dsh-workbuddy-xdpool 1.7.0 → 1.7.2

package/lib/bin.js

@@ -1,7 +1,7 @@
 import { createDecipheriv, createHash, randomUUID } from "node:crypto";
-import { copyFile, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { copyFile, mkdir, readFile, readdir, rename, writeFile, writeFile as writeFile$1 } from "node:fs/promises";
 import { homedir, platform } from "node:os";
-import { basename, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import z from "@deepseek-ai/schemastery";
@@ -427,6 +427,7 @@ function parseUpstreamModel(value) {
 	const reasoning = parseReasoning(raw["reasoning"]);
 	const supportsToolCall = typeof raw["supportsToolCall"] === "boolean" ? raw["supportsToolCall"] : void 0;
 	const supportsImages = typeof raw["supportsImages"] === "boolean" ? raw["supportsImages"] : void 0;
+	const tags = Array.isArray(raw["tags"]) ? raw["tags"].filter((tag) => typeof tag === "string" && tag !== "") : void 0;
 	return {
 		id,
 		name,
@@ -437,7 +438,8 @@ function parseUpstreamModel(value) {
 		...descriptionZh === void 0 ? {} : { descriptionZh },
 		...descriptionEn === void 0 ? {} : { descriptionEn },
 		...supportsToolCall === void 0 ? {} : { supportsToolCall },
-		...supportsImages === void 0 ? {} : { supportsImages }
+		...supportsImages === void 0 ? {} : { supportsImages },
+		...tags === void 0 || tags.length === 0 ? {} : { tags }
 	};
 }
 /**
@@ -2321,6 +2323,41 @@ async function readCredential(path) {
 	}
 }
 /**
+* The pool id a document would receive, WITHOUT decrypting anything.
+*
+* Used to honour the ignore list before the at-rest key lookup runs: `uin` and
+* `uid` are read as plain strings by {@link parseWorkBuddyAuth}, while
+* `nickname` is commonly encrypted — so this returns undefined for an account
+* whose identity lives only in the encrypted nickname, and the caller falls
+* back to the full parse for those.
+*/
+function cheapIdentityId(text) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const document = parsed;
+	const identity = typeof document["account"] === "object" && document["account"] !== null ? document["account"] : document;
+	const uin = typeof identity["uin"] === "string" && identity["uin"] !== "" ? identity["uin"] : void 0;
+	const uid = typeof identity["uid"] === "string" && identity["uid"] !== "" ? identity["uid"] : void 0;
+	if (uin === void 0 && uid === void 0) return void 0;
+	return workbuddyAccountId({
+		...uin === void 0 ? {} : { uin },
+		...uid === void 0 ? {} : { uid }
+	});
+}
+/** {@link cheapIdentityId} for a file path; undefined when it cannot be read. */
+async function cheapIdentityIdFromFile(path) {
+	try {
+		return cheapIdentityId(await readFile(path, "utf8"));
+	} catch {
+		return;
+	}
+}
+/**
 * Build the field opener, or undefined when the app cannot supply its key.
 *
 * Split out so the key lookup is testable without a real desktop install, and so
@@ -2399,6 +2436,21 @@ var WorkBuddyAccountPool = class {
 	*/
 	disabledIds = /* @__PURE__ */ new Set();
 	/**
+	* Account ids the user threw out of the pool for good.
+	*
+	* Enforced BEFORE the credential is parsed: `scan()` skips a file whose
+	* identity is already ignored, so an ignored account costs no at-rest key
+	* lookup (which spawns the desktop app on 5.6.0+) and cannot re-enter the pool
+	* when the app writes a fresh sign-in for it. That is the difference from
+	* {@link disabledIds}, which only filters at pick time and leaves the account
+	* listed, readable and re-discoverable.
+	*
+	* The set is supplied by the host from the plugin's own ignore file, and is
+	* replaced wholesale on every {@link applyIgnored} so removing an entry takes
+	* effect on the next scan without a restart.
