dsh-workbuddy-xdpool 1.7.0 → 1.7.2

package/lib/index.js

@@ -1,7 +1,7 @@
 import { basename, dirname, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
-import { readFile, readdir } from "node:fs/promises";
+import { mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { execFile, execFileSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
@@ -443,6 +443,7 @@ function parseUpstreamModel(value) {
 	const reasoning = parseReasoning(raw["reasoning"]);
 	const supportsToolCall = typeof raw["supportsToolCall"] === "boolean" ? raw["supportsToolCall"] : void 0;
 	const supportsImages = typeof raw["supportsImages"] === "boolean" ? raw["supportsImages"] : void 0;
+	const tags = Array.isArray(raw["tags"]) ? raw["tags"].filter((tag) => typeof tag === "string" && tag !== "") : void 0;
 	return {
 		id,
 		name,
@@ -453,7 +454,8 @@ function parseUpstreamModel(value) {
 		...descriptionZh === void 0 ? {} : { descriptionZh },
 		...descriptionEn === void 0 ? {} : { descriptionEn },
 		...supportsToolCall === void 0 ? {} : { supportsToolCall },
-		...supportsImages === void 0 ? {} : { supportsImages }
+		...supportsImages === void 0 ? {} : { supportsImages },
+		...tags === void 0 || tags.length === 0 ? {} : { tags }
 	};
 }
 /**
@@ -2428,6 +2430,41 @@ async function readCredential(path) {
 	}
 }
 /**
+* The pool id a document would receive, WITHOUT decrypting anything.
+*
+* Used to honour the ignore list before the at-rest key lookup runs: `uin` and
+* `uid` are read as plain strings by {@link parseWorkBuddyAuth}, while
+* `nickname` is commonly encrypted — so this returns undefined for an account
+* whose identity lives only in the encrypted nickname, and the caller falls
+* back to the full parse for those.
+*/
+function cheapIdentityId(text) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+	const document = parsed;
+	const identity = typeof document["account"] === "object" && document["account"] !== null ? document["account"] : document;
+	const uin = typeof identity["uin"] === "string" && identity["uin"] !== "" ? identity["uin"] : void 0;
+	const uid = typeof identity["uid"] === "string" && identity["uid"] !== "" ? identity["uid"] : void 0;
+	if (uin === void 0 && uid === void 0) return void 0;
+	return workbuddyAccountId({
+		...uin === void 0 ? {} : { uin },
+		...uid === void 0 ? {} : { uid }
+	});
+}
+/** {@link cheapIdentityId} for a file path; undefined when it cannot be read. */
+async function cheapIdentityIdFromFile(path) {
+	try {
+		return cheapIdentityId(await readFile(path, "utf8"));
+	} catch {
+		return;
+	}
+}
+/**
 * Build the field opener, or undefined when the app cannot supply its key.
 *
 * Split out so the key lookup is testable without a real desktop install, and so
@@ -2506,6 +2543,21 @@ var WorkBuddyAccountPool = class {
 	*/
 	disabledIds = /* @__PURE__ */ new Set();
 	/**
+	* Account ids the user threw out of the pool for good.
+	*
+	* Enforced BEFORE the credential is parsed: `scan()` skips a file whose
+	* identity is already ignored, so an ignored account costs no at-rest key
+	* lookup (which spawns the desktop app on 5.6.0+) and cannot re-enter the pool
+	* when the app writes a fresh sign-in for it. That is the difference from
+	* {@link disabledIds}, which only filters at pick time and leaves the account
+	* listed, readable and re-discoverable.
+	*
+	* The set is supplied by the host from the plugin's own ignore file, and is
+	* replaced wholesale on every {@link applyIgnored} so removing an entry takes
+	* effect on the next scan without a restart.
+	*/
+	ignoredIds = /* @__PURE__ */ new Set();
+	/**
 	* Per-account credit floor, keyed by account id. 0 (or absent) means "spend
 	* it all".
 	*
@@ -2557,12 +2609,39 @@ var WorkBuddyAccountPool = class {
 		if (options.disabledAccountIds !== void 0) this.disabledIds = new Set(options.disabledAccountIds);
 		if (options.creditReserves !== void 0) this.setCreditReserves(options.creditReserves);
 	}
+	/**
+	* Replace the permanent ignore list.
+	*
+	* Also drops any already-discovered account that is now ignored, so the change
+	* is visible without waiting for the next scan: the card refreshes its status
+	* document right after the write, and an account still sitting in `accounts`
+	* would keep showing up there.
