dsh-xdpool 2.4.6 → 2.5.1

package/lib/index.js

@@ -15,6 +15,15 @@ import { env } from "node:process";
 import http, { createServer, request } from "node:http";
 import https, { request as request$1 } from "node:https";
 import { Readable, Transform } from "node:stream";
+//#region src/credit-reserve.ts
+/** Build a merge-safe reserve update. Zero overrides inherited/previous floors. */
+function creditReservesWith(current, accountId, reserve) {
+	return {
+		...current,
+		[accountId]: reserve
+	};
+}
+//#endregion
 //#region src/badges.ts
 /**
 * Promotion badges the upstream attaches to a model.
@@ -390,10 +399,39 @@ const CHAT_IDENTITY_HEADERS = Object.freeze({
 * rewrite is applied to assistant history too — one past reply carrying a
 * fingerprint would otherwise fail every later request in the conversation.
 *
+* A THIRD FINGERPRINT (measured against the live domestic gateway 2026-10-28)
+*
+* The file-reference guidance DSH contributes whenever the agent has a `read`
+* tool reintroduced the same 400/11128 after the two rewrites above shipped:
+*
+*   Tokens prefixed with @ are paths the user explicitly referenced.
+*   Relative paths resolve from the workspace root; absolute paths identify
+*   files or directories on the host.
+*
+* Ordinary phrasing throughout — the blocked region names no product — so the
+* fingerprint is not "this prompt is not WorkBuddy's" but a literal substring
+* list that happens to include this sentence. Neither sentence is the trigger
+* on its own: each 200s in isolation, and the pair 400s; the smallest edit
+* anywhere in the pair clears it, which is what marks it as content and not
+* prompt length, and the matching half is the second sentence ("Tokens
+* prefixed with @" alone stayed clean while the "Relative paths…" line was the
+* one whose text the gateway recognised).
+*
+* The rewrite turns the indicative into the same statement's participle —
+* "Relative paths resolve from the workspace root" becomes "Relative paths are
+* resolved against the workspace root". Meaning, length class and line breaks
+* are preserved; the substring the gateway lists is gone. Verified at 200 with
+* the full runtime system prompt (≈41k chars) that reproduced the 400 on the
+* same account, and with the pair alone.
+*
 * The list is an ARRAY because these fingerprints are appended to over time; a
 * future rejection should be one more row here, not a new code path.
 */
-const BANNED_SYSTEM_PHRASES = Object.freeze([[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"], [/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface"]]);
+const BANNED_SYSTEM_PHRASES = Object.freeze([
+	[/powered by DeepSeek Harness/gi, "running on DeepSeek Harness"],
+	[/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface"],
+	[/Relative paths resolve from the workspace root/gi, "Relative paths are resolved against the workspace root"]
+]);
 /**
 * Rewrite fingerprinted system/assistant content, leaving everything else
 * byte-identical.
@@ -1124,7 +1162,8 @@ function parseTask(value) {
 		status: typeof raw["status"] === "string" ? raw["status"] : "",
 		claimable: !claimed && target > 0 && current >= target,
 		claimed,
-		locked: raw["locked"] === true
+		locked: raw["locked"] === true,
+		jumpUrl: typeof raw["jump_url"] === "string" ? raw["jump_url"] : ""
 	};
 }
 var WorkBuddyUpstreamClient = class {
@@ -3840,11 +3879,11 @@ var WorkBuddyAccountPool = class {
 	* model id the legacy account-wide check applies (callers that cannot name a
 	* model, e.g. CLI diagnostics).
 	*/
-	available(now, modelId, region) {
+	available(now, modelId, region, reserveExempt) {
 		return this.accounts.filter((account) => {
 			if (this.disabledIds.has(account.id)) return false;
 			const reserve = this.creditReserves.get(account.id);
-			if (reserve !== void 0 && reserve > 0) {
+			if (!reserveExempt?.has(account.id) && reserve !== void 0 && reserve > 0) {
 				const balance = this.creditBalances.get(account.id);
 				if (balance !== void 0 && balance <= reserve) return false;
 			}
@@ -3868,7 +3907,7 @@ var WorkBuddyAccountPool = class {
 	* Counts are over the region's accounts, since a provider only ever sees its
 	* own gateway.
 	*/
-	unavailableReason(modelId, region) {
+	unavailableReason(modelId, region, reserveExempt) {
 		const now = Date.now();
 		const inRegion = this.accounts.filter((account) => region === void 0 || regionOf(account.credential.domain) === region);
 		if (inRegion.length === 0) return {
@@ -3881,6 +3920,29 @@ var WorkBuddyAccountPool = class {
 		let cooling = 0;
 		let disabled = 0;
 		let dead = 0;
+		/**
+		* Accounts that survived every OTHER filter and are held back only by their
+		* credit floor.
+		*
+		* Counted rather than returned on the first hit. The old `return` fired the
+		* moment it met one reserved account, so a single account parked under its
+		* floor reported `reserve` for the whole gateway — even while four other
+		* accounts were healthy and had just been tried. The caller turns
+		* `reason === 'reserve'` into a 402 telling the user to lower the reserve,
+		* which pointed at a setting that was not the problem (#98: a five-account
+		* pool reported `reserve_floor` because of one account that had sat below
+		* its floor for weeks, while the actual state was "the rest are cooling").
+		*/
+		let reserved = 0;
+		/**
+		* Accounts that reached the end of the walk unblocked.