+	*/
+	ignoredIds = /* @__PURE__ */ new Set();
+	/**
 	* Per-account credit floor, keyed by account id. 0 (or absent) means "spend
 	* it all".
 	*
@@ -2450,12 +2502,39 @@ var WorkBuddyAccountPool = class {
 		if (options.disabledAccountIds !== void 0) this.disabledIds = new Set(options.disabledAccountIds);
 		if (options.creditReserves !== void 0) this.setCreditReserves(options.creditReserves);
 	}
+	/**
+	* Replace the permanent ignore list.
+	*
+	* Also drops any already-discovered account that is now ignored, so the change
+	* is visible without waiting for the next scan: the card refreshes its status
+	* document right after the write, and an account still sitting in `accounts`
+	* would keep showing up there.
+	*/
+	applyIgnored(ids) {
+		this.ignoredIds = new Set(ids);
+		if (this.ignoredIds.size === 0) return;
+		this.accounts = this.accounts.filter((account) => !this.ignoredIds.has(account.id));
+	}
+	/** Whether this account has been thrown out of the pool for good. */
+	isIgnored(accountId) {
+		return this.ignoredIds.has(accountId);
+	}
+	/** Every ignored id currently in force, in insertion order. */
+	ignoredIdsInOrder() {
+		return [...this.ignoredIds];
+	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
 		const found = [];
 		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
+			if (this.ignoredIds.size > 0) {
+				const cheapId = await cheapIdentityIdFromFile(file);
+				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
+			}
 			const credential = await readCredential(file);
-			if (credential !== void 0) found.push(credential);
+			if (credential === void 0) continue;
+			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
+			found.push(credential);
 		}
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
@@ -2796,28 +2875,44 @@ ${new Date(until).toISOString()}
 };
 //#endregion
 //#region src/catalog.ts
-/** Static fallback used before the first live catalog fetch. */
+/**
+* Static fallback used before the first live catalog fetch, and whenever the
+* upstream cannot be reached.
+*
+* The multipliers are carried on purpose. Without them the provider's model
+* picker silently loses every rate and every free badge the moment the live
+* fetch fails — which reads to the user as "the plugin broke my model list"
+* rather than "the upstream is unreachable". The values are the ones the two
+* gateways actually advertise for these ids (`credits: "x0.79 credits"` and so
+* on), so a fallback row looks the same as a live one.
+*
+* `multiplier: 0` is the gateways' own spelling of "free" (`credits: "x0.00"`),
+* which is what turns on the free badge.
+*/
 const FALLBACK_WORKBUDDY_MODELS = [
 	{
 		id: "glm-5.3",
 		name: "GLM-5.3",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .79
 	},
 	{
 		id: "glm-5.3-flash",
 		name: "GLM-5.3-Flash",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .06
 	},
 	{
 		id: "glm-5.2",
 		name: "GLM-5.2",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .79
 	},
 	{
 		id: "glm-5.1",
@@ -2845,7 +2940,8 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		name: "Kimi-K3",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: 1.62
 	},
 	{
 		id: "minimax-m3",
@@ -2859,14 +2955,16 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		name: "Hy3",
 		contextWindow: 32e3,
 		maxOutputTokens: 8e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: 0
 	},
 	{
 		id: "hy4-preview",
 		name: "Hy4-Preview",
 		contextWindow: 1e6,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .29
 	}
 ];
 /** Live catalog with a static fallback behind it. */
@@ -2944,7 +3042,8 @@ function toModelInfo(model) {
 		maxOutputTokens: model.maxTokens,
 		supportsImages: model.supportsImages ?? false,
 		...model.creditMultiplier === void 0 ? {} : { multiplier: model.creditMultiplier },
-		...model.reasoning?.supportedEfforts === void 0 ? {} : { supportedEfforts: model.reasoning.supportedEfforts }
+		...model.reasoning?.supportedEfforts === void 0 ? {} : { supportedEfforts: model.reasoning.supportedEfforts },
+		...model.tags === void 0 || model.tags.length === 0 ? {} : { tags: model.tags }
 	};
 }
 /** Map the live upstream list, falling back to the static list when empty. */
@@ -3358,6 +3457,30 @@ function expertChatEvents(expert, conversationId, requestId) {
 		expert_industry_id: ""
 	} : event);
 }
+//#endregion
+//#region src/status-paths.ts
+/**
+* The schedule every automation job falls back to.