+	*/
+	applyIgnored(ids) {
+		this.ignoredIds = new Set(ids);
+		if (this.ignoredIds.size === 0) return;
+		this.accounts = this.accounts.filter((account) => !this.ignoredIds.has(account.id));
+	}
+	/** Whether this account has been thrown out of the pool for good. */
+	isIgnored(accountId) {
+		return this.ignoredIds.has(accountId);
+	}
+	/** Every ignored id currently in force, in insertion order. */
+	ignoredIdsInOrder() {
+		return [...this.ignoredIds];
+	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
 		const found = [];
 		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
+			if (this.ignoredIds.size > 0) {
+				const cheapId = await cheapIdentityIdFromFile(file);
+				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
+			}
 			const credential = await readCredential(file);
-			if (credential !== void 0) found.push(credential);
+			if (credential === void 0) continue;
+			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
+			found.push(credential);
 		}
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
@@ -2903,28 +2982,44 @@ ${new Date(until).toISOString()}
 };
 //#endregion
 //#region src/catalog.ts
-/** Static fallback used before the first live catalog fetch. */
+/**
+* Static fallback used before the first live catalog fetch, and whenever the
+* upstream cannot be reached.
+*
+* The multipliers are carried on purpose. Without them the provider's model
+* picker silently loses every rate and every free badge the moment the live
+* fetch fails — which reads to the user as "the plugin broke my model list"
+* rather than "the upstream is unreachable". The values are the ones the two
+* gateways actually advertise for these ids (`credits: "x0.79 credits"` and so
+* on), so a fallback row looks the same as a live one.
+*
+* `multiplier: 0` is the gateways' own spelling of "free" (`credits: "x0.00"`),
+* which is what turns on the free badge.
+*/
 const FALLBACK_WORKBUDDY_MODELS = [
 	{
 		id: "glm-5.3",
 		name: "GLM-5.3",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .79
 	},
 	{
 		id: "glm-5.3-flash",
 		name: "GLM-5.3-Flash",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .06
 	},
 	{
 		id: "glm-5.2",
 		name: "GLM-5.2",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .79
 	},
 	{
 		id: "glm-5.1",
@@ -2952,7 +3047,8 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		name: "Kimi-K3",
 		contextWindow: 2e5,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: 1.62
 	},
 	{
 		id: "minimax-m3",
@@ -2966,14 +3062,16 @@ const FALLBACK_WORKBUDDY_MODELS = [
 		name: "Hy3",
 		contextWindow: 32e3,
 		maxOutputTokens: 8e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: 0
 	},
 	{
 		id: "hy4-preview",
 		name: "Hy4-Preview",
 		contextWindow: 1e6,
 		maxOutputTokens: 128e3,
-		supportsImages: true
+		supportsImages: true,
+		multiplier: .29
 	}
 ];
 /** Live catalog with a static fallback behind it. */
@@ -3051,7 +3149,8 @@ function toModelInfo(model) {
 		maxOutputTokens: model.maxTokens,
 		supportsImages: model.supportsImages ?? false,
 		...model.creditMultiplier === void 0 ? {} : { multiplier: model.creditMultiplier },
-		...model.reasoning?.supportedEfforts === void 0 ? {} : { supportedEfforts: model.reasoning.supportedEfforts }
+		...model.reasoning?.supportedEfforts === void 0 ? {} : { supportedEfforts: model.reasoning.supportedEfforts },
+		...model.tags === void 0 || model.tags.length === 0 ? {} : { tags: model.tags }
 	};
 }
 /** Map the live upstream list, falling back to the static list when empty. */
@@ -3161,7 +3260,8 @@ const TAG_LABEL = {
 *  so we don't tack a trailing separator on a plain model. */
 function displaySuffix(info) {
 	const parts = [];
-	if (typeof info.multiplier === "number" && Number.isFinite(info.multiplier)) parts.push(`x${info.multiplier.toFixed(2)}`);
+	if (info.multiplier === 0) parts.push("免费");
+	else if (typeof info.multiplier === "number" && Number.isFinite(info.multiplier)) parts.push(`x${info.multiplier.toFixed(2)}`);
 	for (const tag of info.tags ?? []) {
 		const label = TAG_LABEL[tag];
 		if (label !== void 0 && !parts.includes(label)) parts.push(label);
@@ -3660,6 +3760,65 @@ function expertChatEvents(expert, conversationId, requestId) {
 		expert_industry_id: ""
 	} : event);
 }
+//#endregion
+//#region src/status-paths.ts
+/**
+* Node-free constants and types shared by the Host and browser halves of the
+* WorkBuddy XD Pool settings card.
+*
+* Pool's runtime state already lives in `src/status.ts` (`buildStatus` /
+* `WorkBuddyStatus`); this module only carves the cross-domain (Host→browser)
+* JSON document into a shape that stays token-free and matches what the
+* browser card renders. Route paths are plugin-owned and mounted on the Host's
+* same-origin web server (see `src/web-status.ts`).
