dsh-workbuddy-xdpool 1.6.1 → 1.7.1

package/lib/bin.js

@@ -1,7 +1,7 @@
 import { createDecipheriv, createHash, randomUUID } from "node:crypto";
-import { copyFile, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { copyFile, mkdir, readFile, readdir, rename, writeFile, writeFile as writeFile$1 } from "node:fs/promises";
 import { homedir, platform } from "node:os";
-import { basename, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import z from "@deepseek-ai/schemastery";
@@ -427,6 +427,7 @@ function parseUpstreamModel(value) {
 	const reasoning = parseReasoning(raw["reasoning"]);
 	const supportsToolCall = typeof raw["supportsToolCall"] === "boolean" ? raw["supportsToolCall"] : void 0;
 	const supportsImages = typeof raw["supportsImages"] === "boolean" ? raw["supportsImages"] : void 0;
+	const tags = Array.isArray(raw["tags"]) ? raw["tags"].filter((tag) => typeof tag === "string" && tag !== "") : void 0;
 	return {
 		id,
 		name,
@@ -437,7 +438,8 @@ function parseUpstreamModel(value) {
 		...descriptionZh === void 0 ? {} : { descriptionZh },
 		...descriptionEn === void 0 ? {} : { descriptionEn },
 		...supportsToolCall === void 0 ? {} : { supportsToolCall },
-		...supportsImages === void 0 ? {} : { supportsImages }
+		...supportsImages === void 0 ? {} : { supportsImages },
+		...tags === void 0 || tags.length === 0 ? {} : { tags }
 	};
 }
 /**
@@ -1640,8 +1642,20 @@ const AAD_DOMAIN = Buffer.from("WB-AAD\0", "ascii");
 const SYMMETRIC_SCHEME = "sym-v1";
 /** Env override pointing at the WorkBuddy desktop executable. */
 const WORKBUDDY_APP_EXECUTABLE_ENV = "WORKBUDDY_APP_EXECUTABLE";
-/** How long the app is given to answer with its key payload. */
-const KEY_FETCH_TIMEOUT_MS = 1e4;
+/**
+* How long the app is given to answer with its key payload.
+*
+* 30s, not 10s: the child is the WorkBuddy Electron binary running as plain
+* Node, and its FIRST spawn on a cold machine costs several seconds on its own
+* (measured 4.5s here) before the endpoint security stack has warmed its scan
+* cache. Under load — a concurrent `pnpm install` from the market, a running
+* full-disk scan — that first spawn crosses a 10s budget, the fetch rejects,
+* `readAtRestKey` returns undefined, and every encrypted credential then reads
+* as `WorkBuddyEncryptedCredentialError` until the 60s negative cache expires.
+* A successful fetch is cached for the process lifetime, so the longer budget
+* is only ever paid once per process, and only when the app is present but slow.
+*/
+const KEY_FETCH_TIMEOUT_MS = 3e4;
 /**
 * Executable file names the desktop app ships under, in probe order.
 *
@@ -1896,6 +1910,7 @@ function windowsFallbackAppPaths(env) {
 		}
 		roots.add(join(drive, "Program Files"));
 		roots.add(join(drive, "Program Files (x86)"));
+		roots.add(drive);
 	}
 	for (const root of roots) for (const name of APP_EXECUTABLE_NAMES) {
 		out.push(join(root, "WorkBuddy", name));
@@ -2308,6 +2323,41 @@ async function readCredential(path) {
 	}
 }
 /**
+* The pool id a document would receive, WITHOUT decrypting anything.
+*
+* Used to honour the ignore list before the at-rest key lookup runs: `uin` and
+* `uid` are read as plain strings by {@link parseWorkBuddyAuth}, while
+* `nickname` is commonly encrypted — so this returns undefined for an account
+* whose identity lives only in the encrypted nickname, and the caller falls
+* back to the full parse for those.
