dsh-workbuddy-xdpool 1.5.2 → 1.7.0

package/lib/index.js

@@ -3,8 +3,8 @@ import z from "@deepseek-ai/schemastery";
 import { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { readFile, readdir } from "node:fs/promises";
 import { homedir } from "node:os";
-import { execFile } from "node:child_process";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { execFile, execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
@@ -1747,10 +1747,29 @@ const AAD_DOMAIN = Buffer.from("WB-AAD\0", "ascii");
 const SYMMETRIC_SCHEME = "sym-v1";
 /** Env override pointing at the WorkBuddy desktop executable. */
 const WORKBUDDY_APP_EXECUTABLE_ENV = "WORKBUDDY_APP_EXECUTABLE";
-/** How long the app is given to answer with its key payload. */
-const KEY_FETCH_TIMEOUT_MS = 1e4;
-/** File name of the WorkBuddy desktop executable on Windows. */
-const APP_EXECUTABLE_NAME = "WorkBuddy.exe";
+/**
+* How long the app is given to answer with its key payload.
+*
+* 30s, not 10s: the child is the WorkBuddy Electron binary running as plain
+* Node, and its FIRST spawn on a cold machine costs several seconds on its own
+* (measured 4.5s here) before the endpoint security stack has warmed its scan
+* cache. Under load — a concurrent `pnpm install` from the market, a running
+* full-disk scan — that first spawn crosses a 10s budget, the fetch rejects,
+* `readAtRestKey` returns undefined, and every encrypted credential then reads
+* as `WorkBuddyEncryptedCredentialError` until the 60s negative cache expires.
+* A successful fetch is cached for the process lifetime, so the longer budget
+* is only ever paid once per process, and only when the app is present but slow.
+*/
+const KEY_FETCH_TIMEOUT_MS = 3e4;
+/**
+* Executable file names the desktop app ships under, in probe order.
+*
+* `WorkBuddyAI.exe` is the INTERNATIONAL build; both apps can be installed side
+* by side (observed on a real machine: `D:\\workbuddy\\WorkBuddy.exe` for the
+* domestic one and `D:\\workbuddyai\\WorkBuddyAI.exe` for the international one),
+* so the name cannot be assumed.
+*/
+const APP_EXECUTABLE_NAMES = ["WorkBuddy.exe", "WorkBuddyAI.exe"];
 /**
 * macOS bundles the desktop app may be installed as, in probe order.
 *
@@ -1859,6 +1878,23 @@ function openEncryptedField(field, key) {
 	return Buffer.concat([decipher.update(Buffer.from(ciphertext, "base64")), decipher.final()]).toString("utf8");
 }
 /**
+* The key id an encrypted field envelope demands, or undefined when the
+* envelope cannot be read.
+*
+* The account pool uses it to pick the right desktop build's key when more
+* than one build (domestic and international) is installed on the same machine:
+* each `.info` file names the key id its fields were sealed under, so the opener
+* must select the matching derived key rather than assume one build exists.
+*/
+function encryptedFieldKeyId(field) {
+	try {
+		const record = JSON.parse(Buffer.from(field.envelope, "base64").toString("utf8"));
+		return typeof record["keyId"] === "string" ? record["keyId"] : void 0;
+	} catch {
+		return;
+	}
+}
+/**
 * The executable inside a macOS app bundle, read from the bundle's own
 * `Info.plist`.
 *
@@ -1884,116 +1920,140 @@ function macosBundleExecutable(bundle) {
 	return join(bundle, "Contents", "MacOS", name);
 }
 /**
-* Candidate paths of the WorkBuddy desktop executable, in probe order.
+* Windows install locations recorded by the app's own uninstaller.
 *
-* The Windows build is the one that encrypts credentials, so Windows leads;
-* the macOS bundles are listed because the same native module ships there and
-* the encryption policy is enabled on macOS builds too (observed from 5.6.x),
-* and `undefined` entries (an unset env variable) are dropped.
+* The registry is the authoritative answer: it survives a non-default drive, a
+* renamed folder and a differently-named executable, none of which any fixed
+* path list can predict. Real machines put the app at `D:\workbuddy\WorkBuddy.exe`
+* and `D:\workbuddyai\WorkBuddyAI.exe` — exactly the layouts a
+* `%ProgramFiles%\WorkBuddy\WorkBuddy.exe` probe cannot see, which is why the
+* plugin reported "the desktop app could not provide the key" for an app that was
+* installed and running.