+*
+* @module dsh-workbuddy-xdpool/status-paths
+*/
+/** Plugin-owned read-only pool status endpoint (account rows + models + shim). */
+const POOL_STATUS_PATH = "/plugins/dsh-workbuddy-xdpool/status";
+/** Plugin-owned local account rescan endpoint (re-read desktop snapshots). */
+const POOL_RESCAN_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/rescan";
+/** Plugin-owned cooldown reset endpoint (clear all 429 cooldowns). */
+const POOL_RESET_COOLDOWN_PATH = "/plugins/dsh-workbuddy-xdpool/cooldowns/reset";
+/** Plugin-owned daily check-in action endpoint (claim today's reward). */
+const POOL_CHECKIN_PATH = "/plugins/dsh-workbuddy-xdpool/checkin";
+/** Plugin-owned model-selection save endpoint (writes the settings section). */
+const POOL_MODELS_SAVE_PATH = "/plugins/dsh-workbuddy-xdpool/models/save";
+/** Switch one account in or out of the pool (card toggle). */
+const POOL_ACCOUNT_DISABLE_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/disabled";
+/**
+* Throw one account out of the pool for good, or take it back.
+*
+* Separate from the disable route because the semantics differ: disabling is a
+* rotation preference the account survives, ignoring survives the account.
+*/
+const POOL_ACCOUNT_IGNORE_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/ignored";
+/** Run one automation job immediately, so the card can verify it on demand. */
+const POOL_AUTOMATION_RUN_PATH = "/plugins/dsh-workbuddy-xdpool/automation/run";
+/** Set or clear one account's reserved-credit floor. */
+const POOL_CREDIT_RESERVE_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/credit-reserve";
+/**
+* The schedule every automation job falls back to.
+*
+* Shared by both halves on purpose. The host uses it when a configured hour
+* list arrives empty (the settings schema materializes "never configured" into
+* `[]`), and the card uses it when it writes the `automation` block back, so a
+* document that already holds an empty list is healed instead of being saved
+* back as an unrunnable schedule.
+*
+* This lives here rather than in `scheduler.ts` because the browser half cannot
+* import the host module: `scheduler.ts` pulls in `node:crypto` and the whole
+* upstream client, none of which exists in the browser bundle. Two hand-written
+* copies would drift, and the drift is invisible — the card would write a
+* schedule the scheduler does not run.
+*/
+const DEFAULT_AUTOMATION_HOURS = {
+	checkin: [9],
+	report: [10],
+	tasks: [11],
+	streak: [12],
+	travel: [9, 21]
+};
 /** How often the loop wakes to look for a due job. */
 /**
 * How long to wait for event scoring to land before re-reading the task list.
@@ -3718,6 +3877,23 @@ function isAutomationJobKind(value) {
 	return typeof value === "string" && AUTOMATION_JOB_KINDS.includes(value);
 }
 const JOB_KINDS = AUTOMATION_JOB_KINDS;
+/**
+* Pick the hour list to run on: the configured one, or the default.
+*
+* An EMPTY list is treated as "not configured" rather than as "never run".
+* That distinction is the whole point: the settings schema materializes an
+* absent list into `[]` (a bare `z.array` with no `.default()`), so a config
+* that never mentioned the schedule arrives here looking exactly like one
+* deliberately set to nothing — and honouring the empty reading silently
+* disabled every job while the card still showed the switch as ON.
+*
+* A user who genuinely wants a job skipped can leave it out of the schedule
+* they save; they cannot express "off" with an empty array through the card
+* either way, because the card always writes a non-empty list.
+*/
+function hoursOrDefault(configured, fallback) {
+	return configured !== void 0 && configured.length > 0 ? configured : fallback;
+}
 const EMPTY_JOB_STATE = {
 	ok: 0,
 	failed: 0,
@@ -3906,11 +4082,11 @@ var WorkBuddyScheduler = class {
 			this.earningsDate = today;
 		}
 		this.enabled = options.enabled ?? false;
-		this.checkinHours = options.checkinHours ?? [9];
-		this.reportHours = options.reportHours ?? [10];
-		this.taskHours = options.taskHours ?? [11];
-		this.streakHours = options.streakHours ?? [12];
-		this.travelHours = options.travelHours ?? [9, 21];
+		this.checkinHours = hoursOrDefault(options.checkinHours, DEFAULT_AUTOMATION_HOURS.checkin);
+		this.reportHours = hoursOrDefault(options.reportHours, DEFAULT_AUTOMATION_HOURS.report);
+		this.taskHours = hoursOrDefault(options.taskHours, DEFAULT_AUTOMATION_HOURS.tasks);
+		this.streakHours = hoursOrDefault(options.streakHours, DEFAULT_AUTOMATION_HOURS.streak);
+		this.travelHours = hoursOrDefault(options.travelHours, DEFAULT_AUTOMATION_HOURS.travel);
 	}
 	/** Apply a new configuration; safe to call while running. */
 	/**
@@ -3938,11 +4114,11 @@ var WorkBuddyScheduler = class {
 	}