+*/
+function cheapIdentityId(text) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const document = parsed;
+	const identity = typeof document["account"] === "object" && document["account"] !== null ? document["account"] : document;
+	const uin = typeof identity["uin"] === "string" && identity["uin"] !== "" ? identity["uin"] : void 0;
+	const uid = typeof identity["uid"] === "string" && identity["uid"] !== "" ? identity["uid"] : void 0;
+	if (uin === void 0 && uid === void 0) return void 0;
+	return workbuddyAccountId({
+		...uin === void 0 ? {} : { uin },
+		...uid === void 0 ? {} : { uid }
+	});
+}
+/** {@link cheapIdentityId} for a file path; undefined when it cannot be read. */
+async function cheapIdentityIdFromFile(path) {
+	try {
+		return cheapIdentityId(await readFile(path, "utf8"));
+	} catch {
+		return;
+	}
+}
+/**
 * Build the field opener, or undefined when the app cannot supply its key.
 *
 * Split out so the key lookup is testable without a real desktop install, and so
@@ -2386,6 +2436,21 @@ var WorkBuddyAccountPool = class {
 	*/
 	disabledIds = /* @__PURE__ */ new Set();
 	/**
+	* Account ids the user threw out of the pool for good.
+	*
+	* Enforced BEFORE the credential is parsed: `scan()` skips a file whose
+	* identity is already ignored, so an ignored account costs no at-rest key
+	* lookup (which spawns the desktop app on 5.6.0+) and cannot re-enter the pool
+	* when the app writes a fresh sign-in for it. That is the difference from
+	* {@link disabledIds}, which only filters at pick time and leaves the account
+	* listed, readable and re-discoverable.
+	*
+	* The set is supplied by the host from the plugin's own ignore file, and is
+	* replaced wholesale on every {@link applyIgnored} so removing an entry takes
+	* effect on the next scan without a restart.
+	*/
+	ignoredIds = /* @__PURE__ */ new Set();
+	/**
 	* Per-account credit floor, keyed by account id. 0 (or absent) means "spend
 	* it all".
 	*
@@ -2437,12 +2502,39 @@ var WorkBuddyAccountPool = class {
 		if (options.disabledAccountIds !== void 0) this.disabledIds = new Set(options.disabledAccountIds);
 		if (options.creditReserves !== void 0) this.setCreditReserves(options.creditReserves);
 	}
+	/**
+	* Replace the permanent ignore list.
+	*
+	* Also drops any already-discovered account that is now ignored, so the change
+	* is visible without waiting for the next scan: the card refreshes its status
+	* document right after the write, and an account still sitting in `accounts`
+	* would keep showing up there.
+	*/
+	applyIgnored(ids) {
+		this.ignoredIds = new Set(ids);
+		if (this.ignoredIds.size === 0) return;
+		this.accounts = this.accounts.filter((account) => !this.ignoredIds.has(account.id));
+	}
+	/** Whether this account has been thrown out of the pool for good. */
+	isIgnored(accountId) {
+		return this.ignoredIds.has(accountId);
+	}
+	/** Every ignored id currently in force, in insertion order. */
+	ignoredIdsInOrder() {
+		return [...this.ignoredIds];
+	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
 		const found = [];
 		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
+			if (this.ignoredIds.size > 0) {
+				const cheapId = await cheapIdentityIdFromFile(file);
+				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
+			}
 			const credential = await readCredential(file);
-			if (credential !== void 0) found.push(credential);
+			if (credential === void 0) continue;
+			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
+			found.push(credential);
 		}
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
@@ -2783,28 +2875,44 @@ ${new Date(until).toISOString()}
 };
 //#endregion
 //#region src/catalog.ts
-/** Static fallback used before the first live catalog fetch. */
+/**
+* Static fallback used before the first live catalog fetch, and whenever the
+* upstream cannot be reached.
+*
+* The multipliers are carried on purpose. Without them the provider's model
+* picker silently loses every rate and every free badge the moment the live
+* fetch fails — which reads to the user as "the plugin broke my model list"
+* rather than "the upstream is unreachable". The values are the ones the two
+* gateways actually advertise for these ids (`credits: "x0.79 credits"` and so
+* on), so a fallback row looks the same as a live one.
