dsh-xdpool 2.1.0 → 2.2.0

package/lib/index.js

@@ -4,8 +4,8 @@ import z from "@deepseek-ai/schemastery";
 import crypto, { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { execFile, execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, truncateSync } from "node:fs";
+import { execFile, execFileSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
@@ -275,6 +275,34 @@ function chatHeaders(credential) {
 		"X-Product": "SaaS"
 	};
 }
+/**
+* The client-identity headers the desktop app puts on every chat completion.
+*
+* WHY THESE EXIST AND WHY THEY BELONG ON /v2/chat/completions ONLY
+*
+* The gateway attributes each request to a client, and that attribution is what
+* surfaces in the user's billing console as the "使用端" column. The desktop app
+* (`buildVlmGatewayHeaders` in its bundled `main/server.js`) sends
+* `X-IDE-Type`/`X-IDE-Name`/`X-IDE-Version` on every `/v2/chat/completions`, so
+* its traffic reads as "WorkBuddy". Our chat requests sent none of them, so the
+* same spend attributed to nothing — the column showed "–" and the user's
+* billing page looked like the requests had come from nowhere.
+*
+* They are deliberately NOT part of `chatHeaders()`, which is shared with the
+* points-automation endpoints (`listTasks` / `acceptTasks`). Those are not chat
+* completions, and the evidence for the desktop app sending identity headers on
+* them is nil — adding identity headers to an endpoint that never carried them
+* risks changing how that traffic is attributed or filtered, and the automation
+* was never reported broken. Only the two chat completions get these.
+*
+* The version is the same literal `openConversation()` already sends, so both
+* chat paths — the pool's and the automation's — claim the same client.
+*/
+const CHAT_IDENTITY_HEADERS = Object.freeze({
+	"X-IDE-Name": "WorkBuddy",
+	"X-IDE-Type": "WorkBuddy",
+	"X-IDE-Version": "5.5.6"
+});
 /** Refresh-endpoint headers; X-Refresh-Token appears here and nowhere else. */
 function refreshHeaders(credential) {
 	const headers = {
@@ -979,7 +1007,10 @@ var WorkBuddyUpstreamClient = class {
 	async completeChat(credential, prepared, signal) {
 		const response = await this.fetchImpl(`${chatBase(credential)}/v2/chat/completions`, {
 			method: "POST",
-			headers: chatHeaders(credential),
+			headers: {
+				...chatHeaders(credential),
+				...CHAT_IDENTITY_HEADERS
+			},
 			body: prepared,
 			...signal === void 0 ? {} : { signal }
 		});
@@ -996,7 +1027,10 @@ var WorkBuddyUpstreamClient = class {
 		try {
 			response = await this.fetchImpl(`${chatBase(credential)}/v2/chat/completions`, {
 				method: "POST",
-				headers: chatHeaders(credential),
+				headers: {
+					...chatHeaders(credential),
+					...CHAT_IDENTITY_HEADERS
+				},
 				body: prepared,
 				...signal === void 0 ? {} : { signal }
 			});
@@ -1476,15 +1510,13 @@ var WorkBuddyUpstreamClient = class {
 				method: "POST",
 				headers: {
 					...chatHeaders(credential),
+					...CHAT_IDENTITY_HEADERS,
 					"Accept": "text/event-stream",
 					"User-Agent": DESKTOP_TASK_UA,
 					"X-Conversation-ID": conversationId,
 					"X-Request-ID": String(Date.now()) + "000000",
 					"X-Agent-Intent": "craft",
 					"X-Agent-Type": "main",
-					"X-IDE-Name": "WorkBuddy",
-					"X-IDE-Type": "WorkBuddy",
-					"X-IDE-Version": "5.5.6",
 					"x-codebuddy-request": "1",
 					...expertId === "" ? {} : { "X-Expert-Id": expertId }
 				},
@@ -1859,6 +1891,256 @@ var WorkBuddyUpstreamClient = class {
 	}
 };
 //#endregion
+//#region src/ignored.ts
+/**
+* The permanent ignore list: accounts the user has thrown out of the pool.
