@dmh2002/dsh-connect-qoder 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -2,6 +2,71 @@
 
 格式参照 [Keep a Changelog](https://keepachangelog.com/zh-CN/1.1.0/)，版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 0.4.2 (2026-10-13)
+
+用户实拍：国际版账号「ddd」显示 **「✗ Qoder 拒绝了这个账号的 PAT——请添加新 PAT 或换一个账号」**，并附一句「我感觉大概率还是我们出了问题」。**这个判断是对的**：账号一切正常，PAT 没有任何问题，是我们把上游的一句「今天用满了」读成了「你的凭据坏了」。0.4.1 修的是文案自相矛盾，这一版修的是**判据本身**。
+
+同族 `dsh-connect-workbuddy` 在 4.4.2 修掉了那层**保存/删除/导入时的忙碌遮罩**（卡片是近黑板子、spinner 与外壳不同拍），本版把该改动逐条对齐过来 —— 两族共用同一套 `dsm-*` 卡片语言，遮罩也该是同一套。
+
+### Fixed
+
+- **任何 HTTP 403 都被判成「凭据被拒」—— 业务码明明就在同一个响应体里，却没被读。**
+  - **实测（本机真实 PAT，`scripts/probe-cosy.mjs global`，只读）**：
+
+    | 检查 | 结果 |
+    | --- | --- |
+    | PAT 换令牌 | ✅ 成功（姓名可读，`hasOauthToken: true`） |
+    | 模型目录 | ✅ 15 个模型，`qfmodel` 在列 |
+    | 积分（sash 面） | ✅ `userQuota {total:300, used:0, remaining:300}` + `addOnQuota {total:200}`，`isQuotaExceeded: false` |
+    | **对话（chat 面）** | ❌ `HTTP 403 {"code":"110","message":"Billing daily count exceeded"}` |
+    | 换 `efficient` 重试 | ❌ **同一个 110** —— 证明与模型 key 无关 |
+
+  - **官方码表**（[docs.qoder.com/zh/cli/sdk/errors](https://docs.qoder.com/zh/cli/sdk/errors)）是决定性依据：`105` 才是「登录态或 Access Token 已过期 → 换新凭据」；**`110` = 「达到当日用量限制 → 等待用量周期重置」**，`113`/`115`–`119`/`122` 同属用量与配额族。也就是说「403 就是凭据坏了」这个推断**在协议层面根本不成立**——403 只是承载码的容器。
+  - **三层缺陷叠加，缺一不可**（这也是它一直没被查出来的原因）：
+    1. `classifyBusinessCode` 只认 `105` / `115` / `402` / `6004`，**`110` 根本不在表里**，落到 `unknown`；
+    2. 更关键：`403 + 110` **从来没走到过 `classifyBusinessCode`**。SSE 信封分支与 chat 的非 200 分支都只调 `classifyHttpStatus`，于是 `403 → auth`；
+    3. `onServingFailure` 把上游原文**丢掉了**（参数写成 `_message`），落盘的记录只剩一句结论 —— 实测那条 `credential-rejected` 记录**连 `message` 字段都没有**，卡片因此只能空口指控，而真相就在被丢掉的那串字符里。探针路径早就带原文（`redactUpstreamText`），**两条路径写同一个文件却只有一个带**。
+  - **危害不止文案难听**：`credential-rejected` 在账号池里是**无条件永久排除**（`exclusionOf` 刻意不看冷却期，理由写在注释里：令牌被拒，等也没用）。这个理由对 `105` 成立、对 `110` 恰好相反 —— 一个明天自动恢复的账号被踢出池且**不自愈**，同时被要求去做一件根本无效的事（换 PAT）。
+  - **修法**：新增 `classifyFailure(status, detail)` —— **业务码优先于 HTTP 状态，认不出的码才回落状态**（`TOKEN_EXPIRE` 这类字符串码、非 JSON 的 body、空 body 全部维持原行为，真被拒的那一侧不能被改坏）；`businessCodeOf` 把上游两种写法（`"110"` 与裸数字 `110`）归一，取不到就返回 `undefined`，**绝不猜**；官方码表按族补全（配额 / 请求 / 瞬时）；SSE 信封与 `chatStream` 两条真路径接入；`onServingFailure` 的那段内联字面量抽成模块级纯函数 `liveRequestProbe`，**带上脱敏后的原文**。
+  - **修好误判后暴露出第二个错（同轮改掉）**：110 正确落到 `out-of-credit` 档之后，既有文案是「积分不足 / Not enough credits」—— **而这个账号实测还有 500 积分、`isQuotaExceeded: false`**。`110` 说的是「当日用量**次数**」，与余额无关；照发就是第二句自相矛盾的话（0.4.1 刚为第一句发过补丁）。改成「用量已达上限 / Usage limit reached」，排除芯片与「池里没有可用账号」的提示语**同口径**（否则同一张卡片上两个词指同一件事）。带恢复时刻的那格也去掉了「积分包」这个限定 —— 恢复时刻也可能来自上游的重置句子，写死来源就是编造。
+  - **现场复核（改动后打真实上游）**：同一条请求现在报 `kind=quota-exhausted`，不再是 `auth`。
+  - **测试 +27（515 → 542）**：`tests/upstream.spec.ts` +17（逐字锚定现场抓到的 `HTTP 403 {"code":"110","message":"Billing daily count exceeded"}`；整族码覆盖；`105` 仍判 auth；认不出的码回落；**六条真路径全部端到端钉住**），`tests/index.spec.ts` +6（`liveRequestProbe` 的映射、原文必带、空原因不写成空串、**PAT 不落盘**、内容策略与不可映射 kind 不写池），`tests/locales.spec.ts` +4（渲染后的实际文字，不是 key 名）。
+  - **真接线是六条，不是两条 —— 这是本轮最该诚实记下的一句。** 第一稿只给 `chatStream` 的非 200 分支和 SSE 信封补了端到端测试，**忘了还有四个调用点同样只按状态分类却一个测试都没有**（换令牌 `/jobToken`、积分主路径 `/me/usage`、签到 `/campaigns/**`、模型列表 `/model/list`）。改完那四处之后做了「退化回只看状态」的变异：前两个与信封都立刻被接住，而**模型列表那条跑出的是全绿** —— 又一个漏掉的接线。补上 `fetchModels` 钉住它之后，六个调用点各自退化**都**被对应测试接住。教训还是同一个：分判据（`classifyFailure`）写得再准，**只要有一条真路径没接线，全量测试照样绿**。
+  - **八组变异测试**：业务码优先整体关掉 / 信封路径退回只看状态 / `chatStream` 退回只看状态 / 换令牌路径退回只看状态 / 积分主路径退回只看状态 / 签到路径退回只看状态 / 模型列表路径退回只看状态（第一遍**没被接住**，补测试后才接住）/ 丢掉上游原文 / 从配额族删掉 `110` / `businessCodeOf` 不认裸数字 / 文案退回「积分耗尽」与「积分包 {at} 刷新」—— 各自被对应测试接住。
+  - **两处诚实记录**：(a) 第一轮变异（只改 `chatStream` 那一行）跑出全绿，正是「真路径没测试」的直接证据 —— 这不是免责，是当时漏掉另外四处的根因；(b) 一次变异脚本的 perl 正则报错（未闭合括号）导致该组**根本没落地**，当时的「通过」是假信号，重跑并校验「变异确已落地」之后才有结论。