 *
-* On macOS the executable name comes from each bundle (see
-* {@link macosBundleExecutable}) rather than being assembled from the app name.
+* `DisplayIcon` is the field that actually carries the path (observed as
+* `D:\workbuddy\WorkBuddy.exe,0`); `InstallLocation` is usually empty for these
+* installers, so both are read and either may contribute.
 *
-* `readBundleExecutable` is injectable, in the same spirit as `platform`/`home`/
-* `env`: the macOS branch consults the real filesystem, so without a seam the
-* expected candidates would depend on whether the host machine happens to have
-* the app installed — and the test would pass on a developer's Mac while
-* failing in CI.
+* Returns [] on any failure — a missing registry key is the normal case on
+* non-Windows, not an error.
 */
-function workbuddyAppExecutableCandidates(platform = process.platform, home = homedir(), env = process.env, readBundleExecutable = macosBundleExecutable) {
-	const candidates = [env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim()];
-	if (platform === "win32") {
-		const local = env["LOCALAPPDATA"]?.trim();
-		const programFiles = env["ProgramFiles"]?.trim();
-		const programFilesX86 = env["ProgramFiles(x86)"]?.trim();
-		candidates.push(local === void 0 || local === "" ? void 0 : join(local, "Programs", "WorkBuddy", APP_EXECUTABLE_NAME), local === void 0 || local === "" ? void 0 : join(local, "WorkBuddy", APP_EXECUTABLE_NAME), programFiles === void 0 || programFiles === "" ? void 0 : join(programFiles, "WorkBuddy", APP_EXECUTABLE_NAME), programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : join(programFilesX86, "WorkBuddy", APP_EXECUTABLE_NAME));
-	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
-	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
-}
-/**
-* Bundle identifier PREFIXES the desktop app is signed with — `com.tencent.
-* workbuddy` (domestic, observed as `…workbuddy.mac`) and `com.workbuddy`
-* (international, observed as `com.workbuddy.workbuddy-ai`).
-*
-* Used to CONFIRM that a discovered bundle really is WorkBuddy before it is
-* launched. This matters because the discovery below scans directories and then
-* execs what it finds: every Electron app is built around a binary called
-* `Electron`, so a name-only match could pick a different product's bundle and
-* run it. The identifier is the app's own claim about itself, so it is the
-* check that makes the scan safe.
-*/
-const APP_BUNDLE_IDENTIFIER_PREFIXES = ["com.tencent.workbuddy", "com.workbuddy"];
-/**
-* Whether a bundle identifies itself as the WorkBuddy desktop app.
-*
-* The match is on dot boundaries, so a hypothetical `com.workbuddyish` cannot
-* pass as `com.workbuddy`.
-*
-* An unreadable or identifier-less plist is treated as NOT WorkBuddy: refusing
-* a candidate only costs a fallback to another path, whereas accepting the
-* wrong one would execute an unrelated application.