+*
+* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
+* account stays on the card, can be switched back on, and its credential keeps
+* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
+* one is not mine any more" — so an ignored account is skipped BEFORE its
+* credential is decrypted, never appears among the pool's accounts, and does not
+* come back when the desktop app writes a fresh `.info` file for it.
+*
+* It lives in a plugin-owned file rather than in the settings document for one
+* practical reason: the CLI has no settings service. `dsh-xdpool
+* ignore <id>` runs without a host, so a settings-only list could be written by
+* the card and never by the CLI. One file, read by both halves, keeps the two
+* views of "which accounts are ignored" identical by construction.
+*
+* @module dsh-xdpool/ignored
+*/
+/** Directory holding this plugin's own state (imported snapshots, ignore list). */
+const PLUGIN_DATA_DIR_NAME = ".xdpool";
+/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
+const IGNORED_FILE_NAME = "ignored.json";
+/**
+* The DSH home directory, honouring the same override the host uses.
+*
+* Shared by the CLI and the host so both halves resolve the same file: an
+* `ignore` written from the terminal has to be visible to the running plugin,
+* which is only true if they agree on where "home" is.
+*/
+function dshHome(env = process.env) {
+	const fromEnv = env["DSH_HOME"];
+	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
+	return join(homedir(), ".dsh");
+}
+/** This plugin's own state directory. */
+function pluginDataDir(env = process.env) {
+	return join(dshHome(env), PLUGIN_DATA_DIR_NAME);
+}
+/** Absolute path of the ignore list. */
+function ignoredIdsPath(env = process.env) {
+	return join(pluginDataDir(env), IGNORED_FILE_NAME);
+}
+/**
+* Normalize whatever the file holds into a clean list.
+*
+* Tolerant on purpose: this file is hand-editable and a malformed entry must not
+* take the pool down. An entry without a usable id is dropped; a missing label
+* falls back to the id so the card always has something to print.
+*/
+function normalize$1(raw) {
+	if (typeof raw !== "object" || raw === null) return [];
+	const entries = raw.accounts;
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
+		if (id === "" || seen.has(id)) continue;
+		seen.add(id);
+		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
+		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
+		out.push({
+			id,
+			label,
+			ignoredAt
+		});
+	}
+	return out;
+}
+/**
+* Read the ignore list, tolerating every "no list yet" shape.
+*
+* A missing file, unreadable file, or invalid JSON all mean the same thing to
+* the caller — nothing is ignored — so none of them throws. The pool must be
+* able to start on a machine that has never ignored anything.
+*/
+async function readIgnoredAccounts(path = ignoredIdsPath()) {
+	try {
+		return normalize$1(JSON.parse(await readFile(path, "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* Synchronous read, for startup.
+*
+* The host applies the ignore list from inside `apply()`, which is synchronous,
+* and doing it there removes a startup race: an async load could resolve AFTER
+* the first account scan, which would let an ignored account slip into the pool
+* once per boot. The file is a few hundred bytes, so a blocking read at startup
+* costs nothing measurable.
+*/
+function readIgnoredAccountsSync(path = ignoredIdsPath()) {
+	try {
+		return normalize$1(JSON.parse(readFileSync(path, "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* Replace the ignore list, atomically.
+*
+* Written to a sibling temp file and renamed over the target so a crash (or a
+* concurrent reader) can never observe a half-written document — the ignore
+* list is the only thing standing between a dead account and the rotation, and
+* a truncated file reads as "nothing is ignored", which would quietly put every
+* discarded account back in the pool.
+*/
+async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
+	const payload = JSON.stringify({
+		version: 1,
+		accounts
+	}, null, 2);
+	await mkdir(dirname(path), { recursive: true });
+	const temp = `${path}.tmp`;
+	await writeFile(temp, `${payload}\n`, "utf8");
+	await rename(temp, path);
+}
+/**
+* Add one account to the ignore list, preserving the rest.
+*
+* A read-modify-write rather than a wholesale replace: the card and the CLI can
+* both be open, and each request names exactly one account, so re-writing the
+* whole list from a stale view would drop the other side's edits.
