dsh-xdpool 2.2.1 → 2.4.0

package/CHANGELOG.md

@@ -1,6 +1,50 @@
 # Changelog
 本项目的所有重要变更都会记录在此文件。
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
+## 2.4.0 — 会话身份头、清单不再冻结、中文路由可存
+> 这一版收的是「用着用着就报错」的那一类问题：调用被网关判成非法渠道（11128）、国际版模型清单永远停在启动那一刻、中文名字的路由点了保存却没存下、上下文选择一选就弹回去。
+### 会话身份头：修掉 400 / 11128「Illegal API invocation from an unapproved channel」
+网关对「这一轮对话属于谁」有一组身份头，缺一个就整轮拒绝，报 `11128 Illegal API invocation from an unapproved channel`，看起来像密钥失效，其实是新会话没自报身份。补齐官方客户端的契约：
+- **会话稳定三头**（同一会话内不变）：`X-Conversation-ID`、`X-Conversation-Request-ID`、`acp-connection-id`。
+- **每请求两头**（逐次随机）：`X-Conversation-Message-ID`、`X-Request-ID`。
+- 另附 `X-Agent-Intent`、`X-Agent-Purpose`、`x-codebuddy-request`、`X-Private-Data`、`X-Product` 与 W3C/B3 追踪族。
+
+实测口径：三个稳定头缺任一个即 400 11128，齐全即 200；值本身不校验（非 UUID 字符串也过）。池车道（WorkBuddy 国内/国际）与扫码渠道的 `send` 两条路径都已接上。
+顺带修掉同源的一处：`role: "developer"` 的消息在国内网关同样触发 11128，现统一上送为 `system`。
+### 国际版模型清单：不再冻结在启动那一刻
+`createProvider` 的 `models` 是在创建 provider 时快照下来的数组，而原来的 `invalidate()` 只重排了 profile、复用了同一个 provider 对象，宿主按对象身份记忆化 `current()`，于是**新拿到的模型清单永远送不到选择器**——表现是「重新获取模型」点了没反应、国际版清单停在开机那一刻。现在每次 `invalidate()` 重建 provider 与 profile 两个对象，并通过 adapter handle 的 `replace()` 重新登记路由，由宿主自己发出 `llm/adapters-updated`。
+（附带核查：国际版本来就有独立的 `modelSelectionGlobal` 键，与国内白名单分开读写，这一处无需改动。）
+### 中文路由名现在存得下
+链名 slug 原来是 `[^a-z0-9]+ → '-'`，中文名整串被压成空 id，规范化时被当作无效条目静默丢弃——于是「保存成功」但什么都没存。改为 Unicode 感知的 slug（`\p{L}`/`\p{N}`），拉丁名形态完全不变，已存的路由 id 继续可解析。
+### 上下文大小：选中态不再一选就弹回
+渠道卡把「从未保存过预算」当成了「已收窄到 200K」显示，用户点「完整」清空预算后该行又算回 200K，选中态立刻跳回第一项。现在未保存过预算就显示完整窗口；清空预算时同时保留 `nativeContextWindow`，radio 组不会在指针底下消失。
+### 思考档位：不再只认一档
+pack 兜底表把十几个模型的 `reasoningEfforts` 写成了单档（`["medium"]` / `["high"]`），于是国际版 `Deepseek-V4.1-Flash` 只能选 High。逐模型实测（两网关、五档全跑）后按真实能力补齐：凡是能调通的模型五档都接受、且各档 `reasoning_content` 长度不同。`gpt-5.3-codex` 五档皆 200 但 reasoning 恒空——档位合法而不可观测，已经在表里注明；`gemini-3.5-flash` 与 `primary-model` 的 400 是账号套餐权限（`model [X] is not allowed for user type [personal]`），与档位无关，未动。
+### 重复账号：同一个人不再显示成两个