 	applyConfig(options) {
 		if (options.enabled !== void 0) this.enabled = options.enabled;
-		if (options.checkinHours !== void 0) this.checkinHours = options.checkinHours;
-		if (options.reportHours !== void 0) this.reportHours = options.reportHours;
-		if (options.taskHours !== void 0) this.taskHours = options.taskHours;
-		if (options.streakHours !== void 0) this.streakHours = options.streakHours;
-		if (options.travelHours !== void 0) this.travelHours = options.travelHours;
+		if (options.checkinHours !== void 0) this.checkinHours = hoursOrDefault(options.checkinHours, DEFAULT_AUTOMATION_HOURS.checkin);
+		if (options.reportHours !== void 0) this.reportHours = hoursOrDefault(options.reportHours, DEFAULT_AUTOMATION_HOURS.report);
+		if (options.taskHours !== void 0) this.taskHours = hoursOrDefault(options.taskHours, DEFAULT_AUTOMATION_HOURS.tasks);
+		if (options.streakHours !== void 0) this.streakHours = hoursOrDefault(options.streakHours, DEFAULT_AUTOMATION_HOURS.streak);
+		if (options.travelHours !== void 0) this.travelHours = hoursOrDefault(options.travelHours, DEFAULT_AUTOMATION_HOURS.travel);
 	}
 	/** Hours for one job, used by the loop and the status document. */
 	hoursOf(kind) {
@@ -3988,7 +4164,7 @@ var WorkBuddyScheduler = class {
 	async runNow(kind, force = false) {
 		const today = dayKey(this.now());
 		const state = this.states[kind];
-		if (!force && state.lastRunSlot === slotKey(this.now())) return { ...state };
+		if (!force && state.lastFiredHour === slotKey(this.now())) return { ...state };
 		this.busy = true;
 		try {
 			await this.runJob(kind, today);
@@ -4086,13 +4262,46 @@ var WorkBuddyScheduler = class {
 	* two hours still runs twice a day — but a job whose hour passed while DSH was
 	* closed runs immediately on the next tick instead of waiting for tomorrow.
 	*/
-	isDue(kind, now) {
+	/**
+	* The configured slot `kind` should consume at `now`, or undefined when none.
+	*
+	* Returns the SLOT STRING (not a boolean) because the caller must record the
+	* same value it acted on. Returning a boolean was the original bug's enabler:
+	* the tick asked "is it due", then `runJob` independently wrote "what time is
+	* it now" — and those two answers were almost never equal.
+	*
+	* CATCH-UP semantics are deliberate: a candidate fires once its hour has
+	* PASSED and its slot is still unconsumed, so a laptop that slept through
+	* 10:00 still runs the job when it wakes, on the same day.
+	*
+	* The EARLIEST unconsumed candidate wins, which is what keeps a two-hour job
+	* (`travelHours: [9, 21]`) whole: consuming the earliest due slot leaves the
+	* later one for its own hour.
+	*/
+	dueSlot(kind, now) {
 		const hours = this.hoursOf(kind);
-		if (hours.length === 0) return false;
-		const { hour } = zonedParts(now);
-		const current = Number(hour);
+		if (hours.length === 0) return void 0;
+		const current = Number(zonedParts(now).hour);
 		const today = dayKey(now);
-		return hours.some((candidate) => candidate <= current && this.states[kind].lastRunSlot !== `${today}T${String(candidate).padStart(2, "0")}`);
+		const fired = this.firedSlotsOf(kind);
+		for (const candidate of [...hours].sort((a, b) => a - b)) {
+			if (candidate > current) break;
+			const slot = `${today}T${String(candidate).padStart(2, "0")}`;
+			if (!fired.has(slot)) return slot;
+		}
+	}
+	/** Today's consumed slots for one job, as a set. */
+	firedSlotsOf(kind) {
+		const stored = this.states[kind].firedSlots;
+		if (stored === void 0) return /* @__PURE__ */ new Set();
+		const today = dayKey(this.now());
+		return new Set(stored.filter((slot) => slot.startsWith(`${today}T`)));
+	}
+	/** Record one consumed slot on a job's state. */
+	consumeSlot(kind, slot) {
+		const state = this.states[kind];
+		const today = dayKey(this.now());
+		state.firedSlots = [.../* @__PURE__ */ new Set([...this.firedSlotsOf(kind), slot])].filter((entry) => entry.startsWith(`${today}T`)).sort();
 	}
 	async tick() {
 		if (!this.enabled || this.stopped || this.busy) return;
@@ -4103,9 +4312,10 @@ var WorkBuddyScheduler = class {
 			const today = dayKey(now);
 			for (const kind of JOB_KINDS) {
 				if (this.stopped) return;
-				if (this.states[kind].lastRunSlot === slot) continue;
-				if (!this.isDue(kind, now)) continue;
-				await this.runJob(kind, today);
+				if (this.states[kind].lastFiredHour === slot) continue;
+				const consumed = this.dueSlot(kind, now);
+				if (consumed === void 0) continue;
+				await this.runJob(kind, today, consumed);
 			}
 		} catch (error) {
 			this.logger.warn?.("dsh-workbuddy-xdpool automation tick failed:", error);
@@ -4191,6 +4401,12 @@ var WorkBuddyScheduler = class {
 	/**
 	* Run one job against every eligible account and record the outcome.