-*/
-function isWorkbuddyBundle(bundle) {
-	let plist;
-	try {
-		plist = readFileSync(join(bundle, "Contents", "Info.plist"), "utf8");
-	} catch {
-		return false;
+function windowsRegistryAppPaths() {
+	if (process.platform !== "win32") return [];
+	const roots = [
+		["HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
+		["HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"],
+		["HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", "/**"]
+	];
+	const out = [];
+	for (const [root] of roots) {
+		let listing;
+		try {
+			listing = execFileSync("reg", [
+				"query",
+				root,
+				"/s",
+				"/v",
+				"DisplayName"
+			], {
+				encoding: "utf8",
+				timeout: 1e4,
+				windowsHide: true,
+				maxBuffer: 8388608
+			});
+		} catch {
+			continue;
+		}
+		const keys = listing.split(/\r?\n(?=HKEY_)/u).filter((block) => /WorkBuddy|CodeBuddy/iu.test(block));
+		for (const key of keys) {
+			const keyPath = /^(HKEY_[^\r\n]+)/u.exec(key)?.[1]?.trim();
+			if (keyPath === void 0) continue;
+			for (const name of ["DisplayIcon", "InstallLocation"]) try {
+				const value = execFileSync("reg", [
+					"query",
+					keyPath,
+					"/v",
+					name
+				], {
+					encoding: "utf8",
+					timeout: 5e3,
+					windowsHide: true
+				});
+				const raw = /REG_(?:SZ|EXPAND_SZ)\s+(.+)$/mu.exec(value)?.[1]?.trim();
+				if (raw === void 0 || raw === "") continue;
+				const cleaned = raw.replace(/^"/u, "").replace(/",-?\d+$/u, "").replace(/,-?\d+$/u, "").trim();
+				out.push(cleaned);
+			} catch {}
+		}
 	}
-	const identifier = /<key>\s*CFBundleIdentifier\s*<\/key>\s*<string>([^<]*)<\/string>/u.exec(plist)?.[1]?.trim().toLowerCase();
-	if (identifier === void 0 || identifier === "") return false;
-	return APP_BUNDLE_IDENTIFIER_PREFIXES.some((prefix) => identifier === prefix || identifier.startsWith(`${prefix}.`));
+	return out;
 }
 /**
-* Bundles of the desktop app found one level BELOW a macOS applications
-* directory.
-*
-* Users do file apps into subfolders (`/Applications/IDE/WorkBuddy.app`), and
-* a hardcoded `/Applications/<name>` then reports the app as missing while it
-* is installed and signed in. The scan is deliberately ONE level deep and
-* matches the known bundle names only, so it stays predictable and cheap; each
-* candidate is then confirmed by {@link isWorkbuddyBundle} before use.
+* Windows fallbacks for an app the registry did not cover: the well-known
+* per-user and machine-wide locations, plus every fixed drive's `Program Files`.
 *
-* Returns [] when the parent is absent or unreadable — a missing directory is
-* the normal case, not an error.
+* Drive enumeration matters because installing to a non-system drive is common
+* on Windows and no environment variable points there.
 */
-function macosNestedAppBundles(parent) {
-	let entries;
-	try {
-		entries = readdirSync(parent);
-	} catch {
-		return [];
-	}
-	const bundles = [];
-	for (const entry of entries) {
-		const nested = join(parent, entry);
-		for (const name of MACOS_APP_BUNDLE_NAMES) {
-			const bundle = join(nested, name);
-			try {
-				if (!statSync(bundle).isDirectory()) continue;
-			} catch {
-				continue;
-			}
-			if (isWorkbuddyBundle(bundle)) bundles.push(bundle);
+function windowsFallbackAppPaths(env) {
+	const out = [];
+	const roots = /* @__PURE__ */ new Set();
+	for (const key of [
+		"ProgramFiles",
+		"ProgramW6432",
+		"ProgramFiles(x86)",
+		"LOCALAPPDATA"
+	]) {
+		const value = env[key]?.trim();
+		if (value !== void 0 && value !== "") roots.add(value);
+	}
+	for (let code = 67; code <= 90; code += 1) {
+		const drive = String.fromCharCode(code) + ":\\";
+		try {
+			if (!existsSync(drive)) continue;
+		} catch {
+			continue;
 		}
-	}
-	return bundles;
+		roots.add(join(drive, "Program Files"));
+		roots.add(join(drive, "Program Files (x86)"));
+		roots.add(drive);
+	}
+	for (const root of roots) for (const name of APP_EXECUTABLE_NAMES) {
+		out.push(join(root, "WorkBuddy", name));
+		out.push(join(root, "WorkBuddy AI", name));
+		out.push(join(root, "Programs", "WorkBuddy", name));
+	}
+	for (const root of roots) try {
+		for (const entry of readdirSync(root)) {
+			if (!/^(workbuddy|codebuddy)/iu.test(entry)) continue;
+			for (const name of APP_EXECUTABLE_NAMES) out.push(join(root, entry, name));
+		}
+	} catch {}
+	return out;
 }
 /**
-* The first candidate that exists as a file, or undefined when the desktop app
-* is not installed where this platform expects it.
+* Candidate paths of the WorkBuddy desktop executable, in probe order.