+*/
+async function ignoreAccount(account, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	if (current.some((entry) => entry.id === account.id)) return current;
+	const next = [...current, {
+		id: account.id,
+		label: account.label ?? account.id,
+		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
+	}];
+	await writeIgnoredAccounts(next, path);
+	return next;
+}
+/** Drop one account from the ignore list. Returns the resulting list. */
+async function unignoreAccount(accountId, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	const next = current.filter((entry) => entry.id !== accountId);
+	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
+	return next;
+}
+//#endregion
+//#region src/account-store.ts
+/**
+* Durable copy of the discovered accounts, inside the plugin's data directory.
+*
+* The pool's account list is otherwise pure memory: the desktop app keeps only
+* the CURRENT sign-in on disk (each login overwrites the one auth file), so
+* accounts gathered by switching sign-ins evaporated on every restart. This
+* store is the fix — `scan()` seeds from it and writes the merged list back, so
+* the pool now survives restarts.
+*
+* JSON only, atomic rename on write: a crash mid-write leaves the previous
+* generation intact, and the pool never reads a half-written account again.
+*
+* @module dsh-xdpool/account-store
+*/
+/** File name of the durable account list, inside the plugin data directory. */
+const ACCOUNTS_FILE_NAME = "accounts.json";
+/**
+* State files that live in the same directory but are NOT account snapshots.
+*
+* The snapshot importer (`dsh-xdpool import <key>`) writes `<md5prefix>.json`
+* into this directory, and the pool scans it — so every other `.json` file here
+* is treated as an imported snapshot. These three are the plugin's own
+* bookkeeping and must never be parsed as credentials.
+*/
+const NON_SNAPSHOT_FILES = [
+	ACCOUNTS_FILE_NAME,
+	"ignored.json",
+	"preferred.json"
+];
+/** Absolute path of the durable account list. */
+function accountStorePath(env = process.env) {
+	return join(dshHome(env), PLUGIN_DATA_DIR_NAME, ACCOUNTS_FILE_NAME);
+}
+/** The directory the pool scans for imported `<md5prefix>.json` snapshots. */
+function snapshotDirPath(env = process.env) {
+	return join(dshHome(env), PLUGIN_DATA_DIR_NAME);
+}
+/**
+* True when a file name in the snapshot directory is plugin bookkeeping rather
+* than an imported snapshot.
+*/
+function isStateFile(name) {
+	return NON_SNAPSHOT_FILES.includes(name);
+}
+/** True when a value has the shape of a stored account. */
+function isStoredAccount(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	const credential = record["credential"];
+	return typeof record["id"] === "string" && typeof record["label"] === "string" && typeof credential === "object" && credential !== null && typeof credential["accessToken"] === "string" && typeof credential["refreshToken"] === "string";
+}
+/**
+* Read the durable list. Tolerant on purpose: a malformed or half-written file
+* yields `[]` and the pool simply rediscovers from disk, rather than a corrupt
+* store taking the whole pool down.
+*/
+async function loadStoredAccounts(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return [];
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return [];
+	}
+	const entries = parsed?.["accounts"];
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (!isStoredAccount(entry)) continue;
+		if (seen.has(entry.id)) continue;
+		seen.add(entry.id);
+		out.push(entry);
+	}
+	return out;
+}
+/**
+* Atomically write the durable list: `${path}.tmp` first, then rename. A crash
+* mid-write leaves the previous generation intact.
+*/
+async function saveStoredAccounts(path, accounts) {
+	const stored = accounts.map((account) => ({
+		id: account.id,
+		label: account.label,
+		credential: account.credential,
+		savedAtMs: Date.now()
+	}));
+	const document = JSON.stringify({
+		version: 1,
+		accounts: stored
+	}, null, 2) + "\n";
+	await mkdir(join(path, ".."), { recursive: true });
+	const tmp = `${path}.tmp`;
+	await writeFile(tmp, document, "utf8");
+	await rename(tmp, path);
+}
+//#endregion
 //#region src/at-rest.ts
 /**
 * WorkBuddy desktop "at-rest" credential decryption.
@@ -2707,6 +2989,23 @@ async function authFilesIn(dir) {
 	return files.map((name) => join(dir, name));
 }
 /**
+* Snapshot files in the plugin data directory that are account snapshots.
