dsh-cliproxyapi-pro 1.8.0 → 1.9.0

package/CHANGELOG.md

@@ -4,6 +4,14 @@
 
 本插件的所有重要变更。版本号遵循[语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 1.9.0 — 2026-10-25
+
+### 新增
+- **图片和视频生成的总开关。** 「生成」标签顶部新增「启用图片和视频生成」，对所有账号生效。关闭时输入框旁不显示生成按钮，`/cpa-image`、`/cpa-video`、`/cpa-video-edit`、`/cpa-video-extend`、`/cpa-video-status` 不注册，agent 生成工具 `generate_media` 也不注册，「生成」标签只显示这个开关；已提交的视频照常完成，聊天记录里已生成的结果仍可查看（不再提供编辑 / 延长按钮）。新安装默认关闭；已有 `media-settings.json`（字段缺失视为开启）或用过生成（存在 `media-sessions.json` / `media-jobs.json`）的配置保持开启。保存在 `media-settings.json` 的新字段 `enabled` 中。
+
+### 变更
+- **管理密钥被拒绝后最多自动重试 3 次。** 额度查询遇到 CPA 管理接口 401/403 时，按 5 分钟缓存周期在后台继续尝试，连续 3 次被拒绝后停止自动查询（CPA 对同一地址累计 5 次错误密钥会封禁 30 分钟）。失败次数保存在 `.dsh-cliproxyapi/quota-state.json`（不含密钥），重启 DSH 或重载插件后继续计数。保存新的管理密钥（包括在 DSH 凭证页修改）、清除密钥或一次成功的查询会清零；停止后手动刷新只再试一次，再被拒绝立即停止。额度页和输入框徽标显示「已连续被拒绝 n/3 次」或已停止的说明，`/cpa-status` 也会注明。之前的版本在第一次被拒绝后就暂停（仅在本次运行内有效）。
+
 ## 1.8.0 — 2026-10-22
 
 ### 新增

package/README.en.md

@@ -49,7 +49,7 @@ The plugin is published on npm as [`dsh-cliproxyapi-pro`](https://www.npmjs.com/
    dsh-cliproxyapi-pro
    ```
 
-   To pin a version, write `dsh-cliproxyapi-pro@1.8.0`.
+   To pin a version, write `dsh-cliproxyapi-pro@1.9.0`.
 4. Click **Install**. When it finishes, the dialog offers to enable the plugin right away — accept it.
 
 > If downloads are slow in mainland China, open **Registry** next to the input and choose **the mainland China mirror**.
@@ -78,7 +78,7 @@ In **Add plugin**, or as the `plugin_manager` `target`, you can also enter:
 
 | Source | What to enter |
 |---|---|
-| A released version | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#v1.8.0` |
+| A released version | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#v1.9.0` |
 | Latest development version | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#main` |
 | Offline package | Download [`dsh-cliproxyapi-pro.tgz`](https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro/releases/latest/download/dsh-cliproxyapi-pro.tgz) (always the latest release) and enter its absolute local path |
 | Local source (development) | Absolute path of a cloned repository; installed as a link, so code changes go live when the plugin reloads |
@@ -96,29 +96,37 @@ If CPA runs on this machine on the default port `8317` without a key, there is n
 
 ## Screenshots
 
-The panel follows the DSH display language; the screenshots show the Chinese UI. Images 1–5 are offline component renders: this plugin's real UI code with sample data (`example.com` addresses, fictional accounts) rendered in a browser, with colors approximating the DSH dark theme; the real colors follow your DSH theme. Image 6 is an actual capture of 1.6.0 in the DSH desktop app.
+The panel follows the DSH display language; the screenshots show the Chinese UI. Images 1–7 are offline component renders: this plugin's real UI code with sample data (`example.com` addresses, fictional accounts) rendered in a browser, with colors approximating the DSH dark theme; the real colors follow your DSH theme. Image 8 is an actual capture of 1.6.0 in the DSH desktop app.
 
-**1. Accounts and connection.** The **CLIProxyAPI** page in the Settings dialog's left navigation: one account bar for all tabs; under the account title are the connection state, address and model count, with the **Enabled** switch (applies at once) and the **⋯** menu (**Probe & Refresh**, **Delete Account**) on the right. The **Connection** tab has one row per setting, **Test Connection** next to the address (uses the values being edited, saves nothing), and secondary explanations in ⓘ tips.
+**1. Accounts and connection.** The **CLIProxyAPI** page in the Settings dialog's left navigation: one account bar for all four tabs (Connection / Models / Generation / Quota); under the account title are the connection state, address and model count, with the **Enabled** switch (applies at once) and the **⋯** menu (**Probe & Refresh**, **Delete Account**) on the right. The **Connection** tab has one row per setting, **Test Connection** next to the address (uses the values being edited, saves nothing), and secondary explanations in ⓘ tips.
 
 ![Account bar, account header and Connection tab (offline render)](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/connection.png)
 
-**2. Models and one save bar.** The **Models** tab lists every model on that CPA: All / Checked / Unchecked, family filter, search, bulk actions and **Reset to Recommended**; checked models show the protocol they will use and can be edited with **Edit Parameters**. Connection and model edits are tracked together, and a bar at the bottom shows **Unsaved changes · Discard / Save & Apply**.
+**2. Models and one save bar.** The **Models** tab lists every chat model on that CPA: All / Checked / Unchecked, family filter, search, bulk actions and **Reset to Recommended**; checked models show the protocol they will use and can be edited with **Edit Parameters**. Connection and model edits are tracked together, and a bar at the bottom shows **Unsaved changes · Discard / Save & Apply**.
 
 ![Models tab with the save bar (offline render)](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/model-filter.png)
 
-**3. Quota.** The **Quota** tab: management key, quota data and refresh, a distribution bar, credentials grouped by channel (plan, prefix, status, 5-hour / daily / weekly meters with reset times; Devin shows its daily / weekly quota, shared by every Devin model; channels without a quota endpoint show status and recent requests only), and an expandable "Model → Channel" table. The tab label shows the lowest remaining quota among the account's usable credentials.
+**3. Image and video generation.** The top of the **Generation** tab holds the master switch **Enable image and video generation** (for every account, off on a new installation; while off this page shows only the switch, and neither the composer's generation buttons nor the generation commands exist). Once on, it lists image and video models in groups, each with its own switch and kind; below are marking missed models, the save location, video defaults and the agent generation settings.
+
+![Generation tab: master switch, image / video models and generation settings (offline render)](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/generation.png)
+
+**4. Quota.** The **Quota** tab: management key, quota data and refresh, a distribution bar, credentials grouped by channel (plan, prefix, status, 5-hour / daily / weekly meters with reset times; Devin shows its daily / weekly quota, shared by every Devin model; channels without a quota endpoint show status and recent requests only), and an expandable "Model → Channel" table. The tab label shows the lowest remaining quota among the account's usable credentials.
 
 ![Quota tab: distribution bar and per-channel credential quota (offline render)](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/quota.png)
 
-**4. Quota in the composer.** The badge left of the model selector shows the best remaining quota among the usable credentials serving the current model; clicking it lists every such credential with its quota windows. It appears only for models this plugin synchronizes whose account has a management key.
+**5. A rejected management key.** After CPA rejects the key 3 times in a row (401/403), automatic checks stop so CPA does not ban this address; the page explains why and keeps the last data it read. Saving a new management key resumes them; a manual **Refresh Quota** tries only once.
+
+![Quota tab: automatic checks stopped after the management key was rejected 3 times in a row (offline render)](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/quota-key-stopped.png)
+
+**6. Quota in the composer.** The badge left of the model selector shows the best remaining quota among the usable credentials serving the current model; clicking it lists every such credential with its quota windows. It appears only for models this plugin synchronizes whose account has a management key.
 
 ![Quota badge next to the model selector with its peek (offline render)](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/quota-badge.png)
 
-**5. Adding an account.** Enter a name, address and API key and click **Connect**: it tests first and creates an enabled account only when that works; on failure the reason is shown and **Add Anyway (Disabled)** is offered.
+**7. Adding an account.** Enter a name, address and API key and click **Connect**: it tests first and creates an enabled account only when that works; on failure the reason is shown and **Add Anyway (Disabled)** is offered.
 
 ![Add account form (offline render)](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/add-account.png)
 
-**6. The plugin update page under Built-in plugins** (actual 1.6.0 capture). **Settings** → **Built-in plugins** → the **CLIProxyAPI** tab holds only plugin updates: checking and offline download, **Update Now** once the DSH plugin market is detected, the update channel, the download region, and the automatic check / download / install switches. Here the plugin is already the latest Stable version, so **Update Now** is disabled.
+**8. The plugin update page under Built-in plugins** (actual 1.6.0 capture). **Settings** → **Built-in plugins** → the **CLIProxyAPI** tab holds only plugin updates: checking and offline download, **Update Now** once the DSH plugin market is detected, the update channel, the download region, and the automatic check / download / install switches. Here the plugin is already the latest Stable version, so **Update Now** is disabled.
 