 	*
+	* `consumedSlot` is the configured slot this run spends (`dueSlot`'s answer).
+	* It is passed IN rather than recomputed here so the value recorded is exactly
+	* the value the schedule decided on — the defect this replaces wrote
+	* `slotKey(now)` instead, i.e. the clock time the run finished at, which
+	* almost never equals the configured candidate the gate had compared against.
+	*
 	* The task job runs in TWO passes. The first sends the event chains that light
 	* up client-scored tasks; the second collects rewards. They are separate
 	* because scoring lands asynchronously — a chain sent and claimed within the
@@ -4198,7 +4414,7 @@ var WorkBuddyScheduler = class {
 	* while claiming wants the whole pool to have been lit up first. Splitting
 	* them costs one shared wait instead of one wait per account.
 	*/
-	async runJob(kind, today) {
+	async runJob(kind, today, consumedSlot) {
 		const accountWord = kind === "report" ? "report" : kind;
 		let ok = 0;
 		let failed = 0;
@@ -4263,7 +4479,8 @@ var WorkBuddyScheduler = class {
 			if (index < accounts.length - 1 && this.delayMs > 0 && !this.stopped) await sleep(this.delayMs);
 		}
 		const state = this.states[kind];
-		state.lastRunSlot = slotKey(this.now());
+		if (consumedSlot !== void 0) this.consumeSlot(kind, consumedSlot);
+		state.lastFiredHour = slotKey(this.now());
 		state.lastRunDate = today;
 		state.lastRunAtMs = this.now().getTime();
 		state.ok = ok;
@@ -5415,36 +5632,6 @@ function formatRates(status) {
 	return lines.join("\n");
 }
 //#endregion
-//#region src/status-paths.ts
-/**
-* Node-free constants and types shared by the Host and browser halves of the
-* WorkBuddy XD Pool settings card.
-*
-* Pool's runtime state already lives in `src/status.ts` (`buildStatus` /
-* `WorkBuddyStatus`); this module only carves the cross-domain (Host→browser)
-* JSON document into a shape that stays token-free and matches what the
-* browser card renders. Route paths are plugin-owned and mounted on the Host's
-* same-origin web server (see `src/web-status.ts`).
-*
-* @module dsh-workbuddy-xdpool/status-paths
-*/
-/** Plugin-owned read-only pool status endpoint (account rows + models + shim). */
-const POOL_STATUS_PATH = "/plugins/dsh-workbuddy-xdpool/status";
-/** Plugin-owned local account rescan endpoint (re-read desktop snapshots). */
-const POOL_RESCAN_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/rescan";
-/** Plugin-owned cooldown reset endpoint (clear all 429 cooldowns). */
-const POOL_RESET_COOLDOWN_PATH = "/plugins/dsh-workbuddy-xdpool/cooldowns/reset";
-/** Plugin-owned daily check-in action endpoint (claim today's reward). */
-const POOL_CHECKIN_PATH = "/plugins/dsh-workbuddy-xdpool/checkin";
-/** Plugin-owned model-selection save endpoint (writes the settings section). */
-const POOL_MODELS_SAVE_PATH = "/plugins/dsh-workbuddy-xdpool/models/save";
-/** Switch one account in or out of the pool (card toggle). */
-const POOL_ACCOUNT_DISABLE_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/disabled";
-/** Run one automation job immediately, so the card can verify it on demand. */
-const POOL_AUTOMATION_RUN_PATH = "/plugins/dsh-workbuddy-xdpool/automation/run";
-/** Set or clear one account's reserved-credit floor. */
-const POOL_CREDIT_RESERVE_PATH = "/plugins/dsh-workbuddy-xdpool/accounts/credit-reserve";
-//#endregion
 //#region src/web-status.ts
 /** Redact token-like content before it crosses to the browser. */
 /**
@@ -5569,6 +5756,27 @@ function parseAccountToggle(body, known) {
 	};
 }
 /**
+* Validate an ignore/unignore request.
+*
+* Two different notions of "known" apply, which is why the caller passes both:
+*
+* - ignoring requires the account to be IN THE POOL, because the card can only
+*   name an account it was just shown;
+* - un-ignoring requires the account to be ON THE IGNORE LIST instead — by
+*   definition it is not in the pool any more, so checking the pool would make
+*   the undo button impossible to use.
+*/
+function parseAccountIgnore(body, knownInPool, knownIgnored) {
+	const accountId = typeof body["accountId"] === "string" ? body["accountId"].trim() : "";
+	const ignored = body["ignored"];
+	if (accountId === "" || typeof ignored !== "boolean") return void 0;
+	if (ignored ? !knownInPool(accountId) : !knownIgnored(accountId)) return void 0;
+	return {
+		accountId,
+		ignored
+	};
+}
+/**
 * Parse a manual-run request.
