dsh-xdpool 2.1.1 → 2.2.1

package/CHANGELOG.md

@@ -1,6 +1,20 @@
 # Changelog
 本项目的所有重要变更都会记录在此文件。
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
+## 2.2.1 — README 已知限制描述更正
+纯文档修正：README「已知限制」里写着池「没法替你发起登录或扫码」——这是改名前的旧描述。现在的 XD Pool 有扫码登录页，可以为自己十三家渠道发起扫码登录；WorkBuddy 本体的 token 仍由桌面 App 的腾讯 SSO 铸造并绑定设备，这条限制保留但改成了准确的说法。代码无变化，发布这一版只为让 npm 页面的 README 跟上。
+## 2.2.0 — 账号池重启不再失忆，CLI 修好，快照真正回读
+> 群友报的三个问题一起收掉：重启 DSH 后账号池只剩当前登录账号；`dsh-xdpool` 命令行任何子命令都报 `ERR_MODULE_NOT_FOUND`；`import` 写进去的快照写了就忘，永远读不回来。
+### 重启后账号还在：账号池持久化
+**现象**：在桌面端来回切换登录，攒了一池账号；重启 DSH，池里只剩当前登录的那一个。
+**根因**：账号池的账号列表是纯内存——`scan()` 只合并不落盘。而上游桌面端在磁盘上只保留**当前登录**的凭据文件（每次登录覆盖同一个文件），所以「重启 = 磁盘上有什么就是什么」，磁盘上永远只有一个。
+**修法**：新增 `account-store.ts`，池的扫描从 `~/.dsh/.xdpool/accounts.json` 播种、每次扫描后原子回写（先写 `.tmp` 再改名，崩溃不会留半个文件）。桌面端只记得最后一次登录，池子自己记账。生产入口（宿主和 CLI 共用的 `createCore()`）默认开启；测试构造的池默认关闭，不会把 fixture 写进真实目录。
+### `import` 的快照终于有人读了
+`dsh-xdpool import` 一直把 `<md5前8>.json` 快照写进 `~/.dsh/.xdpool/`，但**没有任何代码路径读回它**——写了就忘。现在插件数据目录本身就是一个扫描源，快照里的每个凭据都会在下次扫描时收进池子；插件自己的状态文件（`accounts.json`、`ignored.json`、`preferred.json`）明确排除，绝不会被当成凭据解析出幻影账号。
+### CLI 能跑了
+`lib/bin.js` 顶部带着四个打包时从 `index.ts` 一路带入的副作用 import（`@earendil-works/pi-ai` 等 optional peer），绑定里零引用——后果是所有 CLI 子命令直接 `ERR_MODULE_NOT_FOUND`。这四个包改为 external（源码里本来就没有绑定引用），`bin.js` 加载即净，只有命令真正走到 adapter 才会解析。
+### 文档对齐
+README 里「历史登录快照」的四处描述与实际行为不符，一并改写为如实口径：桌面端只保留当前登录，池子自己把攒到的账号持久保存到 `~/.dsh/.xdpool/accounts.json`，重启不丢；`import` 快照同目录，每次扫描收进池。
 ## 2.1.1 — 修掉两个用户看得见的 bug
 > 一个让你在插件清单里看到一条失败的红条目，一个让你的账单上「使用端」是空的。都是 2.1.0 之前就存在的，这一版一起收掉。
 ### 插件清单里那条 failed 的 billion-context,没有了

package/README.en.md

@@ -31,7 +31,7 @@ Then it grew into seven pages. Beyond the account pool: sign in to thirteen vend
 
 **It also throws in a full points-automation suite**: check-ins, task rewards, streak redemption, the buddy trip — all the chores you'd otherwise click through every day, done in the background.
 
-> **How this differs from the single-account connectors**: plugins like `dsh-workbuddy-connect` handle one account at a time. XD Pool treats **multiple accounts as the normal case** — it doesn't pick favourites or ask you to import anything. Every sign-in snapshot on this machine goes into one shared pool, exposed as a single `xdpool` provider group, with automatic failover inside.
+> **How this differs from the single-account connectors**: plugins like `dsh-workbuddy-connect` handle one account at a time. XD Pool treats **multiple accounts as the normal case** — it doesn't pick favourites or ask you to import anything. Every account you've switched through on the desktop app is remembered across restarts, exposed as a single `xdpool` provider group, with automatic failover inside.
 
 > **Upgrading from the old name**: this plugin used to be `dsh-workbuddy-xdpool`. Your data is **carried over automatically** (API keys, ignore list, account pin). The one thing you may need to do by hand is a default model pinned to an old id — see [Upgrading from an older version](#upgrading-from-an-older-version).
 
@@ -214,7 +214,7 @@ dsh plugin --profile desktop exec dsh-xdpool login     # guide to adding another
 
 ## How accounts get into the pool
 
-Auto-discovery. Every sign-in on the WorkBuddy desktop app leaves a token-bearing snapshot; XD Pool scans them and absorbs each into the pool. So multi-account = sign in / switch accounts in the desktop app, then hit "Detect accounts again" or restart DSH.
+The desktop app keeps only the **currently signed-in** account on disk (each switch overwrites the same file), so XD Pool remembers accounts itself: every time you switch sign-ins in the desktop app, the outgoing account is captured into `~/.dsh/.xdpool/accounts.json` and **survives restarts**. Hit "Detect accounts again" or just start using the pool — every historical account comes back.
 
 To snapshot an extra login explicitly (e.g. to pin one account for verification):
 