+桌面端凭据同时带数字 `uin` 与 UUID `uid`，扫码渠道只带 `uid`，而账号 id 是按 `uin` 优先哈希的——同一个人走两条登录路径就整出两个池条目，各自带一部分模型。现在按 `uid` 建次级索引合并到同一个池条目，既不改哈希（否则全部冷却、失效标记、忽略名单、持久化快照一次性作废），也与凭据到达顺序无关。
+### 「重新检测账号」不再静默失败
+`listAllAccounts` 漏了 `await`，拿到的是一个 Promise，随后的 `.filter` 抛 `is not a function` 并被外层 try/catch 吞掉，表现是扫码账号全部并进池、重新检测永远没结果。
+### 其他
+- 测试：新增会话身份头与中文路由名的回归用例，全套 68 文件 910 用例。
+## 2.3.0 — 扫码渠道接入账号池，免密车道修复，数据看板有了真数
+> 这一版收掉三件大事：扫码登录的账号真正归入账号池并按渠道展示；免费模型车道跟上上游的新校验、不再动辄 403；数据看板不再是一排零。
+### 账号池：扫码渠道按渠道入池、逐模型可控
+**账号池页新增了扫码渠道卡**。此前扫码登录页加的账号游离在账号池之外——账号池只认 WorkBuddy 桌面端登录的账号，扫码加进来的十几个渠道账号在池里没有一席之地，模型开不开、哪个开，全靠猜。现在每家扫码渠道在账号池页有一张自己的卡：账号列表（昵称、启停、到期、余额）、模型列表（逐个勾选启用、免费/失效标签、上下文大小选择）、每日签到与积分领取。改动即时生效，不必点保存。
+配套的 RPC 通道一并补齐：前端与扫码渠道后端之间的账号、模型、积分、启停等请求全部走同一封装（`channel-rpc.ts`），新增 `model.setDisabledMany`、`model.setContextBudget` 等方法，保证卡片上看到的和后端真实状态一致。
+**重复账号自动清理**：同一渠道反复扫码不再攒出一排半成品账号——按「可用性」保留（长期凭据优先于临期凭据），其余清掉，日志里写明留了谁删了谁。
+### 停机补偿：自动领取
+WorkBuddy 侧偶发的模型服务异常会按账号补偿积分（在网页「用量」页顶部领，过期作废）。现在自动任务多了一项「停机补偿」，默认每天下午检查一次，有就领、领完记账，账单里能看到「补偿 +N 积分」。
+### 免费模型车道：跟上上游的客户端校验
+免费模型上游在 10 月中旬收紧了两道校验，旧版几乎每次调用都撞 403：
+- **会话 id 编码**：上游要求会话 id 按规范的降序时间戳编码（低 12 位落在固定区间），旧实现用哈希摘要当前缀，合规概率只有约 1.5%。现在改为确定性派生规范 id——同一会话稳定映射到同一上游会话，配额不会被反复消耗。
+- **客户端指纹**：请求头、路径、工具声明的形状全部对齐当前 CLI 客户端（v2 形状），并用真实网关验证过：免费模型能正常返回内容，超限时明确报限流而不是 403 拒绝。
+### 数据看板：不再是一排零
+免密通道的调用此前从未接入用量记录器，看板上免费模型的调用数恒为 0、重启即清空。现在每次调用（无论成败）都会记录请求数、轮次、首字延迟、生成速度；Token 总量取决于上游是否回传用量帧，不回传时如实显示「未上报」而不是编一个数。
+### 其他
+- 聚合渠道页的模型按「免费优先、上下文窗口、识图能力」排序；能力未知的模型如实留空，不编造窗口数字。
+- 渠道卡模型行在模型较多时提供搜索框；按钮配色统一为中性色，hover 有扫光动效。
+- 重复的登录入口合并；「已添加 N 个账号」的计数修正为去重后的真实数量。
+- 新增 5 个测试文件（免密车道闸门、扫码账号接入、RPC 方法清单、模型选择、客户端 bundle 纯净度），全套 68 文件 895 用例。
 ## 2.2.1 — README 已知限制描述更正
 纯文档修正：README「已知限制」里写着池「没法替你发起登录或扫码」——这是改名前的旧描述。现在的 XD Pool 有扫码登录页，可以为自己十三家渠道发起扫码登录；WorkBuddy 本体的 token 仍由桌面 App 的腾讯 SSO 铸造并绑定设备，这条限制保留但改成了准确的说法。代码无变化，发布这一版只为让 npm 页面的 README 跟上。
 ## 2.2.0 — 账号池重启不再失忆，CLI 修好，快照真正回读

package/lib/bin.js

@@ -161,6 +161,31 @@ const SESSION_DEAD_MARKERS = [
 */
 const ALREADY_CHECKIN_MARKERS = ["已签到", "already"];
 /**
+* Markers for "there is no compensation offer to collect".
