dsh-xdpool 2.1.0 → 2.2.0

package/lib/bin.js

@@ -224,6 +224,34 @@ function chatHeaders(credential) {
 		"X-Product": "SaaS"
 	};
 }
+/**
+* The client-identity headers the desktop app puts on every chat completion.
+*
+* WHY THESE EXIST AND WHY THEY BELONG ON /v2/chat/completions ONLY
+*
+* The gateway attributes each request to a client, and that attribution is what
+* surfaces in the user's billing console as the "使用端" column. The desktop app
+* (`buildVlmGatewayHeaders` in its bundled `main/server.js`) sends
+* `X-IDE-Type`/`X-IDE-Name`/`X-IDE-Version` on every `/v2/chat/completions`, so
+* its traffic reads as "WorkBuddy". Our chat requests sent none of them, so the
+* same spend attributed to nothing — the column showed "–" and the user's
+* billing page looked like the requests had come from nowhere.
+*
+* They are deliberately NOT part of `chatHeaders()`, which is shared with the
+* points-automation endpoints (`listTasks` / `acceptTasks`). Those are not chat
+* completions, and the evidence for the desktop app sending identity headers on
+* them is nil — adding identity headers to an endpoint that never carried them
+* risks changing how that traffic is attributed or filtered, and the automation
+* was never reported broken. Only the two chat completions get these.
+*
+* The version is the same literal `openConversation()` already sends, so both
+* chat paths — the pool's and the automation's — claim the same client.
+*/
+const CHAT_IDENTITY_HEADERS = Object.freeze({
+	"X-IDE-Name": "WorkBuddy",
+	"X-IDE-Type": "WorkBuddy",
+	"X-IDE-Version": "5.5.6"
+});
 /** Refresh-endpoint headers; X-Refresh-Token appears here and nowhere else. */
 function refreshHeaders(credential) {
 	const headers = {
@@ -819,7 +847,10 @@ var WorkBuddyUpstreamClient = class {
 	async completeChat(credential, prepared, signal) {
 		const response = await this.fetchImpl(`${chatBase(credential)}/v2/chat/completions`, {
 			method: "POST",
-			headers: chatHeaders(credential),
+			headers: {
+				...chatHeaders(credential),
+				...CHAT_IDENTITY_HEADERS
+			},
 			body: prepared,
 			...signal === void 0 ? {} : { signal }
 		});
@@ -836,7 +867,10 @@ var WorkBuddyUpstreamClient = class {
 		try {
 			response = await this.fetchImpl(`${chatBase(credential)}/v2/chat/completions`, {
 				method: "POST",
-				headers: chatHeaders(credential),
+				headers: {
+					...chatHeaders(credential),
+					...CHAT_IDENTITY_HEADERS
+				},
 				body: prepared,
 				...signal === void 0 ? {} : { signal }
 			});
@@ -1316,15 +1350,13 @@ var WorkBuddyUpstreamClient = class {
 				method: "POST",
 				headers: {
 					...chatHeaders(credential),
+					...CHAT_IDENTITY_HEADERS,
 					"Accept": "text/event-stream",
 					"User-Agent": DESKTOP_TASK_UA,
 					"X-Conversation-ID": conversationId,
 					"X-Request-ID": String(Date.now()) + "000000",
 					"X-Agent-Intent": "craft",
 					"X-Agent-Type": "main",
-					"X-IDE-Name": "WorkBuddy",
-					"X-IDE-Type": "WorkBuddy",
-					"X-IDE-Version": "5.5.6",
 					"x-codebuddy-request": "1",
 					...expertId === "" ? {} : { "X-Expert-Id": expertId }
 				},
@@ -1699,6 +1731,240 @@ var WorkBuddyUpstreamClient = class {
 	}
 };
 //#endregion
+//#region src/ignored.ts
+/**
+* The permanent ignore list: accounts the user has thrown out of the pool.
+*
+* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
+* account stays on the card, can be switched back on, and its credential keeps
+* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
+* one is not mine any more" — so an ignored account is skipped BEFORE its
+* credential is decrypted, never appears among the pool's accounts, and does not
+* come back when the desktop app writes a fresh `.info` file for it.
+*
+* It lives in a plugin-owned file rather than in the settings document for one
+* practical reason: the CLI has no settings service. `dsh-xdpool
+* ignore <id>` runs without a host, so a settings-only list could be written by
+* the card and never by the CLI. One file, read by both halves, keeps the two
+* views of "which accounts are ignored" identical by construction.