 ![The CLIProxyAPI update page under Built-in plugins: version status, plugin-market update, channel, region and automatic switches](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/updates.png)
 
@@ -180,12 +188,13 @@ Each account's **Quota** tab (next to **Connection**, **Models** and **Generatio
 - **Composer badge**: a small badge left of the model selector (signal bars + percentage) shows the best remaining quota among the usable credentials serving the selected model; click it for every credential's windows. It appears only for models this plugin synchronizes whose account has a management key; without a key there is no badge. On the New Session page (before the composer takes over the session) the badge sits at the right end of the workspace row above the input box.
 - **Exact matching**: credentials are looked up only in the account the selected route belongs to (`cli-proxy*`, `cli-proxy-2*`, …); a prefixed model (such as `devin/claude-opus-5-5`) matches only credentials with that prefix; a bare id (such as `claude-opus-5-5`) prefers un-prefixed credentials, so the Claude and Devin channels never mix. Per-model-group windows (for example Antigravity) count only the group that fits the current model.
 - **Troubleshooting**: `/cpa-status` includes a quota summary: each account's key state, quota state, credential count, and which credentials each picker model maps to with its remaining quota (never the key).
-- **Refreshing**: results are cached on the Host for 5 minutes; stale accounts refresh in the background only while a page is asking, or on **Refresh Quota**. A rejected management key (401/403) pauses that account's automatic refresh until the key changes or you refresh manually, so CPA's bad-key protection is not triggered.
+- **Refreshing**: results are cached on the Host for 5 minutes; stale accounts refresh in the background only while a page is asking, or on **Refresh Quota**. When the management key is rejected (401/403), background checks continue at the 5-minute interval and stop for that account after 3 rejections in a row, so CPA's bad-key protection (a 30-minute ban after 5 bad keys from one address) is not triggered. The count is stored in `.dsh-cliproxyapi/quota-state.json` (never the key) and continues after a DSH restart; saving a new management key (also on the DSH credentials page), clearing the key or a successful check resets it. Once stopped, a manual refresh tries only once and stops again on another rejection. The Quota tab and the badge show how many times the key was rejected, or that checks have stopped.
 
 ### Image and video models (the "Generation" tab)
 
 CPA serves image and video generators (such as Grok Imagine) through `/v1/images/*` and `/v1/videos/*`. They cannot chat, so the plugin recognizes them and keeps them out of the chat model picker.
 
+- **Master switch**: **Enable image and video generation** at the top of the Generation tab applies to every account. While off, the composer shows no generation buttons, `/cpa-image`, `/cpa-video`, `/cpa-video-edit`, `/cpa-video-extend` and `/cpa-video-status` are not registered, the agent generation tool is not registered either, and the Generation tab shows only this switch; videos already submitted still finish, and past results in the chat stay viewable (without the edit / extend buttons). New installations start with it off; a profile that already has `media-settings.json` or has used generation keeps it on after the upgrade. Either way, media models never enter the chat model picker. Everything below needs it switched on.
 - **Recognition**, in order: a kind you set on the Generation tab; the catalog's `type` (`openai-image` is an image model) or output modalities (image-only output is an image model, video output a video model); the model families CPA routes to its image / video handlers, matched by prefix: ids starting with `grok-imagine-image` or `gpt-image-` are image models, ids starting with `grok-imagine-video` and `sora-2*` are video models. Everything else is a chat model (for example `gemini-3.1-flash-image`: CPA serves it only through chat, and DSH cannot show images returned in a chat reply). A media model that only the plain `/v1/models` listing carries is included too. A catalog may list variants CPA's generation endpoints do not accept yet (for example `grok-imagine-video-1.5-lite`); they cannot chat either, so they count as media models, and generating with one shows CPA's error.
 - **Not in the model picker**: media models are written to no chat route and take no part in the first-run recommendation; an older selection that names them does not synchronize them (the selection itself is kept). The Models tab lists chat models only.
 - **The Generation tab** (next to Connection / Models / Quota) lists "Image models" and "Video models"; changes are saved at once. A switch decides whether each model is offered for generation (models that appear later start switched on), and a kind menu changes it to image / video / chat; a kind you set can be reset to the detected one. A model detection missed can be marked under "Mark another model as a media model". Changing a kind re-synchronizes that account's routes immediately. `sora-2*` is labelled "→ grok-imagine-video": CPA rewrites it to the Grok video model.
@@ -259,7 +268,7 @@ Each time `/cpa-image`, `/cpa-video`, `/cpa-video-edit` or `/cpa-video-extend` r
 
 #### Letting the agent generate (`generate_media` tool, off by default)
 
-With **Let the agent generate images / videos** switched on in the Generation tab, the chat agent can call the `generate_media` tool to generate images and videos, or to edit and extend videos. While off (the default) the tool is not registered and takes no model context; when on, it is registered only while at least one generation model is enabled. Its definition is compact and lists no models.
+With **Let the agent generate images / videos** switched on in the Generation tab, the chat agent can call the `generate_media` tool to generate images and videos, or to edit and extend videos. While off (the default) the tool is not registered and takes no model context; when on, it is registered only while the **Enable image and video generation** master switch is on and at least one generation model is enabled. Its definition is compact and lists no models.
 
 - **What it does**: parameters `kind` (image / video) and `prompt`, optionally `mode` (generate / edit / extend), `model`, `images` (local image paths: for images, to edit or combine; for videos, 1 is the first frame and 2 or more are references), `frames` (first frame / references / first & last frame / last frame), `video` (the source of an edit / extension: a local MP4 path or a public link; without it, this session's newest generated video), `aspect`, `seconds`, `resolution`, `count`. Optional fields may be omitted or set to `null` (including on Responses strict-schema routes); video `count` should be `null`, as each call generates one video. An omitted, `null` or empty `model` uses this session's pick in the composer button (a sub-agent uses the pick of the session it belongs to). It works like the matching slash command, except that the prompt is **sent as written**: words like "10s" or "portrait" in it are not read as options and the chat model is not asked to interpret parameters. The tool description also tells the agent to use the user's own wording and level of detail, never expanding it into a longer scene description or adding camera, lighting, style, character or environment details the user did not ask for.
 - **Result**: files go to the save location; the tool returns their paths, the model and the actual parameters. For images, when the current chat model can see images, the generated images (downscaled by DSH) are handed to it as well. The chat renders one **independent generation row** from the recorded tool lifecycle, outside the thinking process, using the slash command's exchange layout (progress, images / a playable video, open / show in folder / copy, and **Edit video… / Extend video…** under a video). There is no need to expand thinking, no extra user command is fabricated, and tool cards or legacy mirrored command cards with a matching generation row do not repeat the result.
@@ -336,6 +345,8 @@ Apart from the generation tool `generate_media` (off by default, see above), thi
 - `/cpa-video-status` — list this session's video jobs.
 - `/cpa-video-edit [--video path | --url link | --from command-id] [-m model] change` / `/cpa-video-extend [same] [-s 2-10] what happens next` — edit / extend any MP4 (an attached video file works too). See [Editing and extending videos](#editing-and-extending-videos-cpa-video-edit-cpa-video-extend).
 
+`/cpa-image` and `/cpa-video*` exist only while **Enable image and video generation** is on in the Generation tab.
+
 ### HTTP API
 
 Used by the settings panel. Requires the DSH Web session's authentication; POST accepts only same-origin requests from loopback or trusted hosts.
@@ -356,7 +367,7 @@ Used by the settings panel. Requires the DSH Web session's authentication; POST
 | POST | `/api/dsh-cliproxyapi/quota/refresh` | `{ accountId? }` | Start refreshing the quota of one or every account and return at once (`refreshing` is set in the snapshot) |
 | POST | `/api/dsh-cliproxyapi/quota/save` | `{ accountId, managementKey?, clear? }` | Store or clear the account's management key and start refreshing its quota; the response never contains the key |
 | GET | `/api/dsh-cliproxyapi/media/status` | — | `{ ok, media }`: generation settings and each account's recognized image / video models; no network access |
-| POST | `/api/dsh-cliproxyapi/media/save` | `{ account: { accountId, disabledModels?, kindOverrides? } }` | Save an account's switched-off media models (replaces the list) or kind overrides (merged per model; `null` restores detection); a kind change re-synchronizes that account and adds `status` to the response. Invalid values return 400 with a code such as `invalid-account` or `invalid-kind` |
+| POST | `/api/dsh-cliproxyapi/media/save` | `{ enabled? }`, global fields (such as `agentTool`, `outputDir`), or `{ account: { accountId, disabledModels?, kindOverrides? } }` | `enabled` switches generation on / off (registering or removing the generation commands and the agent tool at once); save an account's switched-off media models (replaces the list) or kind overrides (merged per model; `null` restores detection); a kind change re-synchronizes that account and adds `status` to the response. Invalid values return 400 with a code such as `invalid-enabled`, `invalid-account` or `invalid-kind` |
 | POST | `/api/dsh-cliproxyapi/media/diagnose` | `{ accountId }` | Read-only diagnostic (see above); returns `{ ok, diagnostic }` without the key |
 | GET | `/api/dsh-cliproxyapi/media/session?sessionId=` | — | `{ ok, session }`: the image / video models to choose from, the current pick and where it comes from (`session` / `last` / `only`), and this session's recent files (names and ids only, no paths); `pendingConfirmations` lists only compatibility requests owned by this exact session when the native question service is absent, as `{ commandId, kind, en, zh, expiresAt }`; native questions never appear in that list; no network access |
 | POST | `/api/dsh-cliproxyapi/media/session/save` | `{ sessionId?, kind: "image" \| "video", ref }` | Pick a session's model (`ref` is `accountId/modelId`; `null` clears the session's pick) and remember it as the last pick; a model that is not offered returns 400 `invalid-model`. Alternatively `{ sessionId, videoConfirm?, imageConfirm?, videoBudget? }` (`ask` / `auto` / `inherit`; the limit is `{ mode: "limited", seconds }` / `{ mode: "unlimited" }` / `inherit`) sets this session's agent-generation rules |
@@ -404,11 +415,12 @@ Failures use a top-level `errorCode` or `update.errorCode`; HTTP status or `ok`
   ```
 
   Panel saves take effect immediately. After editing this file manually, reload the plugin or restart DSH to re-read it. Corrupt, structurally invalid, invalid-field or unreadable files use safe defaults with automatic network checks disabled. Check results, the candidate version, download notices and commands are in-memory only and reset on plugin reload; downloaded packages remain in the separate `updates` subdirectory for you to clean up when needed.
-- **Generation settings**: stored separately at `<profile dir>/.dsh-cliproxyapi/media-settings.json`; `state.json` is not changed. Without this file the defaults apply; a damaged file also falls back to the defaults with a log warning, and the next save first keeps the damaged file as `media-settings.corrupt-<time>.json`. Currently `outputDir` (save location), `lastSelection` (the last picked models) and each account's `disabledModels` (switched-off media models) and `kindOverrides` (kinds you set) take effect; the other fields are reserved for the generation features still to come and have no effect yet:
+- **Generation settings**: stored separately at `<profile dir>/.dsh-cliproxyapi/media-settings.json`; `state.json` is not changed. Without this file the defaults apply (`enabled: false`, generation off; but on when `media-sessions.json` or `media-jobs.json` exists); a file without the `enabled` field (written before the master switch existed) reads as on. A damaged file also falls back to the defaults with a log warning, and the next save first keeps the damaged file as `media-settings.corrupt-<time>.json`. The fields: `enabled` (master switch), `agentTool` (agent generation tool), `outputDir` (save location), `defaultVideoSeconds` / `defaultVideoResolution` (video defaults), `imageConfirm` / `videoConfirm` / `videoBudget` (agent confirmation and seconds limit), `lastSelection` (the last picked models), and each account's `disabledModels` (switched-off media models) and `kindOverrides` (kinds you set):
 
   ```json
   {
     "version": 1,
+    "enabled": true,
     "agentTool": false,
     "outputDir": "generated",
     "defaultVideoSeconds": 6,
@@ -425,6 +437,7 @@ Failures use a top-level `errorCode` or `update.errorCode`; HTTP status or `ok`
 