+- **既有误判记录会不会一直卡着用户**：不会，但要说清路径。升级后第一次对话仍会失败（今天确实用满了），而这次失败会**覆写**那条记录为 `out-of-credit` —— 它带 30 分钟兜底冷却，会自动回池。`resolveServing`（首发射给谁）**不看探针**，只有池内故障转移与卡片「已排除」芯片看，所以直接选中该账号的用户始终能正常用它。上游对 110 **没给恢复时刻**（英文原文里没有可解析的重置句子），插件因此**不自造零点**，按既有的 30 分钟兜底重试；真正的恢复以用量周期为准。
+- **忙碌遮罩（保存 / 删除 / 导入时那层）改用宿主主题令牌，spinner 换成宿主同款弧线。** 对齐同族 `dsh-connect-workbuddy` 4.4.2（同一处缺陷的修复），三处自造值逐一换掉：
+  - 遮罩底色原写死 `rgba(0,0,0,.38)` —— 既不跟主题也没有宿主的模糊。改用宿主自己遮罩用的 `--dsw-alias-bg-mask-1`（亮 `.24` / 暗 `.5`）+ `--dsw-mask-blur`，与外壳里其他遮罩一致。
+  - 卡片底色原用 `--dsw-alias-bg-primary`，**这个变量在宿主令牌集里根本不存在**（宿主只有 `bg-base` / `bg-layer-1..3` / `bg-module-platform` / `bg-overlay`），于是一路回退到本文件写死的近黑 `#1b1c20` —— 这就是「一块黑板子、上面的字看不清」的根因。改用宿主给弹层用的 `--dsw-alias-bg-layer-2`，亮暗两套各自成立；阴影也换成宿主自己的 `--dsw-elevation-prominent`。
+  - 提示行原用 `label-tertiary` —— 那是宿主最暗的一档（亮 `neutral-bluish-600` / 暗 `neutral-bluish-400`），给元数据用的，不该承载一句要等的人必须读的话。改用 `label-secondary`。
+  - **spinner**：原是 18px 的 CSS border 环、`.7s` 匀速转，比宿主自己的状态转圈（`_dsh-state-dot-spin`：SVG 弧线 + dash 呼吸、`1.5s`）快了近一倍 —— 比起形状，**这个速度差才是它看着廉价的主因**。改为同款弧线几何与 `1.5s` 节奏，`currentColor` 继承所在层级，reduced-motion 降级为静态弧线（与宿主降级方式一致），并补 `aria-hidden` 免得 `role="status"` 之外多报一次。
+  - 测试 +4（`tests/styles.spec.ts` 6 → 10）。**其中一条断言第一版是空转的，已修**：`toContain('--dsw-alias-bg-layer-2')` 对全文匹配 —— 该令牌在文件里另有 7 处出处，于是把遮罩退回自造值也照样通过。改成按 `ruleOf(...)` 取**遮罩规则自己的声明体**断言，五组变异（卡片底色退回 `bg-primary` / 遮罩退回写死黑幕 / hint 退回 `label-tertiary` / spinner 退回 18px border 环 / 删掉 dash keyframes）才各自转红。另有一条守卫按**源文件顶层语句数**断言，专防「模板字符串里的反引号提前截断整个样式表、而 typecheck 与 build 都不报错」（同族真实踩过）。
+
+## 0.4.1 (2026-10-13)
+
+0.4.0 上线后一小时里回来的两个小修：**签到单元格那句自相矛盾的文案**（用户实拍），以及**连红 6 次的 windows CI job**。后者顺带暴露了一个流程洞：发布只跑本地 `check`（macOS），没人看 CI。
+
+### Fixed
+
+- **签到那一格「已签到 · 00:39:22 后刷新」自相矛盾 —— 两句话说的是不同的窗**（用户实拍，并直接指出：「这个是 39 分钟后可以签到，所以不能显示已签到」）。
+  - **根因是两个字段来自两个窗口**：`checkedInToday` 是**上一窗**的 `claimStatus`，而 `checkinRefreshAtMs` 是那一窗的 `endAt` —— 也就是**下一窗什么时候开**。并排读就成了「今天已经签完，可 39 分钟后又有事可做」。`due` 态更糟：「已签到 · 现在可以领取」，七个字里自我否定。
+  - **修法：一格只说一句话**，四态各一句 —— 未知 / 「已签到」（上游没给开窗时刻）/ 「`HH:MM:SS` 后可再签到」/ 「现在可以签到」。去掉「已签到」**不丢任何事实**：「**再**签到」本身已经蕴含这一窗签过了。
+  - **「后刷新」也一并改掉**：旧措辞字面说的是「这一行多久刷新」，而那个数字其实是**可再签的时刻**，两回事。悬停提示同步点明，并与 Qoder 网页的倒计时对齐（同一个 `endAt`）。
+  - 样式：`next` 那格去掉 `margin-left`（它现在是这一格的主句，不再是附注），保留 `tabular-nums` 防逐秒抖动。
+  - **测试的结构性缺口（记下来，这类文案 bug 的唯一防线）**：`tests/pool-render.spec.tsx` 的 `t` 是**保留 key** 的假翻译器 —— 它能钉住「用了哪个 key」，**永远钉不住「这句话读起来通不通」**；而且此前**没有任何测试 import 过 `locales`**。这句矛盾文案就是这么发出去的。新增 `tests/locales.spec.ts`，用**真实 locale 表**断言用户实际看到的字符串（含 `{countdown}` 渲染后的整句），钉住「不并排已签到」「不说刷新」「title 里不放 Markdown 星号」。三组变异测试：把「已签到」并回倒计时格 / 文案改回「后刷新」/ 并回到 due 态 —— 各自被对应测试接住。
+
+### Tests
+
+- **CI 的 windows job 连红 6 次 —— 断言了 Windows 表达不了的东西。** `expected 438 to be 384`（`0o666` vs `0o600`），出在 `tests/accounts.spec.ts` 的保险库权限位那条；ubuntu job 一直是绿的。
+  - **不是写入路径的 bug**：`src/accounts.ts` 确实请求了 `mode: 0o600`。是 node 在 Windows 上只把「只读」一位映射进 `st_mode`，普通文件一律报 `0o666` —— 写什么权限都读不回来；那边的文件保护由 `%USERPROFILE%` 的 NTFS ACL 承担，与 mode 位无关。
+  - **为什么红了 6 次没人管**：这条断言是 `5002aa4` **引入时就带着病**（上一个绿 run `0c865e1` 还没有这个文件），此后每次 push 都精确红在同一条上。真正的问题不是断言写错，是**没人看 CI** —— 发布流程只跑本地 `pnpm run check`（绿），而本地是 macOS，恰好是这条断言能过的平台。
+  - **修法**：`it.skipIf(process.platform === 'win32')`，**不是**把断言改成 `0o666` —— 那等于把平台限制钉成「正确行为」，将来写入路径真的丢掉 0600 就再也测不出来。跳过会留在 CI 报告里（已核实：windows job 打印 `accounts.spec.ts (24 tests | 1 skipped)`）。顺带把这条测试拆成两个（区域分键 vs 权限位），失败时能直接看出是哪一半。
+
+### Docs
+
+- **`RELEASING.md` 新增第 5.5 步「CI 双平台必须转绿（不得跳过）」。** 上面的红灯红了 6 次而无人察觉，根因是发布门禁只有第 1 步的本地 `pnpm run check` —— 本机是 macOS，恰好是那条断言能过的平台，而 CI 的 windows job 从来没进过清单。新步骤要求：核对最新 run 的 `headSha` **就是**本次推的提交、**两个 job 都 success**（不是只看 overall）、有 skipped 时确认是有意的跳过。第 1 步旁加了指向它的警示。
+  - **编号用 5.5 而不重排 6-10**：正文里已有「第 7 步」「第 8 步」「第 9 步」的交叉引用（2FA、registry 核验、GitHub Release），重排会让它们全部错位 —— 沿用 §2.5 的既有先例。
+
 ## 0.4.0 (2026-10-13)
 