 *
 * The job name is checked against the real job list rather than passed through:
@@ -5740,7 +5948,8 @@ async function poolWebStatus(deps, region = "cn") {
 		regions,
 		shim,
 		automation,
-		creditReserves: deps.pool.creditReservesInOrder()
+		creditReserves: deps.pool.creditReservesInOrder(),
+		ignored: deps.ignoredAccounts?.() ?? []
 	};
 }
 /**
@@ -5864,6 +6073,42 @@ function registerPoolStatusRoute(ctx, deps) {
 			}
 		});
 		/**
+		* Throw one account out of the pool for good, or take it back.
+		*
+		* Same three guards as the disable route — POST only, loopback origin only,
+		* and an explicit `accountId` — plus the semantic split in
+		* {@link parseAccountIgnore}: ignoring checks the pool, un-ignoring checks
+		* the ignore list.
+		*
+		* The credential FILE is deliberately left alone. Deleting it would sign the
+		* desktop app out (the live file IS the app's current session) and would not
+		* even stick, since the app rewrites it on the next sign-in. Ignoring is
+		* enforced on the read side instead, which is both reversible and durable.
+		*/
+		const disposeAccountIgnore = ctx.webServer.register({
+			kind: "exact",
+			path: POOL_ACCOUNT_IGNORE_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "POST") return json(res, 405, { error: "method not allowed" });
+				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
+				if (deps.setAccountIgnored === void 0) return json(res, 503, { error: "settings service unavailable; the ignore list cannot be saved" });
+				try {
+					const body = await readJsonBody(req);
+					const knownInPool = new Set(deps.pool.list().map((account) => account.id));
+					const knownIgnored = new Set((deps.ignoredAccounts?.() ?? []).map((entry) => entry.id));
+					const parsed = parseAccountIgnore(body, (id) => knownInPool.has(id), (id) => knownIgnored.has(id));
+					if (parsed === void 0) return json(res, 400, { error: "invalid account ignore payload" });
+					await deps.setAccountIgnored(parsed.accountId, parsed.ignored);
+					json(res, 200, {
+						ok: true,
+						...parsed
+					});
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
+		/**
 		* Run one automation job on demand.
 		*
 		* POST only, loopback origin only, and the job name must be one of the four
@@ -5923,6 +6168,7 @@ function registerPoolStatusRoute(ctx, deps) {
 		return () => {
 			disposeAutomationRun();
 			disposeCreditReserve();
+			disposeAccountIgnore();
 			disposeCheckin();
 			disposeAccountDisable();
 			disposeModelsSave();
@@ -5933,6 +6179,153 @@ function registerPoolStatusRoute(ctx, deps) {
 	}, "dsh-workbuddy-xdpool: Web status route");
 }
 //#endregion
+//#region src/ignored.ts
+/**
+* The permanent ignore list: accounts the user has thrown out of the pool.
+*
+* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
+* account stays on the card, can be switched back on, and its credential keeps
+* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
+* one is not mine any more" — so an ignored account is skipped BEFORE its
+* credential is decrypted, never appears among the pool's accounts, and does not
+* come back when the desktop app writes a fresh `.info` file for it.
+*
+* It lives in a plugin-owned file rather than in the settings document for one
+* practical reason: the CLI has no settings service. `dsh-workbuddy-xdpool
+* ignore <id>` runs without a host, so a settings-only list could be written by
+* the card and never by the CLI. One file, read by both halves, keeps the two
+* views of "which accounts are ignored" identical by construction.
+*
+* @module dsh-workbuddy-xdpool/ignored
+*/
+/** Directory holding this plugin's own state (imported snapshots, ignore list). */
+const PLUGIN_DATA_DIR_NAME = ".workbuddy-xdpool";
+/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
+const IGNORED_FILE_NAME = "ignored.json";
+/**
+* The DSH home directory, honouring the same override the host uses.
+*
+* Shared by the CLI and the host so both halves resolve the same file: an
+* `ignore` written from the terminal has to be visible to the running plugin,
+* which is only true if they agree on where "home" is.
+*/
+function dshHome(env = process.env) {
+	const fromEnv = env["DSH_HOME"];
+	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
+	return join(homedir(), ".dsh");
+}
+/** This plugin's own state directory. */
+function pluginDataDir(env = process.env) {
+	return join(dshHome(env), PLUGIN_DATA_DIR_NAME);
+}
+/** Absolute path of the ignore list. */
+function ignoredIdsPath(env = process.env) {
+	return join(pluginDataDir(env), IGNORED_FILE_NAME);
+}
+/**
+* Normalize whatever the file holds into a clean list.
+*
+* Tolerant on purpose: this file is hand-editable and a malformed entry must not
+* take the pool down. An entry without a usable id is dropped; a missing label
+* falls back to the id so the card always has something to print.