@@ -224,7 +224,7 @@ dsh plugin --profile desktop exec dsh-xdpool accounts
 dsh plugin --profile desktop exec dsh-xdpool remove myKey
 ```
 
-Snapshots are stored under `~/.dsh/.xdpool/` named by the **MD5-8 prefix** of their key (so keys with Chinese, `/`, or spaces are safe). Long-lived use relies on refresh-token auto-renewal; if it lapses, re-sign-in on the desktop and `import <key> --force`.
+Imported snapshots live in the same directory, `~/.dsh/.xdpool/`, and every scan absorbs them into the pool — they are no longer written and never read back. Snapshots are named by the **MD5-8 prefix** of their key (so keys with Chinese, `/`, or spaces are safe). Long-lived use relies on refresh-token auto-renewal; if it lapses, re-sign-in on the desktop and `import <key> --force`.
 
 ## Configuration
 
@@ -246,7 +246,7 @@ xdpool:
 
 - **Host side** (`src/`, inside the DSH main process)
   - `index.ts` — registers the `xdpool` provider, the `xdpool` settings section, the same-origin routes (status / re-scan / clear cooldowns / check-in / automation run / credit reserve), plus account discovery and catalog seeding.
-  - `accounts.ts` — `WorkBuddyAccountPool`: reads the desktop auth snapshots, 429 cooldowns, rotation and token refresh; account disabling and credit reserves live here too.
+  - `accounts.ts` — `WorkBuddyAccountPool`: discovers and durably stores local WorkBuddy accounts (`account-store.ts`), 429 cooldowns, rotation and token refresh; account disabling and credit reserves live here too.
   - `scheduler.ts` — the points-automation scheduler: runs five jobs on local time points (check-in / report / tasks / streak / travel), persists the daily earnings ledger, and backs the card's "Run now" button with the same code path.
   - `task-events.ts` — builds the 13 task event chains. Each chain is plain data plus the fingerprint channel it must go out on (desktop or web); the tasks that need a REAL conversation (skill, experts) open one here to get the server-side id.
   - `catalog.ts` / `upstream.ts` — the upstream client: model catalog (with per-model multipliers and free / image tags), credits, check-in, and every automation endpoint, switching CN/global by credential domain.
@@ -259,7 +259,7 @@ xdpool:
 
 ## Known limitations
 
-- **Only accounts on THIS machine's desktop app**: the pool cannot — and will not — sign you in or scan a QR code (tokens are minted by the WorkBuddy desktop app's own Tencent SSO and bound to the device). Adding an account = signing in on the desktop app; XD Pool absorbs it.
+- **The WorkBuddy sign-in itself still goes through the desktop app**: XD Pool can launch QR sign-in for its own thirteen login channels, but WorkBuddy's own token is minted by the desktop app's Tencent SSO and bound to the device — the pool will not sign you in to WorkBuddy. Adding an account = signing in on the desktop app; XD Pool absorbs it.
 
 - **A few automation tasks are deliberately not implemented**
   - `Expert_Philanthropy` (charity expert): requires a real donation; there is no way around it.

package/README.md

@@ -31,7 +31,7 @@
 
 **另外附送一整套「积分自动化」**：签到、领任务奖励、连登兑换、开猫猫旅行……这些每天都要手动点一遍的活儿，插件在后台替你干完了。
 
-> **和单账号连接插件的区别**：`dsh-workbuddy-connect` 那类插件是「一次一个账号」。XD Pool 把**多账号当默认情况**——不挑号、不手动导入，本机 WorkBuddy 所有历史登录快照全部收进一个共享池，对外用一个 `xdpool` provider 分组，池内自动容错。
+> **和单账号连接插件的区别**：`dsh-workbuddy-connect` 那类插件是「一次一个账号」。XD Pool 把**多账号当默认情况**——不挑号、不手动导入，你在桌面 App 换登过的每个号都被池记下并跨重启保存，对外用一个 `xdpool` provider 分组，池内自动容错。
 
 > **从旧名升级**：这个插件以前叫 `dsh-workbuddy-xdpool`。改名后**旧数据会自动接过来**（你的 API key、忽略名单、账号 pin 都还在）；唯一需要你动手的是「默认模型」如果指向旧 id，见[从旧版升级](#从旧版升级)。
 
@@ -70,7 +70,7 @@
 
 ### 一、多账号池
 
-- **零配置**：装上、打开，就完事了。WorkBuddy 桌面 App 里每个登过的账号都会被自动发现并入池，不需要在插件里录任何东西。
+- **零配置**：装上、打开，就完事了。WorkBuddy 桌面 App 里每个登过的账号都会被自动发现、持久保存并入池（重启不丢），不需要在插件里录任何东西。
 
 - **自动容错换号**：池子记着每个账号的限流状态。某个号触发 429 就冷却它，后面的请求自动落到下一个健康的号上；冷却结束自动恢复。所有号都在冷却时，请求才排队等待。
 - **四种账号分配方式**：`priority` 先用完一个号；`round-robin` 按顺序轮换；`balanced` 随机抽、偏向闲置久的；`sticky` 让**一个对话只用一个账号，新对话才换下一个**——上游缓存按账号隔离，中途换号等于把整段对话的缓存作废，`sticky` 就是为这件事准备的。卡片上点一下即可切换，默认仍是 `priority`。
@@ -221,7 +221,7 @@ dsh plugin --profile desktop exec dsh-xdpool login     # 教你怎么在桌面
 
 ## 池里怎么多账号？
 
-池子走**自动发现**：WorkBuddy 桌面 App 每次登录都会在本机留一个带令牌的历史快照，XD Pool 扫描这些快照，把每个账号都收进池。所以多账号 = 在桌面 App 里换着登几次，之后点卡片上的「重新检测账号」或者重启 DSH，新号就自动进池了。
+桌面 App 同一时间只保留**当前登录账号**的凭据（每次换号都会覆盖同一个文件），所以 XD Pool 自己把账号记下来：你在桌面 App 里换着登几个号，每个号在切走的瞬间就被池收进 `~/.dsh/.xdpool/accounts.json` 持久保存——**重启 DSH 也不会丢**。之后点卡片上的「重新检测账号」，或者直接开始用，池都会带着全部历史账号服务。
 
 如果你想给桌面 App 之外的一次登录做个**显式快照**（比如临时固定某个号做验证），也可以手动导入：
 
@@ -233,7 +233,7 @@ dsh plugin --profile desktop exec dsh-xdpool accounts
 dsh plugin --profile desktop exec dsh-xdpool remove myKey
 ```
 
-导入的快照以 key 的 **MD5 前 8 位**命名，放在 `~/.dsh/.xdpool/`（key 本身记在文件里），中文、带 `/`、带空格的 key 都安全。长期使用靠 refresh token 自动续期；失效了就回桌面重新登录，再 `import <key> --force` 覆盖。
+导入的快照与自动保存的账号存在同一个目录 `~/.dsh/.xdpool/` 下，每次扫描都会被一并收进池——不再是「导入了但没人读」。快照以 key 的 **MD5 前 8 位**命名（key 本身记在文件里），中文、带 `/`、带空格的 key 都安全。长期使用靠 refresh token 自动续期；失效了就回桌面重新登录，再 `import <key> --force` 覆盖。
 
 ## 配置
 
@@ -259,7 +259,7 @@ xdpool:
 
 - **宿主侧**（`src/`，跑在 DSH 主进程里）
   - `index.ts` —— 注册 `xdpool` provider、`xdpool` 设置节、各条同源路由（状态 / 重新检测 / 清除冷却 / 签到 / 自动化运行 / 保留积分），以及账号发现与模型目录播种。
-  - `accounts.ts` —— `WorkBuddyAccountPool`：读本机 WorkBuddy 桌面 auth 快照、429 冷却、轮换与 token 刷新；账号停用与积分保留也在这里。
+  - `accounts.ts` —— `WorkBuddyAccountPool`：发现并持久保存本机 WorkBuddy 账号（`account-store.ts` 落盘）、429 冷却、轮换与 token 刷新；账号停用与积分保留也在这里。
   - `scheduler.ts` —— 积分自动化的调度器：按本地时点跑五个任务（签到 / 上报 / 任务 / 连登 / 旅行），每日收益账本落盘，手动「立即运行」走的是同一套逻辑。
   - `task-events.ts` —— 13 条任务事件链的构造。每条链都是纯数据，外加它该走哪个指纹通道（桌面 / 网页）；需要真实会话的任务（技能、专家）在这里先开一次真对话，拿到服务端 id。
   - `catalog.ts` / `upstream.ts` —— 上游模型目录（含每模型积分倍率、免费 / 图片能力标签）、积分查询、签到、自动化各接口的上游客户端（按凭据域名自动切国内外）。
@@ -272,7 +272,7 @@ xdpool:
 