 0.3.0 发布后挖出的四条修复，外加一条有意的旧行为移除。四条里两条是 0.3.0 自己带出来的伤：**npm 上 0.3.0 的 peer 范围装不进当前 DSH**（装上即 `ERESOLVE`，必须尽快覆盖掉），以及**国际版需要的第二族令牌**；另两条是用户实拍回来的（思考强度间歇性消失、签到倒计时）。其中思考强度那条经历了一次返工 —— 第一版修复在生产路径上是**死代码**，险些带着假说明发布，经过与返工都记在条目里。
@@ -60,6 +125,7 @@
     - **上游没给 `endAt` 就不显示倒计时**，绝不用本地零点或「上次 +24h」编一个。
   - **顺带修掉一个真缺陷**：客户端最初把「已领取但上游没给时间」与「倒计时走完了」都表达成 `countdownText(...) === ''`，于是前者被渲染成「现在可以领取」—— 把「不知道下一窗什么时候开」说成了「已经可以领了」。改成四态（`off` / `unknown` / `ticking` / `due`）。测试接住了它：先写成两态时那条断言立刻失败。
   - 测试 +17（`tests/checkin-countdown.spec.ts` 新建 7 条、`tests/upstream.spec.ts` +5、`tests/pool-render.spec.tsx` +5），**用实测值锚定**（`endAt = 1791856740`，倒计时断言精确到 `09:22:23`）。四组变异测试：`already-claimed` 丢掉刷新时刻 / `unknown` 塌成 `due` / 宿主快照丢掉 `refreshAtMs` / 上游缺字段时仍然编一个 —— 各自被对应测试接住。
+  - **本条的单元格文案在 0.4.1 被推翻**（「已签到 · 倒计时」并排自相矛盾）—— 见 0.4.1 的第一条。发布说明里那句「已签到的行显示『已签到 · HH:MM:SS 后刷新』」随之改正。
 
 ### Changed
 

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { S as deriveFingerprint, _ as piAiRuntimeInfo, d as qoderAccountsPath, f as QODER_PAT_ENV_VARS, h as patFromEnv, i as readHostHeartbeat, n as isHeartbeatProcessAlive, o as qoderPoolStorePath, r as qoderHostHeartbeatPath, u as QoderAccountStore, v as QODER_REGIONS, x as isQoderUpstreamError, y as QoderUpstreamClient } from "./host-heartbeat-BNuj6Lt_.js";
+import { S as deriveFingerprint, _ as piAiRuntimeInfo, d as qoderAccountsPath, f as QODER_PAT_ENV_VARS, h as patFromEnv, i as readHostHeartbeat, n as isHeartbeatProcessAlive, o as qoderPoolStorePath, r as qoderHostHeartbeatPath, u as QoderAccountStore, v as QODER_REGIONS, x as isQoderUpstreamError, y as QoderUpstreamClient } from "./host-heartbeat-DOru8uF9.js";
 import { rm } from "node:fs/promises";
 //#region src/bin.ts
 /**