+*
+* The offer is seasonal — an outage announcement opens one, and it closes on a
+* deadline — so for most of the year every account answers a claim with a
+* refusal. That is a successful no-op, not a failure, for the same reason
+* `isAlreadyCheckin` exists.
+*/
+const NO_COMPENSATION_MARKERS = [
+	"没有可领取",
+	"暂无可领取",
+	"无可领取",
+	"不可领取",
+	"未开启",
+	"没有活动",
+	"已领取",
+	"已过期",
+	"活动已结束",
+	"已结束",
+	"not eligible",
+	"no compensation",
+	"already claimed",
+	"not found",
+	"expired"
+];
+/**
 * Hosts the international product answers on, once each has been stripped of a
 * leading label. The WorkBuddy AI desktop app signs in at `workbuddy.ai` (and
 * the desktop client itself lists `workbuddy.cc` alongside it); the CodeBuddy
@@ -252,6 +277,80 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 	"X-IDE-Type": "WorkBuddy",
 	"X-IDE-Version": "5.5.6"
 });
+/**
+* The conversation-identity headers the gateway's channel check demands.
+*
+* WHY THIS EXISTS
+*
+* `www.workbuddy.ai` turned "channel verification" from a soft check into a
+* hard one. A `POST /v2/chat/completions` missing ANY of `X-Conversation-ID`,
+* `X-Conversation-Request-ID` or `X-Conversation-Message-ID` is rejected with
+* business code 11128 (`msg: "request illegal"` on the international gateway,
+* `msg: "conversation id missing"` in the earlier wording). Verified by
+* elimination against real credentials: delete any one of the three and the
+* call 400s; send all three and it 200s with normal SSE. Every other header the
+* desktop sends (`acp-connection-id`, `X-Request-ID`, `X-Agent-Intent`,
+* `X-Private-Data`, the W3C/B3 tracing family) can be dropped without effect,
+* so only these three are load-bearing.
+*
+* The values are NOT validated — plain non-UUID strings pass — so the gateway
+* is checking for presence and consistency, not for a signature. That lets us
+* derive them from the conversation instead of registering state with upstream.
+*
+* 11128 IS MULTIPLEXED. The domestic gateway returns the same code with
+* `msg: "Illegal API invocation from an unapproved channel"` for a different
+* cause entirely: a `developer`-role message. `prepareChatBody()` already
+* rewrites that role; see its comment. Never branch on the business code alone.
+*/
+const CONVERSATION_STABLE_SALT = "conversation";
+/**
+* The three stable conversation ids for one logical conversation.
+*
+* Stable across every call and every account in a conversation, because the
+* upstream treats the triple as one session: regenerating them per request
+* would read as a new conversation on each turn. Derived rather than stored so
+* the identity survives a restart and needs no registry — the same reasoning
+* `deriveDeviceId` uses for the device id.
+*
+* Falls back to a random seed when the caller has no key (a one-shot compaction
+* outside any conversation), which is safe because presence is all that is
+* checked.
+*/
+function conversationIdentityOf(conversationKey, seed = randomUUID) {
+	const base = conversationKey === void 0 || conversationKey === "" ? seed() : conversationKey;
+	const hash = (suffix) => createHash("sha256").update(`${CONVERSATION_STABLE_SALT}:${suffix}:${base}`).digest("hex");
+	const asUuid = (hex) => `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+	return {
+		conversationId: asUuid(hash("id")),
+		conversationRequestId: asUuid(hash("request")),
+		acpConnectionId: asUuid(hash("acp"))
+	};
+}
+/**
+* Full header set for one chat completion.
+*
+* `chatHeaders()` stays untouched on purpose: it is shared with the
+* points-automation endpoints, which have never been shown to carry
+* conversation identity, and adding it there would change how that traffic is
+* attributed. The per-request ids are fresh UUIDs every call; only the triple
+* from `conversationIdentityOf` is stable.