 ## 已知限制
 
-- **只能用本机桌面 App 里的账号**：池不会、也没法替你发起 WorkBuddy 的登录或扫码（token 由 WorkBuddy 桌面 App 自己的腾讯 SSO 铸造并和设备绑定）。加号 = 在桌面 App 里登录 / 切换，XD Pool 自动吸收。
+- **WorkBuddy 主账号的登录仍走桌面 App**：XD Pool 可以为插件自己的十三家扫码登录渠道发起扫码，但 WorkBuddy 本体的 token 由桌面 App 的腾讯 SSO 铸造并和设备绑定，池不会替你登录 WorkBuddy。加号 = 在桌面 App 里登录 / 切换，XD Pool 自动吸收。
 
 - **自动化里有几个任务刻意没做**
   - `Expert_Philanthropy`（公益专家）：需要真捐钱，绕不过去。

package/lib/bin.js

@@ -1731,6 +1731,240 @@ var WorkBuddyUpstreamClient = class {
 	}
 };
 //#endregion
+//#region src/ignored.ts
+/**
+* The permanent ignore list: accounts the user has thrown out of the pool.
+*
+* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
+* account stays on the card, can be switched back on, and its credential keeps
+* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
+* one is not mine any more" — so an ignored account is skipped BEFORE its
+* credential is decrypted, never appears among the pool's accounts, and does not
+* come back when the desktop app writes a fresh `.info` file for it.
+*
+* It lives in a plugin-owned file rather than in the settings document for one
+* practical reason: the CLI has no settings service. `dsh-xdpool
+* ignore <id>` runs without a host, so a settings-only list could be written by
+* the card and never by the CLI. One file, read by both halves, keeps the two
+* views of "which accounts are ignored" identical by construction.
+*
+* @module dsh-xdpool/ignored
+*/
+/** Directory holding this plugin's own state (imported snapshots, ignore list). */
+const PLUGIN_DATA_DIR_NAME = ".xdpool";
+/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
+const IGNORED_FILE_NAME = "ignored.json";
+/**
+* The DSH home directory, honouring the same override the host uses.
+*
+* Shared by the CLI and the host so both halves resolve the same file: an
+* `ignore` written from the terminal has to be visible to the running plugin,
+* which is only true if they agree on where "home" is.
+*/
+function dshHome$1(env = process.env) {
+	const fromEnv = env["DSH_HOME"];
+	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
+	return join(homedir(), ".dsh");
+}
+/** This plugin's own state directory. */
+function pluginDataDir(env = process.env) {
+	return join(dshHome$1(env), PLUGIN_DATA_DIR_NAME);
+}
+/** Absolute path of the ignore list. */
+function ignoredIdsPath(env = process.env) {
+	return join(pluginDataDir(env), IGNORED_FILE_NAME);
+}
+/**
+* Normalize whatever the file holds into a clean list.
+*
+* Tolerant on purpose: this file is hand-editable and a malformed entry must not
+* take the pool down. An entry without a usable id is dropped; a missing label
+* falls back to the id so the card always has something to print.
+*/
+function normalize$1(raw) {
+	if (typeof raw !== "object" || raw === null) return [];
+	const entries = raw.accounts;
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
+		if (id === "" || seen.has(id)) continue;
+		seen.add(id);
+		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
+		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
+		out.push({
+			id,
+			label,
+			ignoredAt
+		});
+	}
+	return out;
+}
+/**
+* Read the ignore list, tolerating every "no list yet" shape.
+*
+* A missing file, unreadable file, or invalid JSON all mean the same thing to
+* the caller — nothing is ignored — so none of them throws. The pool must be
+* able to start on a machine that has never ignored anything.
+*/
+async function readIgnoredAccounts(path = ignoredIdsPath()) {
+	try {
+		return normalize$1(JSON.parse(await readFile(path, "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* Replace the ignore list, atomically.
+*
+* Written to a sibling temp file and renamed over the target so a crash (or a
+* concurrent reader) can never observe a half-written document — the ignore
+* list is the only thing standing between a dead account and the rotation, and
+* a truncated file reads as "nothing is ignored", which would quietly put every
+* discarded account back in the pool.
+*/
+async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
+	const payload = JSON.stringify({
+		version: 1,
+		accounts
+	}, null, 2);
+	await mkdir(dirname(path), { recursive: true });
+	const temp = `${path}.tmp`;
+	await writeFile$1(temp, `${payload}\n`, "utf8");
+	await rename(temp, path);
+}
+/**
+* Add one account to the ignore list, preserving the rest.
+*
+* A read-modify-write rather than a wholesale replace: the card and the CLI can
+* both be open, and each request names exactly one account, so re-writing the
+* whole list from a stale view would drop the other side's edits.
+*/
+async function ignoreAccount(account, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	if (current.some((entry) => entry.id === account.id)) return current;
+	const next = [...current, {
+		id: account.id,
+		label: account.label ?? account.id,
+		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
+	}];
+	await writeIgnoredAccounts(next, path);
+	return next;
+}
+/** Drop one account from the ignore list. Returns the resulting list. */
+async function unignoreAccount(accountId, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	const next = current.filter((entry) => entry.id !== accountId);
+	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
+	return next;
+}
+//#endregion
+//#region src/account-store.ts
+/**
+* Durable copy of the discovered accounts, inside the plugin's data directory.
+*
+* The pool's account list is otherwise pure memory: the desktop app keeps only
+* the CURRENT sign-in on disk (each login overwrites the one auth file), so
+* accounts gathered by switching sign-ins evaporated on every restart. This
+* store is the fix — `scan()` seeds from it and writes the merged list back, so
+* the pool now survives restarts.
+*
+* JSON only, atomic rename on write: a crash mid-write leaves the previous
+* generation intact, and the pool never reads a half-written account again.
+*
+* @module dsh-xdpool/account-store
+*/
+/** File name of the durable account list, inside the plugin data directory. */
+const ACCOUNTS_FILE_NAME = "accounts.json";
+/**
+* State files that live in the same directory but are NOT account snapshots.
+*
+* The snapshot importer (`dsh-xdpool import <key>`) writes `<md5prefix>.json`
+* into this directory, and the pool scans it — so every other `.json` file here
+* is treated as an imported snapshot. These three are the plugin's own
+* bookkeeping and must never be parsed as credentials.
+*/
+const NON_SNAPSHOT_FILES = [
+	ACCOUNTS_FILE_NAME,
+	"ignored.json",
+	"preferred.json"
+];
+/** Absolute path of the durable account list. */
+function accountStorePath(env = process.env) {
+	return join(dshHome$1(env), PLUGIN_DATA_DIR_NAME, ACCOUNTS_FILE_NAME);
+}
+/** The directory the pool scans for imported `<md5prefix>.json` snapshots. */
+function snapshotDirPath(env = process.env) {
+	return join(dshHome$1(env), PLUGIN_DATA_DIR_NAME);
+}
+/**
+* True when a file name in the snapshot directory is plugin bookkeeping rather
+* than an imported snapshot.
+*/
+function isStateFile(name) {
+	return NON_SNAPSHOT_FILES.includes(name);
+}
+/** True when a value has the shape of a stored account. */
+function isStoredAccount(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	const credential = record["credential"];
+	return typeof record["id"] === "string" && typeof record["label"] === "string" && typeof credential === "object" && credential !== null && typeof credential["accessToken"] === "string" && typeof credential["refreshToken"] === "string";
+}
+/**
+* Read the durable list. Tolerant on purpose: a malformed or half-written file
+* yields `[]` and the pool simply rediscovers from disk, rather than a corrupt
+* store taking the whole pool down.
+*/
+async function loadStoredAccounts(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return [];
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return [];
+	}
+	const entries = parsed?.["accounts"];
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (!isStoredAccount(entry)) continue;
+		if (seen.has(entry.id)) continue;
+		seen.add(entry.id);
+		out.push(entry);
+	}
+	return out;
+}
+/**
+* Atomically write the durable list: `${path}.tmp` first, then rename. A crash
+* mid-write leaves the previous generation intact.
+*/
+async function saveStoredAccounts(path, accounts) {
+	const stored = accounts.map((account) => ({
+		id: account.id,
+		label: account.label,
+		credential: account.credential,
+		savedAtMs: Date.now()
+	}));
+	const document = JSON.stringify({
+		version: 1,
+		accounts: stored
+	}, null, 2) + "\n";
+	await mkdir(join(path, ".."), { recursive: true });
+	const tmp = `${path}.tmp`;
+	await writeFile$1(tmp, document, "utf8");
+	await rename(tmp, path);
+}
+//#endregion
 //#region src/at-rest.ts
 /**
 * WorkBuddy desktop "at-rest" credential decryption.
@@ -2579,6 +2813,23 @@ async function authFilesIn(dir) {
 	return files.map((name) => join(dir, name));
 }
 /**
+* Snapshot files in the plugin data directory that are account snapshots.
+*
+* Every `*.info` file there is one (the importer keeps that extension for
+* uniformity with the auth dirs it copies from); the plugin's own JSON state
+* files (`accounts.json`, `ignored.json`, `preferred.json`) are NOT and must
+* never reach the credential parser.
+*/
+async function snapshotFilesIn(dir) {
+	let entries;
+	try {
+		entries = await readdir(dir);
+	} catch {
+		return [];
+	}
+	return entries.filter((name) => name.endsWith(".info")).filter((name) => !isStateFile(name)).sort((a, b) => a < b ? 1 : a > b ? -1 : 0).map((name) => join(dir, name));
+}
+/**
 * One credential file, or undefined when it cannot be used.
 *
 * Returns undefined — rather than throwing — for every failure mode, so ONE bad
@@ -2857,6 +3108,18 @@ var WorkBuddyAccountPool = class {
 	*/
 	lastUsedAt = /* @__PURE__ */ new Map();