package/lib/client.js

@@ -474,6 +474,48 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/client/BusyOverlay.tsx
 		/**
+		* The shared busy veil's spinner: an arc that breathes while it turns.
+		*
+		* Deliberately the host's own state-spinner shape (dsh's `_dsh-state-dot-spin`)
+		* rather than a border-ring: a two-tone CSS ring at .7s read as a loading
+		* indicator from another decade and was out of step with every spinner in the
+		* shell. The motion lives in CSS (`dsm-qoder-veil-spin` / `-dash`), so this
+		* element only describes the geometry; `currentColor` lets it inherit whatever
+		* tier it sits in.
+		*
+		* `aria-hidden` because the veil's `role="status"` already announces the
+		* message — a second announcement from a decorative arc is noise.
+		*
+		* 对齐：dingminhua/dsh-connect-workbuddy 的 VeilSpinner（MIT，LaoDing）。类名换
+		*   `dsm-qoder-*`，几何与节奏（20px / 1.5s / dash 呼吸 / currentColor）逐条沿用。
+		*/
+		function VeilSpinner() {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("svg", {
+				className: "dsm-qoder-veil-spinner",
+				viewBox: "0 0 20 20",
+				"aria-hidden": "true",
+				focusable: "false",
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
+					className: "dsm-qoder-veil-spinner-track",
+					cx: "10",
+					cy: "10",
+					r: "8",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "2"
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("circle", {
+					className: "dsm-qoder-veil-spinner-arc",
+					cx: "10",
+					cy: "10",
+					r: "8",
+					fill: "none",
+					stroke: "currentColor",
+					strokeWidth: "2",
+					strokeLinecap: "round"
+				})]
+			});
+		}
+		/**
 		* The veil. Deliberately NOT a modal dialog: it carries no focusable control
 		* and no dismissal — there is nothing for the user to decide, only a step to
 		* wait through.
@@ -488,10 +530,7 @@ window.__ModuleLoader__.load({
 				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 					className: "dsm-qoder-veil-card",
 					children: [
-						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: "dsm-qoder-veil-spinner",
-							"aria-hidden": "true"
-						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(VeilSpinner, {}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: "dsm-qoder-veil-text",
 							children: message
@@ -1373,17 +1412,18 @@ window.__ModuleLoader__.load({
 												className: "dsm-qoder-pool-unknown",
 												title: t("row.poolNeverTested"),
 												children: t("row.poolCheckinUnknown")
-											}) : account.checkedInToday ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-												className: "dsm-qoder-pool-checked",
-												children: t("row.poolCheckedIn")
-											}), checkinCountdown.state === "ticking" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											}) : account.checkedInToday ? checkinCountdown.state === "ticking" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 												className: "dsm-qoder-pool-checkin-next",
 												title: t("row.poolCheckinNextHint"),
 												children: t("row.poolCheckinNext", { countdown: checkinCountdown.text })
 											}) : checkinCountdown.state === "due" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 												className: "dsm-qoder-pool-checkin-due",
+												title: t("row.poolCheckinDueHint"),
 												children: t("row.poolCheckinDue")
-											}) : null] }) : t("row.poolNotCheckedIn")
+											}) : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "dsm-qoder-pool-checked",
+												children: t("row.poolCheckedIn")
+											}) : t("row.poolNotCheckedIn")
 										}) : null,
 										/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 											className: "dsm-qoder-pool-row-actions",
@@ -2534,11 +2574,12 @@ window.__ModuleLoader__.load({
 .dsm-qoder-pool-check input{margin:0;cursor:pointer;accent-color:var(--dsw-alias-brand-primary,#5686fe)}
 .dsm-qoder-pool-check input:disabled{cursor:default;opacity:.5}
 .dsm-qoder-pool-checked{color:var(--dsw-alias-state-success-primary,#22a06b)}
-/* 「已签到 · 09:22:23 后刷新」：倒计时是上游给的刷新时刻，逐秒变化，所以给它
-   等宽数字（tabular-nums）—— 否则位数一变整格宽度就抖，表格列跟着左右晃。
-   颜色刻意比「已签到」弱一档：已签到是状态，倒计时是附注，不该抢读。 */
-.dsm-qoder-pool-checkin-next{margin-left:6px;font-variant-numeric:tabular-nums;font-feature-settings:"tnum";color:var(--dsw-alias-label-tertiary,#999)}
-.dsm-qoder-pool-checkin-due{margin-left:6px;color:var(--dsw-alias-state-success-primary,#22a06b)}
+/* 倒计时那一格现在是**唯一**的一句话（不再与「已签到」并排），所以没有 margin-left。
+   数字逐秒变化，给它等宽数字（tabular-nums）—— 否则位数一变整格宽度就抖，表格列
+   跟着左右晃。颜色沿用单元格本身的 label-tertiary：它就是这一格的主句。 */
+.dsm-qoder-pool-checkin-next{font-variant-numeric:tabular-nums;font-feature-settings:"tnum"}
+/* 到点之后同样是主句、不缩进；绿色表示「此刻有事可做」，与「已签到」同色。 */
+.dsm-qoder-pool-checkin-due{color:var(--dsw-alias-state-success-primary,#22a06b)}
 .dsm-qoder-pool-unknown{color:var(--dsw-alias-label-dimmed,#9aa0a6)}
 .dsm-qoder-pool-member{color:var(--dsw-alias-brand-primary,#5686fe)}
 .dsm-qoder-pool-not-member{color:var(--dsw-alias-label-dimmed,#9aa0a6)}
@@ -2646,14 +2687,53 @@ window.__ModuleLoader__.load({
 .dsm-qoder-addpat-doc a{color:var(--dsw-alias-brand-primary,#5686fe);font-size:12px;line-height:18px;text-decoration:none}
 .dsm-qoder-addpat-doc a:hover{text-decoration:underline}
 /* The shared busy veil: a fixed overlay for operations whose result only shows
-   up after the list re-read. It is NOT a modal. */
-.dsm-qoder-veil{position:fixed;inset:0;z-index:60;display:flex;align-items:center;justify-content:center;background:rgba(0,0,0,.38);cursor:progress}
-.dsm-qoder-veil-card{display:flex;flex-direction:column;align-items:center;gap:8px;max-width:min(340px,80vw);padding:16px 20px;border:1px solid var(--dsw-alias-border-l2,#3a3d45);border-radius:12px;background:var(--dsw-alias-bg-primary,#1b1c20);box-shadow:0 8px 28px rgba(0,0,0,.35)}
-.dsm-qoder-veil-text{font-size:13px;line-height:20px;color:var(--dsw-alias-label-primary,#e8e9ed);text-align:center}
-.dsm-qoder-veil-hint{font-size:12px;line-height:18px;color:var(--dsw-alias-label-tertiary,#999);text-align:center}
-.dsm-qoder-veil-spinner{width:18px;height:18px;border:2px solid var(--dsw-alias-border-l2,#3a3d45);border-top-color:var(--dsw-alias-brand-primary,#5686fe);border-radius:50%;animation:dsm-qoder-veil-spin .7s linear infinite}
+   up after the list re-read (remove / import / add). It is NOT a modal: no
+   control, no dismissal — only "this is running" and "here is why nothing
+   moved yet". Fixed positioning so it covers the card regardless of which
+   section started the operation, and a semi-transparent backdrop so the table
+   stays visible underneath — the user is watching a specific row change, and
+   hiding it would defeat the point.
+
+   The mask and the card surface are the HOST's own tokens, not this file's
+   invention. --dsw-alias-bg-mask-1 + --dsw-mask-blur is exactly what the
+   host's own overlays use (see dsh-client-ui-settings-general's Dws9Sa_mask),
+   so the veil now dims the way every other overlay in the shell does instead
+   of laying its own black wash on top. The previous hardcoded rgba(0,0,0,.38)
+   was tuned against neither theme: too weak next to the host's .24 mask in
+   light mode, and it ignored the host's blur entirely.
+
+   bg-layer-2 (not bg-primary, which does not exist in the host's token set
+   at all and therefore always fell through to this file's near-black #1b1c20)
+   is the same surface the host puts behind its panels — that near-black fallback
+   is what made the veil read as a black slab with unreadable text on it. */
+.dsm-qoder-veil{position:fixed;inset:0;z-index:60;display:flex;align-items:center;justify-content:center;background:var(--dsw-alias-bg-mask-1,rgba(0,0,0,.32));backdrop-filter:var(--dsw-mask-blur);cursor:progress}
+/* --dsw-elevation-prominent is the host's own panel shadow (a hairline stroke
+   plus two soft layers); the previous 0 8px 28px rgba(0,0,0,.35) was a
+   hand-rolled drop shadow that read as a heavy grey box. */