+		*
+		* Non-zero means the pool still has somewhere to send a request, so a
+		* reserve is NOT what this answer is about: editing a number cannot fix a
+		* request that some other account is already able to serve, and saying
+		* otherwise sends the reader to the wrong setting.
+		*/
+		let usable = 0;
 		for (const account of inRegion) {
 			if (this.disabledIds.has(account.id)) {
 				disabled += 1;
@@ -3896,16 +3958,14 @@ var WorkBuddyAccountPool = class {
 				continue;
 			}
 			const reserve = this.creditReserves.get(account.id);
-			if (reserve !== void 0 && reserve > 0) {
+			if (!reserveExempt?.has(account.id) && reserve !== void 0 && reserve > 0) {
 				const balance = this.creditBalances.get(account.id);
-				if (balance !== void 0 && balance <= reserve) return {
-					total: inRegion.length,
-					cooling,
-					disabled,
-					dead,
-					reason: "reserve"
-				};
+				if (balance !== void 0 && balance <= reserve) {
+					reserved += 1;
+					continue;
+				}
 			}
+			usable += 1;
 		}
 		if (dead > 0) return {
 			total: inRegion.length,
@@ -3928,6 +3988,13 @@ var WorkBuddyAccountPool = class {
 			dead,
 			reason: "disabled"
 		};
+		if (usable === 0 && reserved > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			dead,
+			reason: "reserve"
+		};
 		return {
 			total: inRegion.length,
 			cooling,
@@ -4104,16 +4171,18 @@ var WorkBuddyAccountPool = class {
 	* Scans on first use, and rescans when every known account is cooling down: a
 	* fresh desktop login is the usual way out of an exhausted pool.
 	*
+	* `reserveExempt` is host-only: account ids whose own credentials freshly
+	* confirmed a zero-credit model. It never bypasses disabled, dead credentials, cooldowns or region.
 	* `conversationKey` is only consulted under `sticky`; other modes ignore it.
 	*/
-	async acquire(modelId, region, conversationKey) {
+	async acquire(modelId, region, conversationKey, reserveExempt) {
 		if (this.accounts.length === 0) await this.scan();
 		const maxTries = this.accounts.length + 1;
 		for (let attempt = 0; attempt < maxTries; attempt += 1) {
-			let pool = this.available(Date.now(), modelId, region);
+			let pool = this.available(Date.now(), modelId, region, reserveExempt);
 			if (pool.length === 0 && attempt === 0) {
 				await this.scan();
-				pool = this.available(Date.now(), modelId, region);
+				pool = this.available(Date.now(), modelId, region, reserveExempt);
 			}
 			if (pool.length === 0) return void 0;
 			if (this.preferredAccountId !== void 0) {
@@ -4966,22 +5035,6 @@ const POOL_COMBOS_SAVE_PATH = "/plugins/dsh-xdpool/combos/save";
 */
 const POOL_RELAY_PATH = "/plugins/dsh-xdpool/relay";
 /**
-* What the locally running billion-context proxy is doing, read-only.
-*
-* Its own route because the answer comes from ANOTHER plugin: billion-context
-* runs its own loopback listener and publishes its own JSON, so this route only
-* finds that listener and relays a filtered subset. Nothing here is folded into
-* {@link POOL_STATUS_PATH}: the pool card polls that every 30 seconds, and a
-* third-party proxy's session table is not something every pool poll should
-* carry.
-*
-* The word "read-only" is load-bearing on both ends. This plugin sends GETs
-* only — it never configures, restarts or writes to the proxy — and the payload
-* it relays deliberately omits every field that could carry conversation
-* material.
-*/
-const POOL_BILLION_PATH = "/plugins/dsh-xdpool/billion";
-/**
 * Read the usage panel's aggregate.
 *
 * GET only, and token-free by construction: the recorder holds counts and
@@ -12198,65 +12251,6 @@ function createWorkBuddyAdapter(options) {
 	};
 }
 //#endregion
-//#region src/billion-mount.ts
-/** The package name the loader resolves, exactly as our patch row names it. */
-const BILLION_PACKAGE = "billion-context";
-/**
-* Is this package installed and able to run?
-*
-* Any entry whose name matches counts — including one whose fiber has not
-* started yet. When this function still decided whether to mount, a fiber-less
-* entry had to be treated as absent: treating an import-in-flight as present
-* would have skipped the mount and left the compressor never starting. Now that
-* nothing mounts, the distinction only picks a label, and the honest one is
-* "installed": a user watching billion-context's own boot does not want the
-* card telling them it is missing while its proxy is half-way up.
-*
-* A DISABLED entry does not count. `loader.entries()` yields disabled rows too
-* — the host skips starting them, it does not drop them — and our own patch
-* row is disabled on purpose. Counting it would make every profile that never
-* installed billion-context read as "installed", which is precisely the lie the
-* card must not tell.
-*/
-function mountedInLoader(loader, packageName) {
-	for (const entry of loader.entries()) {
-		if (entry.options?.name !== packageName) continue;
-		if (entry.options?.disabled === true) continue;
-		return true;
-	}
-	return false;
-}
-/**
-* Report whether the compressor is already running. Never mounts.
-*
-* Resolves rather than rejects on every path: a compressor that will not start
-* is a card that says so, never a pool that fails to boot. The pool's own model
-* registry has nothing to do with compression, and one missing optional feature
-* must not take the accounts down with it.