+*
+* `multiplier: 0` is the gateways' own spelling of "free" (`credits: "x0.00"`),
+* which is what turns on the free badge.
+*/
 const FALLBACK_WORKBUDDY_MODELS = [
 	{
 		id: "glm-5.3",
 		name: "GLM-5.3",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .79
 	},
 	{
 		id: "glm-5.3-flash",
 		name: "GLM-5.3-Flash",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .06
 	},
 	{
 		id: "glm-5.2",
 		name: "GLM-5.2",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .79
 	},
 	{
 		id: "glm-5.1",
@@ -2832,7 +2940,8 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		name: "Kimi-K3",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: 1.62
 	},
 	{
 		id: "minimax-m3",
@@ -2846,14 +2955,16 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		name: "Hy3",
 		contextWindow: 32e3,
 		maxOutputTokens: 8e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: 0
 	},
 	{
 		id: "hy4-preview",
 		name: "Hy4-Preview",
 		contextWindow: 1e6,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .29
 	}
 ];
 /** Live catalog with a static fallback behind it. */
@@ -2931,7 +3042,8 @@ function toModelInfo(model) {
 		maxOutputTokens: model.maxTokens,
 		supportsImages: model.supportsImages ?? false,
 		...model.creditMultiplier === void 0 ? {} : { multiplier: model.creditMultiplier },
-		...model.reasoning?.supportedEfforts === void 0 ? {} : { supportedEfforts: model.reasoning.supportedEfforts }
+		...model.reasoning?.supportedEfforts === void 0 ? {} : { supportedEfforts: model.reasoning.supportedEfforts },
+		...model.tags === void 0 || model.tags.length === 0 ? {} : { tags: model.tags }
 	};
 }
 /** Map the live upstream list, falling back to the static list when empty. */
@@ -3345,6 +3457,30 @@ function expertChatEvents(expert, conversationId, requestId) {
 		expert_industry_id: ""
 	} : event);
 }
+//#endregion
+//#region src/status-paths.ts
+/**
+* The schedule every automation job falls back to.
+*
+* Shared by both halves on purpose. The host uses it when a configured hour
+* list arrives empty (the settings schema materializes "never configured" into
+* `[]`), and the card uses it when it writes the `automation` block back, so a
+* document that already holds an empty list is healed instead of being saved
+* back as an unrunnable schedule.
+*
+* This lives here rather than in `scheduler.ts` because the browser half cannot
+* import the host module: `scheduler.ts` pulls in `node:crypto` and the whole
+* upstream client, none of which exists in the browser bundle. Two hand-written
+* copies would drift, and the drift is invisible — the card would write a
+* schedule the scheduler does not run.
+*/
+const DEFAULT_AUTOMATION_HOURS = {
+	checkin: [9],
+	report: [10],
+	tasks: [11],
+	streak: [12],
+	travel: [9, 21]
+};
 /**
 * The fallback record for the 腾讯轻量云 expert, used when the marketplace
 * listing cannot be read. The id is the one the task is scored against.
@@ -3388,6 +3524,23 @@ const JOB_KINDS = [
 	"streak",
 	"travel"
 ];
+/**
+* Pick the hour list to run on: the configured one, or the default.
+*
+* An EMPTY list is treated as "not configured" rather than as "never run".
+* That distinction is the whole point: the settings schema materializes an
+* absent list into `[]` (a bare `z.array` with no `.default()`), so a config
+* that never mentioned the schedule arrives here looking exactly like one
+* deliberately set to nothing — and honouring the empty reading silently
+* disabled every job while the card still showed the switch as ON.
+*
+* A user who genuinely wants a job skipped can leave it out of the schedule
+* they save; they cannot express "off" with an empty array through the card
+* either way, because the card always writes a non-empty list.