+*
+* Shared by both halves on purpose. The host uses it when a configured hour
+* list arrives empty (the settings schema materializes "never configured" into
+* `[]`), and the card uses it when it writes the `automation` block back, so a
+* document that already holds an empty list is healed instead of being saved
+* back as an unrunnable schedule.
+*
+* This lives here rather than in `scheduler.ts` because the browser half cannot
+* import the host module: `scheduler.ts` pulls in `node:crypto` and the whole
+* upstream client, none of which exists in the browser bundle. Two hand-written
+* copies would drift, and the drift is invisible — the card would write a
+* schedule the scheduler does not run.
+*/
+const DEFAULT_AUTOMATION_HOURS = {
+	checkin: [9],
+	report: [10],
+	tasks: [11],
+	streak: [12],
+	travel: [9, 21]
+};
 /**
 * The fallback record for the 腾讯轻量云 expert, used when the marketplace
 * listing cannot be read. The id is the one the task is scored against.
@@ -3401,6 +3524,23 @@ const JOB_KINDS = [
 	"streak",
 	"travel"
 ];
+/**
+* Pick the hour list to run on: the configured one, or the default.
+*
+* An EMPTY list is treated as "not configured" rather than as "never run".
+* That distinction is the whole point: the settings schema materializes an
+* absent list into `[]` (a bare `z.array` with no `.default()`), so a config
+* that never mentioned the schedule arrives here looking exactly like one
+* deliberately set to nothing — and honouring the empty reading silently
+* disabled every job while the card still showed the switch as ON.
+*
+* A user who genuinely wants a job skipped can leave it out of the schedule
+* they save; they cannot express "off" with an empty array through the card
+* either way, because the card always writes a non-empty list.
+*/
+function hoursOrDefault(configured, fallback) {
+	return configured !== void 0 && configured.length > 0 ? configured : fallback;
+}
 const EMPTY_JOB_STATE = {
 	ok: 0,
 	failed: 0,
@@ -3576,11 +3716,11 @@ var WorkBuddyScheduler = class {
 			this.earningsDate = today;
 		}
 		this.enabled = options.enabled ?? false;
-		this.checkinHours = options.checkinHours ?? [9];
-		this.reportHours = options.reportHours ?? [10];
-		this.taskHours = options.taskHours ?? [11];
-		this.streakHours = options.streakHours ?? [12];
-		this.travelHours = options.travelHours ?? [9, 21];
+		this.checkinHours = hoursOrDefault(options.checkinHours, DEFAULT_AUTOMATION_HOURS.checkin);
+		this.reportHours = hoursOrDefault(options.reportHours, DEFAULT_AUTOMATION_HOURS.report);
+		this.taskHours = hoursOrDefault(options.taskHours, DEFAULT_AUTOMATION_HOURS.tasks);
+		this.streakHours = hoursOrDefault(options.streakHours, DEFAULT_AUTOMATION_HOURS.streak);
+		this.travelHours = hoursOrDefault(options.travelHours, DEFAULT_AUTOMATION_HOURS.travel);