-*/
-async function mountBillionContext(ctx, logger) {
-	try {
-		let loader;
-		ctx.inject(["loader"], (scoped) => {
-			loader = scoped.loader;
-		});
-		if (loader === void 0) return {
-			state: "unavailable",
-			reason: "the host exposes no plugin loader"
-		};
-		if (mountedInLoader(loader, BILLION_PACKAGE)) {
-			logger.info?.(`[xdpool] billion-context is already mounted; leaving it alone`);
-			return { state: "already-mounted" };
-		}
-		return { state: "not-required" };
-	} catch (error) {
-		return {
-			state: "unavailable",
-			reason: error instanceof Error ? error.message : String(error)
-		};
-	}
-}
-//#endregion
 //#region src/pack-accounts.ts
 /**
 * Channel ids whose accounts this plugin serves itself.
@@ -13726,6 +13720,33 @@ function withSessionQuotaHint(error, retryAfterMs) {
 	return new AggregateError(error.kind, `${error.message} — this quota is counted per conversation on the free tier, so a new conversation (or another model) starts with its own budget`, error.status);
 }
 /**
+* Say what a 403 on this lane actually means (#96).
+*
+* The gateway answers a client it does not recognise with `403 FreeTierError`
+* and no explanation of which of its four fingerprint facts was wrong. That
+* reaches the caller as a bare `client` failure, and a bare 4xx is what the
+* host then renders in its own words: the user in #96 saw "当前请求的额度已用尽"
+* for a request that had never been billed. The wording pointed at waiting,
+* while the actual cause was "this build's fingerprint no longer matches, update
+* the plugin" — the two need opposite responses.
+*
+* The lane cannot tell them apart from the outside (both look like a refusal
+* with a thin body), so this does not pretend to. It names the actionable
+* reading FIRST — the fingerprint, which the user can fix by updating — and
+* keeps the quota possibility second, because it is the one that fixes itself.
+*
+* A 429 keeps its own hint ({@link withSessionQuotaHint}): that one really is
+* quota, and blurring the two would lose a distinction worth keeping.
+*/
+function withFreeTierHint(status, refusal, retryAfterMs) {
+	const base = classifyUpstream(status, refusal, retryAfterMs, "");
+	if (status !== 403) return base;
+	const separator = base.message.indexOf(": ");
+	const detail = separator === -1 ? "" : base.message.slice(separator + 2);
+	const kept = detail === "" ? "" : ` (provider said: ${detail})`;
+	return new AggregateError(base.kind, `the free lane refused this client: its request fingerprint no longer matches what opencode.ai accepts, so this is NOT an exhausted quota and waiting will not help — update dsh-xdpool and try again; if it persists, report this message. The shared free quota is also metered per conversation, so one retry in a fresh conversation covers the case where only that budget is spent${kept}`, status);
+}
+/**
 * POST one streaming turn and hand back chat-shaped deltas.
 *
 * The shape of the ANSWER decides how it is read, never its Content-Type: a front
@@ -13769,7 +13790,7 @@ async function postFreeStreamed({ modelId, body, session, requestId, hooks, plan
 	const retryAfter = retryAfterMs(response);
 	if (!response.ok) {
 		const refusal = await response.text().catch(() => "");
-		throw withSessionQuotaHint(classifyUpstream(response.status, refusal, retryAfter, ""), retryAfter);
+		throw withSessionQuotaHint(withFreeTierHint(response.status, refusal, retryAfter), retryAfter);
 	}
 	if (response.body === null) throw new AggregateError("server", "the free lane returned no body", response.status);
 	let events;
@@ -13802,7 +13823,7 @@ async function postFreeStreamed({ modelId, body, session, requestId, hooks, plan
 		} catch {
 			continue;
 		}
-		if (isRecord$1(decoded) && (decoded.error !== void 0 || decoded.type === "error")) throw withSessionQuotaHint(classifyUpstream(response.status, event, retryAfter, ""), retryAfter);
+		if (isRecord$1(decoded) && (decoded.error !== void 0 || decoded.type === "error")) throw withSessionQuotaHint(withFreeTierHint(response.status, event, retryAfter), retryAfter);
 		const translated = chatChunksFor(wire, decoded, tools);
 		for (const delta of translated.frames) hooks.onDelta(delta);
 		if (translated.usage !== void 0) usage = translated.usage;
@@ -15019,6 +15040,71 @@ function appearanceChain(themeKey = APPEARANCE_THEME_KEY) {
 	};
 }
 /**
+* Pull the `expertId` out of a task's `jump_url`.
+*
+* The "体验XX专家" tasks (#98) name an expert that is NOT in the marketplace
+* listing — the reporter翻遍了 marketExpertList in both `agent` and `team`
+* types and got zero hits — so the only place the id appears is the deeplink
+* embedded in the task itself:
+*
+*   https://www.workbuddy.cn/work/launch/?deeplink=workbuddy%3A%2F%2Fexperts%3FexpertId%3Dex_GDl31WahyIH0&buddy_type=workbuddy
+*
+* The deeplink is percent-encoded, and it has to be: the `?` and `&` inside it
+* would otherwise end the outer query. So the parse is two steps — decode the
+* `deeplink` parameter, then read `expertId` off the scheme it decodes to — and
+* NOT a regex over the whole URL, which would also match the outer `expertId`
+* spelling in a future URL shape and silently pick the wrong one.
+*
+* Returns undefined for the tasks whose deeplink carries no id at all
+* (`WorkBuddy_Valorant` points at `workbuddy://expert` with no query), which is
+* the honest answer: those need a different source and are not guessed here.