+.dsm-qoder-veil-card{display:flex;flex-direction:column;align-items:center;gap:8px;max-width:min(340px,80vw);padding:16px 20px;border:1px solid var(--dsw-alias-border-l2,#0000001a);border-radius:12px;background:var(--dsw-alias-bg-layer-2,#fff);box-shadow:var(--dsw-elevation-prominent,0 8px 28px rgba(0,0,0,.35))}
+.dsm-qoder-veil-text{font-size:13px;line-height:20px;color:var(--dsw-alias-label-primary,#0f1115);text-align:center}
+/* label-secondary, not label-tertiary: this line carries the operation's
+   detail and must stay legible. tertiary is the host's dimmest tier
+   (neutral-bluish-600 on light, neutral-bluish-400 on dark) and is meant
+   for metadata, not for a sentence the user has to read while waiting. */
+.dsm-qoder-veil-hint{font-size:12px;line-height:18px;color:var(--dsw-alias-label-secondary,#61666b);text-align:center}
+/* The spinner proves the UI is alive when the row under it has not changed yet
+   — which is precisely the confusion the veil exists to remove. It follows the
+   host's own state spinner (dsh's _dsh-state-dot-spin): an SVG arc whose
+   dash breathes while it turns, currentColor so it inherits the tier it sits
+   in, and the same 1.5s beat. The previous 18px border-ring at .7s was roughly
+   twice the host's speed and visibly out of step with every other spinner in
+   the shell — that mismatch, more than the shape itself, is what made it look
+   cheap.
+
+   Reduced-motion users get the static arc rather than a frozen ring, matching
+   how the host degrades its own spinner. */
+.dsm-qoder-veil-spinner{width:20px;height:20px;color:var(--dsw-alias-label-secondary,#61666b);animation:dsm-qoder-veil-spin 1.5s linear infinite}
+.dsm-qoder-veil-spinner-track{opacity:.25}
+.dsm-qoder-veil-spinner-arc{stroke-dasharray:12 150;animation:dsm-qoder-veil-dash 1.5s ease-in-out infinite}
 @keyframes dsm-qoder-veil-spin{to{transform:rotate(360deg)}}
-@media (prefers-reduced-motion: reduce){.dsm-qoder-veil-spinner{animation:none}}
+@keyframes dsm-qoder-veil-dash{0%{stroke-dasharray:12 150;stroke-dashoffset:0}50%{stroke-dasharray:24 150;stroke-dashoffset:-6}to{stroke-dasharray:12 150;stroke-dashoffset:0}}
+@media (prefers-reduced-motion: reduce){.dsm-qoder-veil-spinner{animation:none}.dsm-qoder-veil-spinner-arc{animation:none;stroke-dasharray:18 150;stroke-dashoffset:-3}}
 `;
 		/**
 		* Composer credit readout styles, injected by the readout component itself.
@@ -4317,8 +4397,8 @@ window.__ModuleLoader__.load({
 				"row.probeOkMs": "✓ 可用（{ms}）",
 				"row.probeRateLimitedUnknown": "✗ 被限流 · 上游未给出何时恢复",
 				"row.probeRateLimitedAt": "✗ 被限流 · {at} 之后可再用",
-				"row.probeOutOfCreditUnknown": "✗ 积分不足 · 上游未给出何时恢复",
-				"row.probeOutOfCreditAt": "✗ 积分不足 · 积分包 {at} 刷新",
+				"row.probeOutOfCreditUnknown": "✗ 用量已达上限 · 上游未给出何时恢复",
+				"row.probeOutOfCreditAt": "✗ 用量已达上限 · {at} 恢复",
 				"row.probeCredentialRejected": "✗ Qoder 拒绝了这个账号的 PAT——请添加新 PAT 或换一个账号",
 				"row.probePolicyRejected": "✗ Qoder 服务端按内容策略拒绝了这次请求——重新添加 PAT 无效",
 				"row.probeNotFound": "✗ 上游不认识这个模型",
@@ -4330,7 +4410,7 @@ window.__ModuleLoader__.load({
 				"row.docsHint": "如何创建 PAT？",
 				"row.poolTitle": "账号池",
 				"row.poolNoCandidate": "账号池里目前没有可用的账号。",
-				"row.poolNoCandidateHint": "成员要么在限流冷却中、要么积分耗尽、要么凭据被拒、要么上游无响应。限流、积分耗尽与瞬时故障都会自动回池——按上游给出的恢复时间，没给时间就按 30 分钟兜底，不需要你操作；只有「凭据被拒」需要换一个新 PAT。",
+				"row.poolNoCandidateHint": "成员要么在限流冷却中、要么用量已达上限、要么凭据被拒、要么上游无响应。限流、用量上限与瞬时故障都会自动回池——按上游给出的恢复时间，没给时间就按 30 分钟兜底，不需要你操作；只有「凭据被拒」需要换一个新 PAT。",
 				"row.poolEmptyHint": "这个区域还没有账号。用上面的「添加 PAT」粘贴一个，或用「导出 / 导入账号」把别的机器上的账号搬过来 —— 账号池、模型测试与每日签到都需要至少一个账号。",
 				"row.poolTestAll": "一键测试所有账号",
 				"row.poolCheckinAll": "一键签到所有账号",
@@ -4362,15 +4442,16 @@ window.__ModuleLoader__.load({
 				"row.poolCheckedIn": "已签到",
 				"row.poolNotCheckedIn": "未签到",
 				"row.poolCheckinUnknown": "—",
-				"row.poolCheckinNext": "· {countdown} 后刷新",
-				"row.poolCheckinNextHint": "这一窗已经领过了。下一窗在上游给出的时刻开放 —— 与 Qoder 网页上的倒计时是同一个数。",
-				"row.poolCheckinDue": "· 现在可以领取",
+				"row.poolCheckinNext": "{countdown} 后可再签到",
+				"row.poolCheckinNextHint": "这一窗已经签到过了。这个数字是下一窗什么时候开（到点就能再签），与 Qoder 网页上的倒计时是同一个数 —— 不是「这一行多久刷新」。",
+				"row.poolCheckinDue": "现在可以签到",
+				"row.poolCheckinDueHint": "下一窗已经开了，这个账号现在可以再签。「已签到」说的是上一窗，所以这里不再重复它。",
 				"row.poolNeverTested": "尚未测试",
 				"row.poolTestedAt": "测试于 {at}",
 				"row.poolCreditSoon": "{count} 积分 3 天内过期",
 				"row.poolCreditNearest": "最近积分包 {at} 过期",
 				"row.poolExcludedRateLimited": "被限流",
-				"row.poolExcludedOutOfCredit": "积分耗尽",
+				"row.poolExcludedOutOfCredit": "用量已达上限",
 				"row.poolExcludedRejected": "被拒绝",
 				"row.poolExcludedUnusable": "不可用",
 				"row.poolRetryAt": "{at} 之后可再用",
@@ -4583,8 +4664,8 @@ window.__ModuleLoader__.load({
 				"row.probeOkMs": "✓ Usable ({ms})",
 				"row.probeRateLimitedUnknown": "✗ Rate limited · the upstream gave no time for when it frees up",
 				"row.probeRateLimitedAt": "✗ Rate limited · usable again after {at}",
-				"row.probeOutOfCreditUnknown": "✗ Not enough credits · the upstream gave no time for when it frees up",
-				"row.probeOutOfCreditAt": "✗ Not enough credits · quota refreshes {at}",
+				"row.probeOutOfCreditUnknown": "✗ Usage limit reached · the upstream gave no time for when it frees up",
+				"row.probeOutOfCreditAt": "✗ Usage limit reached · recovers {at}",
 				"row.probeCredentialRejected": "✗ Qoder refused this account's PAT — add a new one or pick another account",
 				"row.probePolicyRejected": "✗ Qoder's server refused this request under its content policy — re-adding the PAT will not help",
 				"row.probeNotFound": "✗ The upstream does not know this model",
@@ -4596,7 +4677,7 @@ window.__ModuleLoader__.load({
 				"row.docsHint": "How to create a PAT?",
 				"row.poolTitle": "Account pool",
 				"row.poolNoCandidate": "No account in this pool can be used right now.",
-				"row.poolNoCandidateHint": "Members are rate-limited, out of credits, rejected, or unreachable. Rate limits, drained quotas and transient failures return to the pool on their own — at the time the upstream states, or after a 30-minute fallback. Only a rejected credential needs a new PAT.",
+				"row.poolNoCandidateHint": "Members are rate-limited, at their usage limit, rejected, or unreachable. Rate limits, usage limits and transient failures return to the pool on their own — at the time the upstream states, or after a 30-minute fallback. Only a rejected credential needs a new PAT.",
 				"row.poolEmptyHint": "This region has no accounts yet. Use “Add PAT” above to paste one, or “Export / import accounts” to bring them over from another machine — the pool, the model tests and the daily check-in all need at least one account.",
 				"row.poolTestAll": "Test all accounts",
 				"row.poolCheckinAll": "Claim daily credits",
@@ -4628,15 +4709,16 @@ window.__ModuleLoader__.load({
 				"row.poolCheckedIn": "Checked in",
 				"row.poolNotCheckedIn": "Not checked in",
 				"row.poolCheckinUnknown": "—",
-				"row.poolCheckinNext": "· next in {countdown}",
-				"row.poolCheckinNextHint": "This daily window has been claimed. The next one opens at the time the upstream stated (the same countdown the Qoder web page shows).",
-				"row.poolCheckinDue": "· claimable now",
+				"row.poolCheckinNext": "Claimable again in {countdown}",
+				"row.poolCheckinNextHint": "This daily window has been claimed. The number is when the NEXT window opens (claim again then) — the same countdown the Qoder web page shows, not how often this row refreshes.",
+				"row.poolCheckinDue": "Claimable now",
+				"row.poolCheckinDueHint": "The next window has opened, so this account can claim again now. \"Checked in\" referred to the previous window, so it is not repeated here.",
 				"row.poolNeverTested": "Not tested yet",
 				"row.poolTestedAt": "Tested {at}",
 				"row.poolCreditSoon": "{count} expiring within 3 days",
 				"row.poolCreditNearest": "Nearest package expires {at}",
 				"row.poolExcludedRateLimited": "Rate limited",
-				"row.poolExcludedOutOfCredit": "Out of credits",
+				"row.poolExcludedOutOfCredit": "Usage limit reached",
 				"row.poolExcludedRejected": "Rejected",
 				"row.poolExcludedUnusable": "Unusable",
 				"row.poolRetryAt": "Back after {at}",