+*/
+function chatCompletionHeaders(credential, conversationKey) {
+	const identity = conversationIdentityOf(conversationKey);
+	return {
+		...chatHeaders(credential),
+		...CHAT_IDENTITY_HEADERS,
+		"X-Conversation-ID": identity.conversationId,
+		"X-Conversation-Request-ID": identity.conversationRequestId,
+		"acp-connection-id": identity.acpConnectionId,
+		"X-Conversation-Message-ID": randomUUID(),
+		"X-Request-ID": randomUUID(),
+		"X-Agent-Intent": "craft",
+		"X-Agent-Purpose": "conversation",
+		"X-Private-Data": "true",
+		"x-codebuddy-request": "1"
+	};
+}
 /** Refresh-endpoint headers; X-Refresh-Token appears here and nowhere else. */
 function refreshHeaders(credential) {
 	const headers = {
@@ -456,6 +555,16 @@ function isAlreadyCheckin(error) {
 	const message = error instanceof Error ? error.message : String(error);
 	return ALREADY_CHECKIN_MARKERS.some((marker) => message.includes(marker));
 }
+/**
+* Whether an error means "no compensation offer is running for this account".
+*
+* Callers treat this as a successful no-op: the job did its job and correctly
+* found nothing to collect.
+*/
+function isNoCompensation(error) {
+	const lower = (error instanceof Error ? error.message : String(error)).toLowerCase();
+	return NO_COMPENSATION_MARKERS.some((marker) => lower.includes(marker.toLowerCase()));
+}
 /** Parse the upstream's `credits` string into a multiplier. */
 function parseCreditMultiplier(value) {
 	if (typeof value !== "string") return void 0;
@@ -844,13 +953,10 @@ var WorkBuddyUpstreamClient = class {
 	* single string. Throws on any failure: the compactor then falls back to
 	* plain truncation rather than failing the user's turn.
 	*/
-	async completeChat(credential, prepared, signal) {
+	async completeChat(credential, prepared, signal, conversationKey) {
 		const response = await this.fetchImpl(`${chatBase(credential)}/v2/chat/completions`, {
 			method: "POST",
-			headers: {
-				...chatHeaders(credential),
-				...CHAT_IDENTITY_HEADERS
-			},
+			headers: chatCompletionHeaders(credential, conversationKey),
 			body: prepared,
 			...signal === void 0 ? {} : { signal }
 		});
@@ -862,15 +968,12 @@ var WorkBuddyUpstreamClient = class {
 		return await readCompletionText(response.body);
 	}
 	/** Forward one chat completion. Never throws for upstream failures. */
-	async chatStream(credential, prepared, signal) {
+	async chatStream(credential, prepared, signal, conversationKey) {
 		let response;
 		try {
 			response = await this.fetchImpl(`${chatBase(credential)}/v2/chat/completions`, {
 				method: "POST",
-				headers: {
-					...chatHeaders(credential),
-					...CHAT_IDENTITY_HEADERS
-				},
+				headers: chatCompletionHeaders(credential, conversationKey),
 				body: prepared,
 				...signal === void 0 ? {} : { signal }
 			});
@@ -1112,6 +1215,52 @@ var WorkBuddyUpstreamClient = class {
 		};
 	}
 	/**
+	* Read the service-outage compensation offer, if any.
+	*
+	* NOTE the missing `/v2`: unlike the check-in routes, this one lives at
+	* `/billing/meter/compensation-status` and the `/v2` variant answers a plain
+	* 404 (verified on both billing hosts). The web client calls it that way too.
+	*/
+	async fetchCompensationStatus(credential) {
+		const response = await this.fetchImpl(`${billingBase(credential)}/billing/meter/compensation-status`, {
+			method: "POST",
+			headers: billingHeaders(credential),
+			body: "{}",
+			signal: AbortSignal.timeout(JSON_TIMEOUT_MS)
+		});
+		const envelope = await readEnvelope(response);
+		if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
+		const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
+		return {
+			active: data["active"] === true,
+			claimed: data["claimed"] === true,
+			creditNum: typeof data["credit_num"] === "number" ? data["credit_num"] : 0,
+			...typeof data["end_time"] === "string" && data["end_time"] !== "" ? { endTime: data["end_time"] } : {}
+		};
+	}
+	/**
+	* Collect the running compensation offer.