+*
+* Every `*.info` file there is one (the importer keeps that extension for
+* uniformity with the auth dirs it copies from); the plugin's own JSON state
+* files (`accounts.json`, `ignored.json`, `preferred.json`) are NOT and must
+* never reach the credential parser.
+*/
+async function snapshotFilesIn(dir) {
+	let entries;
+	try {
+		entries = await readdir(dir);
+	} catch {
+		return [];
+	}
+	return entries.filter((name) => name.endsWith(".info")).filter((name) => !isStateFile(name)).sort((a, b) => a < b ? 1 : a > b ? -1 : 0).map((name) => join(dir, name));
+}
+/**
 * One credential file, or undefined when it cannot be used.
 *
 * Returns undefined — rather than throwing — for every failure mode, so ONE bad
@@ -2985,6 +3284,18 @@ var WorkBuddyAccountPool = class {
 	*/
 	lastUsedAt = /* @__PURE__ */ new Map();
 	refreshInflight = /* @__PURE__ */ new Map();
+	/**
+	* Whether `scan()` seeds from and writes back the durable account store.
+	*
+	* Off by default (tests build fixtures over temp dirs and must not touch the
+	* user's real store); `createCore()` turns it on for production, which is
+	* what makes accounts gathered by switching desktop sign-ins survive a
+	* restart — the desktop app keeps only the current sign-in's credential file
+	* on disk.
+	*/
+	persistent;
+	/** Path of the durable store; computed once so tests can pin it. */
+	storePath;
 	constructor(options = {}) {
 		this.logger = options.logger;
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
@@ -2994,6 +3305,8 @@ var WorkBuddyAccountPool = class {
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.distribution = options.distribution ?? "priority";
+		this.persistent = options.persistent ?? false;
+		this.storePath = accountStorePath();
 	}
 	/**
 	* Re-apply configuration that only affects discovery and cooldown policy,
@@ -3043,26 +3356,44 @@ var WorkBuddyAccountPool = class {
 	async scan() {
 		const found = [];
 		const skipped = [];
-		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
-			if (this.ignoredIds.size > 0) {
-				const cheapId = await cheapIdentityIdFromFile(file);
-				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
-			}
-			const credential = await readCredential(file);
-			if (credential === void 0) {
-				skipped.push({
-					path: file,
-					reason: await skipReasonFor(file)
-				});
-				continue;
+		const scanDirs = this.persistent ? [...this.authDirs, snapshotDirPath()] : this.authDirs;
+		for (const dir of scanDirs) {
+			const files = dir === snapshotDirPath() ? await snapshotFilesIn(dir) : await authFilesIn(dir);
+			for (const file of files) {
+				if (this.ignoredIds.size > 0) {
+					const cheapId = await cheapIdentityIdFromFile(file);
+					if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
+				}
+				const credential = await readCredential(file);
+				if (credential === void 0) {
+					skipped.push({
+						path: file,
+						reason: await skipReasonFor(file)
+					});
+					continue;
+				}
+				if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
+				found.push(credential);
 			}
-			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
-			found.push(credential);
 		}
 		this.skippedFiles = skipped;
 		if (skipped.length > 0) this.logger?.warn?.(`dsh-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
+		if (this.persistent && this.accounts.length === 0) {
+			const stored = await loadStoredAccounts(this.storePath);
+			for (const entry of stored) {
+				if (byId.has(entry.id)) continue;
+				byId.set(entry.id, {
+					id: entry.id,
+					label: entry.label,
+					credential: entry.credential,
+					cooldownUntilMs: 0,
+					modelCooldowns: {},
+					rateLimitHits: 0
+				});
+			}
+		}
 		for (const credential of found) {
 			const id = workbuddyAccountId(credential);
 			const existing = byId.get(id);
@@ -3091,6 +3422,11 @@ var WorkBuddyAccountPool = class {
 		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
 		this.accounts = ordered;
 		this.lastScanAtMs = Date.now();
+		if (this.persistent) try {
+			await saveStoredAccounts(this.storePath, this.accounts);
+		} catch (error) {
+			this.logger?.warn?.("dsh-xdpool: could not persist the account store", error);
+		}
 		return this.accounts;
 	}
 	/** All accounts, cooldown state included. */
@@ -11334,21 +11670,32 @@ function createWorkBuddyAdapter(options) {
 /** The package name the loader resolves, exactly as our patch row names it. */
 const BILLION_PACKAGE = "billion-context";
 /**
-* Is this package already running?