 	refreshInflight = /* @__PURE__ */ new Map();
+	/**
+	* Whether `scan()` seeds from and writes back the durable account store.
+	*
+	* Off by default (tests build fixtures over temp dirs and must not touch the
+	* user's real store); `createCore()` turns it on for production, which is
+	* what makes accounts gathered by switching desktop sign-ins survive a
+	* restart — the desktop app keeps only the current sign-in's credential file
+	* on disk.
+	*/
+	persistent;
+	/** Path of the durable store; computed once so tests can pin it. */
+	storePath;
 	constructor(options = {}) {
 		this.logger = options.logger;
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
@@ -2866,6 +3129,8 @@ var WorkBuddyAccountPool = class {
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.distribution = options.distribution ?? "priority";
+		this.persistent = options.persistent ?? false;
+		this.storePath = accountStorePath();
 	}
 	/**
 	* Re-apply configuration that only affects discovery and cooldown policy,
@@ -2915,26 +3180,44 @@ var WorkBuddyAccountPool = class {
 	async scan() {
 		const found = [];
 		const skipped = [];
-		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
-			if (this.ignoredIds.size > 0) {
-				const cheapId = await cheapIdentityIdFromFile(file);
-				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
-			}
-			const credential = await readCredential(file);
-			if (credential === void 0) {
-				skipped.push({
-					path: file,
-					reason: await skipReasonFor(file)
-				});
-				continue;
+		const scanDirs = this.persistent ? [...this.authDirs, snapshotDirPath()] : this.authDirs;
+		for (const dir of scanDirs) {
+			const files = dir === snapshotDirPath() ? await snapshotFilesIn(dir) : await authFilesIn(dir);
+			for (const file of files) {
+				if (this.ignoredIds.size > 0) {
+					const cheapId = await cheapIdentityIdFromFile(file);
+					if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
+				}
+				const credential = await readCredential(file);
+				if (credential === void 0) {
+					skipped.push({
+						path: file,
+						reason: await skipReasonFor(file)
+					});
+					continue;
+				}
+				if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
+				found.push(credential);
 			}
-			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
-			found.push(credential);
 		}
 		this.skippedFiles = skipped;
 		if (skipped.length > 0) this.logger?.warn?.(`dsh-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
+		if (this.persistent && this.accounts.length === 0) {
+			const stored = await loadStoredAccounts(this.storePath);
+			for (const entry of stored) {
+				if (byId.has(entry.id)) continue;
+				byId.set(entry.id, {
+					id: entry.id,
+					label: entry.label,
+					credential: entry.credential,
+					cooldownUntilMs: 0,
+					modelCooldowns: {},
+					rateLimitHits: 0
+				});
+			}
+		}
 		for (const credential of found) {
 			const id = workbuddyAccountId(credential);
 			const existing = byId.get(id);
@@ -2963,6 +3246,11 @@ var WorkBuddyAccountPool = class {
 		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
 		this.accounts = ordered;
 		this.lastScanAtMs = Date.now();
+		if (this.persistent) try {
+			await saveStoredAccounts(this.storePath, this.accounts);
+		} catch (error) {
+			this.logger?.warn?.("dsh-xdpool: could not persist the account store", error);
+		}
 		return this.accounts;
 	}
 	/** All accounts, cooldown state included. */
@@ -10338,137 +10626,6 @@ function formatRates(status) {
 	}
 	return lines.join("\n");
 }
-//#endregion
-//#region src/ignored.ts
-/**
-* The permanent ignore list: accounts the user has thrown out of the pool.
-*
-* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
-* account stays on the card, can be switched back on, and its credential keeps
-* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
-* one is not mine any more" — so an ignored account is skipped BEFORE its
-* credential is decrypted, never appears among the pool's accounts, and does not
-* come back when the desktop app writes a fresh `.info` file for it.
-*
-* It lives in a plugin-owned file rather than in the settings document for one
-* practical reason: the CLI has no settings service. `dsh-xdpool
-* ignore <id>` runs without a host, so a settings-only list could be written by
-* the card and never by the CLI. One file, read by both halves, keeps the two
-* views of "which accounts are ignored" identical by construction.
-*
-* @module dsh-xdpool/ignored
-*/
-/** Directory holding this plugin's own state (imported snapshots, ignore list). */
-const PLUGIN_DATA_DIR_NAME = ".xdpool";
-/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
-const IGNORED_FILE_NAME = "ignored.json";
-/**
-* The DSH home directory, honouring the same override the host uses.
-*
-* Shared by the CLI and the host so both halves resolve the same file: an
-* `ignore` written from the terminal has to be visible to the running plugin,
-* which is only true if they agree on where "home" is.
-*/
-function dshHome$1(env = process.env) {
-	const fromEnv = env["DSH_HOME"];
-	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
-	return join(homedir(), ".dsh");
-}
-/** This plugin's own state directory. */
-function pluginDataDir(env = process.env) {
-	return join(dshHome$1(env), PLUGIN_DATA_DIR_NAME);
-}
-/** Absolute path of the ignore list. */
-function ignoredIdsPath(env = process.env) {
-	return join(pluginDataDir(env), IGNORED_FILE_NAME);
-}
-/**
-* Normalize whatever the file holds into a clean list.
-*
-* Tolerant on purpose: this file is hand-editable and a malformed entry must not
-* take the pool down. An entry without a usable id is dropped; a missing label
-* falls back to the id so the card always has something to print.
-*/
-function normalize$1(raw) {
-	if (typeof raw !== "object" || raw === null) return [];
-	const entries = raw.accounts;
-	if (!Array.isArray(entries)) return [];
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of entries) {
-		if (typeof entry !== "object" || entry === null) continue;
-		const record = entry;
-		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
-		if (id === "" || seen.has(id)) continue;
-		seen.add(id);
-		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
-		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
-		out.push({
-			id,
-			label,
-			ignoredAt
-		});
-	}
-	return out;
-}
-/**
-* Read the ignore list, tolerating every "no list yet" shape.
-*
-* A missing file, unreadable file, or invalid JSON all mean the same thing to
-* the caller — nothing is ignored — so none of them throws. The pool must be
-* able to start on a machine that has never ignored anything.
-*/
-async function readIgnoredAccounts(path = ignoredIdsPath()) {
-	try {
-		return normalize$1(JSON.parse(await readFile(path, "utf8")));
-	} catch {
-		return [];
-	}
-}
-/**
-* Replace the ignore list, atomically.
-*
-* Written to a sibling temp file and renamed over the target so a crash (or a
-* concurrent reader) can never observe a half-written document — the ignore
-* list is the only thing standing between a dead account and the rotation, and
-* a truncated file reads as "nothing is ignored", which would quietly put every
-* discarded account back in the pool.
-*/
-async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
-	const payload = JSON.stringify({
-		version: 1,
-		accounts
-	}, null, 2);
-	await mkdir(dirname(path), { recursive: true });
-	const temp = `${path}.tmp`;
-	await writeFile$1(temp, `${payload}\n`, "utf8");
-	await rename(temp, path);
-}
-/**
-* Add one account to the ignore list, preserving the rest.
-*
-* A read-modify-write rather than a wholesale replace: the card and the CLI can
-* both be open, and each request names exactly one account, so re-writing the
-* whole list from a stale view would drop the other side's edits.
-*/
-async function ignoreAccount(account, path = ignoredIdsPath()) {
-	const current = await readIgnoredAccounts(path);
-	if (current.some((entry) => entry.id === account.id)) return current;
-	const next = [...current, {
-		id: account.id,
-		label: account.label ?? account.id,
-		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
-	}];
-	await writeIgnoredAccounts(next, path);
-	return next;
-}
-/** Drop one account from the ignore list. Returns the resulting list. */
-async function unignoreAccount(accountId, path = ignoredIdsPath()) {
-	const current = await readIgnoredAccounts(path);
-	const next = current.filter((entry) => entry.id !== accountId);
-	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
-	return next;
-}
 Object.freeze({
 	"workbuddy-xdpool": "xdpool",
 	"workbuddy-xdpool-global": "xdpool-global",
@@ -10647,7 +10804,8 @@ function createCore(logger) {
 	const client = new WorkBuddyUpstreamClient();
 	const pool = new WorkBuddyAccountPool({
 		...logger === void 0 ? {} : { logger },
-		client
+		client,
+		persistent: true
 	});
 	return {
 		pool,
@@ -10666,6 +10824,11 @@ function createCore(logger) {
 *
 *   dsh plugin --profile desktop exec dsh-xdpool <command>
 *
+* The CLI is packaged as a separate entry (`lib/bin.js`) and must stay free of
+* host-injected optional-peer imports: it runs standalone, before any argument
+* is parsed, so a single side-effect import of `@earendil-works/pi-ai` made
+* every command die with ERR_MODULE_NOT_FOUND.
+*
 * @module dsh-xdpool/bin
 */
 /** Directory holding imported account snapshots. */
@@ -10686,7 +10849,7 @@ async function cliCore() {
 }
 /** Snapshot files are named by the md5 prefix of their key, so any key is safe. */
 function snapshotPath(key, dir) {
-	return join(dir, `${createHash("md5").update(key).digest("hex").slice(0, 8)}.json`);
+	return join(dir, `${createHash("md5").update(key).digest("hex").slice(0, 8)}.info`);
 }
 function dshHome() {
 	const fromEnv = process.env["DSH_HOME"];