 	}
 	/** Apply a new configuration; safe to call while running. */
 	/**
@@ -3608,11 +3748,11 @@ var WorkBuddyScheduler = class {
 	}
 	applyConfig(options) {
 		if (options.enabled !== void 0) this.enabled = options.enabled;
-		if (options.checkinHours !== void 0) this.checkinHours = options.checkinHours;
-		if (options.reportHours !== void 0) this.reportHours = options.reportHours;
-		if (options.taskHours !== void 0) this.taskHours = options.taskHours;
-		if (options.streakHours !== void 0) this.streakHours = options.streakHours;
-		if (options.travelHours !== void 0) this.travelHours = options.travelHours;
+		if (options.checkinHours !== void 0) this.checkinHours = hoursOrDefault(options.checkinHours, DEFAULT_AUTOMATION_HOURS.checkin);
+		if (options.reportHours !== void 0) this.reportHours = hoursOrDefault(options.reportHours, DEFAULT_AUTOMATION_HOURS.report);
+		if (options.taskHours !== void 0) this.taskHours = hoursOrDefault(options.taskHours, DEFAULT_AUTOMATION_HOURS.tasks);
+		if (options.streakHours !== void 0) this.streakHours = hoursOrDefault(options.streakHours, DEFAULT_AUTOMATION_HOURS.streak);
+		if (options.travelHours !== void 0) this.travelHours = hoursOrDefault(options.travelHours, DEFAULT_AUTOMATION_HOURS.travel);
 	}
 	/** Hours for one job, used by the loop and the status document. */
 	hoursOf(kind) {
@@ -3658,7 +3798,7 @@ var WorkBuddyScheduler = class {
 	async runNow(kind, force = false) {
 		const today = dayKey(this.now());
 		const state = this.states[kind];
-		if (!force && state.lastRunSlot === slotKey(this.now())) return { ...state };
+		if (!force && state.lastFiredHour === slotKey(this.now())) return { ...state };
 		this.busy = true;
 		try {
 			await this.runJob(kind, today);
@@ -3756,13 +3896,46 @@ var WorkBuddyScheduler = class {
 	* two hours still runs twice a day — but a job whose hour passed while DSH was
 	* closed runs immediately on the next tick instead of waiting for tomorrow.
 	*/
-	isDue(kind, now) {
+	/**
+	* The configured slot `kind` should consume at `now`, or undefined when none.
+	*
+	* Returns the SLOT STRING (not a boolean) because the caller must record the
+	* same value it acted on. Returning a boolean was the original bug's enabler:
+	* the tick asked "is it due", then `runJob` independently wrote "what time is
+	* it now" — and those two answers were almost never equal.
+	*
+	* CATCH-UP semantics are deliberate: a candidate fires once its hour has
+	* PASSED and its slot is still unconsumed, so a laptop that slept through
+	* 10:00 still runs the job when it wakes, on the same day.
+	*
+	* The EARLIEST unconsumed candidate wins, which is what keeps a two-hour job
+	* (`travelHours: [9, 21]`) whole: consuming the earliest due slot leaves the
+	* later one for its own hour.