 - **Per-session generation records**: `<profile dir>/.dsh-cliproxyapi/media-sessions.json` keeps each session's picked generation models, records of its last 48 runs (status, model, prompt, options, start and end times, a display name for the save folder, error summary), and the paths of its last 48 generated files with the command id that produced them (for the command rows in the conversation), for the 500 most recently updated sessions. Deleting it only clears those picks and records, never generated files. A damaged file is treated as empty and kept as `media-sessions.corrupt-<time>.json` before the next write.
 - **Video jobs**: `<profile dir>/.dsh-cliproxyapi/media-jobs.json` keeps submitted video jobs (CPA request id, account, model, session and command id, working directory and save location, prompt, length, submission time, state) so a reload or restart can keep waiting; at most 200, finished ones kept 7 days. No keys and no video URLs. A damaged file is treated as empty and kept as `media-jobs.corrupt-<time>.json` before the next write.
+- **Management key failures**: `<profile dir>/.dsh-cliproxyapi/quota-state.json` records, per account, how many times in a row the CPA management API rejected the key (401/403), the last error code and time, so automatic checks stop after 3; it never holds the key. Deleting it only resets the counts.
 - **Keys**: stored and resolved by ref through the DSH `credentials` service, falling back to an environment variable of the same name.
 - **Environment**: `CLIPROXYAPI_BASE_URL` is used only for auto-discovery of accounts without a base URL.
 - **Plugin row config**: the plugin row's `config` in `cordis.patch.yml` is overlaid on the state file at startup: `accounts` replaces the account list, other fields apply to the first account. Normally keep it `{}` and configure through the Settings panel.

package/README.md

@@ -49,7 +49,7 @@
    dsh-cliproxyapi-pro
    ```
 
-   需要固定版本时可以写成 `dsh-cliproxyapi-pro@1.8.0`。
+   需要固定版本时可以写成 `dsh-cliproxyapi-pro@1.9.0`。
 4. 点击 **安装**，完成后点击 **立即启用**。
 
 > 在中国大陆下载慢，可以点输入框旁的 **安装源**，切换到 **中国大陆镜像源**。
@@ -78,7 +78,7 @@ dsh plugin --profile <profile 名称> add dsh-cliproxyapi-pro
 
 | 来源 | 填写内容 |
 |---|---|
-| 某个发布版本 | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#v1.8.0` |
+| 某个发布版本 | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#v1.9.0` |
 | 最新开发版 | `git+https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro.git#main` |
 | 离线安装包 | 下载 [`dsh-cliproxyapi-pro.tgz`](https://github.com/TinyBOOOOM/dsh-cliproxyapi-pro/releases/latest/download/dsh-cliproxyapi-pro.tgz)（始终是最新版），填写它的本地绝对路径 |
 | 本地源码（开发用） | 克隆后的仓库目录绝对路径；以链接方式安装，改代码后重载插件即生效 |
@@ -96,29 +96,37 @@ CPA 就在本机默认端口 `8317` 且没有设置密钥时，什么都不用
 
 ## 截图
 
-图 1–5 是离线组件渲染：用本插件的真实界面代码加示例数据（`example.com` 地址、虚构账号）在浏览器中渲染，配色按 DSH 深色主题近似，实际颜色跟随你的 DSH 主题。图 6 是 1.6.0 在 DSH 桌面版中的实际截图。
+图 1–7 是离线组件渲染：用本插件的真实界面代码加示例数据（`example.com` 地址、虚构账号）在浏览器中渲染，配色按 DSH 深色主题近似，实际颜色跟随你的 DSH 主题。图 8 是 1.6.0 在 DSH 桌面版中的实际截图。
 
-**1. 账号与连接。** 设置左侧导航的 **CLIProxyAPI** 页：顶部账号栏三个标签共用；账号标题下是连接状态、地址和模型数，右侧「启用」开关立即生效，「⋯」菜单里是「立即探测刷新」和「删除此账号」。「连接」标签里每项一行，地址旁可「测试连接」（用正在编辑的值，不保存），次要说明在 ⓘ 里。
+**1. 账号与连接。** 设置左侧导航的 **CLIProxyAPI** 页：顶部账号栏四个标签（连接 / 模型 / 生成 / 额度）共用；账号标题下是连接状态、地址和模型数，右侧「启用」开关立即生效，「⋯」菜单里是「立即探测刷新」和「删除此账号」。「连接」标签里每项一行，地址旁可「测试连接」（用正在编辑的值，不保存），次要说明在 ⓘ 里。
 
 ![账号栏、账号标题与连接标签（离线渲染）](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/connection.png)
 
-**2. 模型与统一保存。** 「模型」标签列出该 CPA 上的全部模型：全部 / 已勾选 / 未勾选、家族筛选、搜索、批量操作与「恢复推荐精选」；勾选的模型显示将使用的协议，可「编辑参数」。连接和模型的改动统一记录，底部出现「有未保存的更改 · 放弃更改 / 保存并应用」。
+**2. 模型与统一保存。** 「模型」标签列出该 CPA 上的全部对话模型：全部 / 已勾选 / 未勾选、家族筛选、搜索、批量操作与「恢复推荐精选」；勾选的模型显示将使用的协议，可「编辑参数」。连接和模型的改动统一记录，底部出现「有未保存的更改 · 放弃更改 / 保存并应用」。
 
 ![模型标签与底部保存栏（离线渲染）](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/model-filter.png)
 
-**3. 额度。** 「额度」标签：管理密钥、额度数据与刷新、凭证分布条，按渠道分组的凭证（套餐、前缀、状态、5 小时 / 每日 / 每周等额度条与重置时间；Devin 显示每日 / 每周额度，所有 Devin 模型共用；没有额度接口的渠道只显示状态与近期请求），以及可展开的「模型 → 渠道」表。标签上显示该账号可用凭证中最低的剩余额度。
+**3. 生图 / 生视频。** 「生成」标签顶部是总开关「启用图片和视频生成」（对所有账号生效，新安装默认关闭；关闭时这一页只剩这个开关，输入框旁的生成按钮和生成命令都不出现）。打开后分组列出生图 / 生视频模型，每个模型可单独开关、改类型；下面是标记漏识别的模型、保存位置、视频默认值和 agent 生成设置。
+
+![生成标签：总开关、生图 / 生视频模型与生成设置（离线渲染）](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/generation.png)
+
+**4. 额度。** 「额度」标签：管理密钥、额度数据与刷新、凭证分布条，按渠道分组的凭证（套餐、前缀、状态、5 小时 / 每日 / 每周等额度条与重置时间；Devin 显示每日 / 每周额度，所有 Devin 模型共用；没有额度接口的渠道只显示状态与近期请求），以及可展开的「模型 → 渠道」表。标签上显示该账号可用凭证中最低的剩余额度。
 
 ![额度标签：分布条与按渠道分组的凭证额度（离线渲染）](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/quota.png)
 
-**4. 对话框里的额度。** 模型选择器左侧的徽标显示当前模型可用凭证中最充足的剩余额度；点击后列出服务该模型的每个凭证及其额度窗口。只对本插件同步、且所属账号已填写管理密钥的模型显示。
+**5. 管理密钥被拒绝。** 密钥连续 3 次被 CPA 拒绝（401/403）后停止自动查询，以免 CPA 封禁本机地址；页面说明原因，保留上次成功读取的数据。保存新的管理密钥后恢复，手动「刷新额度」只再试一次。
+
+![额度标签：管理密钥连续 3 次被拒绝后停止自动查询（离线渲染）](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/quota-key-stopped.png)
+
+**6. 对话框里的额度。** 模型选择器左侧的徽标显示当前模型可用凭证中最充足的剩余额度；点击后列出服务该模型的每个凭证及其额度窗口。只对本插件同步、且所属账号已填写管理密钥的模型显示。
 
 ![模型选择器旁的额度徽标与弹出列表（离线渲染）](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/quota-badge.png)
 
-**5. 添加账号。** 填名称、地址和 API Key 后点「连接」：先测试，成功才创建并启用账号；失败时显示原因，可选「仍然添加（不启用）」。
+**7. 添加账号。** 填名称、地址和 API Key 后点「连接」：先测试，成功才创建并启用账号；失败时显示原因，可选「仍然添加（不启用）」。
 
 ![添加账号表单（离线渲染）](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/add-account.png)
 
-**6. 内置插件里的插件更新页**（1.6.0 实际截图）。**设置** → **内置插件** → **CLIProxyAPI** 标签页只有插件更新：检查更新与离线下载、检测到 DSH 插件市场后的「立即更新」、更新通道、下载区域，以及自动检查 / 自动下载 / 自动安装开关。图中已是稳定通道最新版本，所以「立即更新」不可用。
+**8. 内置插件里的插件更新页**（1.6.0 实际截图）。**设置** → **内置插件** → **CLIProxyAPI** 标签页只有插件更新：检查更新与离线下载、检测到 DSH 插件市场后的「立即更新」、更新通道、下载区域，以及自动检查 / 自动下载 / 自动安装开关。图中已是稳定通道最新版本，所以「立即更新」不可用。
 