+*/
+function hoursOrDefault(configured, fallback) {
+	return configured !== void 0 && configured.length > 0 ? configured : fallback;
+}
 const EMPTY_JOB_STATE = {
 	ok: 0,
 	failed: 0,
@@ -3563,11 +3716,11 @@ var WorkBuddyScheduler = class {
 			this.earningsDate = today;
 		}
 		this.enabled = options.enabled ?? false;
-		this.checkinHours = options.checkinHours ?? [9];
-		this.reportHours = options.reportHours ?? [10];
-		this.taskHours = options.taskHours ?? [11];
-		this.streakHours = options.streakHours ?? [12];
-		this.travelHours = options.travelHours ?? [9, 21];
+		this.checkinHours = hoursOrDefault(options.checkinHours, DEFAULT_AUTOMATION_HOURS.checkin);
+		this.reportHours = hoursOrDefault(options.reportHours, DEFAULT_AUTOMATION_HOURS.report);
+		this.taskHours = hoursOrDefault(options.taskHours, DEFAULT_AUTOMATION_HOURS.tasks);
+		this.streakHours = hoursOrDefault(options.streakHours, DEFAULT_AUTOMATION_HOURS.streak);
+		this.travelHours = hoursOrDefault(options.travelHours, DEFAULT_AUTOMATION_HOURS.travel);
 	}
 	/** Apply a new configuration; safe to call while running. */
 	/**
@@ -3595,11 +3748,11 @@ var WorkBuddyScheduler = class {
 	}
 	applyConfig(options) {
 		if (options.enabled !== void 0) this.enabled = options.enabled;
-		if (options.checkinHours !== void 0) this.checkinHours = options.checkinHours;
-		if (options.reportHours !== void 0) this.reportHours = options.reportHours;
-		if (options.taskHours !== void 0) this.taskHours = options.taskHours;
-		if (options.streakHours !== void 0) this.streakHours = options.streakHours;
-		if (options.travelHours !== void 0) this.travelHours = options.travelHours;
+		if (options.checkinHours !== void 0) this.checkinHours = hoursOrDefault(options.checkinHours, DEFAULT_AUTOMATION_HOURS.checkin);
+		if (options.reportHours !== void 0) this.reportHours = hoursOrDefault(options.reportHours, DEFAULT_AUTOMATION_HOURS.report);
+		if (options.taskHours !== void 0) this.taskHours = hoursOrDefault(options.taskHours, DEFAULT_AUTOMATION_HOURS.tasks);
+		if (options.streakHours !== void 0) this.streakHours = hoursOrDefault(options.streakHours, DEFAULT_AUTOMATION_HOURS.streak);
+		if (options.travelHours !== void 0) this.travelHours = hoursOrDefault(options.travelHours, DEFAULT_AUTOMATION_HOURS.travel);
 	}
 	/** Hours for one job, used by the loop and the status document. */
 	hoursOf(kind) {
@@ -3830,12 +3983,16 @@ var WorkBuddyScheduler = class {
 	*/
 	persistEarnings() {
 		if (this.saveEarningsFn === void 0) return;
+		const accounts = {};
+		for (const [id, entry] of this.earnings) accounts[id] = entry;
+		const ledger = {
+			date: this.earningsDate,
+			accounts
+		};
 		try {
-			const accounts = {};
-			for (const [id, entry] of this.earnings) accounts[id] = entry;
-			this.saveEarningsFn({
-				date: this.earningsDate,
-				accounts
+			const saved = this.saveEarningsFn(ledger);
+			if (saved !== void 0 && typeof saved.then === "function") saved.then(void 0, (error) => {
+				this.logger.warn?.("dsh-workbuddy-xdpool: could not persist automation earnings:", error);
 			});
 		} catch (error) {
 			this.logger.warn?.("dsh-workbuddy-xdpool: could not persist automation earnings:", error);
@@ -4258,6 +4415,137 @@ function formatRates(status) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/ignored.ts
+/**
+* The permanent ignore list: accounts the user has thrown out of the pool.
+*
+* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
+* account stays on the card, can be switched back on, and its credential keeps
+* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
+* one is not mine any more" — so an ignored account is skipped BEFORE its
+* credential is decrypted, never appears among the pool's accounts, and does not
+* come back when the desktop app writes a fresh `.info` file for it.