+	*/
+	dueSlot(kind, now) {
 		const hours = this.hoursOf(kind);
-		if (hours.length === 0) return false;
-		const { hour } = zonedParts(now);
-		const current = Number(hour);
+		if (hours.length === 0) return void 0;
+		const current = Number(zonedParts(now).hour);
 		const today = dayKey(now);
-		return hours.some((candidate) => candidate <= current && this.states[kind].lastRunSlot !== `${today}T${String(candidate).padStart(2, "0")}`);
+		const fired = this.firedSlotsOf(kind);
+		for (const candidate of [...hours].sort((a, b) => a - b)) {
+			if (candidate > current) break;
+			const slot = `${today}T${String(candidate).padStart(2, "0")}`;
+			if (!fired.has(slot)) return slot;
+		}
+	}
+	/** Today's consumed slots for one job, as a set. */
+	firedSlotsOf(kind) {
+		const stored = this.states[kind].firedSlots;
+		if (stored === void 0) return /* @__PURE__ */ new Set();
+		const today = dayKey(this.now());
+		return new Set(stored.filter((slot) => slot.startsWith(`${today}T`)));
+	}
+	/** Record one consumed slot on a job's state. */
+	consumeSlot(kind, slot) {
+		const state = this.states[kind];
+		const today = dayKey(this.now());
+		state.firedSlots = [.../* @__PURE__ */ new Set([...this.firedSlotsOf(kind), slot])].filter((entry) => entry.startsWith(`${today}T`)).sort();
 	}
 	async tick() {
 		if (!this.enabled || this.stopped || this.busy) return;
@@ -3773,9 +3946,10 @@ var WorkBuddyScheduler = class {
 			const today = dayKey(now);
 			for (const kind of JOB_KINDS) {
 				if (this.stopped) return;
-				if (this.states[kind].lastRunSlot === slot) continue;
-				if (!this.isDue(kind, now)) continue;
-				await this.runJob(kind, today);
+				if (this.states[kind].lastFiredHour === slot) continue;
+				const consumed = this.dueSlot(kind, now);
+				if (consumed === void 0) continue;
+				await this.runJob(kind, today, consumed);
 			}
 		} catch (error) {
 			this.logger.warn?.("dsh-workbuddy-xdpool automation tick failed:", error);
@@ -3861,6 +4035,12 @@ var WorkBuddyScheduler = class {
 	/**
 	* Run one job against every eligible account and record the outcome.
 	*
+	* `consumedSlot` is the configured slot this run spends (`dueSlot`'s answer).
+	* It is passed IN rather than recomputed here so the value recorded is exactly
+	* the value the schedule decided on — the defect this replaces wrote
+	* `slotKey(now)` instead, i.e. the clock time the run finished at, which
+	* almost never equals the configured candidate the gate had compared against.
+	*
 	* The task job runs in TWO passes. The first sends the event chains that light
 	* up client-scored tasks; the second collects rewards. They are separate
 	* because scoring lands asynchronously — a chain sent and claimed within the
@@ -3868,7 +4048,7 @@ var WorkBuddyScheduler = class {
 	* while claiming wants the whole pool to have been lit up first. Splitting
 	* them costs one shared wait instead of one wait per account.
 	*/
-	async runJob(kind, today) {
+	async runJob(kind, today, consumedSlot) {
 		const accountWord = kind === "report" ? "report" : kind;
 		let ok = 0;
 		let failed = 0;
@@ -3933,7 +4113,8 @@ var WorkBuddyScheduler = class {
 			if (index < accounts.length - 1 && this.delayMs > 0 && !this.stopped) await sleep(this.delayMs);
 		}
 		const state = this.states[kind];
-		state.lastRunSlot = slotKey(this.now());
+		if (consumedSlot !== void 0) this.consumeSlot(kind, consumedSlot);
+		state.lastFiredHour = slotKey(this.now());
 		state.lastRunDate = today;
 		state.lastRunAtMs = this.now().getTime();
 		state.ok = ok;
@@ -4275,6 +4456,137 @@ function formatRates(status) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/ignored.ts
+/**
+* The permanent ignore list: accounts the user has thrown out of the pool.
+*
+* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
+* account stays on the card, can be switched back on, and its credential keeps
+* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
+* one is not mine any more" — so an ignored account is skipped BEFORE its
+* credential is decrypted, never appears among the pool's accounts, and does not
+* come back when the desktop app writes a fresh `.info` file for it.
+*
+* It lives in a plugin-owned file rather than in the settings document for one
+* practical reason: the CLI has no settings service. `dsh-workbuddy-xdpool
+* ignore <id>` runs without a host, so a settings-only list could be written by
+* the card and never by the CLI. One file, read by both halves, keeps the two
+* views of "which accounts are ignored" identical by construction.
+*
+* @module dsh-workbuddy-xdpool/ignored
+*/
+/** Directory holding this plugin's own state (imported snapshots, ignore list). */
+const PLUGIN_DATA_DIR_NAME = ".workbuddy-xdpool";
+/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
+const IGNORED_FILE_NAME = "ignored.json";
+/**
+* The DSH home directory, honouring the same override the host uses.