 ![内置插件中的 CLIProxyAPI 更新页：版本状态、插件市场更新、通道、区域与自动开关](https://raw.githubusercontent.com/TinyBOOOOM/dsh-cliproxyapi-pro/main/assets/screenshots/updates.png)
 
@@ -180,12 +188,13 @@ CPA 对每个模型同时提供 OpenAI Chat、OpenAI Responses、Anthropic Messa
 - **对话框徽标**：模型选择器左侧的小徽标（信号格 + 百分比）显示当前所选模型可用凭证中最充足的剩余额度，点击可查看每个凭证的额度。只对本插件同步、且所属账号已填写管理密钥的模型显示；没有管理密钥时不显示徽标。在新建对话页（输入栏尚未接管会话时），徽标显示在输入框上方工作区一行的右侧。
 - **精确匹配**：只在所选模型所属的账号（按路由 `cli-proxy*`、`cli-proxy-2*`…）里找凭证；带前缀的模型（如 `devin/claude-opus-5-5`）只匹配该前缀的凭证；不带前缀的同名模型（如 `claude-opus-5-5`）优先匹配不带前缀的凭证，Claude 渠道与 Devin 渠道不会混用。Antigravity 等按模型分组的额度窗口只取与当前模型相符的那一组。
 - **排查**：`/cpa-status` 会附带额度摘要：每个账号的管理密钥状态、额度状态、凭证数，以及模型选择器中每个模型匹配到的凭证和剩余额度（不输出密钥）。
-- **刷新**：结果在宿主端缓存 5 分钟；有页面在看时才在后台刷新过期账号，也可手动「刷新额度」。管理密钥被拒（401/403）后暂停该账号的自动刷新，直到更新密钥或手动刷新，避免触发 CPA 的错误密钥封禁。
+- **刷新**：结果在宿主端缓存 5 分钟；有页面在看时才在后台刷新过期账号，也可手动「刷新额度」。管理密钥被拒（401/403）时，后台按 5 分钟周期继续尝试，连续 3 次被拒绝后停止该账号的自动查询，避免触发 CPA 的错误密钥封禁（同一地址累计 5 次错误会被封 30 分钟）。失败次数保存在 `.dsh-cliproxyapi/quota-state.json`（不含密钥），重启 DSH 后继续计数；保存新的管理密钥（包括在 DSH 凭证页修改）、清除密钥或一次成功的查询会清零。停止后手动刷新只再试一次，再被拒绝立即停止。额度页和徽标会显示已被拒绝的次数或已停止的说明。
 
 ### 生图 / 生视频模型（「生成」标签页）
 
 CPA 通过 `/v1/images/*` 和 `/v1/videos/*` 提供生图、生视频模型（如 Grok Imagine）。这些模型不能用于对话，所以插件会把它们识别出来，不放进对话模型选择器。
 
+- **总开关**：「生成」标签顶部的「启用图片和视频生成」对所有账号生效。关闭时输入框旁不显示生成按钮，`/cpa-image`、`/cpa-video`、`/cpa-video-edit`、`/cpa-video-extend`、`/cpa-video-status` 不注册，agent 生成工具也不注册，「生成」标签只显示这个开关；已提交的视频照常完成，聊天记录里已生成的结果仍可查看（不提供编辑 / 延长按钮）。新安装默认关闭；已有 `media-settings.json` 或用过生成的配置升级后保持开启。不论开关如何，生成模型都不会进入对话模型选择器。下面介绍的功能都需要先打开它。
 - **识别规则**（按顺序）：你在「生成」标签里手动指定的类型；模型目录里的 `type`（`openai-image` 为生图）或输出模态（只输出图片为生图，输出视频为生视频）；CPA 分流到图片 / 视频接口的模型族，按前缀匹配：以 `grok-imagine-image` 或 `gpt-image-` 开头为生图，以 `grok-imagine-video` 开头或 `sora-2*` 为生视频。其余都是对话模型（如 `gemini-3.1-flash-image`：CPA 只通过对话接口提供它，DSH 也不能显示对话中返回的图片）。只出现在 `/v1/models` 普通列表里的生成模型也会被收录。模型目录可能列出 CPA 生成接口暂不接受的变体（例如 `grok-imagine-video-1.5-lite`），它们同样不能对话，因此归为生成模型；用它们生成时会显示 CPA 返回的错误。
 - **不进入模型选择器**：生成模型不会写入任何对话路由，也不参与首次推荐勾选；即使旧的勾选里含有它们，也不会被同步（勾选本身保持不变）。「模型」标签只列对话模型。
 - **「生成」标签**（与 连接 / 模型 / 额度 并列）：分「生图模型」「生视频模型」两组列出，修改立即保存。每个模型可以用开关决定是否提供给生成功能（新出现的模型默认开启），用类型下拉框改为生图 / 生视频 / 对话模型；手动指定的类型可以恢复为自动识别。识别漏掉的模型可以在「把其他模型标记为生成模型」里手动标记。改动类型会立即重新同步该账号的路由。`sora-2*` 标注为「→ grok-imagine-video」：CPA 会把它改写为 Grok 视频模型调用。
@@ -259,7 +268,7 @@ CPA 通过 `/v1/images/*` 和 `/v1/videos/*` 提供生图、生视频模型（
 
 #### 让 agent 生成（`generate_media` 工具，默认关闭）
 
-在「生成」标签打开 **允许 agent 生成图片 / 视频** 后，对话里的 agent 可以调用 `generate_media` 工具生图、生视频、编辑或延长视频。关闭时（默认）不注册这个工具，不占用模型上下文；打开后，且至少有一个启用的生成模型时才注册，工具说明保持精简，不列模型清单。
+在「生成」标签打开 **允许 agent 生成图片 / 视频** 后，对话里的 agent 可以调用 `generate_media` 工具生图、生视频、编辑或延长视频。关闭时（默认）不注册这个工具，不占用模型上下文；打开后，且总开关「启用图片和视频生成」打开、至少有一个启用的生成模型时才注册，工具说明保持精简，不列模型清单。
 
 - **能做什么**：参数为 `kind`（image / video）、`prompt`，可选 `mode`（generate / edit / extend）、`model`、`images`（本地图片路径：生图时改图 / 合成，生视频时 1 张为首帧、2 张以上为参考图）、`frames`（首帧 / 参考图 / 首尾帧 / 尾帧）、`video`（编辑 / 延长的原视频：本地 MP4 路径或公开链接，不写时用本会话最新生成的视频）、`aspect`、`seconds`、`resolution`、`count`。可选字段可以省略或填 `null`（兼容 Responses 严格参数模式）；视频的 `count` 应填 `null`，一次只生成一个视频。没写 `model` 或填 `null` / 空字符串时，用输入框旁按钮里本会话选中的模型（子 agent 用其所属会话的选择）。处理方式与对应的斜杠命令相同，但提示词**原样发送**：不识别提示词里的「10秒」「竖屏」等词，也不请对话模型解读参数。工具说明同时要求 agent 使用用户自己的措辞和细节，不要扩写成更长的场景描写，也不要添加用户没有要求的镜头、光线、风格、人物或环境细节。
 - **结果**：文件保存到保存位置，工具返回文件路径、模型和实际参数。生图时，如果当前对话模型能看图，还会把生成的图片（DSH 自动缩小）一起交给它。对话根据工具调用的原始记录显示一条**独立的生成行**，放在思考过程之外，和斜杠命令一样显示一问一答（进度、图片 / 可播放的视频、打开 / 显示文件夹 / 复制，视频下方同样有「编辑视频…」「延长视频…」）；不需要展开思考过程，不再额外伪造用户命令，也不会重复显示已有对应生成行的工具卡片或旧版镜像命令卡片。
@@ -336,6 +345,8 @@ CPA 通过 `/v1/images/*` 和 `/v1/videos/*` 提供生图、生视频模型（
 - `/cpa-video-status`：列出本会话的视频任务。
 - `/cpa-video-edit [--video 路径 | --url 链接 | --from 命令id] [-m 模型] 修改说明`、`/cpa-video-extend [同上] [-s 2-10] 接下来的内容`：编辑 / 延长任意 MP4（可附带视频文件）。见 [编辑 / 延长视频](#编辑--延长视频cpa-video-editcpa-video-extend)。
 