package/lib/client.js

@@ -5185,7 +5185,7 @@ window.__ModuleLoader__.load({
 		*
 		* @module dsh-xdpool/version
 		*/
-		const POOL_VERSION = "2.1.1";
+		const POOL_VERSION = "2.2.1";
 		//#endregion
 		//#region src/client/PoolCard.tsx
 		/**

package/lib/index.d.ts

@@ -886,6 +886,21 @@ interface AccountPoolOptions {
    *   behaves like `priority`.
    */
   distribution?: AccountDistribution;
+  /**
+   * Enable the durable account store.
+   *
+   * When on, `scan()` seeds its merge from `~/.dsh/.xdpool/accounts.json` and
+   * writes the merged list back, so accounts gathered by switching desktop
+   * sign-ins survive a restart, and the plugin's snapshot directory becomes a
+   * scan source.
+   *
+   * DEFAULT OFF, on purpose: the 70+ existing pool tests build fixtures over
+   * temp auth dirs, and a store that wrote by default would flush those
+   * fixtures into the user's real `~/.dsh/.xdpool/accounts.json`. Production
+   * assembles the pool through `createCore()`, which passes `persistent: true`;
+   * tests opt in explicitly.
+   */
+  persistent?: boolean;
 }
 export declare class WorkBuddyAccountPool {
   private readonly logger;
@@ -1001,6 +1016,18 @@ export declare class WorkBuddyAccountPool {
    */
   private lastUsedAt;
   private refreshInflight;
+  /**
+   * Whether `scan()` seeds from and writes back the durable account store.
+   *
+   * Off by default (tests build fixtures over temp dirs and must not touch the
+   * user's real store); `createCore()` turns it on for production, which is
+   * what makes accounts gathered by switching desktop sign-ins survive a
+   * restart — the desktop app keeps only the current sign-in's credential file
+   * on disk.
+   */
+  private readonly persistent;
+  /** Path of the durable store; computed once so tests can pin it. */
+  private readonly storePath;
   constructor(options?: AccountPoolOptions);
   /**
    * Re-apply configuration that only affects discovery and cooldown policy,

