dsh-workbuddy-xdpool 1.5.2 → 1.7.0

package/lib/bin.js

@@ -2,8 +2,8 @@ import { createDecipheriv, createHash, randomUUID } from "node:crypto";
 import { copyFile, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { homedir, platform } from "node:os";
 import { basename, join, resolve } from "node:path";
-import { execFile } from "node:child_process";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { execFile, execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import z from "@deepseek-ai/schemastery";
 import "@earendil-works/pi-ai";
 import "@earendil-works/pi-ai/api/openai-completions.lazy";
@@ -1640,10 +1640,29 @@ const AAD_DOMAIN = Buffer.from("WB-AAD\0", "ascii");
 const SYMMETRIC_SCHEME = "sym-v1";
 /** Env override pointing at the WorkBuddy desktop executable. */
 const WORKBUDDY_APP_EXECUTABLE_ENV = "WORKBUDDY_APP_EXECUTABLE";
-/** How long the app is given to answer with its key payload. */
-const KEY_FETCH_TIMEOUT_MS = 1e4;
-/** File name of the WorkBuddy desktop executable on Windows. */
-const APP_EXECUTABLE_NAME = "WorkBuddy.exe";
+/**
+* How long the app is given to answer with its key payload.
+*
+* 30s, not 10s: the child is the WorkBuddy Electron binary running as plain
+* Node, and its FIRST spawn on a cold machine costs several seconds on its own
+* (measured 4.5s here) before the endpoint security stack has warmed its scan
+* cache. Under load — a concurrent `pnpm install` from the market, a running
+* full-disk scan — that first spawn crosses a 10s budget, the fetch rejects,
+* `readAtRestKey` returns undefined, and every encrypted credential then reads
+* as `WorkBuddyEncryptedCredentialError` until the 60s negative cache expires.
+* A successful fetch is cached for the process lifetime, so the longer budget
+* is only ever paid once per process, and only when the app is present but slow.
+*/
+const KEY_FETCH_TIMEOUT_MS = 3e4;
+/**
+* Executable file names the desktop app ships under, in probe order.
+*
+* `WorkBuddyAI.exe` is the INTERNATIONAL build; both apps can be installed side
+* by side (observed on a real machine: `D:\\workbuddy\\WorkBuddy.exe` for the
+* domestic one and `D:\\workbuddyai\\WorkBuddyAI.exe` for the international one),
+* so the name cannot be assumed.
+*/
+const APP_EXECUTABLE_NAMES = ["WorkBuddy.exe", "WorkBuddyAI.exe"];
 /**
 * macOS bundles the desktop app may be installed as, in probe order.
 *
@@ -1752,6 +1771,23 @@ function openEncryptedField(field, key) {
 	return Buffer.concat([decipher.update(Buffer.from(ciphertext, "base64")), decipher.final()]).toString("utf8");
 }
 /**
+* The key id an encrypted field envelope demands, or undefined when the
+* envelope cannot be read.
+*
+* The account pool uses it to pick the right desktop build's key when more
+* than one build (domestic and international) is installed on the same machine:
+* each `.info` file names the key id its fields were sealed under, so the opener
+* must select the matching derived key rather than assume one build exists.
+*/
+function encryptedFieldKeyId(field) {
+	try {
+		const record = JSON.parse(Buffer.from(field.envelope, "base64").toString("utf8"));
+		return typeof record["keyId"] === "string" ? record["keyId"] : void 0;
+	} catch {
+		return;
+	}
+}
+/**
 * The executable inside a macOS app bundle, read from the bundle's own
 * `Info.plist`.
 *
@@ -1777,116 +1813,140 @@ function macosBundleExecutable(bundle) {
 	return join(bundle, "Contents", "MacOS", name);
 }
 /**
-* Candidate paths of the WorkBuddy desktop executable, in probe order.
-*
-* The Windows build is the one that encrypts credentials, so Windows leads;
-* the macOS bundles are listed because the same native module ships there and
-* the encryption policy is enabled on macOS builds too (observed from 5.6.x),
-* and `undefined` entries (an unset env variable) are dropped.
+* Windows install locations recorded by the app's own uninstaller.
 *
-* On macOS the executable name comes from each bundle (see
-* {@link macosBundleExecutable}) rather than being assembled from the app name.