+*
+* Order is deliberate:
+*  1. the explicit override, because a user who set it knows where the app is;
+*  2. the registry, which is what the installer itself recorded;
+*  3. derived fallbacks (per-user, machine-wide, every fixed drive).
+*
+* Only the Windows branch consults the registry (it is the only platform with
+* one). macOS asks each bundle for its own `CFBundleExecutable` instead, because
+* the WorkBuddy bundles ship a binary named `Electron`, not after the app.
+*
+* `readBundleExecutable` and `registryPaths` are injectable in the same spirit as
+* `platform`/`home`/`env`: both consult the real machine, so without a seam the
+* expected candidates would depend on what happens to be installed where the
+* suite runs — passing on a developer's box and failing in CI.
 */
-function findWorkbuddyAppExecutable(platform = process.platform, home = homedir(), env = process.env) {
-	for (const candidate of workbuddyAppExecutableCandidates(platform, home, env)) try {
-		if (existsSync(candidate)) return candidate;
-	} catch {}
-	if (platform === "darwin") for (const parent of ["/Applications", join(home, "Applications")]) for (const bundle of macosNestedAppBundles(parent)) {
-		const executable = macosBundleExecutable(bundle);
-		if (executable === void 0) continue;
-		try {
-			if (existsSync(executable)) return executable;
-		} catch {}
-	}
+function workbuddyAppExecutableCandidates(platform = process.platform, home = homedir(), env = process.env, readBundleExecutable = macosBundleExecutable, registryPaths = windowsRegistryAppPaths) {
+	const candidates = [env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim()];
+	if (platform === "win32") {
+		candidates.push(...registryPaths());
+		candidates.push(...windowsFallbackAppPaths(env));
+	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
+	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
 }
 /**
 * Ask the installed desktop app for its key payload by running its own binary
@@ -2028,28 +2088,95 @@ function fetchAtRestKeyPayload(executable) {
 		});
 	});
 }
-/** Process-lifetime cache of the derived key; never persisted. */
-let cachedKey;
-let inflightKey;
 /**
-* The desktop app's at-rest field key, or undefined when it cannot be obtained
-* (app not installed, an older build without the native module, or a future
-* build that rotates the payload). Cached after the first success so the app is
-* spawned at most once per process; a failure is retried on the next call,
-* because the user may install or start the app between reads.
+* The desktop app's at-rest keys, indexed by the key id each derived key
+* reports (the first 16 hex of its SHA-256).
+*
+* More than one build can be installed on one machine — the domestic
+* `WorkBuddy.exe` and the international `WorkBuddyAI.exe` share a key id on the
+* builds seen here, but a future build may rotate it, and the discovery below
+* must keep working if they ever diverge. A field envelope names the key id it
+* was sealed under, so the opener selects the matching derived key instead of
+* assuming a single build exists. Cached per process and never persisted.
 */
-function readAtRestKey() {
-	if (cachedKey !== void 0) return Promise.resolve(cachedKey);
-	inflightKey ??= (async () => {
-		const executable = findWorkbuddyAppExecutable();
-		if (executable === void 0) return void 0;
-		const key = deriveAtRestKey(await fetchAtRestKeyPayload(executable));
-		cachedKey = key;
-		return key;
+const atRestKeyById = /* @__PURE__ */ new Map();
+let inflightKeys;
+/**
+* When the last full key sweep failed, and how long that failure is trusted.
+*
+* Without this, EVERY credential read spawned the app and waited out the
+* 10-second timeout before giving up — which is what made "rescan accounts" and
+* every status poll crawl on a machine where the app could not be found. A
+* failure is negative-cached briefly: long enough that a burst of reads costs
+* one sweep, short enough that installing or starting the app is picked up
+* without restarting DSH.
+*/
+let lastKeyFailureAtMs = 0;
+const KEY_FAILURE_BACKOFF_MS = 6e4;
+/**
+* Load every desktop build's key id into {@link atRestKeyById}.
+*
+* Mirrors the reference `provideTheKey` shape: probe EVERY candidate executable
+* (not just the first that exists) and keep the key each one yields. A build
+* that fails to answer — a timeout, a single-instance lock, an older build
+* without the native module — is skipped on its own and does NOT poison the
+* other builds, which is exactly the failure mode the single-candidate path
+* had: one bad spawn cached `undefined` for the whole process and every
+* encrypted field then reported "no app could be located".