+*
+* @module dsh-xdpool/ignored
+*/
+/** Directory holding this plugin's own state (imported snapshots, ignore list). */
+const PLUGIN_DATA_DIR_NAME = ".xdpool";
+/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
+const IGNORED_FILE_NAME = "ignored.json";
+/**
+* The DSH home directory, honouring the same override the host uses.
+*
+* Shared by the CLI and the host so both halves resolve the same file: an
+* `ignore` written from the terminal has to be visible to the running plugin,
+* which is only true if they agree on where "home" is.
+*/
+function dshHome$1(env = process.env) {
+	const fromEnv = env["DSH_HOME"];
+	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
+	return join(homedir(), ".dsh");
+}
+/** This plugin's own state directory. */
+function pluginDataDir(env = process.env) {
+	return join(dshHome$1(env), PLUGIN_DATA_DIR_NAME);
+}
+/** Absolute path of the ignore list. */
+function ignoredIdsPath(env = process.env) {
+	return join(pluginDataDir(env), IGNORED_FILE_NAME);
+}
+/**
+* Normalize whatever the file holds into a clean list.
+*
+* Tolerant on purpose: this file is hand-editable and a malformed entry must not
+* take the pool down. An entry without a usable id is dropped; a missing label
+* falls back to the id so the card always has something to print.
+*/
+function normalize$1(raw) {
+	if (typeof raw !== "object" || raw === null) return [];
+	const entries = raw.accounts;
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
+		if (id === "" || seen.has(id)) continue;
+		seen.add(id);
+		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
+		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
+		out.push({
+			id,
+			label,
+			ignoredAt
+		});
+	}
+	return out;
+}
+/**
+* Read the ignore list, tolerating every "no list yet" shape.
+*
+* A missing file, unreadable file, or invalid JSON all mean the same thing to
+* the caller — nothing is ignored — so none of them throws. The pool must be
+* able to start on a machine that has never ignored anything.
+*/
+async function readIgnoredAccounts(path = ignoredIdsPath()) {
+	try {
+		return normalize$1(JSON.parse(await readFile(path, "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* Replace the ignore list, atomically.
+*
+* Written to a sibling temp file and renamed over the target so a crash (or a
+* concurrent reader) can never observe a half-written document — the ignore
+* list is the only thing standing between a dead account and the rotation, and
+* a truncated file reads as "nothing is ignored", which would quietly put every
+* discarded account back in the pool.
+*/
+async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
+	const payload = JSON.stringify({
+		version: 1,
+		accounts
+	}, null, 2);
+	await mkdir(dirname(path), { recursive: true });
+	const temp = `${path}.tmp`;
+	await writeFile$1(temp, `${payload}\n`, "utf8");
+	await rename(temp, path);
+}
+/**
+* Add one account to the ignore list, preserving the rest.
+*
+* A read-modify-write rather than a wholesale replace: the card and the CLI can
+* both be open, and each request names exactly one account, so re-writing the
+* whole list from a stale view would drop the other side's edits.
+*/
+async function ignoreAccount(account, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	if (current.some((entry) => entry.id === account.id)) return current;
+	const next = [...current, {
+		id: account.id,
+		label: account.label ?? account.id,
+		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
+	}];
+	await writeIgnoredAccounts(next, path);
+	return next;
+}
+/** Drop one account from the ignore list. Returns the resulting list. */
+async function unignoreAccount(accountId, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	const next = current.filter((entry) => entry.id !== accountId);
+	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
+	return next;
+}
+//#endregion
+//#region src/account-store.ts
+/**
+* Durable copy of the discovered accounts, inside the plugin's data directory.
+*
+* The pool's account list is otherwise pure memory: the desktop app keeps only
+* the CURRENT sign-in on disk (each login overwrites the one auth file), so
+* accounts gathered by switching sign-ins evaporated on every restart. This
+* store is the fix — `scan()` seeds from it and writes the merged list back, so
+* the pool now survives restarts.
+*
+* JSON only, atomic rename on write: a crash mid-write leaves the previous
+* generation intact, and the pool never reads a half-written account again.
+*
+* @module dsh-xdpool/account-store
+*/
+/** File name of the durable account list, inside the plugin data directory. */
+const ACCOUNTS_FILE_NAME = "accounts.json";
+/**
+* State files that live in the same directory but are NOT account snapshots.
+*
+* The snapshot importer (`dsh-xdpool import <key>`) writes `<md5prefix>.json`
+* into this directory, and the pool scans it — so every other `.json` file here
+* is treated as an imported snapshot. These three are the plugin's own
+* bookkeeping and must never be parsed as credentials.