package/lib/{host-heartbeat-BNuj6Lt_.js → host-heartbeat-DOru8uF9.js}

@@ -693,7 +693,7 @@ var QoderUpstreamClient = class {
 			body
 		});
 		const text = await resp.text();
-		if (resp.status !== 200) throw new QoderUpstreamError(classifyHttpStatus(resp.status, text), `jobToken 交换失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status);
+		if (resp.status !== 200) throw new QoderUpstreamError(classifyFailure(resp.status, text), `jobToken 交换失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status, businessCodeOf(text));
 		let data;
 		try {
 			data = JSON.parse(text);
@@ -884,7 +884,7 @@ var QoderUpstreamClient = class {
 		});
 		if (resp.status !== 200) {
 			const errText = await resp.text();
-			throw new QoderUpstreamError(classifyHttpStatus(resp.status, errText), `聊天请求失败: HTTP ${resp.status} ${truncate(errText, 300)}`, resp.status);
+			throw new QoderUpstreamError(classifyFailure(resp.status, errText), `聊天请求失败: HTTP ${resp.status} ${truncate(errText, 300)}`, resp.status, businessCodeOf(errText));
 		}
 		if (!resp.body) throw new QoderUpstreamError("transient", "聊天响应没有 body");
 		const reader = resp.body.getReader();
@@ -962,7 +962,7 @@ var QoderUpstreamClient = class {
 			...signal === void 0 ? {} : { signal }
 		});
 		const text = await resp.text();
-		if (resp.status !== 200) throw new QoderUpstreamError(classifyHttpStatus(resp.status, text), `请求失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status);
+		if (resp.status !== 200) throw new QoderUpstreamError(classifyFailure(resp.status, text), `请求失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status, businessCodeOf(text));
 		try {
 			return JSON.parse(text);
 		} catch {
@@ -1078,7 +1078,7 @@ var QoderUpstreamClient = class {
 			...signal === void 0 ? {} : { signal }
 		});
 		const text = await resp.text();
-		if (resp.status !== 200 && resp.status !== 201) throw new QoderUpstreamError(classifyHttpStatus(resp.status, text), `请求失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status);
+		if (resp.status !== 200 && resp.status !== 201) throw new QoderUpstreamError(classifyFailure(resp.status, text), `请求失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status, businessCodeOf(text));
 		try {
 			return JSON.parse(text);
 		} catch {
@@ -1145,7 +1145,7 @@ var QoderUpstreamClient = class {
 			...signal === void 0 ? {} : { signal }
 		});
 		const text = await resp.text();
-		if (resp.status !== 200) throw new QoderUpstreamError(classifyHttpStatus(resp.status, text), `请求失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status);
+		if (resp.status !== 200) throw new QoderUpstreamError(classifyFailure(resp.status, text), `请求失败: HTTP ${resp.status} ${truncate(text, 200)}`, resp.status, businessCodeOf(text));
 		try {
 			return JSON.parse(text);
 		} catch {
@@ -1188,7 +1188,7 @@ function parseStreamDelta(dataPayload) {
 	const scv = wrapper.statusCodeValue;
 	if (scv !== void 0 && scv !== null && Number(scv) !== 200) {
 		const detail = typeof wrapper.body === "string" ? wrapper.body : dataPayload.slice(0, 400);
-		throw new QoderUpstreamError(classifyHttpStatus(Number(scv), detail), `上游信封错误: HTTP ${scv} ${truncate(detail, 300)}`, Number(scv));
+		throw new QoderUpstreamError(classifyFailure(Number(scv), detail), `上游信封错误: HTTP ${scv} ${truncate(detail, 300)}`, Number(scv), businessCodeOf(detail));
 	}
 	const innerStr = wrapper.body;
 	if (typeof innerStr !== "string" || innerStr === "") return void 0;
@@ -1280,12 +1280,93 @@ function classifyHttpStatus(status, detail) {
 	if (status === 418 || status >= 500) return "transient";
 	return "unknown";
 }
-/** 业务 code → 错误分类。 */
+/**
+* 从上游错误体里取**业务码**（`{"code":"110","message":"…"}`）。
+*
+* 上游在这一点上有过两种写法：字符串 `"110"` 与裸数字 `110`，都见过；这里
+* 一律归一成字符串。取不到（不是 JSON、没有 code、code 不是串/数）返回
+* `undefined` —— 调用方据此回落到 HTTP 状态分类，**绝不**把「读不出码」当成
+* 某种结论。
+*/
+function businessCodeOf(detail) {
+	const trimmed = detail.trim();
+	if (!trimmed.startsWith("{")) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null) return void 0;
+	const raw = parsed.code;
+	if (typeof raw === "string" && raw !== "") return raw;
+	if (typeof raw === "number" && Number.isInteger(raw)) return String(raw);
+}
+/**
+* 一次失败的分类：**业务码优先于 HTTP 状态**，状态只作兜底。
+*
+* 这是本轮的根因所在（用户实拍：国际版「Qoder 拒绝了这个账号的 PAT」）。实测
+* 上游对**当日用量用尽**回的是
+*
+* ```
+* HTTP 403 {"code":"110","message":"Billing daily count exceeded"}
+* ```
+*
+* 而旧实现只看状态：`403 → auth → credential-rejected → 「请添加新 PAT」`。
+* 那句话不只是文案难听 —— `credential-rejected` 在账号池里是**无条件永久排除**
+* （`exclusionOf` 连冷却期都不看，理由写得很对：令牌被拒，等也没用）。于是
+* 一个只是今天用满、明天自动恢复的账号被踢出池且**不会自愈**，同时被要求去做
+* 一件根本无效的事（换 PAT）。
+*
+* 官方码表（docs.qoder.com/zh/cli/sdk/errors）里 `105` 才是「登录态或 Access
+* Token 已过期」；`110`/`113`/`115`–`119`/`122` 全是**用量与配额**族。也就是说
+* 「403 就是凭据坏了」这个推断在协议层面根本不成立。
+*
+* 认识的码说了算；不认识的（如 `TOKEN_EXPIRE` 这类字符串码）回落状态分类，
+* 行为与改动前一致。
+*/
+function classifyFailure(status, detail) {
+	const code = businessCodeOf(detail);
+	if (code !== void 0) {
+		const byCode = classifyBusinessCode(code);
+		if (byCode !== "unknown") return byCode;
+	}
+	return classifyHttpStatus(status, detail);
+}
+/** 业务 code → 错误分类（官方码表，见 {@link classifyFailure}）。 */
 function classifyBusinessCode(code) {
 	if (code === "105") return "auth";
-	if (code === "115" || code === "402" || code === "6004") return "quota-exhausted";
+	if (QUOTA_CODES.has(code)) return "quota-exhausted";
+	if (code === "406") return "content-policy";
+	if (REQUEST_CODES.has(code)) return "invalid-request";
+	if (TRANSIENT_CODES.has(code)) return "transient";
 	return "unknown";
 }
+const QUOTA_CODES = /* @__PURE__ */ new Set([
+	"110",
+	"113",
+	"115",
+	"116",
+	"117",
+	"118",
+	"119",
+	"122",
+	"402",
+	"6004"
+]);
+/** 416 范围/结构无法满足 · 430 能力不支持 · 80411 输入过长 · 80412 媒体过多。 */
+const REQUEST_CODES = /* @__PURE__ */ new Set([
+	"416",
+	"430",
+	"80411",
+	"80412"
+]);
+const TRANSIENT_CODES = /* @__PURE__ */ new Set([
+	"500",
+	"10408",
+	"10500",
+	"10605"
+]);
 const CONTENT_POLICY_MARKERS = [
 	"DataInspectionFailed",
 	"inappropriate content",
@@ -1728,7 +1809,7 @@ var QoderAccountStore = class {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const QODER_CONNECT_VERSION = "0.4.0";
+const QODER_CONNECT_VERSION = "0.4.2";
 //#endregion
 //#region src/account-pool-store.ts
 /**