+*
+* It lives in a plugin-owned file rather than in the settings document for one
+* practical reason: the CLI has no settings service. `dsh-workbuddy-xdpool
+* ignore <id>` runs without a host, so a settings-only list could be written by
+* the card and never by the CLI. One file, read by both halves, keeps the two
+* views of "which accounts are ignored" identical by construction.
+*
+* @module dsh-workbuddy-xdpool/ignored
+*/
+/** Directory holding this plugin's own state (imported snapshots, ignore list). */
+const PLUGIN_DATA_DIR_NAME = ".workbuddy-xdpool";
+/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
+const IGNORED_FILE_NAME = "ignored.json";
+/**
+* The DSH home directory, honouring the same override the host uses.
+*
+* Shared by the CLI and the host so both halves resolve the same file: an
+* `ignore` written from the terminal has to be visible to the running plugin,
+* which is only true if they agree on where "home" is.
+*/
+function dshHome$1(env = process.env) {
+	const fromEnv = env["DSH_HOME"];
+	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
+	return join(homedir(), ".dsh");
+}
+/** This plugin's own state directory. */
+function pluginDataDir(env = process.env) {
+	return join(dshHome$1(env), PLUGIN_DATA_DIR_NAME);
+}
+/** Absolute path of the ignore list. */
+function ignoredIdsPath(env = process.env) {
+	return join(pluginDataDir(env), IGNORED_FILE_NAME);
+}
+/**
+* Normalize whatever the file holds into a clean list.
+*
+* Tolerant on purpose: this file is hand-editable and a malformed entry must not
+* take the pool down. An entry without a usable id is dropped; a missing label
+* falls back to the id so the card always has something to print.
+*/
+function normalize(raw) {
+	if (typeof raw !== "object" || raw === null) return [];
+	const entries = raw.accounts;
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
+		if (id === "" || seen.has(id)) continue;
+		seen.add(id);
+		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
+		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
+		out.push({
+			id,
+			label,
+			ignoredAt
+		});
+	}
+	return out;
+}
+/**
+* Read the ignore list, tolerating every "no list yet" shape.
+*
+* A missing file, unreadable file, or invalid JSON all mean the same thing to
+* the caller — nothing is ignored — so none of them throws. The pool must be
+* able to start on a machine that has never ignored anything.
+*/
+async function readIgnoredAccounts(path = ignoredIdsPath()) {
+	try {
+		return normalize(JSON.parse(await readFile(path, "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* Replace the ignore list, atomically.
+*
+* Written to a sibling temp file and renamed over the target so a crash (or a
+* concurrent reader) can never observe a half-written document — the ignore
+* list is the only thing standing between a dead account and the rotation, and
+* a truncated file reads as "nothing is ignored", which would quietly put every
+* discarded account back in the pool.
+*/
+async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
+	const payload = JSON.stringify({
+		version: 1,
+		accounts
+	}, null, 2);
+	await mkdir(dirname(path), { recursive: true });
+	const temp = `${path}.tmp`;
+	await writeFile$1(temp, `${payload}\n`, "utf8");
+	await rename(temp, path);
+}
+/**
+* Add one account to the ignore list, preserving the rest.
+*
+* A read-modify-write rather than a wholesale replace: the card and the CLI can
+* both be open, and each request names exactly one account, so re-writing the
+* whole list from a stale view would drop the other side's edits.
+*/
+async function ignoreAccount(account, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	if (current.some((entry) => entry.id === account.id)) return current;
+	const next = [...current, {
+		id: account.id,
+		label: account.label ?? account.id,
+		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
+	}];
+	await writeIgnoredAccounts(next, path);
+	return next;
+}
+/** Drop one account from the ignore list. Returns the resulting list. */
+async function unignoreAccount(accountId, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	const next = current.filter((entry) => entry.id !== accountId);
+	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
+	return next;
+}
+//#endregion
 //#region src/index.ts
 /**
 * One region's model-selection schema.
@@ -4267,6 +4555,18 @@ function formatRates(status) {
 * region that has never been saved stays absent so `applyConfigFromSource` can
 * fall back to the legacy flat keys.
 */
+function asVolatile(schema) {
+	const candidate = schema;
+	return typeof candidate.volatile === "function" ? candidate.volatile() : schema;
+}
+/**
+* One region's model-selection schema.