+* Is this package installed and able to run?
 *
-* `fiber.uid` is the host's "this fiber has actually started" flag: an entry
-* that exists but never finished importing is not a second mount, it is a
-* mount in progress, and treating it as absent would race it.
+* Any entry whose name matches counts — including one whose fiber has not
+* started yet. When this function still decided whether to mount, a fiber-less
+* entry had to be treated as absent: treating an import-in-flight as present
+* would have skipped the mount and left the compressor never starting. Now that
+* nothing mounts, the distinction only picks a label, and the honest one is
+* "installed": a user watching billion-context's own boot does not want the
+* card telling them it is missing while its proxy is half-way up.
+*
+* A DISABLED entry does not count. `loader.entries()` yields disabled rows too
+* — the host skips starting them, it does not drop them — and our own patch
+* row is disabled on purpose. Counting it would make every profile that never
+* installed billion-context read as "installed", which is precisely the lie the
+* card must not tell.
 */
 function mountedInLoader(loader, packageName) {
 	for (const entry of loader.entries()) {
 		if (entry.options?.name !== packageName) continue;
-		if (entry.fiber?.uid !== void 0 && entry.fiber.uid !== null) return true;
+		if (entry.options?.disabled === true) continue;
+		return true;
 	}
 	return false;
 }
 /**
-* Bring billion-context up if it is not already running.
+* Report whether the compressor is already running. Never mounts.
 *
 * Resolves rather than rejects on every path: a compressor that will not start
 * is a card that says so, never a pool that fails to boot. The pool's own model
@@ -11369,12 +11716,7 @@ async function mountBillionContext(ctx, logger) {
 			logger.info?.(`[xdpool] billion-context is already mounted; leaving it alone`);
 			return { state: "already-mounted" };
 		}
-		await loader.create({
-			id: "billion-context-xdpool",
-			name: BILLION_PACKAGE
-		});
-		logger.info?.(`[xdpool] mounted billion-context for the billion card`);
-		return { state: "mounted" };
+		return { state: "not-required" };
 	} catch (error) {
 		return {
 			state: "unavailable",
@@ -18010,153 +18352,6 @@ function formatRates(status) {
 	return lines.join("\n");
 }
 //#endregion
-//#region src/ignored.ts
-/**
-* The permanent ignore list: accounts the user has thrown out of the pool.
-*
-* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
-* account stays on the card, can be switched back on, and its credential keeps
-* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
-* one is not mine any more" — so an ignored account is skipped BEFORE its
-* credential is decrypted, never appears among the pool's accounts, and does not
-* come back when the desktop app writes a fresh `.info` file for it.
-*
-* It lives in a plugin-owned file rather than in the settings document for one
-* practical reason: the CLI has no settings service. `dsh-xdpool
-* ignore <id>` runs without a host, so a settings-only list could be written by
-* the card and never by the CLI. One file, read by both halves, keeps the two
-* views of "which accounts are ignored" identical by construction.
-*
-* @module dsh-xdpool/ignored
-*/
-/** Directory holding this plugin's own state (imported snapshots, ignore list). */
-const PLUGIN_DATA_DIR_NAME = ".xdpool";
-/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
-const IGNORED_FILE_NAME = "ignored.json";
-/**
-* The DSH home directory, honouring the same override the host uses.
-*
-* Shared by the CLI and the host so both halves resolve the same file: an
-* `ignore` written from the terminal has to be visible to the running plugin,
-* which is only true if they agree on where "home" is.