package/lib/index.js

@@ -4,8 +4,8 @@ import z from "@deepseek-ai/schemastery";
 import crypto, { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { execFile, execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, truncateSync } from "node:fs";
+import { execFile, execFileSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
@@ -1891,6 +1891,256 @@ var WorkBuddyUpstreamClient = class {
 	}
 };
 //#endregion
+//#region src/ignored.ts
+/**
+* The permanent ignore list: accounts the user has thrown out of the pool.
+*
+* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
+* account stays on the card, can be switched back on, and its credential keeps
+* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
+* one is not mine any more" — so an ignored account is skipped BEFORE its
+* credential is decrypted, never appears among the pool's accounts, and does not
+* come back when the desktop app writes a fresh `.info` file for it.
+*
+* It lives in a plugin-owned file rather than in the settings document for one
+* practical reason: the CLI has no settings service. `dsh-xdpool
+* ignore <id>` runs without a host, so a settings-only list could be written by
+* the card and never by the CLI. One file, read by both halves, keeps the two
+* views of "which accounts are ignored" identical by construction.
+*
+* @module dsh-xdpool/ignored
+*/
+/** Directory holding this plugin's own state (imported snapshots, ignore list). */
+const PLUGIN_DATA_DIR_NAME = ".xdpool";
+/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
+const IGNORED_FILE_NAME = "ignored.json";
+/**
+* The DSH home directory, honouring the same override the host uses.
+*
+* Shared by the CLI and the host so both halves resolve the same file: an
+* `ignore` written from the terminal has to be visible to the running plugin,
+* which is only true if they agree on where "home" is.
+*/
+function dshHome(env = process.env) {
+	const fromEnv = env["DSH_HOME"];
+	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
+	return join(homedir(), ".dsh");
+}
+/** This plugin's own state directory. */
+function pluginDataDir(env = process.env) {
+	return join(dshHome(env), PLUGIN_DATA_DIR_NAME);
+}
+/** Absolute path of the ignore list. */
+function ignoredIdsPath(env = process.env) {
+	return join(pluginDataDir(env), IGNORED_FILE_NAME);
+}
+/**
+* Normalize whatever the file holds into a clean list.
+*
+* Tolerant on purpose: this file is hand-editable and a malformed entry must not
+* take the pool down. An entry without a usable id is dropped; a missing label
+* falls back to the id so the card always has something to print.
+*/
+function normalize$1(raw) {
+	if (typeof raw !== "object" || raw === null) return [];
+	const entries = raw.accounts;
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
+		if (id === "" || seen.has(id)) continue;
+		seen.add(id);
+		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
+		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
+		out.push({
+			id,
+			label,
+			ignoredAt
+		});
+	}
+	return out;
+}
+/**
+* Read the ignore list, tolerating every "no list yet" shape.
+*
+* A missing file, unreadable file, or invalid JSON all mean the same thing to
+* the caller — nothing is ignored — so none of them throws. The pool must be
+* able to start on a machine that has never ignored anything.
+*/
+async function readIgnoredAccounts(path = ignoredIdsPath()) {
+	try {
+		return normalize$1(JSON.parse(await readFile(path, "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* Synchronous read, for startup.
+*
+* The host applies the ignore list from inside `apply()`, which is synchronous,
+* and doing it there removes a startup race: an async load could resolve AFTER
+* the first account scan, which would let an ignored account slip into the pool
+* once per boot. The file is a few hundred bytes, so a blocking read at startup
+* costs nothing measurable.
+*/
+function readIgnoredAccountsSync(path = ignoredIdsPath()) {
+	try {
+		return normalize$1(JSON.parse(readFileSync(path, "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* Replace the ignore list, atomically.
+*
+* Written to a sibling temp file and renamed over the target so a crash (or a
+* concurrent reader) can never observe a half-written document — the ignore
+* list is the only thing standing between a dead account and the rotation, and
+* a truncated file reads as "nothing is ignored", which would quietly put every
+* discarded account back in the pool.
+*/
+async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
+	const payload = JSON.stringify({
+		version: 1,
+		accounts
+	}, null, 2);
+	await mkdir(dirname(path), { recursive: true });
+	const temp = `${path}.tmp`;
+	await writeFile(temp, `${payload}\n`, "utf8");
+	await rename(temp, path);
+}
+/**
+* Add one account to the ignore list, preserving the rest.
+*
+* A read-modify-write rather than a wholesale replace: the card and the CLI can
+* both be open, and each request names exactly one account, so re-writing the
+* whole list from a stale view would drop the other side's edits.
+*/
+async function ignoreAccount(account, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	if (current.some((entry) => entry.id === account.id)) return current;
+	const next = [...current, {
+		id: account.id,
+		label: account.label ?? account.id,
+		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
+	}];
+	await writeIgnoredAccounts(next, path);
+	return next;
+}
+/** Drop one account from the ignore list. Returns the resulting list. */
+async function unignoreAccount(accountId, path = ignoredIdsPath()) {
+	const current = await readIgnoredAccounts(path);
+	const next = current.filter((entry) => entry.id !== accountId);
+	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
+	return next;
+}
+//#endregion
+//#region src/account-store.ts
+/**
+* Durable copy of the discovered accounts, inside the plugin's data directory.
+*
+* The pool's account list is otherwise pure memory: the desktop app keeps only
+* the CURRENT sign-in on disk (each login overwrites the one auth file), so
+* accounts gathered by switching sign-ins evaporated on every restart. This
+* store is the fix — `scan()` seeds from it and writes the merged list back, so
+* the pool now survives restarts.
+*
+* JSON only, atomic rename on write: a crash mid-write leaves the previous
+* generation intact, and the pool never reads a half-written account again.
+*
+* @module dsh-xdpool/account-store
+*/
+/** File name of the durable account list, inside the plugin data directory. */
+const ACCOUNTS_FILE_NAME = "accounts.json";
+/**
+* State files that live in the same directory but are NOT account snapshots.
+*
+* The snapshot importer (`dsh-xdpool import <key>`) writes `<md5prefix>.json`
+* into this directory, and the pool scans it — so every other `.json` file here