package/lib/index.d.ts

@@ -2,6 +2,8 @@ import z from "@deepseek-ai/schemastery";
 import { Context } from "@deepseek-ai/cordis";
 //#region src/upstream.d.ts
 type QoderRegion = 'cn' | 'global';
+/** 上游错误分类，供 shim 映射为 DSH 可判定的 code。 */
+type UpstreamErrorKind = 'network' | 'auth' | 'rate-limited' | 'invalid-request' | 'content-policy' | 'quota-exhausted' | 'transient' | 'unknown';
 //#endregion
 //#region src/catalog.d.ts
 interface QoderModelInfo {
@@ -47,6 +49,14 @@ interface QoderModelInfo {
  * costs nothing on the Host side either.
  */
 declare const QODER_GITHUB_URL = "https://github.com/dingminhua/dsh-connect-qoder";
+/**
+ * Outcome vocabulary of one model probe, shared by the Host and the card.
+ *
+ * Mirrors `QoderProbeOutcome` in `./probe.ts`; kept as its own declaration
+ * here because this module is the node-free bridge and must not import the
+ * Host-side probe module.
+ */
+type QoderWebProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
 //#endregion
 //#region src/version.d.ts
 /**
@@ -60,6 +70,46 @@ declare const QODER_GITHUB_URL = "https://github.com/dingminhua/dsh-connect-qode
 /** The npm package version this build was produced from. */
 declare const QODER_CONNECT_VERSION: string;
 //#endregion
+//#region src/account-pool.d.ts
+/**
+ * Which of the pool's writers produced a measurement.
+ *
+ * `test-batch` — the user pressed "test", so the outcome is a deliberate
+ *   measurement of the target model.
+ * `live-request` — a real chat request failed and its failure was recorded so
+ *   the NEXT request starts from a measurement instead of rediscovering the
+ *   same wall.
+ */
+type QoderPoolProbeSource = 'test-batch' | 'live-request';
+/**
+ * What the pool knows about ONE account's last test of the target model.
+ *
+ * `undefined` means "never tested", deliberately distinct from every measured
+ * outcome: an untested account is a candidate (the user may want to use it
+ * now) whereas a measured failure is not.
+ */
+interface QoderPoolProbe {
+  outcome: QoderWebProbeOutcome;
+  /** When this measurement was taken, in epoch ms. */
+  atMs: number;
+  /**
+   * WHAT WROTE THIS MEASUREMENT. Absent for any measurement written before the
+   * field existed, so old probe files stay readable — an absent source means
+   * "unknown", never a guess.
+   */
+  source?: QoderPoolProbeSource;
+  /**
+   * When this account may be usable again, when the upstream stated a time.
+   * ABSENT when the upstream named no time — never a locally invented one.
+   */
+  retryAtMs?: number;
+  /**
+   * The upstream's own words on the failure, already redacted by the probe.
+   * ABSENT for a success.
+   */
+  message?: string;
+}
+//#endregion
 //#region src/index.d.ts
 declare const name = "dsh-connect-qoder";
 /** The model registry and settings service required before providers register. */
@@ -122,5 +172,21 @@ declare function regionHasCredential(config: {
   regions?: Record<string, unknown> | null;
 }, region: QoderRegion): boolean;
 declare function apply(ctx: Context, config: Config): void;
+/**
+ * 一次**真实请求**失败要写进账号池的那条测量；kind 不可映射时返回 undefined
+ * （不写：内容策略拒绝是「这一次输入」的事实，不是账号的事实，见
+ * `exclusionOf` 的 policy-rejected 分支）。
+ *
+ * 抽成模块级纯函数并导出，是因为它此前是 `onServingFailure` 里的一段内联字面量，
+ * 而那段代码有一个**已经发生过的**缺陷：上游原文被丢掉（参数写成 `_message`），
+ * 于是池里只有一句结论、没有依据 —— 用户实拍那条 `credential-rejected` 记录连
+ * `message` 都没有，卡片只能空口指控「PAT 被拒」，而真相（`code 110` 当日用量
+ * 用尽）就在被丢掉的那串字符里。探针路径早就带原文（`redactUpstreamText`），
+ * 两条路径写同一个文件却只有一个带。
+ *
+ * 按本项目的既有教训（「判据与动作打包，于是动作有没有真的发生也能被断言」），
+ * 把它做成可测函数而不是留在接线里：接线变异掉，测试照样全绿过一次了。
+ */
+declare function liveRequestProbe(kind: UpstreamErrorKind, message: string): QoderPoolProbe | undefined;
 //#endregion
-export { Config, QODER_CONNECT_VERSION, QODER_GITHUB_URL, apply, asVolatile, catalogSnapshotDeclaresEfforts, inject, name, regionEnabled, regionHasCredential, regionStateOf, serveSavedCatalog, settingsNamespaceOf, unwrapVolatile };
+export { Config, QODER_CONNECT_VERSION, QODER_GITHUB_URL, apply, asVolatile, catalogSnapshotDeclaresEfforts, inject, liveRequestProbe, name, regionEnabled, regionHasCredential, regionStateOf, serveSavedCatalog, settingsNamespaceOf, unwrapVolatile };