+*
+* Shared by the CLI and the host so both halves resolve the same file: an
+* `ignore` written from the terminal has to be visible to the running plugin,
+* which is only true if they agree on where "home" is.
+*/
+function dshHome$1(env = process.env) {
+	const fromEnv = env["DSH_HOME"];
+	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
+	return join(homedir(), ".dsh");
+}
+/** This plugin's own state directory. */
+function pluginDataDir(env = process.env) {
+	return join(dshHome$1(env), PLUGIN_DATA_DIR_NAME);
+}
+/** Absolute path of the ignore list. */
+function ignoredIdsPath(env = process.env) {
+	return join(pluginDataDir(env), IGNORED_FILE_NAME);
+}
+/**
+* Normalize whatever the file holds into a clean list.
+*
+* Tolerant on purpose: this file is hand-editable and a malformed entry must not
+* take the pool down. An entry without a usable id is dropped; a missing label
+* falls back to the id so the card always has something to print.
+*/
+function normalize(raw) {
+	if (typeof raw !== "object" || raw === null) return [];
+	const entries = raw.accounts;
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
+		if (id === "" || seen.has(id)) continue;
+		seen.add(id);
+		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
+		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
+		out.push({
+			id,
+			label,
+			ignoredAt
+		});
+	}
+	return out;
+}
+/**
+* Read the ignore list, tolerating every "no list yet" shape.
+*
+* A missing file, unreadable file, or invalid JSON all mean the same thing to
+* the caller — nothing is ignored — so none of them throws. The pool must be
+* able to start on a machine that has never ignored anything.
+*/
+async function readIgnoredAccounts(path = ignoredIdsPath()) {
+	try {
+		return normalize(JSON.parse(await readFile(path, "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* Replace the ignore list, atomically.
+*
+* Written to a sibling temp file and renamed over the target so a crash (or a
+* concurrent reader) can never observe a half-written document — the ignore
+* list is the only thing standing between a dead account and the rotation, and
+* a truncated file reads as "nothing is ignored", which would quietly put every
+* discarded account back in the pool.
+*/
+async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
+	const payload = JSON.stringify({
+		version: 1,
+		accounts
+	}, null, 2);
+	await mkdir(dirname(path), { recursive: true });
+	const temp = `${path}.tmp`;
+	await writeFile$1(temp, `${payload}\n`, "utf8");
+	await rename(temp, path);
+}
+/**
+* Add one account to the ignore list, preserving the rest.
+*
+* A read-modify-write rather than a wholesale replace: the card and the CLI can
+* both be open, and each request names exactly one account, so re-writing the
+* whole list from a stale view would drop the other side's edits.
+*/
+async function ignoreAccount(account, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	if (current.some((entry) => entry.id === account.id)) return current;
+	const next = [...current, {
+		id: account.id,
+		label: account.label ?? account.id,
+		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
+	}];
+	await writeIgnoredAccounts(next, path);
+	return next;
+}
+/** Drop one account from the ignore list. Returns the resulting list. */
+async function unignoreAccount(accountId, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	const next = current.filter((entry) => entry.id !== accountId);
+	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
+	return next;
+}
+//#endregion
 //#region src/index.ts
 /**
 * One region's model-selection schema.
@@ -4376,6 +4688,20 @@ function createCore(logger) {
 */
 /** Directory holding imported account snapshots. */
 const ACCOUNT_DIR_NAME = ".workbuddy-xdpool";
+/**
+* Assemble the runtime for a CLI command, with the ignore list applied.
+*
+* Every command goes through here rather than calling `createCore()` directly,
+* so a command can never accidentally act on an account the user has thrown out
+* — `checkin all` collecting a reward for a discarded account would be exactly
+* the kind of silent surprise the ignore feature exists to prevent.