+	*
+	* Idempotent upstream: a repeat claim answers `code: 0` with
+	* `claimed: true` rather than an error, so a second pass in the same day
+	* records as a no-op instead of a failure.
+	*/
+	async claimCompensation(credential) {
+		const response = await this.fetchImpl(`${billingBase(credential)}/billing/meter/claim-compensation`, {
+			method: "POST",
+			headers: billingHeaders(credential),
+			body: "{}",
+			signal: AbortSignal.timeout(JSON_TIMEOUT_MS)
+		});
+		const envelope = await readEnvelope(response);
+		if (!response.ok || envelope.code !== 0) throw envelopeError(response.status, envelope);
+		const data = typeof envelope.data === "object" && envelope.data !== null ? envelope.data : {};
+		return {
+			claimed: data["claimed"] !== false,
+			creditNum: typeof data["credit_num"] === "number" ? data["credit_num"] : 0
+		};
+	}
+	/**
 	* Public fingerprint fields every desktop event carries.
 	*
 	* The upstream scores a desktop-fingerprinted task only when the event looks
@@ -3120,6 +3269,15 @@ var WorkBuddyAccountPool = class {
 	persistent;
 	/** Path of the durable store; computed once so tests can pin it. */
 	storePath;
+	/**
+	* Optional second source of credentials: the channel pack's account pool,
+	* which holds the accounts the user signed in through the scan-login page.
+	*
+	* A function rather than a list because that pool is mounted asynchronously
+	* and can be re-read on demand; `undefined` means "no such source", which is
+	* the state every test and every pre-mount startup is in.
+	*/
+	externalSource;
 	constructor(options = {}) {
 		this.logger = options.logger;
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
@@ -3146,6 +3304,14 @@ var WorkBuddyAccountPool = class {
 		if (options.creditReserves !== void 0) this.setCreditReserves(options.creditReserves);
 	}
 	/**
+	* Register (or clear, with `undefined`) the extra credential source that
+	* `scan()` merges alongside the auth directories. Rescanning is the caller's
+	* job: this only changes where the next scan looks.
+	*/
+	applyExternalSource(source) {
+		this.externalSource = source;
+	}
+	/**
 	* Replace the permanent ignore list.
 	*
 	* Also drops any already-discovered account that is now ignored, so the change
@@ -3202,6 +3368,15 @@ var WorkBuddyAccountPool = class {
 		}
 		this.skippedFiles = skipped;
 		if (skipped.length > 0) this.logger?.warn?.(`dsh-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
+		if (this.externalSource !== void 0) try {
+			const external = await this.externalSource();
+			for (const credential of external) {
+				if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
+				found.push(credential);
+			}
+		} catch (error) {
+			this.logger?.warn?.("dsh-xdpool: could not read channel-pack accounts; desktop accounts only", error);
+		}
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
 		if (this.persistent && this.accounts.length === 0) {
@@ -3218,8 +3393,17 @@ var WorkBuddyAccountPool = class {
 				});
 			}
 		}
+		const byUid = /* @__PURE__ */ new Map();
+		for (const account of byId.values()) {
+			const uid = account.credential.uid;
+			if (typeof uid === "string" && uid !== "" && !byUid.has(uid)) byUid.set(uid, account.id);
+		}
 		for (const credential of found) {
-			const id = workbuddyAccountId(credential);
+			const byIdentity = workbuddyAccountId(credential);
+			const uid = credential.uid;
+			const knownId = typeof uid === "string" && uid !== "" ? byUid.get(uid) : void 0;
+			const id = knownId ?? byIdentity;
+			if (knownId === void 0 && typeof uid === "string" && uid !== "") byUid.set(uid, id);
 			const existing = byId.get(id);
 			if (existing === void 0) {
 				byId.set(id, {
@@ -4198,7 +4382,8 @@ const DEFAULT_AUTOMATION_HOURS = {
 	report: [10],
 	tasks: [11],
 	streak: [12],
-	travel: [9, 21]
+	travel: [9, 21],
+	compensation: [13]
 };
 //#endregion
 //#region src/channels.ts
@@ -9156,7 +9341,7 @@ Object.freeze({
 	"openai-responses": "/responses",
 	"anthropic-messages": "/messages"
 });
-process.env.XDPOOL_FREE_BASE;
+typeof process === "undefined" || process.env.XDPOOL_FREE_BASE;
 Object.freeze([
 	"muse-spark-1.3-contributor-free",
 	"muse-spark-1.2-contributor-free",
@@ -9615,7 +9800,8 @@ const JOB_KINDS = [
 	"report",
 	"tasks",
 	"streak",
-	"travel"
+	"travel",
+	"compensation"
 ];
 /**
 * Pick the hour list to run on: the configured one, or the default.