-*
-* `readBundleExecutable` is injectable, in the same spirit as `platform`/`home`/
-* `env`: the macOS branch consults the real filesystem, so without a seam the
-* expected candidates would depend on whether the host machine happens to have
-* the app installed — and the test would pass on a developer's Mac while
-* failing in CI.
-*/
-function workbuddyAppExecutableCandidates(platform = process.platform, home = homedir(), env = process.env, readBundleExecutable = macosBundleExecutable) {
-	const candidates = [env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim()];
-	if (platform === "win32") {
-		const local = env["LOCALAPPDATA"]?.trim();
-		const programFiles = env["ProgramFiles"]?.trim();
-		const programFilesX86 = env["ProgramFiles(x86)"]?.trim();
-		candidates.push(local === void 0 || local === "" ? void 0 : join(local, "Programs", "WorkBuddy", APP_EXECUTABLE_NAME), local === void 0 || local === "" ? void 0 : join(local, "WorkBuddy", APP_EXECUTABLE_NAME), programFiles === void 0 || programFiles === "" ? void 0 : join(programFiles, "WorkBuddy", APP_EXECUTABLE_NAME), programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : join(programFilesX86, "WorkBuddy", APP_EXECUTABLE_NAME));
-	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
-	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
-}
-/**
-* Bundle identifier PREFIXES the desktop app is signed with — `com.tencent.
-* workbuddy` (domestic, observed as `…workbuddy.mac`) and `com.workbuddy`
-* (international, observed as `com.workbuddy.workbuddy-ai`).
-*
-* Used to CONFIRM that a discovered bundle really is WorkBuddy before it is
-* launched. This matters because the discovery below scans directories and then
-* execs what it finds: every Electron app is built around a binary called
-* `Electron`, so a name-only match could pick a different product's bundle and
-* run it. The identifier is the app's own claim about itself, so it is the
-* check that makes the scan safe.
-*/
-const APP_BUNDLE_IDENTIFIER_PREFIXES = ["com.tencent.workbuddy", "com.workbuddy"];
-/**
-* Whether a bundle identifies itself as the WorkBuddy desktop app.
+* The registry is the authoritative answer: it survives a non-default drive, a
+* renamed folder and a differently-named executable, none of which any fixed
+* path list can predict. Real machines put the app at `D:\workbuddy\WorkBuddy.exe`
+* and `D:\workbuddyai\WorkBuddyAI.exe` — exactly the layouts a
+* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see, which is why the
+* plugin reported "the desktop app could not provide the key" for an app that was
+* installed and running.
 *
-* The match is on dot boundaries, so a hypothetical `com.workbuddyish` cannot
-* pass as `com.workbuddy`.
+* `DisplayIcon` is the field that actually carries the path (observed as
+* `D:\workbuddy\WorkBuddy.exe,0`); `InstallLocation` is usually empty for these
+* installers, so both are read and either may contribute.
 *
-* An unreadable or identifier-less plist is treated as NOT WorkBuddy: refusing
-* a candidate only costs a fallback to another path, whereas accepting the
-* wrong one would execute an unrelated application.
+* Returns [] on any failure — a missing registry key is the normal case on
+* non-Windows, not an error.