+*/
+function expertIdFromJumpUrl(jumpUrl) {
+	if (jumpUrl === "") return void 0;
+	/** Read `expertId` off any URL-ish string, decoded or not. */
+	const readId = (value) => {
+		let query = value;
+		try {
+			const parsed = new URL(value);
+			query = parsed.search === "" ? value : parsed.search;
+		} catch {
+			query = value;
+		}
+		const marker = query.indexOf("expertId=");
+		if (marker === -1) return void 0;
+		const rest = query.slice(marker + 9);
+		const end = rest.search(/[&#]/u);
+		const id = (end === -1 ? rest : rest.slice(0, end)).trim();
+		return id === "" ? void 0 : id;
+	};
+	let source = jumpUrl;
+	try {
+		const raw = new URL(jumpUrl).searchParams.get("deeplink");
+		if (raw !== null && raw !== "") source = raw;
+	} catch {
+		source = jumpUrl;
+	}
+	return readId(source);
+}
+/**
+* Build a summon record for an expert the marketplace does not list.
+*
+* Everything the chains need beyond the id is cosmetic — the scorer keys on
+* `expertId` — so the title from the task is reused as the display name rather
+* than inventing one. `version` is left empty, which every consumer already
+* defaults to `1.0.0`.
+*/
+function expertFromTask(expertId, title) {
+	return {
+		expertId,
+		expertType: "agent",
+		displayName: title,
+		profession: title,
+		version: "",
+		categories: []
+	};
+}
+/**
 * The three "summon an expert" events (`expert_summon_click` and friends).
 *
 * Paid before the conversation, in the order the app emits them.
@@ -15141,7 +15227,12 @@ const EVENT_CHAIN_BUILDERS = {
 	skill_1: true,
 	expert_5: true,
 	Expert_team_use_3: true,
-	Expert_lighthouse: true
+	Expert_lighthouse: true,
+	expert_use_maidehao: true,
+	expert_use_douyinyin: true,
+	expert_use_shangjia_xuanchuan: true,
+	expert_use_bowangwang: true,
+	WorkBuddy_Valorant: true
 };
 const AUTOMATION_TICK_MS = 6e4;
 /** The jobs in the order a tick runs them: report before tasks, always. */
@@ -15349,6 +15440,16 @@ var WorkBuddyScheduler = class {
 	/** Host hooks that persist the ledger across restarts. */
 	loadEarnings;
 	saveEarningsFn;
+	/**
+	* The most recent ledger write that may still be in flight.
+	*
+	* `persistEarnings` is synchronous from its callers' point of view, but the
+	* host's settings write is not: it is an async document update. Keeping the
+	* promise here is what lets {@link flushEarnings} wait for the write that
+	* matters — the last one before a restart — without making every counter
+	* update await disk.
+	*/
+	pendingEarningsWrite = Promise.resolve();
 	constructor(pool, client, options = {}) {
 		this.pool = pool;
 		this.client = client;
@@ -15385,6 +15486,18 @@ var WorkBuddyScheduler = class {
 		this.saveEarningsFn = save;
 	}
 	/**
+	* Wait for the ledger write that is (or was last) in flight.
+	*
+	* Called at the END of a task pass, right after the last claim, so the rewards
+	* that were just collected are on disk before a restart can lose them. It is
+	* deliberately NOT awaited on every counter bump: the settings document write
+	* is the slow part, and paying it per account would slow the pass for no
+	* benefit while the process is still alive.
+	*/
+	async flushEarnings() {
+		await this.pendingEarningsWrite;
+	}
+	/**
 	* Fold a previously persisted ledger back in, when it belongs to today.
 	*
 	* Used after the settings document becomes readable, which happens after
@@ -15654,7 +15767,7 @@ var WorkBuddyScheduler = class {
 			compensationCredit: (existing?.compensationCredit ?? 0) + compensationCredit,
 			date: today
 		});
-		this.persistEarnings();
+		this.pendingEarningsWrite = this.persistEarnings();
 	}
 	/** Clear the per-account counters when the local day changes. */
 	rollEarnings(today) {
@@ -15670,9 +15783,18 @@ var WorkBuddyScheduler = class {
 	* Best effort on purpose: a failed save must never abort a run that has
 	* already collected rewards, and the in-memory ledger keeps serving the card
 	* for the rest of the session either way.
+	*
+	* The returned promise settles when the write has landed (or failed). Callers
+	* that are about to END a run await it: reported in #98, a task pass that
+	* claimed 21 tasks had its process restarted before the volatile settings
+	* write reached disk, so `automationEarnings` still read `credit: 0` while
+	* the upstream had really paid out. Fire-and-forget is fine for a counter the
+	* card will re-read in this process; it is not fine for the last write before
+	* exit.