+*/
+async function cliCore() {
+	const core = createCore();
+	const ignored = await readIgnoredAccounts();
+	core.pool.applyIgnored(ignored.map((entry) => entry.id));
+	return core;
+}
 /** Snapshot files are named by the md5 prefix of their key, so any key is safe. */
 function snapshotPath(key, dir) {
 	return join(dir, `${createHash("md5").update(key).digest("hex").slice(0, 8)}.json`);
@@ -4400,6 +4726,9 @@ function usage() {
 		"  accounts            List discovered accounts (add --json)",
 		"  import <key>        Snapshot the current desktop login as <key> (add --force)",
 		"  remove <key>        Delete one imported snapshot",
+		"  ignore <acct>       Drop an account from the pool for good (id or label)",
+		"  unignore <acct>     Put an ignored account back into the pool",
+		"  ignored             List the accounts dropped from the pool (add --json)",
 		"  login               Guide for adding another account (desktop app is single-sign-in)",
 		"  checkin [all|<acct>] Daily check-in: report status, or collect with `all` / a label",
 		"  reset               Clear all rate-limit cooldowns immediately",
@@ -4428,7 +4757,7 @@ async function commandStatus(args) {
 	const asJson = args.includes("--json");
 	const withCredits = args.includes("--credits");
 	const withRates = args.includes("--rates");
-	const core = createCore();
+	const core = await cliCore();
 	const accounts = await core.pool.scan();
 	const status = {
 		ok: accounts.length > 0,
@@ -4489,7 +4818,7 @@ async function commandStatus(args) {
 async function commandCheckin(args) {
 	const asJson = args.includes("--json");
 	const target = args.find((arg) => !arg.startsWith("--"));
-	const core = createCore();
+	const core = await cliCore();
 	if ((await core.pool.scan()).length === 0) {
 		console.error("No WorkBuddy account discovered. Sign in with the WorkBuddy desktop app first.");
 		return 1;
@@ -4573,7 +4902,7 @@ async function commandDoctor() {
 		lines.push(`  ✓ ${dir} → ${snapshots.length} snapshot(s)`);
 	}
 	lines.push("");
-	const accounts = await createCore().pool.scan();
+	const accounts = await (await cliCore()).pool.scan();
 	lines.push(`Accounts discovered: ${accounts.length}`);
 	if (accounts.length === 0) {
 		healthy = false;
@@ -4651,6 +4980,66 @@ async function commandRemove(args) {
 		return 1;
 	}
 }
+/**
+* Throw one account out of the pool for good, or take it back.
+*
+* The target may be a full account id (as `accounts --json` prints it) or any
+* unambiguous fragment of the label, so the user does not have to copy a hash.
+* The id is what gets stored — a label can change when the account is renamed,
+* and an ignore list keyed by a mutable label would silently stop matching.