-*/
-function dshHome(env = process.env) {
-	const fromEnv = env["DSH_HOME"];
-	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
-	return join(homedir(), ".dsh");
-}
-/** This plugin's own state directory. */
-function pluginDataDir(env = process.env) {
-	return join(dshHome(env), PLUGIN_DATA_DIR_NAME);
-}
-/** Absolute path of the ignore list. */
-function ignoredIdsPath(env = process.env) {
-	return join(pluginDataDir(env), IGNORED_FILE_NAME);
-}
-/**
-* Normalize whatever the file holds into a clean list.
-*
-* Tolerant on purpose: this file is hand-editable and a malformed entry must not
-* take the pool down. An entry without a usable id is dropped; a missing label
-* falls back to the id so the card always has something to print.
-*/
-function normalize$1(raw) {
-	if (typeof raw !== "object" || raw === null) return [];
-	const entries = raw.accounts;
-	if (!Array.isArray(entries)) return [];
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of entries) {
-		if (typeof entry !== "object" || entry === null) continue;
-		const record = entry;
-		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
-		if (id === "" || seen.has(id)) continue;
-		seen.add(id);
-		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
-		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
-		out.push({
-			id,
-			label,
-			ignoredAt
-		});
-	}
-	return out;
-}
-/**
-* Read the ignore list, tolerating every "no list yet" shape.
-*
-* A missing file, unreadable file, or invalid JSON all mean the same thing to
-* the caller — nothing is ignored — so none of them throws. The pool must be
-* able to start on a machine that has never ignored anything.
-*/
-async function readIgnoredAccounts(path = ignoredIdsPath()) {
-	try {
-		return normalize$1(JSON.parse(await readFile(path, "utf8")));
-	} catch {
-		return [];
-	}
-}
-/**
-* Synchronous read, for startup.
-*
-* The host applies the ignore list from inside `apply()`, which is synchronous,
-* and doing it there removes a startup race: an async load could resolve AFTER
-* the first account scan, which would let an ignored account slip into the pool
-* once per boot. The file is a few hundred bytes, so a blocking read at startup
-* costs nothing measurable.
-*/
-function readIgnoredAccountsSync(path = ignoredIdsPath()) {
-	try {
-		return normalize$1(JSON.parse(readFileSync(path, "utf8")));
-	} catch {
-		return [];
-	}
-}
-/**
-* Replace the ignore list, atomically.
-*
-* Written to a sibling temp file and renamed over the target so a crash (or a
-* concurrent reader) can never observe a half-written document — the ignore
-* list is the only thing standing between a dead account and the rotation, and
-* a truncated file reads as "nothing is ignored", which would quietly put every
-* discarded account back in the pool.
-*/
-async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
-	const payload = JSON.stringify({
-		version: 1,
-		accounts
-	}, null, 2);
-	await mkdir(dirname(path), { recursive: true });
-	const temp = `${path}.tmp`;
-	await writeFile(temp, `${payload}\n`, "utf8");
-	await rename(temp, path);
-}
-/**
-* Add one account to the ignore list, preserving the rest.
-*
-* A read-modify-write rather than a wholesale replace: the card and the CLI can
-* both be open, and each request names exactly one account, so re-writing the
-* whole list from a stale view would drop the other side's edits.
-*/
-async function ignoreAccount(account, path = ignoredIdsPath()) {
-	const current = await readIgnoredAccounts(path);
-	if (current.some((entry) => entry.id === account.id)) return current;
-	const next = [...current, {
-		id: account.id,
-		label: account.label ?? account.id,
-		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
-	}];
-	await writeIgnoredAccounts(next, path);
-	return next;
-}
-/** Drop one account from the ignore list. Returns the resulting list. */
-async function unignoreAccount(accountId, path = ignoredIdsPath()) {
-	const current = await readIgnoredAccounts(path);
-	const next = current.filter((entry) => entry.id !== accountId);
-	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
-	return next;
-}
-//#endregion
 //#region src/migrate.ts
 /**
 * One-time adoption of state written under the plugin's pre-rename name.
@@ -18807,7 +19002,8 @@ function createCore(logger) {
 	const client = new WorkBuddyUpstreamClient();
 	const pool = new WorkBuddyAccountPool({
 		...logger === void 0 ? {} : { logger },
-		client
+		client,
+		persistent: true
 	});
 	return {
 		pool,