+*/
+function normalize(raw) {
+	if (typeof raw !== "object" || raw === null) return [];
+	const entries = raw.accounts;
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
+		if (id === "" || seen.has(id)) continue;
+		seen.add(id);
+		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
+		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
+		out.push({
+			id,
+			label,
+			ignoredAt
+		});
+	}
+	return out;
+}
+/**
+* Read the ignore list, tolerating every "no list yet" shape.
+*
+* A missing file, unreadable file, or invalid JSON all mean the same thing to
+* the caller — nothing is ignored — so none of them throws. The pool must be
+* able to start on a machine that has never ignored anything.
+*/
+async function readIgnoredAccounts(path = ignoredIdsPath()) {
+	try {
+		return normalize(JSON.parse(await readFile(path, "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* Synchronous read, for startup.
+*
+* The host applies the ignore list from inside `apply()`, which is synchronous,
+* and doing it there removes a startup race: an async load could resolve AFTER
+* the first account scan, which would let an ignored account slip into the pool
+* once per boot. The file is a few hundred bytes, so a blocking read at startup
+* costs nothing measurable.
+*/
+function readIgnoredAccountsSync(path = ignoredIdsPath()) {
+	try {
+		return normalize(JSON.parse(readFileSync(path, "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* Replace the ignore list, atomically.
+*
+* Written to a sibling temp file and renamed over the target so a crash (or a
+* concurrent reader) can never observe a half-written document — the ignore
+* list is the only thing standing between a dead account and the rotation, and
+* a truncated file reads as "nothing is ignored", which would quietly put every
+* discarded account back in the pool.
+*/
+async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
+	const payload = JSON.stringify({
+		version: 1,
+		accounts
+	}, null, 2);
+	await mkdir(dirname(path), { recursive: true });
+	const temp = `${path}.tmp`;
+	await writeFile(temp, `${payload}\n`, "utf8");
+	await rename(temp, path);
+}
+/**
+* Add one account to the ignore list, preserving the rest.
+*
+* A read-modify-write rather than a wholesale replace: the card and the CLI can
+* both be open, and each request names exactly one account, so re-writing the
+* whole list from a stale view would drop the other side's edits.
+*/
+async function ignoreAccount(account, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	if (current.some((entry) => entry.id === account.id)) return current;
+	const next = [...current, {
+		id: account.id,
+		label: account.label ?? account.id,
+		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
+	}];
+	await writeIgnoredAccounts(next, path);
+	return next;
+}
+/** Drop one account from the ignore list. Returns the resulting list. */
+async function unignoreAccount(accountId, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	const next = current.filter((entry) => entry.id !== accountId);
+	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
+	return next;
+}
+//#endregion
 //#region src/index.ts
 /**
 * Host-side plugin entry. Registers the `workbuddy-xdpool` provider into the
@@ -6135,6 +6528,14 @@ function createCore(logger) {
 */
 function apply(ctx, config = {}) {
 	const core = createCore(ctx.logger);
+	const ignoredPath = ignoredIdsPath();
+	let ignoredAccounts = readIgnoredAccountsSync(ignoredPath);
+	core.pool.applyIgnored(ignoredAccounts.map((entry) => entry.id));
+	/** Re-read the ignore file and push it into the pool. */
+	const refreshIgnored = () => {
+		ignoredAccounts = readIgnoredAccountsSync(ignoredPath);
+		core.pool.applyIgnored(ignoredAccounts.map((entry) => entry.id));
+	};
 	/**
 	* Invalidate the provider snapshot so the picker re-reads the catalog.
 	*
@@ -6183,8 +6584,11 @@ function apply(ctx, config = {}) {
 			...imageModelIds === void 0 ? {} : { imageModelIds },
 			...contextBudgets === void 0 ? {} : { contextBudgets }
 		};
-		core.catalogs.cn.applySelection(modelSelectionCn ?? legacySelection);
-		core.catalogs.global.applySelection(modelSelectionGlobal ?? legacySelection);
+		const fallbackSelection = (region) => {
+			return legacySelection.enabledModelIds === void 0 && legacySelection.imageModelIds === void 0 && legacySelection.contextBudgets === void 0 ? core.catalogs[region].currentSelection() : legacySelection;