+*/
+const NON_SNAPSHOT_FILES = [
+	ACCOUNTS_FILE_NAME,
+	"ignored.json",
+	"preferred.json"
+];
+/** Absolute path of the durable account list. */
+function accountStorePath(env = process.env) {
+	return join(dshHome$1(env), PLUGIN_DATA_DIR_NAME, ACCOUNTS_FILE_NAME);
+}
+/** The directory the pool scans for imported `<md5prefix>.json` snapshots. */
+function snapshotDirPath(env = process.env) {
+	return join(dshHome$1(env), PLUGIN_DATA_DIR_NAME);
+}
+/**
+* True when a file name in the snapshot directory is plugin bookkeeping rather
+* than an imported snapshot.
+*/
+function isStateFile(name) {
+	return NON_SNAPSHOT_FILES.includes(name);
+}
+/** True when a value has the shape of a stored account. */
+function isStoredAccount(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	const credential = record["credential"];
+	return typeof record["id"] === "string" && typeof record["label"] === "string" && typeof credential === "object" && credential !== null && typeof credential["accessToken"] === "string" && typeof credential["refreshToken"] === "string";
+}
+/**
+* Read the durable list. Tolerant on purpose: a malformed or half-written file
+* yields `[]` and the pool simply rediscovers from disk, rather than a corrupt
+* store taking the whole pool down.
+*/
+async function loadStoredAccounts(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return [];
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return [];
+	}
+	const entries = parsed?.["accounts"];
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (!isStoredAccount(entry)) continue;
+		if (seen.has(entry.id)) continue;
+		seen.add(entry.id);
+		out.push(entry);
+	}
+	return out;
+}
+/**
+* Atomically write the durable list: `${path}.tmp` first, then rename. A crash
+* mid-write leaves the previous generation intact.
+*/
+async function saveStoredAccounts(path, accounts) {
+	const stored = accounts.map((account) => ({
+		id: account.id,
+		label: account.label,
+		credential: account.credential,
+		savedAtMs: Date.now()
+	}));
+	const document = JSON.stringify({
+		version: 1,
+		accounts: stored
+	}, null, 2) + "\n";
+	await mkdir(join(path, ".."), { recursive: true });
+	const tmp = `${path}.tmp`;
+	await writeFile$1(tmp, document, "utf8");
+	await rename(tmp, path);
+}
+//#endregion
 //#region src/at-rest.ts
 /**
 * WorkBuddy desktop "at-rest" credential decryption.
@@ -2547,6 +2813,23 @@ async function authFilesIn(dir) {
 	return files.map((name) => join(dir, name));
 }
 /**
+* Snapshot files in the plugin data directory that are account snapshots.
+*
+* Every `*.info` file there is one (the importer keeps that extension for
+* uniformity with the auth dirs it copies from); the plugin's own JSON state
+* files (`accounts.json`, `ignored.json`, `preferred.json`) are NOT and must
+* never reach the credential parser.
+*/
+async function snapshotFilesIn(dir) {
+	let entries;
+	try {
+		entries = await readdir(dir);
+	} catch {
+		return [];
+	}
+	return entries.filter((name) => name.endsWith(".info")).filter((name) => !isStateFile(name)).sort((a, b) => a < b ? 1 : a > b ? -1 : 0).map((name) => join(dir, name));
+}
+/**
 * One credential file, or undefined when it cannot be used.
 *
 * Returns undefined — rather than throwing — for every failure mode, so ONE bad
@@ -2825,6 +3108,18 @@ var WorkBuddyAccountPool = class {
 	*/
 	lastUsedAt = /* @__PURE__ */ new Map();
 	refreshInflight = /* @__PURE__ */ new Map();
+	/**
+	* Whether `scan()` seeds from and writes back the durable account store.
+	*
+	* Off by default (tests build fixtures over temp dirs and must not touch the
+	* user's real store); `createCore()` turns it on for production, which is
+	* what makes accounts gathered by switching desktop sign-ins survive a
+	* restart — the desktop app keeps only the current sign-in's credential file
+	* on disk.