 */
-function isWorkbuddyBundle(bundle) {
-	let plist;
-	try {
-		plist = readFileSync(join(bundle, "Contents", "Info.plist"), "utf8");
-	} catch {
-		return false;
+function windowsRegistryAppPaths() {
+	if (process.platform !== "win32") return [];
+	const roots = [
+		["HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
+		["HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
+		["HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"]
+	];
+	const out = [];
+	for (const [root] of roots) {
+		let listing;
+		try {
+			listing = execFileSync("reg", [
+				"query",
+				root,
+				"/s",
+				"/v",
+				"DisplayName"
+			], {
+				encoding: "utf8",
+				timeout: 1e4,
+				windowsHide: true,
+				maxBuffer: 8388608
+			});
+		} catch {
+			continue;
+		}
+		const keys = listing.split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
+		for (const key of keys) {
+			const keyPath = /^(HKEY_[^\r\n]+)/u.exec(key)?.[1]?.trim();
+			if (keyPath === void 0) continue;
+			for (const name of ["DisplayIcon", "InstallLocation"]) try {
+				const value = execFileSync("reg", [
+					"query",
+					keyPath,
+					"/v",
+					name
+				], {
+					encoding: "utf8",
+					timeout: 5e3,
+					windowsHide: true
+				});
+				const raw = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(value)?.[1]?.trim();
+				if (raw === void 0 || raw === "") continue;
+				const cleaned = raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
+				out.push(cleaned);
+			} catch {}
+		}
 	}
-	const identifier = /<key>\s*CFBundleIdentifier\s*<\/key>\s*<string>([^<]*)<\/string>/u.exec(plist)?.[1]?.trim().toLowerCase();
-	if (identifier === void 0 || identifier === "") return false;
-	return APP_BUNDLE_IDENTIFIER_PREFIXES.some((prefix) => identifier === prefix || identifier.startsWith(`${prefix}.`));
+	return out;
 }
 /**
-* Bundles of the desktop app found one level BELOW a macOS applications
-* directory.
-*
-* Users do file apps into subfolders (`/Applications/IDE/WorkBuddy.app`), and
-* a hardcoded `/Applications/<name>` then reports the app as missing while it
-* is installed and signed in. The scan is deliberately ONE level deep and
-* matches the known bundle names only, so it stays predictable and cheap; each
-* candidate is then confirmed by {@link isWorkbuddyBundle} before use.
+* Windows fallbacks for an app the registry did not cover: the well-known
+* per-user and machine-wide locations, plus every fixed drive's `Program Files`.
 *
-* Returns [] when the parent is absent or unreadable — a missing directory is
-* the normal case, not an error.
+* Drive enumeration matters because installing to a non-system drive is common
+* on Windows and no environment variable points there.
 */
-function macosNestedAppBundles(parent) {
-	let entries;
-	try {
-		entries = readdirSync(parent);
-	} catch {
-		return [];
-	}
-	const bundles = [];
-	for (const entry of entries) {
-		const nested = join(parent, entry);
-		for (const name of MACOS_APP_BUNDLE_NAMES) {
-			const bundle = join(nested, name);
-			try {
-				if (!statSync(bundle).isDirectory()) continue;
-			} catch {
-				continue;
-			}
-			if (isWorkbuddyBundle(bundle)) bundles.push(bundle);
+function windowsFallbackAppPaths(env) {
+	const out = [];
+	const roots = /* @__PURE__ */ new Set();
+	for (const key of [
+		"ProgramFiles",
+		"ProgramW6432",
+		"ProgramFiles(x86)",
+		"LOCALAPPDATA"
+	]) {
+		const value = env[key]?.trim();
+		if (value !== void 0 && value !== "") roots.add(value);
+	}
+	for (let code = 67; code <= 90; code += 1) {
+		const drive = String.fromCharCode(code) + ":\\";
+		try {
+			if (!existsSync(drive)) continue;
+		} catch {
+			continue;
 		}
-	}
-	return bundles;
+		roots.add(join(drive, "Program Files"));
+		roots.add(join(drive, "Program Files (x86)"));
+		roots.add(drive);
+	}
+	for (const root of roots) for (const name of APP_EXECUTABLE_NAMES) {
+		out.push(join(root, "WorkBuddy", name));
+		out.push(join(root, "WorkBuddy AI", name));
+		out.push(join(root, "Programs", "WorkBuddy", name));
+	}
+	for (const root of roots) try {
+		for (const entry of readdirSync(root)) {
+			if (!/^(workbuddy|codebuddy)/iu.test(entry)) continue;
+			for (const name of APP_EXECUTABLE_NAMES) out.push(join(root, entry, name));
+		}
+	} catch {}
+	return out;
 }
 /**
-* The first candidate that exists as a file, or undefined when the desktop app
-* is not installed where this platform expects it.
+* Candidate paths of the WorkBuddy desktop executable, in probe order.
+*
+* Order is deliberate:
+*  1. the explicit override, because a user who set it knows where the app is;
+*  2. the registry, which is what the installer itself recorded;
+*  3. derived fallbacks (per-user, machine-wide, every fixed drive).