+`/cpa-image` 和 `/cpa-video*` 只在「生成」标签的「启用图片和视频生成」打开时存在。
+
 ### HTTP 接口
 
 供设置面板使用，需要 DSH Web 会话的认证；POST 只接受来自本机或受信任主机的同源请求。
@@ -356,7 +367,7 @@ CPA 通过 `/v1/images/*` 和 `/v1/videos/*` 提供生图、生视频模型（
 | POST | `/api/dsh-cliproxyapi/quota/refresh` | `{ accountId? }` | 开始刷新一个或全部账号的额度并立即返回（快照中 `refreshing` 为真） |
 | POST | `/api/dsh-cliproxyapi/quota/save` | `{ accountId, managementKey?, clear? }` | 保存或清除该账号的管理密钥，并开始刷新额度；响应不含密钥 |
 | GET | `/api/dsh-cliproxyapi/media/status` | — | `{ ok, media }`：生成设置与每个账号识别出的生图 / 生视频模型；不联网 |
-| POST | `/api/dsh-cliproxyapi/media/save` | `{ account: { accountId, disabledModels?, kindOverrides? } }` | 保存某账号关闭的生成模型（整表替换）或类型覆盖（按模型合并，`null` 表示恢复自动识别）；类型变化时重新同步该账号并在响应中附带 `status`。无效值返回 400 和错误码，如 `invalid-account`、`invalid-kind` |
+| POST | `/api/dsh-cliproxyapi/media/save` | `{ enabled? }`、全局字段（如 `agentTool`、`outputDir`），或 `{ account: { accountId, disabledModels?, kindOverrides? } }` | `enabled` 打开 / 关闭生成总开关（随即注册或移除生成命令和 agent 工具）；保存某账号关闭的生成模型（整表替换）或类型覆盖（按模型合并，`null` 表示恢复自动识别）；类型变化时重新同步该账号并在响应中附带 `status`。无效值返回 400 和错误码，如 `invalid-enabled`、`invalid-account`、`invalid-kind` |
 | POST | `/api/dsh-cliproxyapi/media/diagnose` | `{ accountId }` | 只读诊断（见上文），返回 `{ ok, diagnostic }`，不含 Key |
 | GET | `/api/dsh-cliproxyapi/media/session?sessionId=` | — | `{ ok, session }`：可选的生图 / 生视频模型、当前选择及其来源（`session` / `last` / `only`）、本会话最近生成的文件（只有文件名和 id，不含路径）；`pendingConfirmations` 仅列出缺少原生提问服务时、属于这个确切会话的待确认项 `{ commandId, kind, en, zh, expiresAt }`，原生提问不在其中；不联网 |
 | POST | `/api/dsh-cliproxyapi/media/session/save` | `{ sessionId?, kind: "image" \| "video", ref }` | 为会话选择模型（`ref` 为 `账号id/模型id`，`null` 清除本会话的选择），并记为上一次选择；不在可选列表里的模型返回 400 `invalid-model`。也可以只传 `{ sessionId, videoConfirm?, imageConfirm?, videoBudget? }`（`ask` / `auto` / `inherit`，上限为 `{ mode: "limited", seconds }` / `{ mode: "unlimited" }` / `inherit`）修改本会话的 agent 生成设置 |
@@ -404,11 +415,12 @@ CPA 通过 `/v1/images/*` 和 `/v1/videos/*` 提供生图、生视频模型（
   ```
 
   设置通过面板保存后立即应用。手动编辑此文件后需重载插件或重启 DSH 才会重新读取；文件损坏、结构 / 字段无效或无法读取时采用关闭自动联网检查的安全默认值。版本检查结果、候选版本、下载完成提示与命令只在内存中，插件重载后重新检查；下载包仍位于独立的 `updates` 子目录，由用户按需清理。
-- **生成设置**：独立保存在 `<Profile 目录>/.dsh-cliproxyapi/media-settings.json`，不改动 `state.json`。没有此文件时使用默认值；文件损坏时也使用默认值并在日志中提示，下次保存前会把损坏的文件另存为 `media-settings.corrupt-<时间>.json`。目前生效的是 `outputDir`（保存位置）、`lastSelection`（上一次选择的模型）以及每个账号的 `disabledModels`（关闭的生成模型）和 `kindOverrides`（手动指定的类型）；其余字段为后续生成功能预留，现在没有效果：
+- **生成设置**：独立保存在 `<Profile 目录>/.dsh-cliproxyapi/media-settings.json`，不改动 `state.json`。没有此文件时使用默认值（`enabled: false`，生成关闭；但已存在 `media-sessions.json` 或 `media-jobs.json` 时视为开启）；文件里没有 `enabled` 字段（总开关出现之前写入的文件）时视为开启。文件损坏时也使用默认值并在日志中提示，下次保存前会把损坏的文件另存为 `media-settings.corrupt-<时间>.json`。各字段：`enabled`（总开关）、`agentTool`（agent 生成工具）、`outputDir`（保存位置）、`defaultVideoSeconds` / `defaultVideoResolution`（视频默认值）、`imageConfirm` / `videoConfirm` / `videoBudget`（agent 生成的确认方式和秒数上限）、`lastSelection`（上一次选择的模型），以及每个账号的 `disabledModels`（关闭的生成模型）和 `kindOverrides`（手动指定的类型）：
 
   ```json
   {
     "version": 1,
+    "enabled": true,
     "agentTool": false,
     "outputDir": "generated",
     "defaultVideoSeconds": 6,
@@ -425,6 +437,7 @@ CPA 通过 `/v1/images/*` 和 `/v1/videos/*` 提供生图、生视频模型（
 
 - **会话生成记录**：`<Profile 目录>/.dsh-cliproxyapi/media-sessions.json` 保存每个会话选择的生成模型、最近 48 次生成的记录（状态、模型、提示词、选项、起止时间、保存目录显示名、错误摘要），以及最近生成的最多 48 个文件路径和生成它们的命令 id（供对话里的命令行显示图片），只保留最近更新的 500 个会话。删除它只会清空这些选择和记录，不会删除已生成的文件。文件损坏时按空记录处理，下次写入前另存为 `media-sessions.corrupt-<时间>.json`。
 - **视频任务**：`<Profile 目录>/.dsh-cliproxyapi/media-jobs.json` 保存已提交的视频任务（CPA 请求 id、账号、模型、会话和命令 id、工作目录与保存位置、提示词、时长、提交时间、状态），用于重载或重启后继续等待；最多 200 个，已结束的保留 7 天。不含 Key 和视频地址。文件损坏时按空处理，下次写入前另存为 `media-jobs.corrupt-<时间>.json`。
+- **管理密钥失败次数**：`<Profile 目录>/.dsh-cliproxyapi/quota-state.json` 记录每个账号连续被 CPA 管理接口拒绝（401/403）的次数、最后的错误码和时间，用来在 3 次后停止自动查询；不含密钥。删除它只会清零计数。
 - **密钥**：通过 DSH 的 `credentials` 服务按引用名存取；凭证服务里没有时，回退读取同名环境变量。
 - **环境变量**：`CLIPROXYAPI_BASE_URL` 只用于服务地址留空的账号的自动发现。
 - **插件行配置**：`cordis.patch.yml` 中本插件行的 `config` 会在启动时叠加到状态文件上：包含 `accounts` 时替换账号列表，否则其中的字段作用于第一个账号。一般保持 `{}`，用设置面板配置即可。

package/lib/client.js

@@ -309,8 +309,10 @@ window.__ModuleLoader__.load({
       qDurDH: "{d}天{h}小时",
       qDurHM: "{h}小时{m}分",
       qDurM: "{m}分钟",
-      qErrUnauthorized: "管理密钥无效（401）。为避免 CPA 因错误密钥封禁地址，已暂停自动刷新；更新密钥或手动刷新后重试。",
+      qErrUnauthorized: "管理密钥无效（401），请检查后重新保存。",
       qErrForbidden: "CPA 拒绝了管理请求（403）：请确认 CPA 已开启 remote-management.allow-remote，且密钥正确。",
+      qAuthRetrying: "已连续被拒绝 {n}/{max} 次；连续 {max} 次后停止自动查询。",
+      qAuthPaused: "已连续被拒绝 {n} 次，自动查询已停止，以免 CPA 因错误密钥封禁本机地址。保存新的管理密钥后恢复；手动刷新只会再试一次。",
       qErrNetwork: "无法连接 CPA 管理接口，请检查服务地址与网络。",
       qErrTimeout: "CPA 管理接口响应超时，请稍后重试。",
       qErrHttp: "CPA 管理接口返回错误（HTTP {status}）。",
@@ -484,6 +486,10 @@ window.__ModuleLoader__.load({
       mediaConfirmAllowed: "已允许，开始生成",
       mediaConfirmDeclined: "已拒绝",
       mediaConfirmFailed: "没有送达：{error}",
+      mediaMasterTitle: "启用图片和视频生成",
+      mediaMasterHint: "对所有账号生效。关闭时输入框旁不显示生成按钮，没有 /cpa-image、/cpa-video 等生成命令，也不注册 agent 生成工具；已提交的视频会继续完成，聊天记录里已生成的结果仍可查看。",
+      mediaMasterOnNote: "已开启：可以用输入框旁的按钮、斜杠命令生成图片和视频。",
+      mediaMasterOffNote: "已关闭：界面上不显示生成功能，也没有生成命令。打开后才会出现下面的模型和设置。",
       mediaAgentTitle: "允许 agent 生成图片 / 视频",
       mediaAgentHint: "打开后，对话里的 agent 可以调用 generate_media 工具，用上面启用的生成模型生图、生视频、编辑或延长视频，文件保存到会话工作目录下的保存位置。关闭时不注册这个工具，不占用上下文。斜杠命令和输入框旁的按钮不受影响。",
       mediaAgentOnNote: "已开启：agent 可以调用 generate_media。确认方式和秒数上限可在输入框旁的生成按钮里按会话单独修改。",
@@ -805,8 +811,10 @@ window.__ModuleLoader__.load({
       qDurDH: "{d}d {h}h",
       qDurHM: "{h}h {m}m",
       qDurM: "{m}m",
-      qErrUnauthorized: "The management key was rejected (401). Automatic refresh is paused so CPA does not ban this address for bad keys; update the key or refresh manually to retry.",
+      qErrUnauthorized: "The management key was rejected (401). Check it and save it again.",
       qErrForbidden: "CPA refused the management request (403). Make sure remote-management.allow-remote is on and the key is correct.",
+      qAuthRetrying: "Rejected {n}/{max} times in a row; automatic checks stop after {max}.",
+      qAuthPaused: "Rejected {n} times in a row, so automatic checks have stopped to keep CPA from banning this address for bad keys. Saving a new management key resumes them; a manual refresh tries only once.",
       qErrNetwork: "Could not reach the CPA management API. Check the server address and network.",
       qErrTimeout: "The CPA management API timed out. Retry shortly.",
       qErrHttp: "The CPA management API returned an error (HTTP {status}).",
@@ -980,6 +988,10 @@ window.__ModuleLoader__.load({
       mediaConfirmAllowed: "Allowed; generating",
       mediaConfirmDeclined: "Declined",
       mediaConfirmFailed: "Not delivered: {error}",
+      mediaMasterTitle: "Enable image and video generation",
+      mediaMasterHint: "Applies to every account. While off, the composer shows no generation buttons, /cpa-image, /cpa-video and the other generation commands do not exist, and no agent generation tool is registered. Videos already submitted still finish, and past results in the chat stay viewable.",
+      mediaMasterOnNote: "On: generate images and videos with the composer buttons and slash commands.",
+      mediaMasterOffNote: "Off: no generation features appear and no generation commands exist. Turn it on to see the models and settings below.",
       mediaAgentTitle: "Let the agent generate images / videos",
       mediaAgentHint: "When on, the chat agent can call the generate_media tool to generate images and videos, or edit / extend videos, with the generation models enabled above; files go to the save location under the session's working directory. When off the tool is not registered and takes no context. Slash commands and the composer button work either way.",
       mediaAgentOnNote: "On: the agent can call generate_media. Confirmation and the seconds limit can be changed per session in the generation button next to the composer.",
@@ -4745,6 +4757,7 @@ select.dcpa-q-input.dcpa-media-kind { flex: none; width: auto; height: 28px; fon
           if (!mounted.current) return;
           setData(body.media ?? null);
           after?.();
+          if ("enabled" in patch) announceMediaGeneration();
           setNotice({ tone: "ok", text: t("mediaSaved") });
         } catch (err) {
           if (mounted.current) setNotice({ tone: "error", text: mediaErrorText(t, err) });
@@ -5005,13 +5018,47 @@ select.dcpa-q-input.dcpa-media-kind { flex: none; width: auto; height: 28px; fon
         return h("div", { className: "dcpa-tabbody dcpa-models dcpa-media" }, h("p", { className: "dcpa-q-sub" }, t("mediaLoading")));
       }
 