+		};
+		core.catalogs.cn.applySelection(modelSelectionCn ?? fallbackSelection("cn"));
+		core.catalogs.global.applySelection(modelSelectionGlobal ?? fallbackSelection("global"));
 		core.scheduler.applyConfig(automationOptions(automation));
 	};
 	const settingsService = ctx.settings;
@@ -6194,6 +6598,7 @@ function apply(ctx, config = {}) {
 	ctx.on("loader/volatile-update", () => {
 		applyConfigFromSource();
 	});
+	applyConfigFromSource();
 	/**
 	* Write one key of the plugin's own settings section. Only ever called with
 	* the three model-selection keys, so the settings file cannot be steered from
@@ -6324,7 +6729,19 @@ function apply(ctx, config = {}) {
 			if (reserve > 0) next[accountId] = reserve;
 			else delete next[accountId];
 			await setSetting("creditReserves", next, next);
-		}
+		},
+		setAccountIgnored: async (accountId, ignored) => {
+			if (ignored) {
+				const known = core.pool.list().find((account) => account.id === accountId);
+				await ignoreAccount({
+					id: accountId,
+					...known === void 0 ? {} : { label: known.label }
+				}, ignoredPath);
+			} else await unignoreAccount(accountId, ignoredPath);
+			refreshIgnored();
+			if (!ignored) await core.pool.scan();
+		},
+		ignoredAccounts: () => ignoredAccounts
 	}));
 	api = {
 		...core,
@@ -6457,4 +6874,4 @@ function apply(ctx, config = {}) {
 	});
 }
 //#endregion
-export { APPEARANCE_THEME_KEY, AUTOMATION_JOB_KINDS, AUTOMATION_TICK_MS, BUDDY_APP_ID, BUDDY_APP_NAME, Config, DEFAULT_CONTEXT_BUDGET, EVENT_SCORE_WAIT_MS, FALLBACK_WORKBUDDY_MODELS, LIBRARY_DOC_URL, LIGHTHOUSE_EXPERT_ID, PLAYBOOK_CASE_ID, PLAYBOOK_CASE_NAME, POOL_AUTOMATION_RUN_PATH, POOL_CHECKIN_PATH, POOL_CREDIT_RESERVE_PATH, POOL_MODELS_SAVE_PATH, POOL_RESCAN_PATH, POOL_RESET_COOLDOWN_PATH, POOL_STATUS_PATH, SKILL_ID, SKILL_NAME, TEMPLATE_PRESETS, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_LIVE_FILENAME, WORKBUDDY_POOL_PROVIDER, WORKBUDDY_POOL_SETTINGS_NS, WorkBuddyAccountPool, WorkBuddyCatalog, WorkBuddyScheduler, WorkBuddyUpstreamClient, appearanceChain, apply, automationChain, automationOptions, buddyAppChain, buddyAppEvents, buildStatus, candidateAuthDirs, canvasChain, chatChain, classifyUpstreamError, createCore, createWorkBuddyAdapter, createWorkBuddyShim, currentApi, dayKey, defaultDesktopAuthDirs, desktopAutomationCreatedEvent, desktopCanvasEvents, desktopChatEvents, expertActualUseEvent, expertChatEvents, expertSummonEvents, formatRates, formatStatus, inject, isAutomationJobKind, isFireHour, libraryReadChain, modelSelectionKeyFor, name, parseRateLimitReset, parseWorkBuddyAuth, playbookChain, poolWebStatus, registerPoolStatusRoute, setApi, skillChain, templateChain, templateChains, workbuddyAccountId };
+export { APPEARANCE_THEME_KEY, AUTOMATION_JOB_KINDS, AUTOMATION_TICK_MS, BUDDY_APP_ID, BUDDY_APP_NAME, Config, DEFAULT_AUTOMATION_HOURS, DEFAULT_CONTEXT_BUDGET, EVENT_SCORE_WAIT_MS, FALLBACK_WORKBUDDY_MODELS, IGNORED_FILE_NAME, LIBRARY_DOC_URL, LIGHTHOUSE_EXPERT_ID, PLAYBOOK_CASE_ID, PLAYBOOK_CASE_NAME, PLUGIN_DATA_DIR_NAME, POOL_ACCOUNT_IGNORE_PATH, POOL_AUTOMATION_RUN_PATH, POOL_CHECKIN_PATH, POOL_CREDIT_RESERVE_PATH, POOL_MODELS_SAVE_PATH, POOL_RESCAN_PATH, POOL_RESET_COOLDOWN_PATH, POOL_STATUS_PATH, SKILL_ID, SKILL_NAME, TEMPLATE_PRESETS, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_LIVE_FILENAME, WORKBUDDY_POOL_PROVIDER, WORKBUDDY_POOL_SETTINGS_NS, WorkBuddyAccountPool, WorkBuddyCatalog, WorkBuddyScheduler, WorkBuddyUpstreamClient, appearanceChain, apply, automationChain, automationOptions, buddyAppChain, buddyAppEvents, buildStatus, candidateAuthDirs, canvasChain, chatChain, classifyUpstreamError, createCore, createWorkBuddyAdapter, createWorkBuddyShim, currentApi, dayKey, defaultDesktopAuthDirs, desktopAutomationCreatedEvent, desktopCanvasEvents, desktopChatEvents, dshHome, expertActualUseEvent, expertChatEvents, expertSummonEvents, formatRates, formatStatus, ignoreAccount, ignoredIdsPath, inject, isAutomationJobKind, isFireHour, libraryReadChain, modelSelectionKeyFor, name, parseRateLimitReset, parseWorkBuddyAuth, playbookChain, pluginDataDir, poolWebStatus, readIgnoredAccounts, readIgnoredAccountsSync, registerPoolStatusRoute, setApi, skillChain, templateChain, templateChains, unignoreAccount, workbuddyAccountId, writeIgnoredAccounts };