+*
+* Only the Windows branch consults the registry (it is the only platform with
+* one). macOS asks each bundle for its own `CFBundleExecutable` instead, because
+* the WorkBuddy bundles ship a binary named `Electron`, not after the app.
+*
+* `readBundleExecutable` and `registryPaths` are injectable in the same spirit as
+* `platform`/`home`/`env`: both consult the real machine, so without a seam the
+* expected candidates would depend on what happens to be installed where the
+* suite runs — passing on a developer's box and failing in CI.
 */
-function findWorkbuddyAppExecutable(platform = process.platform, home = homedir(), env = process.env) {
-	for (const candidate of workbuddyAppExecutableCandidates(platform, home, env)) try {
-		if (existsSync(candidate)) return candidate;
-	} catch {}
-	if (platform === "darwin") for (const parent of ["/Applications", join(home, "Applications")]) for (const bundle of macosNestedAppBundles(parent)) {
-		const executable = macosBundleExecutable(bundle);
-		if (executable === void 0) continue;
-		try {
-			if (existsSync(executable)) return executable;
-		} catch {}
-	}
+function workbuddyAppExecutableCandidates(platform = process.platform, home = homedir(), env = process.env, readBundleExecutable = macosBundleExecutable, registryPaths = windowsRegistryAppPaths) {
+	const candidates = [env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim()];
+	if (platform === "win32") {
+		candidates.push(...registryPaths());
+		candidates.push(...windowsFallbackAppPaths(env));
+	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
+	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
 }
 /**
 * Ask the installed desktop app for its key payload by running its own binary
@@ -1921,28 +1981,95 @@ function fetchAtRestKeyPayload(executable) {
 		});
 	});
 }
-/** Process-lifetime cache of the derived key; never persisted. */
-let cachedKey;
-let inflightKey;
 /**
-* The desktop app's at-rest field key, or undefined when it cannot be obtained
-* (app not installed, an older build without the native module, or a future
-* build that rotates the payload). Cached after the first success so the app is
-* spawned at most once per process; a failure is retried on the next call,
-* because the user may install or start the app between reads.
+* The desktop app's at-rest keys, indexed by the key id each derived key
+* reports (the first 16 hex of its SHA-256).
+*
+* More than one build can be installed on one machine — the domestic
+* `WorkBuddy.exe` and the international `WorkBuddyAI.exe` share a key id on the
+* builds seen here, but a future build may rotate it, and the discovery below
+* must keep working if they ever diverge. A field envelope names the key id it
+* was sealed under, so the opener selects the matching derived key instead of
+* assuming a single build exists. Cached per process and never persisted.
 */
-function readAtRestKey() {
-	if (cachedKey !== void 0) return Promise.resolve(cachedKey);
-	inflightKey ??= (async () => {
-		const executable = findWorkbuddyAppExecutable();
-		if (executable === void 0) return void 0;
-		const key = deriveAtRestKey(await fetchAtRestKeyPayload(executable));
-		cachedKey = key;
-		return key;
+const atRestKeyById = /* @__PURE__ */ new Map();
+let inflightKeys;
+/**
+* When the last full key sweep failed, and how long that failure is trusted.
+*
+* Without this, EVERY credential read spawned the app and waited out the
+* 10-second timeout before giving up — which is what made "rescan accounts" and
+* every status poll crawl on a machine where the app could not be found. A
+* failure is negative-cached briefly: long enough that a burst of reads costs
+* one sweep, short enough that installing or starting the app is picked up
+* without restarting DSH.
+*/
+let lastKeyFailureAtMs = 0;
+const KEY_FAILURE_BACKOFF_MS = 6e4;
+/**
+* Load every desktop build's key id into {@link atRestKeyById}.
+*
+* Mirrors the reference `provideTheKey` shape: probe EVERY candidate executable
+* (not just the first that exists) and keep the key each one yields. A build
+* that fails to answer — a timeout, a single-instance lock, an older build
+* without the native module — is skipped on its own and does NOT poison the
+* other builds, which is exactly the failure mode the single-candidate path
+* had: one bad spawn cached `undefined` for the whole process and every
+* encrypted field then reported "no app could be located".