+	*/
+	persistent;
+	/** Path of the durable store; computed once so tests can pin it. */
+	storePath;
 	constructor(options = {}) {
 		this.logger = options.logger;
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
@@ -2834,6 +3129,8 @@ var WorkBuddyAccountPool = class {
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.distribution = options.distribution ?? "priority";
+		this.persistent = options.persistent ?? false;
+		this.storePath = accountStorePath();
 	}
 	/**
 	* Re-apply configuration that only affects discovery and cooldown policy,
@@ -2883,26 +3180,44 @@ var WorkBuddyAccountPool = class {
 	async scan() {
 		const found = [];
 		const skipped = [];
-		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
-			if (this.ignoredIds.size > 0) {
-				const cheapId = await cheapIdentityIdFromFile(file);
-				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
-			}
-			const credential = await readCredential(file);
-			if (credential === void 0) {
-				skipped.push({
-					path: file,
-					reason: await skipReasonFor(file)
-				});
-				continue;
+		const scanDirs = this.persistent ? [...this.authDirs, snapshotDirPath()] : this.authDirs;
+		for (const dir of scanDirs) {
+			const files = dir === snapshotDirPath() ? await snapshotFilesIn(dir) : await authFilesIn(dir);
+			for (const file of files) {
+				if (this.ignoredIds.size > 0) {
+					const cheapId = await cheapIdentityIdFromFile(file);
+					if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
+				}
+				const credential = await readCredential(file);
+				if (credential === void 0) {
+					skipped.push({
+						path: file,
+						reason: await skipReasonFor(file)
+					});
+					continue;
+				}
+				if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
+				found.push(credential);
 			}
-			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
-			found.push(credential);
 		}
 		this.skippedFiles = skipped;
 		if (skipped.length > 0) this.logger?.warn?.(`dsh-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
+		if (this.persistent && this.accounts.length === 0) {
+			const stored = await loadStoredAccounts(this.storePath);
+			for (const entry of stored) {
+				if (byId.has(entry.id)) continue;
+				byId.set(entry.id, {
+					id: entry.id,
+					label: entry.label,
+					credential: entry.credential,
+					cooldownUntilMs: 0,
+					modelCooldowns: {},
+					rateLimitHits: 0
+				});
+			}
+		}
 		for (const credential of found) {
 			const id = workbuddyAccountId(credential);
 			const existing = byId.get(id);
@@ -2931,6 +3246,11 @@ var WorkBuddyAccountPool = class {
 		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
 		this.accounts = ordered;
 		this.lastScanAtMs = Date.now();
+		if (this.persistent) try {
+			await saveStoredAccounts(this.storePath, this.accounts);
+		} catch (error) {
+			this.logger?.warn?.("dsh-xdpool: could not persist the account store", error);
+		}
 		return this.accounts;
 	}
 	/** All accounts, cooldown state included. */
@@ -10306,137 +10626,6 @@ function formatRates(status) {
 	}
 	return lines.join("\n");
 }
-//#endregion
-//#region src/ignored.ts
-/**
-* The permanent ignore list: accounts the user has thrown out of the pool.
-*
-* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
-* account stays on the card, can be switched back on, and its credential keeps
-* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
-* one is not mine any more" — so an ignored account is skipped BEFORE its
-* credential is decrypted, never appears among the pool's accounts, and does not
-* come back when the desktop app writes a fresh `.info` file for it.
-*
-* It lives in a plugin-owned file rather than in the settings document for one
-* practical reason: the CLI has no settings service. `dsh-xdpool
-* ignore <id>` runs without a host, so a settings-only list could be written by
-* the card and never by the CLI. One file, read by both halves, keeps the two
-* views of "which accounts are ignored" identical by construction.
-*
-* @module dsh-xdpool/ignored
-*/
-/** Directory holding this plugin's own state (imported snapshots, ignore list). */
-const PLUGIN_DATA_DIR_NAME = ".xdpool";
-/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
-const IGNORED_FILE_NAME = "ignored.json";
-/**
-* The DSH home directory, honouring the same override the host uses.
-*
-* Shared by the CLI and the host so both halves resolve the same file: an
-* `ignore` written from the terminal has to be visible to the running plugin,
-* which is only true if they agree on where "home" is.
-*/
-function dshHome$1(env = process.env) {
-	const fromEnv = env["DSH_HOME"];
-	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
-	return join(homedir(), ".dsh");
-}
-/** This plugin's own state directory. */
-function pluginDataDir(env = process.env) {
-	return join(dshHome$1(env), PLUGIN_DATA_DIR_NAME);
-}
-/** Absolute path of the ignore list. */
-function ignoredIdsPath(env = process.env) {
-	return join(pluginDataDir(env), IGNORED_FILE_NAME);
-}
-/**
-* Normalize whatever the file holds into a clean list.