+      // The master switch (all accounts): off hides every generation feature.
+      const generationOn = data?.settings?.enabled === true;
+      const masterCard = h(
+        "div",
+        { className: "dcpa-media-card", "data-generation": generationOn ? "on" : "off" },
+        h(
+          "div",
+          { className: "dcpa-media-agent-head" },
+          h("span", { className: "dcpa-frow-label" }, t("mediaMasterTitle"), h(InfoTip, { t, text: t("mediaMasterHint") })),
+          h(
+            "button",
+            {
+              type: "button",
+              role: "switch",
+              className: "dcpa-switch",
+              "aria-checked": generationOn,
+              "aria-label": t("mediaMasterTitle"),
+              disabled: busy !== null || data === null,
+              onClick: () => void saveGlobal({ enabled: !generationOn }),
+            },
+            h("span", { className: "dcpa-switch-thumb" })
+          )
+        ),
+        h("p", { className: "dcpa-q-sub" }, t(generationOn ? "mediaMasterOnNote" : "mediaMasterOffNote"))
+      );
+      const messages = [
+        error ? h("p", { key: "err", className: "dcpa-q-msg", "data-tone": "error", role: "alert" }, fmt(t, "mediaLoadError", { error })) : null,
+        data?.settingsError ? h("p", { key: "invalid", className: "dcpa-q-msg", "data-tone": "error", role: "alert" }, t("mediaSettingsInvalid")) : null,
+        notice ? h("p", { key: "notice", className: "dcpa-q-msg", "data-tone": notice.tone, role: notice.tone === "error" ? "alert" : "status" }, notice.text) : null,
+      ];
+
+      if (!generationOn) {
+        return h("div", { className: "dcpa-tabbody dcpa-models dcpa-media" }, masterCard, ...messages);
+      }
+
       return h(
         "div",
         { className: "dcpa-tabbody dcpa-models dcpa-media" },
+        masterCard,
         h("p", { className: "dcpa-q-sub" }, t("mediaIntro")),
-        error ? h("p", { className: "dcpa-q-msg", "data-tone": "error", role: "alert" }, fmt(t, "mediaLoadError", { error })) : null,
-        data?.settingsError ? h("p", { className: "dcpa-q-msg", "data-tone": "error", role: "alert" }, t("mediaSettingsInvalid")) : null,
-        notice ? h("p", { className: "dcpa-q-msg", "data-tone": notice.tone, role: notice.tone === "error" ? "alert" : "status" }, notice.text) : null,
+        ...messages,
         mine && models.length === 0
           ? h("p", { className: "dcpa-hint" }, t(catalogRead ? "mediaNone" : "mediaNoCatalog"))
           : null,
@@ -5215,7 +5262,12 @@ select.dcpa-q-input.dcpa-media-kind { flex: none; width: auto; height: 28px; fon
     function quotaErrorText(t, account) {
       const key = QUOTA_ERROR_KEYS[account?.errorCode];
       if (key === undefined) return null;
-      return fmt(t, key, { status: account.errorStatus ?? "?" });
+      const text = fmt(t, key, { status: account.errorStatus ?? "?" });
+      // Consecutive management-key rejections: the count, or that background checks stopped.
+      const n = account.authFailures;
+      if ((account.errorCode !== "unauthorized" && account.errorCode !== "forbidden") || !Number.isInteger(n) || n <= 0) return text;
+      const max = account.authFailureLimit ?? 3;
+      return `${text} ${fmt(t, account.authPaused ? "qAuthPaused" : "qAuthRetrying", { n, max })}`;
     }
 
     function windowLabel(t, w) {
@@ -5527,6 +5579,16 @@ select.dcpa-q-input.dcpa-media-kind { flex: none; width: auto; height: 28px; fon
     const composerBadges = createBadgePresence();
     // The generation-model button has its own composer/hero presence.
     const mediaChips = createBadgePresence();
+    // The Generation tab tells the composer buttons when the master switch
+    // changed, so they appear / disappear without waiting for a retry.
+    const mediaGenerationListeners = new Set();
+    const announceMediaGeneration = () => {
+      for (const fn of [...mediaGenerationListeners]) {
+        try {
+          fn();
+        } catch {}
+      }
+    };
 
     /**
      * Composer placement announces itself for its session; hero placement
@@ -6293,8 +6355,10 @@ select.dcpa-q-input.dcpa-media-kind { flex: none; width: auto; height: 28px; fon
             if (controller.signal.aborted) return;
             if (!res.ok || body.ok === false) throw new Error(body.error || `HTTP ${res.status}`);
             setData(body.session ?? null);
-            needsRetry = body.session?.catalogIncomplete === true ||
-              !["image", "video"].some((kind) => Array.isArray(body.session?.options?.[kind]) && body.session.options[kind].length > 0);
+            // Generation switched off: nothing to show and nothing to wait for
+            // (the Generation tab announces when it is switched on again).
+            needsRetry = body.session?.generation !== false && (body.session?.catalogIncomplete === true ||
+              !["image", "video"].some((kind) => Array.isArray(body.session?.options?.[kind]) && body.session.options[kind].length > 0));
           } catch (err) {
             if (!controller.signal.aborted) setError(err instanceof Error ? err.message : String(err));
           } finally {
@@ -6309,6 +6373,19 @@ select.dcpa-q-input.dcpa-media-kind { flex: none; width: auto; height: 28px; fon
         };
       }, [sessionId, shadowed, openKind, retry]);
 
+      // The master switch changed on the Generation tab: load again now.
+      useEffect(() => {
+        const reload = () => {
+          if (!mounted.current) return;
+          closeMenu();
+          setRetry((n) => n + 1);
+        };
+        mediaGenerationListeners.add(reload);
+        return () => {
+          mediaGenerationListeners.delete(reload);
+        };
+      }, []);
+
       useEffect(() => {
         if (openKind === null) return undefined;
         const place = () => {

package/lib/index.js

@@ -2156,7 +2156,11 @@ export function renderQuotaText(snapshot, onlyAccountId) {
       continue;
     }
     const creds = Array.isArray(a.credentials) ? a.credentials : [];
-    const state = a.state + (a.errorCode ? ` (${a.errorCode}${a.errorStatus ? ` ${a.errorStatus}` : ""})` : "") + (a.refreshing ? ", refreshing" : "");
+    const state = a.state + (a.errorCode ? ` (${a.errorCode}${a.errorStatus ? ` ${a.errorStatus}` : ""})` : "") +
+      (Number.isInteger(a.authFailures) && a.authFailures > 0
+        ? `, key rejected ${a.authFailures}/${a.authFailureLimit}${a.authPaused ? ", automatic checks stopped until a new management key is saved" : ""}`
+        : "") +
+      (a.refreshing ? ", refreshing" : "");
     lines.push(`- ${a.displayName} [${a.accountId}]: ${state}; ${creds.length} credential(s)${a.fetchedAt ? `; fetched ${a.fetchedAt}` : ""}; routes ${(a.routes ?? []).join(", ") || "none"}`);
     for (const m of a.pickerModels ?? []) {
       const ids = a.modelIndex?.[m.id] ?? [];
@@ -2356,8 +2360,16 @@ function applyImpl(ctx, config) {
   // account state, never inside it, so no state migration is involved.
   const mediaSettingsPath = join(updateDirectory, "media-settings.json");
   let mediaWarned = false;
+  // Generation is off for a new profile; one that already picked a model or
+  // generated something before the switch existed (session or job file, no
+  // readable settings file) keeps it on.
+  const mediaUsedBefore = () =>
+    existsSync(join(updateDirectory, "media-sessions.json")) || existsSync(join(updateDirectory, "media-jobs.json"));
   const readMedia = () => {
     const loaded = loadMediaSettings(mediaSettingsPath);
+    if ((loaded.error !== undefined || !existsSync(mediaSettingsPath)) && mediaUsedBefore()) {
+      loaded.settings = { ...loaded.settings, enabled: true };
+    }
     if (loaded.error === undefined) {
       mediaWarned = false;
     } else if (!mediaWarned) {
@@ -2396,7 +2408,19 @@ function applyImpl(ctx, config) {
 