+*/
+function ensureAtRestKeys() {
+	if (atRestKeyById.size > 0) return Promise.resolve();
+	if (Date.now() - lastKeyFailureAtMs < KEY_FAILURE_BACKOFF_MS) return Promise.resolve();
+	inflightKeys ??= (async () => {
+		const candidates = workbuddyAppExecutableCandidates().filter((candidate) => {
+			try {
+				return existsSync(candidate);
+			} catch {
+				return false;
+			}
+		});
+		if (candidates.length === 0) {
+			lastKeyFailureAtMs = Date.now();
+			return;
+		}
+		let anySuccess = false;
+		await Promise.all(candidates.map(async (executable) => {
+			try {
+				const key = deriveAtRestKey(await fetchAtRestKeyPayload(executable));
+				atRestKeyById.set(deriveAtRestKeyId(key), key);
+				anySuccess = true;
+			} catch {}
+		}));
+		if (anySuccess) lastKeyFailureAtMs = 0;
+		else lastKeyFailureAtMs = Date.now();
 	})().finally(() => {
-		inflightKey = void 0;
+		inflightKeys = void 0;
+	});
+	return inflightKeys;
+}
+/**
+* Synchronous key lookup for a key id already loaded by {@link ensureAtRestKeys}.
+*
+* The account pool warms the cache up front (via {@link readAtRestKey}) and then
+* opens each encrypted field through a synchronous closure, because the parser
+* runs `decrypt` inline. Lookups that race the warm-up, or ask for a key id no
+* installed build produced, return undefined and are reported as the
+* encrypted-but-unavailable error rather than a silently empty token.
+*/
+function atRestKeyFor(keyId) {
+	return atRestKeyById.get(keyId);
+}
+/**
+* Backwards-compatible single-key view: the first key any build provided.
+*
+* Kept so callers that do not yet carry a key id (and the legacy tests) still
+* resolve to a usable key on single-build machines. Multi-build callers should
+* prefer {@link readAtRestKeyById} and select by the field's own key id.
+*/
+function readAtRestKey() {
+	return ensureAtRestKeys().then(() => {
+		for (const key of atRestKeyById.values()) return key;
 	});
-	return inflightKey;
 }
 //#endregion
 //#region src/accounts.ts
@@ -2017,7 +2144,7 @@ const ENCRYPTED_CREDENTIAL_CODE = "ENCRYPTED_CREDENTIAL";
 var WorkBuddyEncryptedCredentialError = class extends Error {
 	code = ENCRYPTED_CREDENTIAL_CODE;
 	constructor(sourcePath) {
-		super(`workbuddy: ${sourcePath} holds encrypted credentials but the desktop app could not provide the key. Install the WorkBuddy desktop app (or point WORKBUDDY_APP_EXECUTABLE at it) — signing in again will not help.`);
+		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed.`);
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
@@ -2201,10 +2328,13 @@ async function readCredential(path) {
 * error that would look like a corrupt file.
 */
 async function encryptedFieldOpener() {
-	const key = await readAtRestKey().catch(() => void 0);
-	if (key === void 0) return void 0;
+	await readAtRestKey().catch(() => void 0);
 	return (field) => {
 		if (!isEncryptedFieldWrapper(field)) throw new Error("workbuddy: not an encrypted field wrapper");
+		const keyId = encryptedFieldKeyId(field);
+		if (keyId === void 0) throw new Error("workbuddy: encrypted field has no key id");
+		const key = atRestKeyFor(keyId);
+		if (key === void 0) throw new Error("workbuddy: no at-rest key available for this encrypted field");
 		return openEncryptedField(field, key);
 	};
 }
@@ -3713,12 +3843,16 @@ var WorkBuddyScheduler = class {
 	*/
 	persistEarnings() {
 		if (this.saveEarningsFn === void 0) return;
+		const accounts = {};
+		for (const [id, entry] of this.earnings) accounts[id] = entry;
+		const ledger = {
+			date: this.earningsDate,
+			accounts
+		};
 		try {
-			const accounts = {};
-			for (const [id, entry] of this.earnings) accounts[id] = entry;
-			this.saveEarningsFn({
-				date: this.earningsDate,
-				accounts
+			const saved = this.saveEarningsFn(ledger);
+			if (saved !== void 0 && typeof saved.then === "function") saved.then(void 0, (error) => {
+				this.logger.warn?.("dsh-workbuddy-xdpool: could not persist automation earnings:", error);
 			});
 		} catch (error) {
 			this.logger.warn?.("dsh-workbuddy-xdpool: could not persist automation earnings:", error);
@@ -4150,6 +4284,18 @@ function formatRates(status) {
 * region that has never been saved stays absent so `applyConfigFromSource` can
 * fall back to the legacy flat keys.