+*/
+function ensureAtRestKeys() {
+	if (atRestKeyById.size > 0) return Promise.resolve();
+	if (Date.now() - lastKeyFailureAtMs < KEY_FAILURE_BACKOFF_MS) return Promise.resolve();
+	inflightKeys ??= (async () => {
+		const candidates = workbuddyAppExecutableCandidates().filter((candidate) => {
+			try {
+				return existsSync(candidate);
+			} catch {
+				return false;
+			}
+		});
+		if (candidates.length === 0) {
+			lastKeyFailureAtMs = Date.now();
+			return;
+		}
+		let anySuccess = false;
+		await Promise.all(candidates.map(async (executable) => {
+			try {
+				const key = deriveAtRestKey(await fetchAtRestKeyPayload(executable));
+				atRestKeyById.set(deriveAtRestKeyId(key), key);
+				anySuccess = true;
+			} catch {}
+		}));
+		if (anySuccess) lastKeyFailureAtMs = 0;
+		else lastKeyFailureAtMs = Date.now();
 	})().finally(() => {
-		inflightKey = void 0;
+		inflightKeys = void 0;
+	});
+	return inflightKeys;
+}
+/**
+* Synchronous key lookup for a key id already loaded by {@link ensureAtRestKeys}.
+*
+* The account pool warms the cache up front (via {@link readAtRestKey}) and then
+* opens each encrypted field through a synchronous closure, because the parser
+* runs `decrypt` inline. Lookups that race the warm-up, or ask for a key id no
+* installed build produced, return undefined and are reported as the
+* encrypted-but-unavailable error rather than a silently empty token.
+*/
+function atRestKeyFor(keyId) {
+	return atRestKeyById.get(keyId);
+}
+/**
+* Backwards-compatible single-key view: the first key any build provided.
+*
+* Kept so callers that do not yet carry a key id (and the legacy tests) still
+* resolve to a usable key on single-build machines. Multi-build callers should
+* prefer {@link readAtRestKeyById} and select by the field's own key id.
+*/
+function readAtRestKey() {
+	return ensureAtRestKeys().then(() => {
+		for (const key of atRestKeyById.values()) return key;
 	});
-	return inflightKey;
 }
 //#endregion
 //#region src/accounts.ts
@@ -2124,7 +2251,7 @@ const ENCRYPTED_CREDENTIAL_CODE = "ENCRYPTED_CREDENTIAL";
 var WorkBuddyEncryptedCredentialError = class extends Error {
 	code = ENCRYPTED_CREDENTIAL_CODE;
 	constructor(sourcePath) {
-		super(`workbuddy: ${sourcePath} holds encrypted credentials but the desktop app could not provide the key. Install the WorkBuddy desktop app (or point WORKBUDDY_APP_EXECUTABLE at it) — signing in again will not help.`);
+		super(`workbuddy: ${sourcePath} holds encrypted credentials, but no WorkBuddy desktop app could be located to provide the key. If the app IS installed, it is simply outside the paths this plugin probes — set WORKBUDDY_APP_EXECUTABLE to its full .exe path (then restart DSH) and the credential will open. Signing in again will not help: the credential itself is intact. Run \`dsh-workbuddy-xdpool doctor\` to see which paths were probed.`);
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
@@ -2308,10 +2435,13 @@ async function readCredential(path) {
 * error that would look like a corrupt file.