   // Quota ("额度" tab + composer badge): management keys live in the
   // credentials service under their own refs, never in account state.
+  // Consecutive management-key rejections per account (never the key itself),
+  // so a wrong key stays stopped across reloads and restarts.
+  const quotaStatePath = join(updateDirectory, "quota-state.json");
   const quota = createQuotaController({
+    authStore: {
+      read: () => (existsSync(quotaStatePath) ? JSON.parse(readFileSync(quotaStatePath, "utf8")) : undefined),
+      write: (value) => {
+        mkdirSync(dirname(quotaStatePath), { recursive: true });
+        const tmp = `${quotaStatePath}.${Date.now().toString(36)}.tmp`;
+        writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+        renameSync(tmp, quotaStatePath);
+      },
+    },
     listAccounts: () => controller.quotaAccounts(),
     resolveKey: (ref) => resolveApiKey(ref),
     describeKey: (ref) => describeApiKey(ref),
@@ -2453,13 +2477,18 @@ function applyImpl(ctx, config) {
   // Per-session model picks and recent outputs, in their own file.
   const mediaSessions = createMediaSessionStore(join(updateDirectory, "media-sessions.json"));
 
+  // With generation switched off nothing is offered: no composer buttons, no
+  // agent tool, and no command can pick a model.
   const mediaChoices = () => {
     const { settings } = readMedia();
     const accounts = controller.mediaAccounts();
+    const on = settings.enabled === true;
     return {
       settings,
       accounts,
-      options: { image: mediaOptions(accounts, settings, "image"), video: mediaOptions(accounts, settings, "video") },
+      options: on
+        ? { image: mediaOptions(accounts, settings, "image"), video: mediaOptions(accounts, settings, "video") }
+        : { image: [], video: [] },
     };
   };
 
@@ -2474,6 +2503,7 @@ function applyImpl(ctx, config) {
   let catalogRetryAt = 0;
   const mediaChoicesFor = async (kind) => {
     let choices = mediaChoices();
+    if (choices.settings.enabled !== true) return choices;
     const missing = (k) => choices.options[k].length === 0;
     const someMissing = kind === "any" ? missing("image") || missing("video") : missing(kind);
     const cold = choices.accounts.some((a) => a.enabled && a.discovered === 0);
@@ -2513,6 +2543,8 @@ function applyImpl(ctx, config) {
     const policy = agentPolicy(settings, entry);
     return {
       sessionId: sessionId ?? null,
+      // The Generation tab's master switch; off = the composer shows nothing.
+      generation: settings.enabled === true,
       options,
       current,
       // Compatibility composer fallback; native questions never enter this map.
@@ -2522,7 +2554,7 @@ function applyImpl(ctx, config) {
       // True while an enabled account's last catalog read missed the plain
       // listing; the composer button retries instead of keeping an old,
       // image-less list.
-      catalogIncomplete: accounts.some((a) => a.enabled === true && a.catalogIncomplete === true),
+      catalogIncomplete: settings.enabled === true && accounts.some((a) => a.enabled === true && a.catalogIncomplete === true),
       // The agent tool's rules for this session (shown while the tool is switched on).
       agent: {
         enabled: settings.agentTool === true,
@@ -3608,6 +3640,9 @@ function applyImpl(ctx, config) {
   const TOOL_PREVIEWS = 4;
   let toolsCtx;
   let toolOff;
+  // The generation slash commands (registered only while generation is on).
+  let commandsCtx;
+  let mediaCommandsOff;
 
   const gateError = (message) => Object.assign(new Error(message), { gateError: true });
 
@@ -3964,6 +3999,37 @@ function applyImpl(ctx, config) {
       }
       ctx.logger?.info?.("cpa: generate_media tool unregistered");
     }
+    syncMediaCommands();
+  };
+
+  /**
+   * Register or unregister /cpa-image and the /cpa-video* commands to match
+   * the Generation tab's master switch. Jobs already submitted keep running.
+   */
+  const syncMediaCommands = () => {
+    let wanted = false;
+    try {
+      wanted = readMedia().settings.enabled === true;
+    } catch {
+      wanted = false;
+    }
+    if (wanted && mediaCommandsOff === undefined && commandsCtx !== undefined) {
+      try {
+        mediaCommandsOff = registerMediaCommands(commandsCtx);
+        ctx.logger?.info?.("cpa: generation commands registered");
+      } catch (error) {
+        ctx.logger?.warn?.(`cpa: could not register the generation commands: ${error instanceof Error ? error.message : String(error)}`);
+      }
+    } else if (!wanted && mediaCommandsOff !== undefined) {
+      const off = mediaCommandsOff;
+      mediaCommandsOff = undefined;
+      try {
+        off();
+      } catch {
+        // already gone with its scope
+      }
+      ctx.logger?.info?.("cpa: generation commands unregistered");
+    }
   };
   // #endregion
 
@@ -3977,6 +4043,8 @@ function applyImpl(ctx, config) {
   );
 
   ctx.on("credentials/reference-updated", (ref) => {
+    // A management key changed (also from the DSH credentials page): start a new failure count.
+    quota.keyChanged(ref);
     for (const id of controller.accountsUsingKey(ref)) {
       void controller.refreshAccount(id);
     }
@@ -4013,6 +4081,26 @@ function applyImpl(ctx, config) {
           return { kind: failed ? "error" : "success", text: renderStatusText(payload) };
         },
       });
+      commandsCtx = cmdCtx;
+      syncMediaCommands();
+      return () => {
+        offStatus?.();
+        offRefresh?.();
+        commandsCtx = undefined;
+        const off = mediaCommandsOff;
+        mediaCommandsOff = undefined;
+        try {
+          off?.();
+        } catch {
+          // disposed with its scope
+        }
+      };
+    }, "cpa: commands");
+  });
+
+  /** The generation commands, registered only while generation is switched on (see syncMediaCommands). */
+  function registerMediaCommands(cmdCtx) {
+    {
       const offVideo = cmdCtx.commands.register({
         name: "cpa-video",
         description: "Generate a video with a CLIProxyAPI video model: text only, one image as the first frame, reference images (--ref, or 2+ images), or pinned first / last frames (--first-last, --last). A submitted video cannot be cancelled.",
@@ -4043,16 +4131,14 @@ function applyImpl(ctx, config) {
         handler: runImageCommand,
       });
       return () => {
-        offStatus?.();
-        offRefresh?.();
         offImage?.();
         offVideo?.();
         offVideoStatus?.();
         offVideoEdit?.();
         offVideoExtend?.();
       };
-    }, "cpa: commands");
-  });
+    }
+  }
 
   // The optional agent tool (registered only while switched on; see syncAgentTool).
   ctx.inject(["tools"], (scope) => {
@@ -4230,8 +4316,9 @@ function applyImpl(ctx, config) {
             const desktop = process.platform === "win32" ? "explorer" : process.platform === "darwin" ? "finder" : "filemanager";
             // Edit / extend this video: by xAI's short-lived link while it is
             // remembered, else by sending its file inline when small enough.
+            // Past results stay visible with generation off, without the edit / extend actions.
             let actions;
-            if (run?.kind === "video" && run.status === "done") {
+            if (run?.kind === "video" && run.status === "done" && readMedia().settings.enabled === true) {
               const source = usableSource(commandId);
               const video = files.find((f) => f.kind === "video");
               let size;

package/lib/media.js

@@ -97,9 +97,15 @@ export class MediaError extends Error {
   }
 }
 
+/**
+ * Defaults for a profile without `media-settings.json`: generation is off
+ * until the user switches it on (an older file without `enabled` reads as on,
+ * see {@link normalizeMediaSettings}).
+ */
 export function defaultMediaSettings() {
   return {
     version: MEDIA_SETTINGS_VERSION,
+    enabled: false,
     agentTool: false,
     outputDir: "generated",
     defaultVideoSeconds: 6,
@@ -182,7 +188,9 @@ function normalizeAccountMedia(value) {
 
 /**
  * Tolerant normalization: every invalid or missing field takes its default,
- * unknown fields are dropped. The result always has `version: 1`.
+ * unknown fields are dropped. The result always has `version: 1`. A missing
+ * `enabled` means a file written before the switch existed (by someone who
+ * already used generation), so it reads as on.
  */
 export function normalizeMediaSettings(raw) {
   const input = plain(raw) ?? {};
@@ -199,6 +207,7 @@ export function normalizeMediaSettings(raw) {
   }
   return {
     version: MEDIA_SETTINGS_VERSION,
+    enabled: typeof input.enabled === "boolean" ? input.enabled : true,
     agentTool: input.agentTool === true,
     outputDir: validOutputDir(input.outputDir) ?? defaults.outputDir,
     defaultVideoSeconds: intIn(input.defaultVideoSeconds, VIDEO_SECONDS) ?? defaults.defaultVideoSeconds,
@@ -241,6 +250,7 @@ export function saveMediaSettings(filePath, settings) {
 }
 
 const PATCH_FIELDS = [
+  "enabled",
   "agentTool",
   "outputDir",
   "defaultVideoSeconds",
@@ -265,6 +275,10 @@ export function applyMediaPatch(current, patch) {
   const unknown = Object.keys(input).filter((key) => !PATCH_FIELDS.includes(key) && key !== "accountId");
   if (unknown.length > 0) throw new MediaError("invalid-request", `unknown field(s): ${unknown.join(", ")}`);
   const next = normalizeMediaSettings(current);
+  if ("enabled" in input) {
+    if (typeof input.enabled !== "boolean") throw new MediaError("invalid-enabled");
+    next.enabled = input.enabled;
+  }
   if ("agentTool" in input) {
     if (typeof input.agentTool !== "boolean") throw new MediaError("invalid-agent-tool");
     next.agentTool = input.agentTool;

package/lib/quota.js

@@ -16,8 +16,39 @@ export const DEFAULT_QUOTA_TIMEOUT_MS = 15_000;
 export const DEFAULT_QUOTA_CONCURRENCY = 4;
 export const MAX_QUOTA_RESPONSE_BYTES = 4 * 1024 * 1024;
 