+* is treated as an imported snapshot. These three are the plugin's own
+* bookkeeping and must never be parsed as credentials.
+*/
+const NON_SNAPSHOT_FILES = [
+	ACCOUNTS_FILE_NAME,
+	"ignored.json",
+	"preferred.json"
+];
+/** Absolute path of the durable account list. */
+function accountStorePath(env = process.env) {
+	return join(dshHome(env), PLUGIN_DATA_DIR_NAME, ACCOUNTS_FILE_NAME);
+}
+/** The directory the pool scans for imported `<md5prefix>.json` snapshots. */
+function snapshotDirPath(env = process.env) {
+	return join(dshHome(env), PLUGIN_DATA_DIR_NAME);
+}
+/**
+* True when a file name in the snapshot directory is plugin bookkeeping rather
+* than an imported snapshot.
+*/
+function isStateFile(name) {
+	return NON_SNAPSHOT_FILES.includes(name);
+}
+/** True when a value has the shape of a stored account. */
+function isStoredAccount(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = value;
+	const credential = record["credential"];
+	return typeof record["id"] === "string" && typeof record["label"] === "string" && typeof credential === "object" && credential !== null && typeof credential["accessToken"] === "string" && typeof credential["refreshToken"] === "string";
+}
+/**
+* Read the durable list. Tolerant on purpose: a malformed or half-written file
+* yields `[]` and the pool simply rediscovers from disk, rather than a corrupt
+* store taking the whole pool down.
+*/
+async function loadStoredAccounts(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return [];
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return [];
+	}
+	const entries = parsed?.["accounts"];
+	if (!Array.isArray(entries)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (!isStoredAccount(entry)) continue;
+		if (seen.has(entry.id)) continue;
+		seen.add(entry.id);
+		out.push(entry);
+	}
+	return out;
+}
+/**
+* Atomically write the durable list: `${path}.tmp` first, then rename. A crash
+* mid-write leaves the previous generation intact.
+*/
+async function saveStoredAccounts(path, accounts) {
+	const stored = accounts.map((account) => ({
+		id: account.id,
+		label: account.label,
+		credential: account.credential,
+		savedAtMs: Date.now()
+	}));
+	const document = JSON.stringify({
+		version: 1,
+		accounts: stored
+	}, null, 2) + "\n";
+	await mkdir(join(path, ".."), { recursive: true });
+	const tmp = `${path}.tmp`;
+	await writeFile(tmp, document, "utf8");
+	await rename(tmp, path);
+}
+//#endregion
 //#region src/at-rest.ts
 /**
 * WorkBuddy desktop "at-rest" credential decryption.
@@ -2739,6 +2989,23 @@ async function authFilesIn(dir) {
 	return files.map((name) => join(dir, name));
 }
 /**
+* Snapshot files in the plugin data directory that are account snapshots.
+*
+* Every `*.info` file there is one (the importer keeps that extension for
+* uniformity with the auth dirs it copies from); the plugin's own JSON state
+* files (`accounts.json`, `ignored.json`, `preferred.json`) are NOT and must
+* never reach the credential parser.
+*/
+async function snapshotFilesIn(dir) {
+	let entries;
+	try {
+		entries = await readdir(dir);
+	} catch {
+		return [];
+	}
+	return entries.filter((name) => name.endsWith(".info")).filter((name) => !isStateFile(name)).sort((a, b) => a < b ? 1 : a > b ? -1 : 0).map((name) => join(dir, name));
+}
+/**
 * One credential file, or undefined when it cannot be used.
 *
 * Returns undefined — rather than throwing — for every failure mode, so ONE bad
@@ -3017,6 +3284,18 @@ var WorkBuddyAccountPool = class {
 	*/
 	lastUsedAt = /* @__PURE__ */ new Map();
 	refreshInflight = /* @__PURE__ */ new Map();
+	/**
+	* Whether `scan()` seeds from and writes back the durable account store.
+	*
+	* Off by default (tests build fixtures over temp dirs and must not touch the
+	* user's real store); `createCore()` turns it on for production, which is
+	* what makes accounts gathered by switching desktop sign-ins survive a
+	* restart — the desktop app keeps only the current sign-in's credential file
+	* on disk.
+	*/
+	persistent;
+	/** Path of the durable store; computed once so tests can pin it. */
+	storePath;
 	constructor(options = {}) {
 		this.logger = options.logger;
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
@@ -3026,6 +3305,8 @@ var WorkBuddyAccountPool = class {
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.distribution = options.distribution ?? "priority";
+		this.persistent = options.persistent ?? false;
+		this.storePath = accountStorePath();
 	}
 	/**
 	* Re-apply configuration that only affects discovery and cooldown policy,
@@ -3075,26 +3356,44 @@ var WorkBuddyAccountPool = class {
 	async scan() {
 		const found = [];
 		const skipped = [];
-		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
-			if (this.ignoredIds.size > 0) {
-				const cheapId = await cheapIdentityIdFromFile(file);
-				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
-			}
-			const credential = await readCredential(file);
-			if (credential === void 0) {
-				skipped.push({
-					path: file,
-					reason: await skipReasonFor(file)
-				});
-				continue;
+		const scanDirs = this.persistent ? [...this.authDirs, snapshotDirPath()] : this.authDirs;
+		for (const dir of scanDirs) {
+			const files = dir === snapshotDirPath() ? await snapshotFilesIn(dir) : await authFilesIn(dir);
+			for (const file of files) {
+				if (this.ignoredIds.size > 0) {
+					const cheapId = await cheapIdentityIdFromFile(file);
+					if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
+				}
+				const credential = await readCredential(file);
+				if (credential === void 0) {
+					skipped.push({
+						path: file,
+						reason: await skipReasonFor(file)
+					});
+					continue;
+				}
+				if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
+				found.push(credential);
 			}
-			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
-			found.push(credential);
 		}
 		this.skippedFiles = skipped;
 		if (skipped.length > 0) this.logger?.warn?.(`dsh-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
+		if (this.persistent && this.accounts.length === 0) {
+			const stored = await loadStoredAccounts(this.storePath);
+			for (const entry of stored) {
+				if (byId.has(entry.id)) continue;
+				byId.set(entry.id, {
+					id: entry.id,
+					label: entry.label,
+					credential: entry.credential,
+					cooldownUntilMs: 0,
+					modelCooldowns: {},
+					rateLimitHits: 0
+				});
+			}
+		}
 		for (const credential of found) {
 			const id = workbuddyAccountId(credential);
 			const existing = byId.get(id);
@@ -3123,6 +3422,11 @@ var WorkBuddyAccountPool = class {
 		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
 		this.accounts = ordered;
 		this.lastScanAtMs = Date.now();
+		if (this.persistent) try {
+			await saveStoredAccounts(this.storePath, this.accounts);
+		} catch (error) {
+			this.logger?.warn?.("dsh-xdpool: could not persist the account store", error);
+		}