 */
+function asVolatile(schema) {
+	const candidate = schema;
+	return typeof candidate.volatile === "function" ? candidate.volatile() : schema;
+}
+/**
+* One region's model-selection schema.
+*
+* Every field is optional on purpose: an absent field keeps its documented
+* meaning ("all enabled" / "follow the upstream image flag" / "no cap"), and a
+* region that has never been saved stays absent so `applyConfigFromSource` can
+* fall back to the legacy flat keys.
+*/
 const modelSelectionSchema = z.object({
 	enabledModelIds: z.array(z.string()).description("Model ids enabled in this region's picker (absent = all)"),
 	imageModelIds: z.array(z.string()).description("Model ids accepting image input in this region (absent = follow upstream)"),
@@ -4177,22 +4323,22 @@ const automationSchema = z.object({
 	exhaustCooldownMs: z.number().step(1).min(1e3).description("How long a spent account rests, in milliseconds")
 });
 z.object({
-	authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app own location)"),
-	cooldownMs: z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds"),
-	distribution: z.union([
+	authFile: asVolatile(z.string().description("WorkBuddy desktop auth file (defaults to the app own location)")),
+	cooldownMs: asVolatile(z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds")),
+	distribution: asVolatile(z.union([
 		"priority",
 		"round-robin",
 		"balanced"
-	]).default("priority").description("How requests are spread: priority (drain one), round-robin (in order), or balanced (idle-weighted random)"),
-	disabledAccountIds: z.array(z.string()).default([]).description("Account ids excluded from the pool (empty = every discovered account participates)"),
-	creditReserves: z.dict(z.number().step(1).min(0)).default({}).description("Per-account credit floor: stop using an account once its balance reaches this value"),
-	enabledModelIds: z.array(z.string()).default([]).description("Legacy shared model-id list; used by a region that has no per-region selection yet"),
-	imageModelIds: z.array(z.string()).default([]).description("Legacy shared image-id list; used by a region that has no per-region selection yet"),
-	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Legacy shared context budgets; used by a region with no per-region selection yet"),
-	modelSelectionCn: modelSelectionSchema.description("Model selection for the domestic gateway"),
-	modelSelectionGlobal: modelSelectionSchema.description("Model selection for the international gateway"),
-	automation: automationSchema.description("Daily points automation (activity report, task claiming, check-in)"),
-	automationEarnings: z.any().description("Automation earnings ledger (written by the scheduler)")
+	]).default("priority").description("How requests are spread: priority (drain one), round-robin (in order), or balanced (idle-weighted random)")),
+	disabledAccountIds: asVolatile(z.array(z.string()).default([]).description("Account ids excluded from the pool (empty = every discovered account participates)")),
+	creditReserves: asVolatile(z.dict(z.number().step(1).min(0)).default({}).description("Per-account credit floor: stop using an account once its balance reaches this value")),
+	enabledModelIds: asVolatile(z.array(z.string()).default([]).description("Legacy shared model-id list; used by a region that has no per-region selection yet")),
+	imageModelIds: asVolatile(z.array(z.string()).default([]).description("Legacy shared image-id list; used by a region that has no per-region selection yet")),
+	contextBudgets: asVolatile(z.dict(z.number().step(1).min(1)).default({}).description("Legacy shared context budgets; used by a region with no per-region selection yet")),
+	modelSelectionCn: asVolatile(modelSelectionSchema.description("Model selection for the domestic gateway")),
+	modelSelectionGlobal: asVolatile(modelSelectionSchema.description("Model selection for the international gateway")),
+	automation: asVolatile(automationSchema.description("Daily points automation (activity report, task claiming, check-in)")),
+	automationEarnings: asVolatile(z.any().description("Automation earnings ledger (written by the scheduler)"))
 });
 /** Assemble the runtime objects without registering anything. */
 /**