+*
+* Every field is optional on purpose: an absent field keeps its documented
+* meaning ("all enabled" / "follow the upstream image flag" / "no cap"), and a
+* region that has never been saved stays absent so `applyConfigFromSource` can
+* fall back to the legacy flat keys.
+*/
 const modelSelectionSchema = z.object({
 	enabledModelIds: z.array(z.string()).description("Model ids enabled in this region's picker (absent = all)"),
 	imageModelIds: z.array(z.string()).description("Model ids accepting image input in this region (absent = follow upstream)"),
@@ -4294,22 +4594,22 @@ const automationSchema = z.object({
 	exhaustCooldownMs: z.number().step(1).min(1e3).description("How long a spent account rests, in milliseconds")
 });
 z.object({
-	authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app own location)"),
-	cooldownMs: z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds"),
-	distribution: z.union([
+	authFile: asVolatile(z.string().description("WorkBuddy desktop auth file (defaults to the app own location)")),
+	cooldownMs: asVolatile(z.number().step(1).min(1e3).default(6e4).description("Rate-limit cooldown per account, in milliseconds")),
+	distribution: asVolatile(z.union([
 		"priority",
 		"round-robin",
 		"balanced"
-	]).default("priority").description("How requests are spread: priority (drain one), round-robin (in order), or balanced (idle-weighted random)"),
-	disabledAccountIds: z.array(z.string()).default([]).description("Account ids excluded from the pool (empty = every discovered account participates)"),
-	creditReserves: z.dict(z.number().step(1).min(0)).default({}).description("Per-account credit floor: stop using an account once its balance reaches this value"),
-	enabledModelIds: z.array(z.string()).default([]).description("Legacy shared model-id list; used by a region that has no per-region selection yet"),
-	imageModelIds: z.array(z.string()).default([]).description("Legacy shared image-id list; used by a region that has no per-region selection yet"),
-	contextBudgets: z.dict(z.number().step(1).min(1)).default({}).description("Legacy shared context budgets; used by a region with no per-region selection yet"),
-	modelSelectionCn: modelSelectionSchema.description("Model selection for the domestic gateway"),
-	modelSelectionGlobal: modelSelectionSchema.description("Model selection for the international gateway"),
-	automation: automationSchema.description("Daily points automation (activity report, task claiming, check-in)"),
-	automationEarnings: z.any().description("Automation earnings ledger (written by the scheduler)")
+	]).default("priority").description("How requests are spread: priority (drain one), round-robin (in order), or balanced (idle-weighted random)")),
+	disabledAccountIds: asVolatile(z.array(z.string()).default([]).description("Account ids excluded from the pool (empty = every discovered account participates)")),
+	creditReserves: asVolatile(z.dict(z.number().step(1).min(0)).default({}).description("Per-account credit floor: stop using an account once its balance reaches this value")),
+	enabledModelIds: asVolatile(z.array(z.string()).default([]).description("Legacy shared model-id list; used by a region that has no per-region selection yet")),
+	imageModelIds: asVolatile(z.array(z.string()).default([]).description("Legacy shared image-id list; used by a region that has no per-region selection yet")),
+	contextBudgets: asVolatile(z.dict(z.number().step(1).min(1)).default({}).description("Legacy shared context budgets; used by a region with no per-region selection yet")),
+	modelSelectionCn: asVolatile(modelSelectionSchema.description("Model selection for the domestic gateway")),
+	modelSelectionGlobal: asVolatile(modelSelectionSchema.description("Model selection for the international gateway")),
+	automation: asVolatile(automationSchema.description("Daily points automation (activity report, task claiming, check-in)")),
+	automationEarnings: asVolatile(z.any().description("Automation earnings ledger (written by the scheduler)"))
 });
 /** Assemble the runtime objects without registering anything. */
 /**
@@ -4347,6 +4647,20 @@ function createCore(logger) {
 */
 /** Directory holding imported account snapshots. */
 const ACCOUNT_DIR_NAME = ".workbuddy-xdpool";
+/**
+* Assemble the runtime for a CLI command, with the ignore list applied.