-*
-* Tolerant on purpose: this file is hand-editable and a malformed entry must not
-* take the pool down. An entry without a usable id is dropped; a missing label
-* falls back to the id so the card always has something to print.
-*/
-function normalize$1(raw) {
-	if (typeof raw !== "object" || raw === null) return [];
-	const entries = raw.accounts;
-	if (!Array.isArray(entries)) return [];
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of entries) {
-		if (typeof entry !== "object" || entry === null) continue;
-		const record = entry;
-		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
-		if (id === "" || seen.has(id)) continue;
-		seen.add(id);
-		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
-		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
-		out.push({
-			id,
-			label,
-			ignoredAt
-		});
-	}
-	return out;
-}
-/**
-* Read the ignore list, tolerating every "no list yet" shape.
-*
-* A missing file, unreadable file, or invalid JSON all mean the same thing to
-* the caller — nothing is ignored — so none of them throws. The pool must be
-* able to start on a machine that has never ignored anything.
-*/
-async function readIgnoredAccounts(path = ignoredIdsPath()) {
-	try {
-		return normalize$1(JSON.parse(await readFile(path, "utf8")));
-	} catch {
-		return [];
-	}
-}
-/**
-* Replace the ignore list, atomically.
-*
-* Written to a sibling temp file and renamed over the target so a crash (or a
-* concurrent reader) can never observe a half-written document — the ignore
-* list is the only thing standing between a dead account and the rotation, and
-* a truncated file reads as "nothing is ignored", which would quietly put every
-* discarded account back in the pool.
-*/
-async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
-	const payload = JSON.stringify({
-		version: 1,
-		accounts
-	}, null, 2);
-	await mkdir(dirname(path), { recursive: true });
-	const temp = `${path}.tmp`;
-	await writeFile$1(temp, `${payload}\n`, "utf8");
-	await rename(temp, path);
-}
-/**
-* Add one account to the ignore list, preserving the rest.
-*
-* A read-modify-write rather than a wholesale replace: the card and the CLI can
-* both be open, and each request names exactly one account, so re-writing the
-* whole list from a stale view would drop the other side's edits.
-*/
-async function ignoreAccount(account, path = ignoredIdsPath()) {
-	const current = await readIgnoredAccounts(path);
-	if (current.some((entry) => entry.id === account.id)) return current;
-	const next = [...current, {
-		id: account.id,
-		label: account.label ?? account.id,
-		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
-	}];
-	await writeIgnoredAccounts(next, path);
-	return next;
-}
-/** Drop one account from the ignore list. Returns the resulting list. */
-async function unignoreAccount(accountId, path = ignoredIdsPath()) {
-	const current = await readIgnoredAccounts(path);
-	const next = current.filter((entry) => entry.id !== accountId);
-	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
-	return next;
-}
 Object.freeze({
 	"workbuddy-xdpool": "xdpool",
 	"workbuddy-xdpool-global": "xdpool-global",
@@ -10615,7 +10804,8 @@ function createCore(logger) {
 	const client = new WorkBuddyUpstreamClient();
 	const pool = new WorkBuddyAccountPool({
 		...logger === void 0 ? {} : { logger },
-		client
+		client,
+		persistent: true
 	});
 	return {
 		pool,
@@ -10634,6 +10824,11 @@ function createCore(logger) {
 *
 *   dsh plugin --profile desktop exec dsh-xdpool <command>
 *
+* The CLI is packaged as a separate entry (`lib/bin.js`) and must stay free of
+* host-injected optional-peer imports: it runs standalone, before any argument
+* is parsed, so a single side-effect import of `@earendil-works/pi-ai` made
+* every command die with ERR_MODULE_NOT_FOUND.