@@ -9662,9 +9848,10 @@ function diffEarnings(before, after) {
 			claimed: entry.claimed - (was?.claimed ?? 0),
 			checkinCredit: entry.checkinCredit - (was?.checkinCredit ?? 0),
 			bonusCredit: entry.bonusCredit - (was?.bonusCredit ?? 0),
-			travelCredit: entry.travelCredit - (was?.travelCredit ?? 0)
+			travelCredit: entry.travelCredit - (was?.travelCredit ?? 0),
+			compensationCredit: entry.compensationCredit - (was?.compensationCredit ?? 0)
 		};
-		if (gain.credit === 0 && gain.energy === 0 && gain.claimed === 0 && gain.checkinCredit === 0 && gain.bonusCredit === 0 && gain.travelCredit === 0) continue;
+		if (gain.credit === 0 && gain.energy === 0 && gain.claimed === 0 && gain.checkinCredit === 0 && gain.bonusCredit === 0 && gain.travelCredit === 0 && gain.compensationCredit === 0) continue;
 		accounts[id] = gain;
 		credit += gain.credit;
 		energy += gain.energy;
@@ -9758,6 +9945,7 @@ var WorkBuddyScheduler = class {
 	reportHours;
 	streakHours;
 	travelHours;
+	compensationHours;
 	timer;
 	running = false;
 	/** Guards against a slow run overlapping the next tick. */
@@ -9777,7 +9965,8 @@ var WorkBuddyScheduler = class {
 		report: { ...EMPTY_JOB_STATE },
 		tasks: { ...EMPTY_JOB_STATE },
 		streak: { ...EMPTY_JOB_STATE },
-		travel: { ...EMPTY_JOB_STATE }
+		travel: { ...EMPTY_JOB_STATE },
+		compensation: { ...EMPTY_JOB_STATE }
 	};
 	claimableSeen = 0;
 	/**
@@ -9814,6 +10003,7 @@ var WorkBuddyScheduler = class {
 		this.taskHours = hoursOrDefault(options.taskHours, DEFAULT_AUTOMATION_HOURS.tasks);
 		this.streakHours = hoursOrDefault(options.streakHours, DEFAULT_AUTOMATION_HOURS.streak);
 		this.travelHours = hoursOrDefault(options.travelHours, DEFAULT_AUTOMATION_HOURS.travel);
+		this.compensationHours = hoursOrDefault(options.compensationHours, DEFAULT_AUTOMATION_HOURS.compensation);
 	}
 	/** Apply a new configuration; safe to call while running. */
 	/**
@@ -9846,6 +10036,7 @@ var WorkBuddyScheduler = class {
 		if (options.taskHours !== void 0) this.taskHours = hoursOrDefault(options.taskHours, DEFAULT_AUTOMATION_HOURS.tasks);
 		if (options.streakHours !== void 0) this.streakHours = hoursOrDefault(options.streakHours, DEFAULT_AUTOMATION_HOURS.streak);
 		if (options.travelHours !== void 0) this.travelHours = hoursOrDefault(options.travelHours, DEFAULT_AUTOMATION_HOURS.travel);
+		if (options.compensationHours !== void 0) this.compensationHours = hoursOrDefault(options.compensationHours, DEFAULT_AUTOMATION_HOURS.compensation);
 	}
 	/** Hours for one job, used by the loop and the status document. */
 	hoursOf(kind) {
@@ -9855,6 +10046,7 @@ var WorkBuddyScheduler = class {
 			case "tasks": return this.taskHours;
 			case "streak": return this.streakHours;
 			case "travel": return this.travelHours;
+			case "compensation": return this.compensationHours;
 		}
 	}
 	/** Start the loop. Idempotent. */
@@ -9968,6 +10160,7 @@ var WorkBuddyScheduler = class {
 			reportHours: this.reportHours,
 			streakHours: this.streakHours,
 			travelHours: this.travelHours,
+			compensationHours: this.compensationHours,
 			jobs,
 			claimableSeen: this.claimableSeen,
 			earningsToday: this.earningsSnapshot(),
@@ -10080,7 +10273,8 @@ var WorkBuddyScheduler = class {
 		const checkinCredit = delta.checkinCredit ?? 0;
 		const bonusCredit = delta.bonusCredit ?? 0;
 		const travelCredit = delta.travelCredit ?? 0;