 	*/
 	persistEarnings() {
-		if (this.saveEarningsFn === void 0) return;
+		const save = this.saveEarningsFn;
+		if (save === void 0) return Promise.resolve();
 		const accounts = {};
 		for (const [id, entry] of this.earnings) accounts[id] = entry;
 		const ledger = {
@@ -15680,12 +15802,14 @@ var WorkBuddyScheduler = class {
 			accounts
 		};
 		try {
-			const saved = this.saveEarningsFn(ledger);
-			if (saved !== void 0 && typeof saved.then === "function") saved.then(void 0, (error) => {
+			const saved = save(ledger);
+			if (saved !== void 0 && typeof saved.then === "function") return Promise.resolve(saved).then(void 0, (error) => {
 				this.logger.warn?.("dsh-xdpool: could not persist automation earnings:", error);
 			});
+			return Promise.resolve();
 		} catch (error) {
 			this.logger.warn?.("dsh-xdpool: could not persist automation earnings:", error);
+			return Promise.resolve();
 		}
 	}
 	/**
@@ -15794,6 +15918,7 @@ var WorkBuddyScheduler = class {
 		state.detail = detail;
 		state.progress = progressNote;
 		this.logger.info?.(`automation ${accountWord}: ${state.message}`);
+		if (kind === "tasks" || kind === "checkin" || kind === "streak" || kind === "travel" || kind === "compensation") await this.flushEarnings();
 	}
 	/** Compose the one-line summary shown on the card. */
 	summarise(kind, ok, failed, claimed, credit, energy) {
@@ -15916,10 +16041,43 @@ var WorkBuddyScheduler = class {
 			case "expert_5": return this.expertChains(credential, "agent", task);
 			case "Expert_team_use_3": return this.expertChains(credential, "team", task);
 			case "Expert_lighthouse": return this.lighthouseChains(credential);
+			case "expert_use_maidehao":
+			case "expert_use_douyinyin":
+			case "expert_use_shangjia_xuanchuan":
+			case "expert_use_bowangwang":
+			case "WorkBuddy_Valorant": return this.taskExpertChains(credential, task);
 			default: return [];
 		}
 	}
 	/**
+	* Summon-and-use one expert NAMED BY THE TASK.
+	*
+	* Structurally `expertChains` minus the marketplace: the expert id is read
+	* from the task's deeplink instead of by browsing `marketExpertList`, because
+	* this family's experts are not listed there at all (#98 measured 500 entries
+	* across both `agent` and `team`, zero hits).
+	*
+	* Returns `[]` — not a throw — when the task carries no usable id: the caller
+	* logs "could not be built" only for exceptions, and a task shape this code
+	* does not understand is information, not a fault.
+	*/
+	async taskExpertChains(credential, task) {
+		const expertId = expertIdFromJumpUrl(task.jumpUrl);
+		if (expertId === void 0) {
+			this.logger.warn?.(`automation events ${task.taskCode}: no expertId in jump_url, skipping`);
+			return [];
+		}
+		const expert = expertFromTask(expertId, task.title);
+		await this.client.reportDesktopEvents(credential, expertSummonEvents(expert));
+		if (this.delayMs > 0 && !this.stopped) await sleep$1(this.delayMs);
+		const chat = await this.client.openConversation(credential, expert.expertId);
+		if (chat === void 0) throw new Error(`${task.taskCode}: no server conversation`);
+		return [{
+			transport: "desktop",
+			events: [...expertChatEvents(expert, chat.conversationId, chat.requestId), expertActualUseEvent(expert, chat.conversationId, chat.requestId)]
+		}];
+	}
+	/**
 	* The summon-and-use chains for the expert tasks.
 	*
 	* Two steps per expert, and both are load-bearing: the summon events alone are
@@ -17259,33 +17417,6 @@ function registerPoolStatusRoute(ctx, deps) {
 			}
 		});
 		/**
-		* The billion-context relay.
-		*
-		* GET only, loopback origin only. Its own route because it is the one
-		* document here that comes from ANOTHER plugin's loopback listener: the
-		* proxy publishes its own JSON and this only reads it, so folding it into
-		* the pool status document would put a third-party service on the critical
-		* path of every 30-second pool poll.
-		*
-		* Answered even when the proxy is absent — `state: 'missing'` with the
-		* install command is far more actionable than a 503, and it is the normal
-		* state on a machine that has not installed billion-context.
-		*/
-		const disposeBillion = ctx.webServer.register({
-			kind: "exact",
-			path: POOL_BILLION_PATH,
-			handler: async (req, res) => {
-				if (req.method !== "GET") return json(res, 405, { error: "method not allowed" });
-				if (!loopbackOrigin(req)) return json(res, 403, { error: "origin-not-trusted" });
-				if (deps.billionDocument === void 0) return json(res, 503, { error: "the billion-context relay is not available in this build" });
-				try {
-					json(res, 200, await deps.billionDocument());
-				} catch (error) {
-					json(res, 500, { error: safeMessage(error) });
-				}
-			}
-		});
-		/**
 		* The chain list plus the roster its members are drawn from.
 		*
 		* GET only. Deliberately not part of the pool status document: chains change
@@ -17361,7 +17492,6 @@ function registerPoolStatusRoute(ctx, deps) {
 			disposeRelay();
 			disposeCombosSave();
 			disposeCombos();
-			disposeBillion();
 			disposeChannels();
 			disposeAggregate();
 			disposeAggregateDiscover();
@@ -17385,247 +17515,6 @@ function registerPoolStatusRoute(ctx, deps) {
 	}, "dsh-xdpool: Web status route");
 }
 //#endregion
-//#region src/billion.ts
-/**
-* Read-only observation of a locally running billion-context proxy.
-*
-* WHAT THIS IS, AND WHY IT IS NOT AN EMBEDDED COMPRESSOR
-*
-* billion-context is a separate DSH plugin that is very likely already
-* installed on this machine — on a stock desktop profile it is mounted by the
-* profile's bundle layer and runs its own loopback listener. This module never
-* implements compression and never proposes to: it finds that listener and
-* relays a few numbers so the card can show what the compressor is doing.
-* Re-implementing folding here would mean a second, divergent answer to the
-* same question and a second set of ways to get it wrong.