+*
+* Every command goes through here rather than calling `createCore()` directly,
+* so a command can never accidentally act on an account the user has thrown out
+* — `checkin all` collecting a reward for a discarded account would be exactly
+* the kind of silent surprise the ignore feature exists to prevent.
+*/
+async function cliCore() {
+	const core = createCore();
+	const ignored = await readIgnoredAccounts();
+	core.pool.applyIgnored(ignored.map((entry) => entry.id));
+	return core;
+}
 /** Snapshot files are named by the md5 prefix of their key, so any key is safe. */
 function snapshotPath(key, dir) {
 	return join(dir, `${createHash("md5").update(key).digest("hex").slice(0, 8)}.json`);
@@ -4371,6 +4685,9 @@ function usage() {
 		"  accounts            List discovered accounts (add --json)",
 		"  import <key>        Snapshot the current desktop login as <key> (add --force)",
 		"  remove <key>        Delete one imported snapshot",
+		"  ignore <acct>       Drop an account from the pool for good (id or label)",
+		"  unignore <acct>     Put an ignored account back into the pool",
+		"  ignored             List the accounts dropped from the pool (add --json)",
 		"  login               Guide for adding another account (desktop app is single-sign-in)",
 		"  checkin [all|<acct>] Daily check-in: report status, or collect with `all` / a label",
 		"  reset               Clear all rate-limit cooldowns immediately",
@@ -4399,7 +4716,7 @@ async function commandStatus(args) {
 	const asJson = args.includes("--json");
 	const withCredits = args.includes("--credits");
 	const withRates = args.includes("--rates");
-	const core = createCore();
+	const core = await cliCore();
 	const accounts = await core.pool.scan();
 	const status = {
 		ok: accounts.length > 0,
@@ -4460,7 +4777,7 @@ async function commandStatus(args) {
 async function commandCheckin(args) {
 	const asJson = args.includes("--json");
 	const target = args.find((arg) => !arg.startsWith("--"));
-	const core = createCore();
+	const core = await cliCore();
 	if ((await core.pool.scan()).length === 0) {
 		console.error("No WorkBuddy account discovered. Sign in with the WorkBuddy desktop app first.");
 		return 1;
@@ -4544,7 +4861,7 @@ async function commandDoctor() {
 		lines.push(`  ✓ ${dir} → ${snapshots.length} snapshot(s)`);
 	}
 	lines.push("");
-	const accounts = await createCore().pool.scan();
+	const accounts = await (await cliCore()).pool.scan();
 	lines.push(`Accounts discovered: ${accounts.length}`);
 	if (accounts.length === 0) {
 		healthy = false;
@@ -4622,6 +4939,66 @@ async function commandRemove(args) {
 		return 1;
 	}
 }
+/**
+* Throw one account out of the pool for good, or take it back.
+*
+* The target may be a full account id (as `accounts --json` prints it) or any
+* unambiguous fragment of the label, so the user does not have to copy a hash.
+* The id is what gets stored — a label can change when the account is renamed,
+* and an ignore list keyed by a mutable label would silently stop matching.
