3190,7 +3801,8 @@ function slotKey(date) {
 * moment it wakes, on the same day.
 */
 function isFireHour(now, hours) {
-	return hours.includes(now.getHours());
+	const { hour } = zonedParts(now);
+	return hours.includes(Number(hour));
 }
 /** Whether this account may be used: not switched off, not cooling. */
 function eligible(account, now) {
@@ -3453,6 +4065,22 @@ var WorkBuddyScheduler = class {
 	* rate-limits per account, so overlapping passes would only trip that limit.
 	* A job that throws is recorded and the loop continues.
 	*/
+	/**
+	* Whether `kind` is due at `now`: its earliest configured hour has passed in
+	* the scheduling timezone, and no hour of today has been consumed yet.
+	*
+	* Hours are consumed per SLOT (one entry per configured hour), so a job with
+	* two hours still runs twice a day — but a job whose hour passed while DSH was
+	* closed runs immediately on the next tick instead of waiting for tomorrow.
+	*/
+	isDue(kind, now) {
+		const hours = this.hoursOf(kind);
+		if (hours.length === 0) return false;
+		const { hour } = zonedParts(now);
+		const current = Number(hour);
+		const today = dayKey(now);
+		return hours.some((candidate) => candidate <= current && this.states[kind].lastRunSlot !== `${today}T${String(candidate).padStart(2, "0")}`);
+	}
 	async tick() {
 		if (!this.enabled || this.stopped || this.busy) return;
 		this.busy = true;
@@ -3463,7 +4091,7 @@ var WorkBuddyScheduler = class {
 			for (const kind of JOB_KINDS) {
 				if (this.stopped) return;
 				if (this.states[kind].lastRunSlot === slot) continue;
-				if (!isFireHour(now, this.hoursOf(kind))) continue;
+				if (!this.isDue(kind, now)) continue;
 				await this.runJob(kind, today);
 			}
 		} catch (error) {
@@ -5482,33 +6110,47 @@ function apply(ctx, config = {}) {
 	* the browser; the catalog re-reads through `onChange` either way.
 	*/
 	/**
-	* Write one key of the plugin's own settings section. Only ever called with the
-	* model-selection keys, the distribution, and the disabled-account list, so the
-	* settings file cannot be steered from the browser; the catalogs and the pool
-	* re-read through `onChange` either way.
+	* Persist one settings key, then VERIFY it landed.
+	*
+	* The settings service resolves `set()` even when the write did not stick, so a
+	* fire-and-forget call reports success while the file keeps the old value — and
+	* the card then shows a value that silently reverts on the next read. That is
+	* exactly the "I typed a reserve, reopened, and it still says 0" report: the
+	* write was reported as saved but never reached the document. Every write now
+	* awaits the setter and re-reads the document; a mismatch throws so the caller
+	* surfaces a real error instead of claiming success.
 	*
-	* `set` returns a promise, so a rejection must be caught explicitly: a bare
-	* `void write.call(...)` swallows it, and the card then looks like it saved
-	* while the value never reached the settings file.
+	* `expected` is what the caller believes it just wrote. Comparison goes through
+	* a JSON round-trip so key order cannot cause a false mismatch.
 	*/
-	const setSetting = (key, value) => {
+	/**
+	* Deep equality that ignores key order, used to verify a settings write.
+	*
+	* `JSON.stringify` is key-order sensitive, so comparing two equal objects whose
+	* keys were inserted in a different order would report a false "not persisted"
+	* failure — and a false failure on a write that DID land is as harmful as a
+	* false success: it sends the user chasing a bug that is not there.
+	*/
+	function stableJsonEqual(left, right) {
+		return canonicalJson(left) === canonicalJson(right);
+	}
+	function canonicalJson(value) {
+		if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+		if (typeof value === "object" && value !== null) return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
+		return JSON.stringify(value);
+	}
+	const setSetting = async (key, value, expected) => {
 		if (value === void 0) return;
-		const write = settingsService?.set;
-		if (write === void 0) {
-			ctx.logger.warn?.(`dsh-workbuddy-xdpool: no settings writer; ` + key + ` was not saved`);
-			return;
-		}
-		try {
-			const result = write.call(settingsService, key, value);
-			if (result !== void 0 && typeof result.then === "function") result.catch((error) => {
-				ctx.logger.warn?.(`dsh-workbuddy-xdpool: failed to persist ` + key, error);
-			});
-		} catch (error) {
-			ctx.logger.warn?.(`dsh-workbuddy-xdpool: failed to persist ` + key, error);
+		const update = settingsService?.update;
+		if (update === void 0) throw new Error(`settings service has no update(); ${key} was not saved`);
+		await update.call(settingsService, WORKBUDDY_POOL_SETTINGS_NS, { [key]: value });
+		if (expected !== void 0) {
+			const stored = current()[key];
+			if (!stableJsonEqual(stored, expected)) throw new Error(`settings field "${key}" was not persisted`);
 		}
 	};
-	core.scheduler.setEarningsPersistence((ledger) => {
-		setSetting("automationEarnings", ledger);
+	core.scheduler.setEarningsPersistence(async (ledger) => {
+		await setSetting("automationEarnings", ledger, ledger);
 	});
 	const storedLedger = current().automationEarnings;
 	if (storedLedger !== void 0) core.scheduler.applyEarningsLedger(storedLedger);
@@ -5554,23 +6196,24 @@ function apply(ctx, config = {}) {
 		shim: () => shimInfo("cn"),
 		scheduler: () => core.scheduler.status(),
 		runAutomation: (_job, _force) => core.scheduler.startRunAll(),
-		saveSelection: (region, selection) => {
-			setSetting(modelSelectionKeyFor(region), {
+		saveSelection: async (region, selection) => {
+			const payload = {
 				...selection.enabledModelIds === void 0 ? {} : { enabledModelIds: [...selection.enabledModelIds] },
 				...selection.imageModelIds === void 0 ? {} : { imageModelIds: [...selection.imageModelIds] },
 				...selection.contextBudgets === void 0 ? {} : { contextBudgets: { ...selection.contextBudgets } }
-			});
+			};
+			await setSetting(modelSelectionKeyFor(region), payload, payload);
 		},
-		setAccountDisabled: (accountId, disabled) => {
+		setAccountDisabled: async (accountId, disabled) => {
 			const currentIds = current().disabledAccountIds ?? [];
 			const next = disabled ? currentIds.includes(accountId) ? currentIds : [...currentIds, accountId] : currentIds.filter((id) => id !== accountId);
-			setSetting("disabledAccountIds", next);
+			await setSetting("disabledAccountIds", next, next);
 		},
-		setCreditReserve: (accountId, reserve) => {
+		setCreditReserve: async (accountId, reserve) => {
 			const next = { ...current().creditReserves ?? {} };
 			if (reserve > 0) next[accountId] = reserve;
 			else delete next[accountId];
-			setSetting("creditReserves", next);
+			await setSetting("creditReserves", next, next);
 		}
 	}));
 	api = {