-*
-* HOW THE LISTENER IS FOUND
-*
-* The proxy picks an ephemeral port at spawn and records it in its own state
-* directory, which we read rather than guess. Guessing would mean scanning a
-* port range on every card poll, and a wrong guess is worse than no answer: it
-* could read some unrelated loopback service. The recorded file is
-* `<state>/billion-context/proxy-origin` and holds a JSON object with at least
-* an `origin`; `port-zone.json` is the same fact keyed by lane. Both are read,
-* and the origin file wins, because it is the one the proxy itself reads on
-* startup.
-*
-* `state` is resolved the same way the proxy resolves it: `XDG_STATE_HOME` when
-* set, else `<homedir>/.local/state` on every platform including Windows — not
-* `%LOCALAPPDATA%`, which is what a Windows developer would reach for first and
-* which would therefore be wrong.
-*
-* WHAT IS RELAYED
-*
-* Counts, sizes, timestamps. Not titles, not first-block hints, not any
-* conversation material. The proxy is happy to hand over more than that, and
-* taking it would put the user's own words into a document the card fetches
-* every 30 seconds and that lives in the plugin's HTTP log.
-*
-* The one addition to that list is the proxy's own origin, so the card can link
-* out to the dashboard the proxy already ships instead of redrawing it. That is
-* a service address rather than conversation material, and anyone who can read
-* this document can already reach that listener directly — which is why it is
-* safe to publish where a title would not be.
-*
-* The proxy also has NO AUTHENTICATION by its own documentation — the README
-* says so outright — so every request here is a hard local one, and the relay
-* only ever reads `/__bili/health` and `/__bili/sessions`. Both are GETs. This
-* module has no code path that could write to that proxy.
-*
-* @module dsh-xdpool/billion
-*/
-/** The proxy's own management prefix. Never guess it; it is theirs. */
-const BILI_PREFIX = "/__bili";
-/** Loopback only. The proxy binds 127.0.0.1 and we refuse anything else. */
-const LOOPBACK_HOSTS$1 = [
-	"127.0.0.1",
-	"localhost",
-	"[::1]",
-	"::1"
-];
-/**
-* How long one relay request may take.
-*
-* Short on purpose: this runs inside the card's status request, and a stalled
-* third-party proxy must degrade to a panel that says "no answer" rather than
-* hold the pool card hostage. The proxy answers these two endpoints in
-* milliseconds; the budget is for the case where it does not.
-*/
-const RELAY_TIMEOUT_MS = 1500;
-/** How many sessions the card is shown. 50 rows is already past the fold. */
-const MAX_SESSIONS = 50;
-/**
-* Where the proxy keeps its state directory.
-*
-* Mirrors the proxy's own resolution exactly: `XDG_STATE_HOME` when it holds an
-* absolute path, else `<homedir>/.local/state`. Deliberately NOT
-* `DSH_HOME ?? homedir()` — DSH_HOME is the profile root and a live value on a
-* real desktop install, so preferring it sent this reader to
-* `<profile>/.local/state/billion-context` and reported "missing" on a machine
-* where the proxy was running and answering. Probed against the live proxy,
-* which is the only way that mistake is visible: every unit test with a faked
-* state directory passes either way.
-*
-* Undefined when neither resolves, because inventing a path to probe would
-* turn "not installed" into a silent hunt through the filesystem.
-*/
-function stateRoot() {
-	const xdg = env.XDG_STATE_HOME;
-	if (typeof xdg === "string" && xdg !== "") {
-		if (xdg.startsWith("/") || /^[A-Za-z]:[\\/]/u.test(xdg)) return join(xdg, "billion-context");
-		return;
-	}
-	const home = homedir();
-	if (typeof home !== "string" || home === "") return void 0;
-	return join(home, ".local", "state", "billion-context");
-}
-/** A loopback http(s) origin, or undefined for anything else. */
-function parseLoopbackOrigin(raw) {
-	let url;
-	try {
-		url = new URL(raw);
-	} catch {
-		return;
-	}
-	if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
-	if (!LOOPBACK_HOSTS$1.includes(url.hostname.toLowerCase())) return void 0;
-	return url.origin;
-}
-/**
-* The proxy origin, from the file the proxy itself reads on startup.
-*
-* `port-zone.json` is the fallback because it is keyed by lane and therefore
-* distinguishes the dsh proxy from, say, a concurrently running opencode one —
-* but `proxy-origin` is preferred because it is the single-writer record.
-*/
-async function readProxyOrigin() {
-	const root = stateRoot();
-	if (root === void 0) return void 0;
-	for (const name of ["proxy-origin", "port-zone.json"]) {
-		let raw;
-		try {
-			raw = await readFile(join(root, name), "utf8");
-		} catch {
-			continue;
-		}
-		if (name === "proxy-origin") {
-			try {
-				const parsed = JSON.parse(raw);
-				const origin = typeof parsed.origin === "string" ? parseLoopbackOrigin(parsed.origin) : void 0;
-				if (origin !== void 0) return origin;
-			} catch {}
-			continue;
-		}
-		try {
-			const port = JSON.parse(raw).lanes?.dsh;
-			if (typeof port === "number" && Number.isInteger(port) && port > 0 && port < 65536) return `http://127.0.0.1:${port}`;
-		} catch {
-			continue;
-		}
-	}
-}
-/** One GET against the proxy, with the relay budget on it. Never throws. */
-async function fetchJson(origin, path) {
-	const controller = new AbortController();
-	const timer = setTimeout(() => {
-		controller.abort();
-	}, RELAY_TIMEOUT_MS);
-	try {
-		const response = await fetch(new URL(BILI_PREFIX + path, origin), {
-			method: "GET",
-			headers: { accept: "application/json" },
-			signal: controller.signal
-		});
-		if (!response.ok) return void 0;
-		return await response.json();
-	} catch {
-		return;
-	} finally {
-		clearTimeout(timer);
-	}
-}
-/** A finite number, or undefined. Guards every relayed field. */
-function num(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-/** A string, or ''. */
-function str(value) {
-	return typeof value === "string" ? value : "";
-}
-/** A boolean, or false. */
-function bool(value) {
-	return value === true;
-}
-/**
-* One session row, reduced.