 */
 async function encryptedFieldOpener() {
-	const key = await readAtRestKey().catch(() => void 0);
-	if (key === void 0) return void 0;
+	await readAtRestKey().catch(() => void 0);
 	return (field) => {
 		if (!isEncryptedFieldWrapper(field)) throw new Error("workbuddy: not an encrypted field wrapper");
+		const keyId = encryptedFieldKeyId(field);
+		if (keyId === void 0) throw new Error("workbuddy: encrypted field has no key id");
+		const key = atRestKeyFor(keyId);
+		if (key === void 0) throw new Error("workbuddy: no at-rest key available for this encrypted field");
 		return openEncryptedField(field, key);
 	};
 }
@@ -3103,10 +3233,10 @@ function createWorkBuddyAdapter(options) {
 		streamIdleTimeoutMs: WORKBUDDY_STREAM_IDLE_TIMEOUT_MS,
 		retryPolicy: resolveRetryPolicy(void 0, "dsh-workbuddy-xdpool retryPolicy"),
 		configuredMaxTokens: /* @__PURE__ */ new Map(),
+		modelErrors: /* @__PURE__ */ new Map(),
 		...REQUEST_IMAGE_BUDGETS,
 		piProvider: provider
 	};
-	Object.assign(profile, { modelErrors: /* @__PURE__ */ new Map() });
 	let profiles = /* @__PURE__ */ new Map([[providerId, profile]]);
 	return {
 		providerId,
@@ -4043,12 +4173,16 @@ var WorkBuddyScheduler = class {
 	*/
 	persistEarnings() {
 		if (this.saveEarningsFn === void 0) return;
+		const accounts = {};
+		for (const [id, entry] of this.earnings) accounts[id] = entry;
+		const ledger = {
+			date: this.earningsDate,
+			accounts
+		};
 		try {
-			const accounts = {};
-			for (const [id, entry] of this.earnings) accounts[id] = entry;
-			this.saveEarningsFn({
-				date: this.earningsDate,
-				accounts
+			const saved = this.saveEarningsFn(ledger);
+			if (saved !== void 0 && typeof saved.then === "function") saved.then(void 0, (error) => {
+				this.logger.warn?.("dsh-workbuddy-xdpool: could not persist automation earnings:", error);
 			});
 		} catch (error) {
 			this.logger.warn?.("dsh-workbuddy-xdpool: could not persist automation earnings:", error);
@@ -5845,6 +5979,56 @@ function automationOptions(automation) {
 * region that has never been saved stays absent so `applyConfigFromSource` can
 * fall back to the legacy flat keys.
 */
+function asVolatile(schema) {
+	const candidate = schema;
+	return typeof candidate.volatile === "function" ? candidate.volatile() : schema;
+}
+/**
+* Peel one live volatile reference.
+*
+* On 0.1.7 a volatile field is handed back as `{ get(): T }` rather than a
+* plain value, so a running instance observes a settings edit without being
+* remounted. Every read of a marked field therefore has to unwrap: passing the
+* reference onward compares an object against a string and reports the field as
+* unset. On 0.1.5 the field is already a plain value, so this is a no-op.
+*
+* The test is duck-typed on purpose — importing `isVolatile` would add a
+* dependency the 0.1.5 line does not carry.
+*/
+function unwrapVolatile(value) {
+	if (value !== null && typeof value === "object" && typeof value.get === "function") return value.get();
+	return value;
+}
+/**
+* Deep copy of a config value with every live `{get(): T}` reference replaced
+* by the value it resolves to.
+*
+* {@link unwrapVolatile} peels only the one level an ordinary read needs. A
+* settings service is different: it validates and `structuredClone`s the WHOLE
+* object, so a reference surviving anywhere inside it fails schema validation
+* with a message that names the field but not the cause —
+* `$.authFile expected string but got [object Object]`. That is what makes the
+* namespace fail to register and the card silently disappear, which is why the
+* object handed to `installSection` goes through this first.
+*/
+function unwrapVolatileDeep(value) {
+	const peeled = unwrapVolatile(value);
+	if (Array.isArray(peeled)) return peeled.map((entry) => unwrapVolatileDeep(entry));
+	if (peeled !== null && typeof peeled === "object") {
+		const out = {};
+		for (const [key, entry] of Object.entries(peeled)) out[key] = unwrapVolatileDeep(entry);
+		return out;
+	}
+	return peeled;
+}
+/**
+* One region's model-selection schema.
+*
+* Every field is optional on purpose: an absent field keeps its documented
+* meaning ("all enabled" / "follow the upstream image flag" / "no cap"), and a
+* region that has never been saved stays absent so `applyConfigFromSource` can
+* fall back to the legacy flat keys.
+*/
 const modelSelectionSchema = z.object({
 	enabledModelIds: z.array(z.string()).description("Model ids enabled in this region's picker (absent = all)"),
 	imageModelIds: z.array(z.string()).description("Model ids accepting image input in this region (absent = follow upstream)"),
@@ -5882,24 +6066,32 @@ const modelSelectionKeyFor = (region) => region === "cn" ? "modelSelectionCn" :
 * also why `contextBudgets` is a real dictionary (`z.dict`) - an open object
 * schema reads as "an object with no fields" and the fold then throws while
 * the provider row is rendered.