+*
 * @module dsh-xdpool/bin
 */
 /** Directory holding imported account snapshots. */
@@ -10654,7 +10849,7 @@ async function cliCore() {
 }
 /** Snapshot files are named by the md5 prefix of their key, so any key is safe. */
 function snapshotPath(key, dir) {
-	return join(dir, `${createHash("md5").update(key).digest("hex").slice(0, 8)}.json`);
+	return join(dir, `${createHash("md5").update(key).digest("hex").slice(0, 8)}.info`);
 }
 function dshHome() {
 	const fromEnv = process.env["DSH_HOME"];

package/lib/client.js

@@ -445,7 +445,6 @@ window.__ModuleLoader__.load({
    sharing a line with a total. */
 .dsm-xdpool-packages li{display:inline-flex;align-items:baseline;gap:5px;min-width:0;padding:1px 8px;border-radius:999px;border:1px solid var(--dsw-alias-border-l1,#2f3035);background:color-mix(in srgb, var(--dsw-alias-bg-layer-1,#191a1e) 62%, transparent);color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:11px;line-height:17px}
 .dsm-xdpool-packages-name{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
-.dsm-xdpool-packages-value{color:var(--dsw-alias-label-tertiary,#999);font-variant-numeric:tabular-nums}
 /* Per-package deadline: the upstream grants one-off packs at arbitrary clock
    times, so each pack carries its own timestamp. It sits inside its own chip on
    its own line — a pack name plus two timestamps did not fit on one line, and
@@ -453,8 +452,17 @@ window.__ModuleLoader__.load({
 .dsm-xdpool-packages-when{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:10.5px;line-height:15px;font-variant-numeric:tabular-nums}
 .dsm-xdpool-packages-when-soon{color:var(--dsw-alias-state-warning-primary,#d97706)}
 /* The balance. Still the most important figure on the row — colour and weight,
-   not size: at 28px it outweighed the account name it belongs to. */
-.dsm-xdpool-total-value{color:var(--dsw-alias-state-success-primary,#22a06b);font-size:16px;line-height:22px;font-weight:700;letter-spacing:-.2px;white-space:nowrap;font-variant-numeric:tabular-nums}
+   not size: at 28px it outweighed the account name it belongs to. The green is
+   pinned rather than taken from the theme alias: at 16px/700 the alias green
+   read darker than the 11px figures beside it on the same row — the same hex
+   looks dimmer in large bold type than in small text — and the user read the
+   balance as grey next to the bright green streak chips. A slightly brighter
+   literal keeps the two readings of "green" on this row identical. */
+.dsm-xdpool-total-value{color:#2fbf7f;font-size:16px;line-height:22px;font-weight:700;letter-spacing:-.2px;white-space:nowrap;font-variant-numeric:tabular-nums}
+/* Per-package figures share the balance's green: they are the same credit
+   balance broken down, and rendering them in grey made the packages look
+   spent while the total looked alive. */
+.dsm-xdpool-packages-value{color:#2fbf7f;font-variant-numeric:tabular-nums}
 /* Model directory list. */
 .dsm-xdpool-models{gap:10px}
 .dsm-xdpool-models-head{display:flex;align-items:center;justify-content:space-between;gap:12px}
@@ -5177,7 +5185,7 @@ window.__ModuleLoader__.load({
 		*
 		* @module dsh-xdpool/version
 		*/
-		const POOL_VERSION = "2.1.0";
+		const POOL_VERSION = "2.2.0";
 		//#endregion
 		//#region src/client/PoolCard.tsx
 		/**

package/lib/index.d.ts

@@ -886,6 +886,21 @@ interface AccountPoolOptions {
    *   behaves like `priority`.
    */
   distribution?: AccountDistribution;
+  /**
+   * Enable the durable account store.
+   *
+   * When on, `scan()` seeds its merge from `~/.dsh/.xdpool/accounts.json` and
+   * writes the merged list back, so accounts gathered by switching desktop
+   * sign-ins survive a restart, and the plugin's snapshot directory becomes a
+   * scan source.
+   *
+   * DEFAULT OFF, on purpose: the 70+ existing pool tests build fixtures over
+   * temp auth dirs, and a store that wrote by default would flush those
+   * fixtures into the user's real `~/.dsh/.xdpool/accounts.json`. Production
+   * assembles the pool through `createCore()`, which passes `persistent: true`;
+   * tests opt in explicitly.
+   */
+  persistent?: boolean;
 }
 export declare class WorkBuddyAccountPool {
   private readonly logger;
@@ -1001,6 +1016,18 @@ export declare class WorkBuddyAccountPool {
    */
   private lastUsedAt;
   private refreshInflight;
+  /**
+   * Whether `scan()` seeds from and writes back the durable account store.
+   *
+   * Off by default (tests build fixtures over temp dirs and must not touch the
+   * user's real store); `createCore()` turns it on for production, which is
+   * what makes accounts gathered by switching desktop sign-ins survive a
+   * restart — the desktop app keeps only the current sign-in's credential file
+   * on disk.
+   */
+  private readonly persistent;
+  /** Path of the durable store; computed once so tests can pin it. */
+  private readonly storePath;
   constructor(options?: AccountPoolOptions);
   /**
    * Re-apply configuration that only affects discovery and cooldown policy,