-		if (credit === 0 && energy === 0 && claimed === 0 && checkinCredit === 0 && bonusCredit === 0 && travelCredit === 0) return;
+		const compensationCredit = delta.compensationCredit ?? 0;
+		if (credit === 0 && energy === 0 && claimed === 0 && checkinCredit === 0 && bonusCredit === 0 && travelCredit === 0 && compensationCredit === 0) return;
 		const existing = this.earnings.get(accountId);
 		this.earnings.set(accountId, {
 			credit: (existing?.credit ?? 0) + credit,
@@ -10089,6 +10283,7 @@ var WorkBuddyScheduler = class {
 			checkinCredit: (existing?.checkinCredit ?? 0) + checkinCredit,
 			bonusCredit: (existing?.bonusCredit ?? 0) + bonusCredit,
 			travelCredit: (existing?.travelCredit ?? 0) + travelCredit,
+			compensationCredit: (existing?.compensationCredit ?? 0) + compensationCredit,
 			date: today
 		});
 		this.persistEarnings();
@@ -10196,7 +10391,19 @@ var WorkBuddyScheduler = class {
 						if (progress !== void 0) progressNote = progress;
 						break;
 					}
-					case "travel": await this.runTravel(account);
+					case "travel":
+						await this.runTravel(account);
+						break;
+					case "compensation": try {
+						const outcome = await this.runCompensation(account);
+						if (outcome.credit > 0) {
+							detail.push(`补偿 +${outcome.credit}`);
+							this.logger.info?.(`automation compensation ${account.label}: +${outcome.credit} credit`);
+						}
+					} catch (error) {
+						if (!isNoCompensation(error)) throw error;
+						this.logger.info?.(`automation compensation ${account.label}: no offer to collect`);
+					}
 				}
 				ok++;
 			} catch (error) {
@@ -10525,6 +10732,27 @@ var WorkBuddyScheduler = class {
 		}
 		this.logger.info?.(`automation travel ${account.label}: nothing to do (state=${travel.state})`);
 	}
+	/**
+	* Collect the running service-outage compensation offer, if any.
+	*
+	* Read-then-claim, rather than claim-blind: a claim costs one mutation the
+	* upstream may reject, and the status call is a free read that also tells us
+	* the size on offer so the ledger records the real number instead of
+	* assuming the usual 500.
+	*
+	* Returns the credits collected — 0 when there was nothing to collect, which
+	* is the normal case for most of the year.
+	*/
+	async runCompensation(account) {
+		const credential = account.credential;
+		const status = await this.client.fetchCompensationStatus(credential);
+		if (!status.active || status.claimed || status.creditNum <= 0) return { credit: 0 };
+		const claim = await this.client.claimCompensation(credential);
+		if (!claim.claimed) return { credit: 0 };
+		const credit = claim.creditNum > 0 ? claim.creditNum : status.creditNum;
+		this.recordEarnings(account.id, dayKey(this.now()), { compensationCredit: credit });
+		return { credit };
+	}
 };
 Object.freeze({
 	"agnes": "推理内容以 think 标签返回",
@@ -10769,6 +10997,7 @@ const automationSchema = z.object({
 	taskHours: z.array(z.number().step(1).min(0).max(23)).description("Local hours for task enrolment and claiming"),
 	streakHours: z.array(z.number().step(1).min(0).max(23)).description("Local hours for streak redemption"),
 	travelHours: z.array(z.number().step(1).min(0).max(23)).description("Local hours for the buddy travel loop"),
+	compensationHours: z.array(z.number().step(1).min(0).max(23)).description("Local hours for the outage-compensation claim"),
 	exhaustCooldownMs: z.number().step(1).min(1e3).description("How long a spent account rests, in milliseconds")
 });
 z.object({