+*
+* Every field is wrapped in {@link asVolatile}: on the 0.1.7 line the settings
+* write gate refuses an entry whose schema declares no volatile field at all
+* ("Plugin entry ... has no volatile fields") and `describe()` skips such an
+* entry — so an unmarked schema means the card can neither render nor save. On
+* the 0.1.5 line the wrapper degrades to an identity no-op (see its JSDoc), and
+* the value the running instance reads is a plain value either way once
+* unwrapped.
 */
 const Config = z.object({
-	authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app own location)"),
-	cooldownMs: z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds"),
-	distribution: z.union([
+	authFile: asVolatile(z.string().description("WorkBuddy desktop auth file (defaults to the app own location)")),
+	cooldownMs: asVolatile(z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds")),
+	distribution: asVolatile(z.union([
 		"priority",
 		"round-robin",
 		"balanced"
-	]).default("priority").description("How requests are spread: priority (drain one), round-robin (in order), or balanced (idle-weighted random)"),
-	disabledAccountIds: z.array(z.string()).default([]).description("Account ids excluded from the pool (empty = every discovered account participates)"),
-	creditReserves: z.dict(z.number().step(1).min(0)).default({}).description("Per-account credit floor: stop using an account once its balance reaches this value"),
-	enabledModelIds: z.array(z.string()).default([]).description("Legacy shared model-id list; used by a region that has no per-region selection yet"),
-	imageModelIds: z.array(z.string()).default([]).description("Legacy shared image-id list; used by a region that has no per-region selection yet"),
-	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Legacy shared context budgets; used by a region with no per-region selection yet"),
-	modelSelectionCn: modelSelectionSchema.description("Model selection for the domestic gateway"),
-	modelSelectionGlobal: modelSelectionSchema.description("Model selection for the international gateway"),
-	automation: automationSchema.description("Daily points automation (activity report, task claiming, check-in)"),
-	automationEarnings: z.any().description("Automation earnings ledger (written by the scheduler)")
+	]).default("priority").description("How requests are spread: priority (drain one), round-robin (in order), or balanced (idle-weighted random)")),
+	disabledAccountIds: asVolatile(z.array(z.string()).default([]).description("Account ids excluded from the pool (empty = every discovered account participates)")),
+	creditReserves: asVolatile(z.dict(z.number().step(1).min(0)).default({}).description("Per-account credit floor: stop using an account once its balance reaches this value")),
+	enabledModelIds: asVolatile(z.array(z.string()).default([]).description("Legacy shared model-id list; used by a region that has no per-region selection yet")),
+	imageModelIds: asVolatile(z.array(z.string()).default([]).description("Legacy shared image-id list; used by a region that has no per-region selection yet")),
+	contextBudgets: asVolatile(z.dict(z.number().step(1).min(1)).default({}).description("Legacy shared context budgets; used by a region with no per-region selection yet")),
+	modelSelectionCn: asVolatile(modelSelectionSchema.description("Model selection for the domestic gateway")),
+	modelSelectionGlobal: asVolatile(modelSelectionSchema.description("Model selection for the international gateway")),
+	automation: asVolatile(automationSchema.description("Daily points automation (activity report, task claiming, check-in)")),
+	automationEarnings: asVolatile(z.any().description("Automation earnings ledger (written by the scheduler)"))
 });
 /** Live API, published for the CLI. */
 let api;
@@ -5956,10 +6148,21 @@ function apply(ctx, config = {}) {
 	/** The domestic adapter, published for the CLI after registration. */
 	let builtAdapter;
 	let invalidateCatalog = () => {};
-	let current = () => config;
+	/**
+	* The effective config with every live volatile reference peeled.
+	*
+	* On 0.1.7 a field marked volatile is handed to the plugin as `{get(): T}` so
+	* a settings edit is observed without a remount, and the loader keeps the
+	* reference live. Every read below therefore goes through this view: a raw
+	* reference compared against a string reports the field as unset, which is
+	* how a saved reserve would read back as "0" while the file holds the value.