-*
-* Every field is defaulted rather than passed through: the proxy's document is
-* a moving target across versions, and an unreadable row should render as
-* zeroes we can explain, not as `undefined` reaching the card.
-*/
-function toSession(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return void 0;
-	const row = raw;
-	const id = str(row.id);
-	if (id === "") return void 0;
-	return {
-		id,
-		protocol: str(row.protocol),
-		live: bool(row.live),
-		requests: num(row.requests) ?? 0,
-		contextTokens: num(row.contextTokens) ?? 0,
-		contextTokensSource: str(row.contextTokensSource),
-		tokensSaved: num(row.tokensSaved) ?? 0,
-		inputTokens: num(row.inputTokens) ?? 0,
-		cachedTokens: num(row.cachedTokens) ?? 0,
-		outputTokens: num(row.outputTokens) ?? 0,
-		cacheHitPct: num(row.cacheHitPct) ?? -1,
-		blocks: num(row.blocks) ?? 0,
-		contextWindow: num(row.contextWindow) ?? 0,
-		lastSeen: str(row.lastSeen),
-		lastModel: str(row.lastModel)
-	};
-}
-/** The whole relay, safe to hand the card: it never rejects. */
-async function readBillionStatus() {
-	const origin = await readProxyOrigin();
-	if (origin === void 0) return {
-		state: "missing",
-		reason: "billion-context is not running on this machine. Install it with \"dsh plugin --profile <name> add billion-context\" and this page fills in.",
-		sessions: [],
-		totalSessions: 0
-	};
-	const health = await fetchJson(origin, "/health");
-	if (health === null || typeof health !== "object") return {
-		state: "unreachable",
-		reason: `billion-context is recorded at ${origin} but did not answer. It may have just been restarted.`,
-		origin,
-		sessions: [],
-		totalSessions: 0
-	};
-	const meta = health;
-	const sessionsDoc = await fetchJson(origin, "/sessions");
-	const rawSessions = sessionsDoc !== null && typeof sessionsDoc === "object" ? sessionsDoc.sessions : void 0;
-	const rows = Array.isArray(rawSessions) ? rawSessions.slice(0, MAX_SESSIONS) : [];
-	const sessions = [];
-	for (const row of rows) {
-		const session = toSession(row);
-		if (session !== void 0) sessions.push(session);
-	}
-	const total = num(sessionsDoc !== null && typeof sessionsDoc === "object" ? sessionsDoc.total : void 0) ?? sessions.length;
-	const version = str(meta.version);
-	const startedAt = num(meta.startedAt);
-	return {
-		state: "ready",
-		origin,
-		...version === "" ? {} : { version },
-		...startedAt === void 0 ? {} : { startedAt },
-		sessions,
-		totalSessions: total
-	};
-}
-//#endregion
 //#region src/diagnostics.ts
 /**
 * A startup trace this plugin owns.
@@ -18631,6 +18520,34 @@ function createWorkBuddyShim(options) {
 	const server = createServer((req, res) => {
 		handle(req, res);
 	});
+	async function acquireForRequest(modelId, conversationKey, signal) {
+		const ordinary = await pool.acquire(modelId, region, conversationKey);
+		const reserveExempt = /* @__PURE__ */ new Set();
+		if (ordinary !== void 0 || modelId === void 0 || signal.aborted) return {
+			account: ordinary,
+			reserveExempt
+		};
+		const now = Date.now();
+		const held = pool.list(region).filter((account) => pool.isReserved(account.id) && !pool.isDisabled(account.id) && (account.credentialDeadUntilMs ?? 0) <= now && account.cooldownUntilMs <= now && (account.modelCooldowns[modelId] ?? 0) <= now);
+		const pricingSignal = AbortSignal.any([signal, AbortSignal.timeout(5e3)]);
+		await Promise.all(held.map(async (account) => {
+			try {
+				const price = (await client.fetchModels(account.credential, pricingSignal)).find((model) => model.id === modelId)?.creditMultiplier;
+				logger?.info?.(`dsh-xdpool: reserve pricing model=${modelId} region=${region ?? "any"} price=${price ?? "unknown"} exempt=${!pricingSignal.aborted && price === 0}`);
+				if (!pricingSignal.aborted && price === 0) reserveExempt.add(account.id);
+			} catch {
+				logger?.info?.(`dsh-xdpool: reserve pricing unavailable model=${modelId} region=${region ?? "any"} aborted=${pricingSignal.aborted}`);
+			}
+		}));
+		if (signal.aborted) return {
+			account: void 0,
+			reserveExempt
+		};
+		return {
+			account: await pool.acquire(modelId, region, conversationKey, reserveExempt),
+			reserveExempt
+		};
+	}
 	/**
 	* "The same model has a paid row" sentence for a 429 body, or undefined.