 		return this.accounts;
 	}
 	/** All accounts, cooldown state included. */
@@ -18048,153 +18352,6 @@ function formatRates(status) {
 	return lines.join("\n");
 }
 //#endregion
-//#region src/ignored.ts
-/**
-* The permanent ignore list: accounts the user has thrown out of the pool.
-*
-* Distinct from `disabledAccountIds`, which is a ROTATION preference. A disabled
-* account stays on the card, can be switched back on, and its credential keeps
-* being read on every scan. Ignoring is a statement about the ACCOUNT — "this
-* one is not mine any more" — so an ignored account is skipped BEFORE its
-* credential is decrypted, never appears among the pool's accounts, and does not
-* come back when the desktop app writes a fresh `.info` file for it.
-*
-* It lives in a plugin-owned file rather than in the settings document for one
-* practical reason: the CLI has no settings service. `dsh-xdpool
-* ignore <id>` runs without a host, so a settings-only list could be written by
-* the card and never by the CLI. One file, read by both halves, keeps the two
-* views of "which accounts are ignored" identical by construction.
-*
-* @module dsh-xdpool/ignored
-*/
-/** Directory holding this plugin's own state (imported snapshots, ignore list). */
-const PLUGIN_DATA_DIR_NAME = ".xdpool";
-/** File holding the permanent ignore list, inside {@link pluginDataDir}. */
-const IGNORED_FILE_NAME = "ignored.json";
-/**
-* The DSH home directory, honouring the same override the host uses.
-*
-* Shared by the CLI and the host so both halves resolve the same file: an
-* `ignore` written from the terminal has to be visible to the running plugin,
-* which is only true if they agree on where "home" is.
-*/
-function dshHome(env = process.env) {
-	const fromEnv = env["DSH_HOME"];
-	if (typeof fromEnv === "string" && fromEnv.trim() !== "") return fromEnv.trim();
-	return join(homedir(), ".dsh");
-}
-/** This plugin's own state directory. */
-function pluginDataDir(env = process.env) {
-	return join(dshHome(env), PLUGIN_DATA_DIR_NAME);
-}
-/** Absolute path of the ignore list. */
-function ignoredIdsPath(env = process.env) {
-	return join(pluginDataDir(env), IGNORED_FILE_NAME);
-}
-/**
-* Normalize whatever the file holds into a clean list.
-*
-* Tolerant on purpose: this file is hand-editable and a malformed entry must not
-* take the pool down. An entry without a usable id is dropped; a missing label
-* falls back to the id so the card always has something to print.
-*/
-function normalize$1(raw) {
-	if (typeof raw !== "object" || raw === null) return [];
-	const entries = raw.accounts;
-	if (!Array.isArray(entries)) return [];
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const entry of entries) {
-		if (typeof entry !== "object" || entry === null) continue;
-		const record = entry;
-		const id = typeof record["id"] === "string" ? record["id"].trim() : "";
-		if (id === "" || seen.has(id)) continue;
-		seen.add(id);
-		const label = typeof record["label"] === "string" && record["label"].trim() !== "" ? record["label"] : id;
-		const ignoredAt = typeof record["ignoredAt"] === "string" ? record["ignoredAt"] : "";
-		out.push({
-			id,
-			label,
-			ignoredAt
-		});
-	}
-	return out;
-}
-/**
-* Read the ignore list, tolerating every "no list yet" shape.
-*
-* A missing file, unreadable file, or invalid JSON all mean the same thing to
-* the caller — nothing is ignored — so none of them throws. The pool must be
-* able to start on a machine that has never ignored anything.
-*/
-async function readIgnoredAccounts(path = ignoredIdsPath()) {
-	try {
-		return normalize$1(JSON.parse(await readFile(path, "utf8")));
-	} catch {
-		return [];
-	}
-}
-/**
-* Synchronous read, for startup.
-*
-* The host applies the ignore list from inside `apply()`, which is synchronous,
-* and doing it there removes a startup race: an async load could resolve AFTER
-* the first account scan, which would let an ignored account slip into the pool
-* once per boot. The file is a few hundred bytes, so a blocking read at startup
-* costs nothing measurable.
-*/
-function readIgnoredAccountsSync(path = ignoredIdsPath()) {
-	try {
-		return normalize$1(JSON.parse(readFileSync(path, "utf8")));
-	} catch {
-		return [];
-	}
-}
-/**
-* Replace the ignore list, atomically.
-*
-* Written to a sibling temp file and renamed over the target so a crash (or a
-* concurrent reader) can never observe a half-written document — the ignore
-* list is the only thing standing between a dead account and the rotation, and
-* a truncated file reads as "nothing is ignored", which would quietly put every
-* discarded account back in the pool.
-*/
-async function writeIgnoredAccounts(accounts, path = ignoredIdsPath()) {
-	const payload = JSON.stringify({
-		version: 1,
-		accounts
-	}, null, 2);
-	await mkdir(dirname(path), { recursive: true });
-	const temp = `${path}.tmp`;
-	await writeFile(temp, `${payload}\n`, "utf8");
-	await rename(temp, path);
-}
-/**
-* Add one account to the ignore list, preserving the rest.
-*
-* A read-modify-write rather than a wholesale replace: the card and the CLI can
-* both be open, and each request names exactly one account, so re-writing the
-* whole list from a stale view would drop the other side's edits.
-*/
-async function ignoreAccount(account, path = ignoredIdsPath()) {
-	const current = await readIgnoredAccounts(path);
-	if (current.some((entry) => entry.id === account.id)) return current;
-	const next = [...current, {
-		id: account.id,
-		label: account.label ?? account.id,
-		ignoredAt: (/* @__PURE__ */ new Date()).toISOString()
-	}];
-	await writeIgnoredAccounts(next, path);
-	return next;
-}
-/** Drop one account from the ignore list. Returns the resulting list. */
-async function unignoreAccount(accountId, path = ignoredIdsPath()) {
-	const current = await readIgnoredAccounts(path);
-	const next = current.filter((entry) => entry.id !== accountId);
-	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
-	return next;
-}
-//#endregion
 //#region src/migrate.ts
 /**
 * One-time adoption of state written under the plugin's pre-rename name.
@@ -18845,7 +19002,8 @@ function createCore(logger) {
 	const client = new WorkBuddyUpstreamClient();
 	const pool = new WorkBuddyAccountPool({
 		...logger === void 0 ? {} : { logger },
-		client
+		client,
+		persistent: true
 	});
 	return {
 		pool,

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-xdpool",
   "displayName": "DSH XD Pool",
   "description": "One DSH model pool for every free quota you have: merge all locally signed-in WorkBuddy accounts with auto-failover, sign in to 13 vendors by QR/web, aggregate 76 vendors' free tiers, plus a usage dashboard, model routing, a local OpenAI-compatible gateway and a points-automation suite.",
-  "version": "2.1.1",
+  "version": "2.2.1",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-xdpool#readme",