+// Consecutive management 401/403 answers after which automatic refresh stops
+// (CPA bans the client address for 30 minutes after 5 failed attempts).
+export const AUTH_FAILURE_LIMIT = 3;
+export const QUOTA_AUTH_STATE_VERSION = 1;
+
 const MANAGEMENT_KEY_REF = "CLI_PROXY_MANAGEMENT_KEY";
 const STATUS_MESSAGE_MAX = 160;
+const AUTH_ERROR_CODES = ["unauthorized", "forbidden"];
+const AUTH_ACCOUNT_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+
+/**
+ * The persisted management-key failure counts (`quota-state.json`):
+ * `{ version: 1, accounts: { [id]: { authFailures, errorCode, errorStatus?, failedAt } } }`.
+ * Never holds a key. Invalid entries are dropped; accounts without failures are not kept.
+ */
+export function normalizeQuotaAuthState(raw) {
+  const accounts = {};
+  const input = raw !== null && typeof raw === "object" && !Array.isArray(raw) ? raw.accounts : undefined;
+  if (input !== null && typeof input === "object" && !Array.isArray(input)) {
+    for (const [id, entry] of Object.entries(input)) {
+      if (!AUTH_ACCOUNT_ID.test(id) || entry === null || typeof entry !== "object") continue;
+      const failures = Number.isInteger(entry.authFailures) && entry.authFailures > 0 ? Math.min(entry.authFailures, 1000) : 0;
+      if (failures === 0) continue;
+      accounts[id] = {
+        authFailures: failures,
+        errorCode: AUTH_ERROR_CODES.includes(entry.errorCode) ? entry.errorCode : "unauthorized",
+        ...(Number.isInteger(entry.errorStatus) ? { errorStatus: entry.errorStatus } : {}),
+        ...(typeof entry.failedAt === "string" && entry.failedAt.length <= 40 ? { failedAt: entry.failedAt } : {}),
+      };
+    }
+  }
+  return { version: QUOTA_AUTH_STATE_VERSION, accounts };
+}
 
 const UPSTREAM = {
   codexUsage: "https://chatgpt.com/backend-api/wham/usage",
@@ -1053,14 +1084,53 @@ export function createQuotaController(deps) {
   const agPreferred = new Map();
   let disposed = false;
 
+  // Consecutive management 401/403 counts survive reloads through
+  // `deps.authStore` ({ read(), write(state) }); without one they live in memory.
+  const readAuth = () => {
+    try {
+      return normalizeQuotaAuthState(deps.authStore?.read?.());
+    } catch {
+      return normalizeQuotaAuthState(undefined);
+    }
+  };
+  const writeAuthEntry = (id, entry) => {
+    if (deps.authStore?.write === undefined) return;
+    try {
+      const next = readAuth();
+      if (entry === undefined) {
+        if (next.accounts[id] === undefined) return;
+        delete next.accounts[id];
+      } else {
+        next.accounts[id] = entry;
+      }
+      deps.authStore.write(normalizeQuotaAuthState(next));
+    } catch (error) {
+      log("warn", `dsh-cliproxyapi: could not save the quota key failure count: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  };
+
   const stateFor = (id) => {
     let st = states.get(id);
     if (st === undefined) {
-      st = { gen: 0, inflight: null, result: null, data: null, lockedOut: false, lastAttemptAt: undefined };
+      const saved = readAuth().accounts[id];
+      st = {
+        gen: 0,
+        inflight: null,
+        result: saved === undefined ? null : { state: "error", errorCode: saved.errorCode, ...(saved.errorStatus === undefined ? {} : { errorStatus: saved.errorStatus }) },
+        data: null,
+        authFailures: saved?.authFailures ?? 0,
+        lastAttemptAt: undefined,
+      };
       states.set(id, st);
     }
     return st;
   };
+  const authPaused = (st) => st.authFailures >= AUTH_FAILURE_LIMIT;
+  /** Forget an account's failure count (a new key, a cleared key, a removed account). */
+  const resetAuth = (id, st = states.get(id)) => {
+    if (st !== undefined) st.authFailures = 0;
+    writeAuthEntry(id, undefined);
+  };
 
   const log = (level, message) => {
     try {
@@ -1479,15 +1549,30 @@ export function createQuotaController(deps) {
           const fetchedAt = new Date(now()).toISOString();
           st.data = { credentials: result.credentials, fetchedAt };
           st.result = { state: "ok" };
-          st.lockedOut = false;
+          if (st.authFailures > 0) resetAuth(account.id, st);
         }
       } catch (error) {
         if (!current()) return;
         const code = error instanceof QuotaError && error.code !== "aborted" ? error.code : error?.code === "aborted" ? null : "network";
         if (code === null) return;
         st.result = { state: "error", errorCode: code, ...(error?.status === undefined ? {} : { errorStatus: error.status }) };
-        if (code === "unauthorized" || code === "forbidden") st.lockedOut = true;
-        log("warn", `dsh-cliproxyapi: quota refresh failed for account ${account.id}: ${code}${error?.status === undefined ? "" : ` (${error.status})`}`);
+        // Only a rejected key counts; network errors neither count nor reset.
+        if (AUTH_ERROR_CODES.includes(code)) {
+          st.authFailures += 1;
+          writeAuthEntry(account.id, {
+            authFailures: st.authFailures,
+            errorCode: code,
+            ...(error?.status === undefined ? {} : { errorStatus: error.status }),
+            failedAt: new Date(now()).toISOString(),
+          });
+        }
+        log(
+          "warn",
+          `dsh-cliproxyapi: quota refresh failed for account ${account.id}: ${code}${error?.status === undefined ? "" : ` (${error.status})`}` +
+            (AUTH_ERROR_CODES.includes(code)
+              ? ` — management key rejected ${st.authFailures}/${AUTH_FAILURE_LIMIT}${authPaused(st) ? "; automatic refresh stopped" : ""}`
+              : "")
+        );
       } finally {
         root.signal.removeEventListener("abort", onRootAbort);
         if (st.gen === gen) {
@@ -1532,6 +1617,9 @@ export function createQuotaController(deps) {
         ...(state === "error" ? { errorCode: st.result.errorCode, ...(st.result.errorStatus === undefined ? {} : { errorStatus: st.result.errorStatus }) } : {}),
         ...(configured && st.data !== null ? { fetchedAt: st.data.fetchedAt } : {}),
         refreshing,
+        ...(configured && st.authFailures > 0
+          ? { authFailures: st.authFailures, authFailureLimit: AUTH_FAILURE_LIMIT, authPaused: authPaused(st) }
+          : {}),
         credentials: configured && st.data !== null ? structuredClone(st.data.credentials) : [],
         pickerModels,
       };
@@ -1552,6 +1640,8 @@ export function createQuotaController(deps) {
       if (!known.has(id)) {
         cancelInflight(st);
         states.delete(id);
+        // An empty list may be a failed read; keep the stored count then.
+        if (accounts.length > 0) resetAuth(id);
       }
     }
     return Promise.all(accounts.map(async (account) => {
@@ -1568,7 +1658,8 @@ export function createQuotaController(deps) {
         for (const { account, keyConfigured: configured } of prepared) {
           if (account.enabled !== true || !configured) continue;
           const st = stateFor(account.id);
-          if (st.inflight !== null || st.lockedOut) continue;
+          // A key rejected AUTH_FAILURE_LIMIT times in a row is not tried in the background again.
+          if (st.inflight !== null || authPaused(st)) continue;
           if (st.lastAttemptAt !== undefined && at - st.lastAttemptAt < ttlMs) continue;
           startRefresh(account);
         }
@@ -1582,8 +1673,8 @@ export function createQuotaController(deps) {
       if (accountId !== undefined && accountId !== null && accountId !== "") {
         const account = findAccount(accountId);
         if (!disposed) {
-          const st = stateFor(account.id);
-          st.lockedOut = false;
+          // A manual refresh tries once even when paused; the count is kept,
+          // so another rejection pauses again at once (a success resets it).
           if (await keyConfigured(managementKeyRef(account.id))) {
             const running = startRefresh(account);
             if (wait) await running;
@@ -1593,9 +1684,9 @@ export function createQuotaController(deps) {
       }
       const prepared = await prepare();
       if (!disposed) {
-        // Refresh-all never retries a locked-out account; only refresh(id) or saveKey clears a lockout.
+        // Refresh-all never retries a paused account; only refresh(id) tries it once, and a new key resets it.
         await Promise.all(prepared
-          .filter(({ account, keyConfigured: configured }) => account.enabled === true && configured && !stateFor(account.id).lockedOut)
+          .filter(({ account, keyConfigured: configured }) => account.enabled === true && configured && !authPaused(stateFor(account.id)))
           .map(({ account }) => (wait ? startRefresh(account) : (startRefresh(account), undefined))));
       }
       return buildSnapshot(prepared);
@@ -1611,7 +1702,7 @@ export function createQuotaController(deps) {
         await deps.unsetKey(ref);
         st.data = null;
         st.result = null;
-        st.lockedOut = false;
+        resetAuth(account.id, st);
         st.lastAttemptAt = undefined;
         return buildSnapshot();
       }
@@ -1621,16 +1712,27 @@ export function createQuotaController(deps) {
         cancelInflight(st);
         await deps.setKey(ref, value);
         st.result = null;
-        st.lockedOut = false;
+        resetAuth(account.id, st);
       }
       if (!disposed && (await keyConfigured(ref))) {
-        st.lockedOut = false;
         const running = startRefresh(account);
         if (wait) await running;
       }
       return buildSnapshot();
     },
 
+    /**
+     * A credential reference changed outside saveKey (e.g. the DSH credentials
+     * page): when it is an account's management key, forget its failure count.
+     * @returns the account id, or undefined for any other reference.
+     */
+    keyChanged(ref) {
+      const account = listAccounts().find((a) => managementKeyRef(a.id) === ref);
+      if (account === undefined) return undefined;
+      resetAuth(account.id);
+      return account.id;
+    },
+
     dispose() {
       if (disposed) return;
       disposed = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cliproxyapi-pro",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Auto-discovery CLIProxyAPI (CPA) provider and management UI for DeepSeek Harness — multiple accounts, dynamic model sync, capability detection, and visual settings.",
   "keywords": [
     "dsh",