 	*
@@ -19131,9 +19048,9 @@ function createWorkBuddyShim(options) {
 			if (signal.aborted) return;
 			attempts.push(member.modelId);
 			if (!member.aggregate) {
-				const account = await pool.acquire(member.modelId, region);
+				const { account, reserveExempt } = await acquireForRequest(member.modelId, conversationKey, signal);
 				if (account === void 0) {
-					const why = pool.unavailableReason(member.modelId, region);
+					const why = pool.unavailableReason(member.modelId, region, reserveExempt);
 					last = {
 						kind: why.reason,
 						status: why.reason === "cooling" ? 429 : 401,
@@ -19141,7 +19058,11 @@ function createWorkBuddyShim(options) {
 					};
 					continue;
 				}
-				const prepared = client.prepareChatBodyFor(raw, region ?? "cn");
+				const memberRaw = JSON.stringify({
+					...JSON.parse(raw),
+					model: member.modelId
+				});
+				const prepared = client.prepareChatBodyFor(memberRaw, region ?? "cn");
 				const result = await client.chatStream(account.credential, prepared, signal, conversationKey);
 				if (result.ok) {
 					const turnId = randomBytes(8).toString("hex");
@@ -19305,9 +19226,9 @@ function createWorkBuddyShim(options) {
 		};
 		for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
 			if (controller.signal.aborted) return;
-			const account = await pool.acquire(modelId, region, conversationKey);
+			const { account, reserveExempt } = await acquireForRequest(modelId, conversationKey, controller.signal);
 			if (account === void 0) {
-				const why = pool.unavailableReason(modelId, region);
+				const why = pool.unavailableReason(modelId, region, reserveExempt);
 				if (why.reason === "cooling") {
 					const subject = modelId === void 0 ? "every WorkBuddy account is rate-limited" : `every account is rate-limited for model ${modelId}`;
 					const upstream = last === void 0 ? "" : ` — ${last.message.slice(0, 200)}`;
@@ -19320,7 +19241,7 @@ function createWorkBuddyShim(options) {
 					return;
 				}
 				if (why.reason === "reserve") {
-					writeOpenAIError(res, 402, "reserve_floor", `every WorkBuddy account is at or below its credit reserve (${why.total} account(s)); lower the reserve on the pool card or top up credits`);
+					writeOpenAIError(res, 402, "reserve_floor", `no WorkBuddy account is available; every account not excluded by a cooldown or a revoked sign-in is at or below its credit reserve (${why.total} account(s) total); lower the reserve on the pool card or top up credits`);
 					return;
 				}
 				if (why.reason === "session_dead") {
@@ -19374,7 +19295,7 @@ function createWorkBuddyShim(options) {
 		}
 		if (isContextTooLong(last.message)) {
 			const recovered = await recoverFromContextOverrun({
-				raw,
+				raw: poolRaw,
 				modelId,
 				controller,
 				region,
@@ -19382,6 +19303,7 @@ function createWorkBuddyShim(options) {
 				client,
 				pool,
 				maxAttempts,
+				acquireAccount: async () => (await acquireForRequest(modelId, conversationKey, controller.signal)).account,
 				usage: usageContext,
 				contextWindow: modelId === void 0 ? void 0 : catalog.current().find((m) => m.id === modelId)?.contextWindow
 			});
@@ -19579,7 +19501,7 @@ async function recoverFromContextOverrun(options) {
 	let compacted = messages;
 	let compactionDetail = "";
 	try {
-		const summariser = await pool.acquire(modelId, region);
+		const summariser = await (options.acquireAccount?.() ?? pool.acquire(modelId, region));
 		if (summariser === void 0) compactionDetail = "no account available to summarise with";
 		else {
 			const outcome = await compactWithSummary(messages, {
@@ -19612,7 +19534,7 @@ async function recoverFromContextOverrun(options) {
 			ok: false,
 			detail: "client disconnected"
 		};
-		const account = await pool.acquire(modelId, region);
+		const account = await (options.acquireAccount?.() ?? pool.acquire(modelId, region));
 		if (account === void 0) return {
 			ok: false,
 			detail: "no account available after compaction"
@@ -21088,9 +21010,7 @@ function apply(ctx, config = {}) {
 			await setSetting("disabledAccountIds", next, next);
 		},
 		setCreditReserve: async (accountId, reserve) => {
-			const next = { ...current().creditReserves ?? {} };
-			if (reserve > 0) next[accountId] = reserve;
-			else delete next[accountId];
+			const next = creditReservesWith(current().creditReserves, accountId, reserve);
 			await setSetting("creditReserves", next, next);
 		},
 		setAccountIgnored: async (accountId, ignored) => {
@@ -21264,7 +21184,6 @@ function apply(ctx, config = {}) {
 			await aggregateCatalog.refresh();
 			return combosStatusOf(readAggregateSettingsSync(), aggregateCatalog, core.catalogs.cn.current());
 		},
-		billionDocument: readBillionStatus,
 		/**
 		* Relay state plus the gateway's model picker.
 		*
@@ -21342,12 +21261,6 @@ function apply(ctx, config = {}) {
 			adoptChannelPackAccounts(ctx, core.pool, ctx.logger);
 		});
 	});
-	mountBillionContext(ctx, ctx.logger).then((outcome) => {
-		recordStartupNote(`billion-context ${outcome.state}`);
-		if (outcome.state === "unavailable") ctx.logger.warn(`[xdpool] billion-context not mounted — ${outcome.reason}`);
-	}, (error) => {
-		recordStartupNote(`billion-context mount failed: ${describeError(error)}`);
-	});
 	Promise.all([shims.cn.ready, shims.global.ready]).then(async () => {
 		if (stopped) return;
 		recordStartupNote(`both shims ready cn=${shims.cn.baseUrl()} global=${shims.global.baseUrl()}; entering registration`);