+	* On 0.1.5 there is nothing to peel and this is the identity.
+	*/
+	let rawCurrent = () => config;
+	const current = () => unwrapVolatileDeep(rawCurrent());
 	const sectionHooks = {
 		setSource(source) {
-			current = source;
+			rawCurrent = source;
 		},
 		onChange() {
 			applyConfigFromSource();
@@ -5985,8 +6188,12 @@ function apply(ctx, config = {}) {
 		core.scheduler.applyConfig(automationOptions(automation));
 	};
 	const settingsService = ctx.settings;
-	if (typeof settingsService.installSection === "function") settingsService.installSection(ctx, WORKBUDDY_POOL_SETTINGS_NS, Config, config, sectionHooks);
-	else ctx.logger.warn?.("dsh-workbuddy-xdpool: settings service has no installSection; card will not mount");
+	if (typeof settingsService.installSection === "function") settingsService.installSection(ctx, WORKBUDDY_POOL_SETTINGS_NS, Config, unwrapVolatileDeep(config), sectionHooks);
+	if (typeof settingsService.configure === "function") ctx.effect(() => settingsService.configure?.({ auto: true }, ctx.fiber) ?? (() => {}));
+	if (typeof settingsService.installSection !== "function" && typeof settingsService.configure !== "function") ctx.logger.warn?.("dsh-workbuddy-xdpool: settings service exposes neither installSection nor configure; the card will not mount");
+	ctx.on("loader/volatile-update", () => {
+		applyConfigFromSource();
+	});
 	/**
 	* Write one key of the plugin's own settings section. Only ever called with
 	* the three model-selection keys, so the settings file cannot be steered from
@@ -6022,11 +6229,31 @@ function apply(ctx, config = {}) {
 		if (typeof value === "object" && value !== null) return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
 		return JSON.stringify(value);
 	}
+	/**
+	* The namespace `settings.update` expects on the running line.
+	*
+	* 0.1.5 resolves writers by the NAMESPACE the plugin registered through
+	* `installSection`, so the plugin picks it. 0.1.7 resolves them by the HOST
+	* PLUGIN ENTRY ID instead (`configEditor.entries().find(row => row.options.id
+	* === ns)`), and the profile patch chooses that id — the live Desktop host
+	* mounts this plugin as `llm-workbuddy-xdpool`, but a marketplace install can
+	* wrap it (`mkt-...`) or mount it through an `include` row. Asking the fiber
+	* for its own entry id is therefore the only correct answer there; guessing
+	* our own namespace makes every save throw `No configurable plugin entry`.
+	*/
+	const settingsWriteNs = typeof settingsService.installSection === "function" ? WORKBUDDY_POOL_SETTINGS_NS : (() => {
+		try {
+			const entryId = ctx.fiber?.entry?.options?.id;
+			return entryId === void 0 || entryId === "" ? WORKBUDDY_POOL_SETTINGS_NS : entryId;
+		} catch {
+			return WORKBUDDY_POOL_SETTINGS_NS;
+		}
+	})();
 	const setSetting = async (key, value, expected) => {
 		if (value === void 0) return;
-		const write = settingsService?.set;
-		if (write === void 0) throw new Error(`settings service unavailable; ${key} was not saved`);
-		await write.call(settingsService, key, value);
+		const update = settingsService?.update;
+		if (update === void 0) throw new Error(`settings service has no update(); ${key} was not saved`);
+		await update.call(settingsService, settingsWriteNs, { [key]: value });
 		if (expected !== void 0) {
 			const stored = current()[key];
 			if (!stableJsonEqual(stored, expected)) throw new Error(`settings field "${key}" was not persisted`);
@@ -6222,7 +6449,9 @@ function apply(ctx, config = {}) {
 				ctx.logger.warn(`dsh-workbuddy-xdpool: ${region} model catalog unavailable; using static fallback`, error);
 			}
 			invalidateCatalog();
-		})();
+		})().catch((error) => {
+			ctx.logger.warn("dsh-workbuddy-xdpool: account catalog seed failed", error);
+		});
 	}, (error) => {
 		ctx.logger.error("dsh-workbuddy-xdpool: shim failed to listen", error);
 	});