package/lib/index.js

@@ -1,4 +1,4 @@
-import { _ as piAiRuntimeInfo, a as writeHostHeartbeat, b as QoderUpstreamError, c as writePoolProbes, h as patFromEnv, l as QODER_CONNECT_VERSION, m as maskPat, p as isQoderAccountId, s as readPoolProbes, t as clearHostHeartbeat, u as QoderAccountStore, x as isQoderUpstreamError, y as QoderUpstreamClient } from "./host-heartbeat-BNuj6Lt_.js";
+import { _ as piAiRuntimeInfo, a as writeHostHeartbeat, b as QoderUpstreamError, c as writePoolProbes, h as patFromEnv, l as QODER_CONNECT_VERSION, m as maskPat, p as isQoderAccountId, s as readPoolProbes, t as clearHostHeartbeat, u as QoderAccountStore, x as isQoderUpstreamError, y as QoderUpstreamClient } from "./host-heartbeat-DOru8uF9.js";
 import { _ as regionOfStatusUrl, a as QODER_MODELS_REFRESH_PATH, c as QODER_REGIONS, d as QODER_SETTINGS_NS, f as QODER_TRANSFER_PATH, g as poolActionOf, h as poolAccountIdOf, i as QODER_GITHUB_URL, m as accountActionOf, n as QODER_ACCOUNTS_REFRESH_PATH, o as QODER_POOL_PATH, p as QODER_USAGE_PATH, r as QODER_ACCOUNT_CREDITS_PATH, s as QODER_PROBE_PATH, t as QODER_ACCOUNTS_PATH, u as QODER_SAVE_PATH, v as transferActionOf, y as unwrapVolatileDeep } from "./status-paths-w2WDUPVS.js";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes, timingSafeEqual } from "node:crypto";
@@ -2418,16 +2418,12 @@ function apply(ctx, config) {
 					};
 				},
 				failoverAccount: async (tried) => nextFailoverCredential(region, tried),
-				onServingFailure: (accountId, kind, _message) => {
-					const outcome = FAIL_OVER_OUTCOME[kind];
-					if (outcome !== void 0 && accountId !== "") {
-						poolRuntime[accountId] = {
-							outcome,
-							atMs: Date.now(),
-							source: "live-request"
-						};
-						writePoolProbes(region, { [accountId]: poolRuntime[accountId] });
-						log(`pool ${region}: ${maskPat(accountId)} marked ${outcome} by live request`);
+				onServingFailure: (accountId, kind, message) => {
+					const probe = liveRequestProbe(kind, message);
+					if (probe !== void 0 && accountId !== "") {
+						poolRuntime[accountId] = probe;
+						writePoolProbes(region, { [accountId]: probe });
+						log(`pool ${region}: ${maskPat(accountId)} marked ${probe.outcome} by live request`);
 					}
 				}
 			}),
@@ -2859,15 +2855,15 @@ function apply(ctx, config) {
 	/** Build the transfer deps once (region-dispatched). */
 	const transferDeps = {
 		exportAccounts: async (region) => {
-			const { transferRecordsFor } = await import("./transfer-CUNaVvmi.js");
+			const { transferRecordsFor } = await import("./transfer-BQMtjWb5.js");
 			return { accounts: transferRecordsFor(region, await stacks[region].store.vaultAccounts()) };
 		},
 		previewImport: async (_region, text) => {
-			const { previewTransferFile } = await import("./transfer-CUNaVvmi.js");
+			const { previewTransferFile } = await import("./transfer-BQMtjWb5.js");
 			return previewTransferFile(text);
 		},
 		importAccounts: async (region, text, indexes) => {
-			const { mergeTransferRecords } = await import("./transfer-CUNaVvmi.js");
+			const { mergeTransferRecords } = await import("./transfer-BQMtjWb5.js");
 			const { changes, imported, skipped } = mergeTransferRecords(region, text, indexes);
 			for (const entry of changes.values()) await stacks[region].store.add(entry.pat, entry.accountName);
 			return {
@@ -3089,5 +3085,30 @@ const FAIL_OVER_OUTCOME = {
 	network: "unavailable",
 	transient: "unavailable"
 };
+/**
+* 一次**真实请求**失败要写进账号池的那条测量；kind 不可映射时返回 undefined
+* （不写：内容策略拒绝是「这一次输入」的事实，不是账号的事实，见
+* `exclusionOf` 的 policy-rejected 分支）。
+*
+* 抽成模块级纯函数并导出，是因为它此前是 `onServingFailure` 里的一段内联字面量，
+* 而那段代码有一个**已经发生过的**缺陷：上游原文被丢掉（参数写成 `_message`），
+* 于是池里只有一句结论、没有依据 —— 用户实拍那条 `credential-rejected` 记录连
+* `message` 都没有，卡片只能空口指控「PAT 被拒」，而真相（`code 110` 当日用量
+* 用尽）就在被丢掉的那串字符里。探针路径早就带原文（`redactUpstreamText`），
+* 两条路径写同一个文件却只有一个带。
+*
+* 按本项目的既有教训（「判据与动作打包，于是动作有没有真的发生也能被断言」），
+* 把它做成可测函数而不是留在接线里：接线变异掉，测试照样全绿过一次了。
+*/
+function liveRequestProbe(kind, message) {
+	const outcome = FAIL_OVER_OUTCOME[kind];
+	if (outcome === void 0) return void 0;
+	return {
+		outcome,
+		atMs: Date.now(),
+		source: "live-request",
+		...message === "" ? {} : { message: redactUpstreamText(message) }
+	};
+}
 //#endregion
-export { Config, QODER_CONNECT_VERSION, QODER_GITHUB_URL, apply, asVolatile, catalogSnapshotDeclaresEfforts, inject, name, regionEnabled, regionHasCredential, regionStateOf, serveSavedCatalog, settingsNamespaceOf, unwrapVolatile };
+export { Config, QODER_CONNECT_VERSION, QODER_GITHUB_URL, apply, asVolatile, catalogSnapshotDeclaresEfforts, inject, liveRequestProbe, name, regionEnabled, regionHasCredential, regionStateOf, serveSavedCatalog, settingsNamespaceOf, unwrapVolatile };

package/lib/{transfer-CUNaVvmi.js → transfer-BQMtjWb5.js}

@@ -1,4 +1,4 @@
-import { g as qoderAccountId } from "./host-heartbeat-BNuj6Lt_.js";
+import { g as qoderAccountId } from "./host-heartbeat-DOru8uF9.js";
 import { l as QODER_REGION_TRANSFER_DOMAIN } from "./status-paths-w2WDUPVS.js";
 //#region src/transfer.ts
 /**

package/package.json

@@ -2,7 +2,7 @@
   "name": "@dmh2002/dsh-connect-qoder",
   "displayName": "DSH Connect Qoder",
   "description": "把 Qoder（通义灵码国内版 / 国际版）接入 DeepSeek Harness：PAT 多账号池、每日签到、积分读数与模型管理。",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",