+*/
+async function commandIgnore(args, ignored) {
+	const verb = ignored ? "ignore" : "unignore";
+	const target = args.filter((arg) => !arg.startsWith("--"))[0];
+	if (target === void 0) {
+		console.error(`usage: dsh-workbuddy-xdpool ${verb} <account-id|label>`);
+		return 2;
+	}
+	const accounts = await (await cliCore()).pool.scan();
+	const current = await readIgnoredAccounts();
+	if (!ignored) {
+		const match = current.find((entry) => entry.id === target) ?? current.find((entry) => entry.label === target) ?? current.find((entry) => entry.id.startsWith(target));
+		if (match === void 0) {
+			console.error(`No ignored account matches "${target}". Run \`ignored\` to list them.`);
+			return 1;
+		}
+		await unignoreAccount(match.id);
+		console.log(`Restored ${match.label} (${match.id}). It rejoins the pool on the next scan.`);
+		return 0;
+	}
+	const matches = accounts.filter((account) => account.id === target || account.label === target || account.id.startsWith(target) || account.label.includes(target));
+	if (matches.length === 0) {
+		console.error(`No account matches "${target}". Run \`accounts\` to list them.`);
+		return 1;
+	}
+	if (matches.length > 1) {
+		console.error(`"${target}" matches ${matches.length} accounts; use the full id:\n` + matches.map((account) => `  ${account.id}  ${account.label}`).join("\n"));
+		return 1;
+	}
+	const account = matches[0];
+	await ignoreAccount({
+		id: account.id,
+		label: account.label
+	});
+	console.log(`Ignored ${account.label} (${account.id}).\n  Its credential is no longer read and it will not rejoin the pool, even if the
+  desktop app signs it in again. Undo with: dsh-workbuddy-xdpool unignore ${account.id}`);
+	return 0;
+}
+/** List the accounts currently thrown out of the pool. */
+async function commandIgnored(args) {
+	const asJson = args.includes("--json");
+	const ignored = await readIgnoredAccounts();
+	if (asJson) {
+		console.log(JSON.stringify(ignored, null, 2));
+		return 0;
+	}
+	if (ignored.length === 0) {
+		console.log("No accounts are ignored. Use `ignore <account-id|label>` to drop one.");
+		return 0;
+	}
+	console.log(ignored.map((entry) => `⛔ ${entry.label}  (${entry.id})`).join("\n"));
+	return 0;
+}
 function commandLogin() {
 	console.log([
 		"Adding another WorkBuddy account",
@@ -4670,7 +5059,7 @@ function commandLogin() {
 	return 0;
 }
 async function commandReset() {
-	const core = createCore();
+	const core = await cliCore();
 	await core.pool.scan();
 	core.pool.resetCooldowns();
 	console.log("Cleared all rate-limit cooldowns.");
@@ -4678,15 +5067,25 @@ async function commandReset() {
 }
 async function commandAccounts(args) {
 	const asJson = args.includes("--json");
-	const accounts = await createCore().pool.scan();
-	if (asJson) console.log(JSON.stringify(accounts.map((account) => ({
+	const accounts = await (await cliCore()).pool.scan();
+	const ignored = await readIgnoredAccounts();
+	if (asJson) console.log(JSON.stringify([...accounts.map((account) => ({
 		id: account.id,
 		label: account.label,
 		cooling: account.cooldownUntilMs > Date.now(),
 		rateLimitHits: account.rateLimitHits
-	})), null, 2));
-	else if (accounts.length === 0) console.log("No imported accounts. Run `import <key>` after signing in on the desktop app.");
-	else console.log(accounts.map((account) => `${account.cooldownUntilMs > Date.now() ? "⏸" : "▶"} ${account.label}`).join("\n"));
+	})), ...ignored.map((entry) => ({
+		id: entry.id,
+		label: entry.label,
+		ignored: true,
+		ignoredAt: entry.ignoredAt
+	}))], null, 2));
+	else if (accounts.length === 0 && ignored.length === 0) console.log("No imported accounts. Run `import <key>` after signing in on the desktop app.");
+	else {
+		const lines = accounts.map((account) => `${account.cooldownUntilMs > Date.now() ? "⏸" : "▶"} ${account.label}`);
+		if (ignored.length > 0) lines.push(...ignored.map((entry) => `⛔ ${entry.label}  (removed; \`unignore ${entry.id}\` to restore)`));
+		console.log(lines.join("\n"));
+	}
 	return 0;
 }
 /** Entry point; returns the process exit code. */
@@ -4704,6 +5103,9 @@ async function main(argv) {
 		case "accounts": return commandAccounts(rest);
 		case "import": return commandImport(rest);
 		case "remove": return commandRemove(rest);
+		case "ignore": return commandIgnore(rest, true);
+		case "unignore": return commandIgnore(rest, false);
+		case "ignored": return commandIgnored(rest);
 		case "login": return commandLogin();
 		case "logout": return commandRemove(["default", ...rest]);
 		case "reset": return commandReset();