+*/
+async function commandIgnore(args, ignored) {
+	const verb = ignored ? "ignore" : "unignore";
+	const target = args.filter((arg) => !arg.startsWith("--"))[0];
+	if (target === void 0) {
+		console.error(`usage: dsh-workbuddy-xdpool ${verb} <account-id|label>`);
+		return 2;
+	}
+	const accounts = await (await cliCore()).pool.scan();
+	const current = await readIgnoredAccounts();
+	if (!ignored) {
+		const match = current.find((entry) => entry.id === target) ?? current.find((entry) => entry.label === target) ?? current.find((entry) => entry.id.startsWith(target));
+		if (match === void 0) {
+			console.error(`No ignored account matches "${target}". Run \`ignored\` to list them.`);
+			return 1;
+		}
+		await unignoreAccount(match.id);
+		console.log(`Restored ${match.label} (${match.id}). It rejoins the pool on the next scan.`);
+		return 0;
+	}
+	const matches = accounts.filter((account) => account.id === target || account.label === target || account.id.startsWith(target) || account.label.includes(target));
+	if (matches.length === 0) {
+		console.error(`No account matches "${target}". Run \`accounts\` to list them.`);
+		return 1;
+	}
+	if (matches.length > 1) {
+		console.error(`"${target}" matches ${matches.length} accounts; use the full id:\n` + matches.map((account) => `  ${account.id}  ${account.label}`).join("\n"));
+		return 1;
+	}
+	const account = matches[0];
+	await ignoreAccount({
+		id: account.id,
+		label: account.label
+	});
+	console.log(`Ignored ${account.label} (${account.id}).\n  Its credential is no longer read and it will not rejoin the pool, even if the
+  desktop app signs it in again. Undo with: dsh-workbuddy-xdpool unignore ${account.id}`);
+	return 0;
+}
+/** List the accounts currently thrown out of the pool. */
+async function commandIgnored(args) {
+	const asJson = args.includes("--json");
+	const ignored = await readIgnoredAccounts();
+	if (asJson) {
+		console.log(JSON.stringify(ignored, null, 2));
+		return 0;
+	}
+	if (ignored.length === 0) {
+		console.log("No accounts are ignored. Use `ignore <account-id|label>` to drop one.");
+		return 0;
+	}
+	console.log(ignored.map((entry) => `⛔ ${entry.label}  (${entry.id})`).join("\n"));
+	return 0;
+}
 function commandLogin() {
 	console.log([
 		"Adding another WorkBuddy account",
@@ -4641,7 +5018,7 @@ function commandLogin() {
 	return 0;
 }
 async function commandReset() {
-	const core = createCore();
+	const core = await cliCore();
 	await core.pool.scan();
 	core.pool.resetCooldowns();
 	console.log("Cleared all rate-limit cooldowns.");
@@ -4649,15 +5026,25 @@ async function commandReset() {
 }
 async function commandAccounts(args) {
 	const asJson = args.includes("--json");
-	const accounts = await createCore().pool.scan();
-	if (asJson) console.log(JSON.stringify(accounts.map((account) => ({
+	const accounts = await (await cliCore()).pool.scan();
+	const ignored = await readIgnoredAccounts();
+	if (asJson) console.log(JSON.stringify([...accounts.map((account) => ({
 		id: account.id,
 		label: account.label,
 		cooling: account.cooldownUntilMs > Date.now(),
 		rateLimitHits: account.rateLimitHits
-	})), null, 2));
-	else if (accounts.length === 0) console.log("No imported accounts. Run `import <key>` after signing in on the desktop app.");
-	else console.log(accounts.map((account) => `${account.cooldownUntilMs > Date.now() ? "⏸" : "▶"} ${account.label}`).join("\n"));
+	})), ...ignored.map((entry) => ({
+		id: entry.id,
+		label: entry.label,
+		ignored: true,
+		ignoredAt: entry.ignoredAt
+	}))], null, 2));
+	else if (accounts.length === 0 && ignored.length === 0) console.log("No imported accounts. Run `import <key>` after signing in on the desktop app.");
+	else {
+		const lines = accounts.map((account) => `${account.cooldownUntilMs > Date.now() ? "⏸" : "▶"} ${account.label}`);
+		if (ignored.length > 0) lines.push(...ignored.map((entry) => `⛔ ${entry.label}  (removed; \`unignore ${entry.id}\` to restore)`));
+		console.log(lines.join("\n"));
+	}
 	return 0;
 }
 /** Entry point; returns the process exit code. */
@@ -4675,6 +5062,9 @@ async function main(argv) {
 		case "accounts": return commandAccounts(rest);
 		case "import": return commandImport(rest);
 		case "remove": return commandRemove(rest);
+		case "ignore": return commandIgnore(rest, true);
+		case "unignore": return commandIgnore(rest, false);
+		case "ignored": return commandIgnored(rest);
 		case "login": return commandLogin();
 		case "logout": return commandRemove(["default", ...rest]);
 		case "reset": return commandReset();