dsh-connect-workbuddy 3.1.0 → 3.3.0

package/lib/index.js

@@ -1,7 +1,7 @@
-import { $ as workbuddyAppExecutableCandidates, A as CREDENTIAL_REJECTED_CODE, B as regionOf, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as isCredentialRejectedError, G as fetchAtRestKeyPayload, H as clearAtRestKeyCache, I as parseCreditMultiplier, J as isWorkbuddyBundle, K as findWorkbuddyAppExecutable, L as parseReasoning, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as readAtRestKey, R as parseUpstreamModel, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as deriveAtRestKey, V as WORKBUDDY_APP_EXECUTABLE_ENV, W as deriveAtRestKeyId, X as macosNestedAppBundles, Y as macosBundleExecutable, Z as openEncryptedField, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as isEncryptedFieldWrapper, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as prepareChatBody } from "./host-heartbeat-DZnPggVT.js";
+import { $ as readAtRestKey, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, J as isEncryptedFieldWrapper, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as openEncryptedField, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as macosBundleExecutable, Y as isWorkbuddyBundle, Z as macosNestedAppBundles, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as workbuddyAppExecutableCandidates, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-t93cLCoW.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
-import { randomBytes, timingSafeEqual } from "node:crypto";
+import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { join } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
@@ -414,6 +414,692 @@ function createWorkBuddyAdapter(options) {
 		}
 	};
 }
+/** One or two full-width bars — the count is a spelling variable. */
+const BARS = `｜｜?`;
+new RegExp(`${BARS}DSML${BARS}`, "g");
+/**
+* Spellings a tag may carry before its name, longest first so the doubled form
+* is consumed before the single one can match its prefix.
+*
+* The ASCII spellings are accepted because the model mixes them: the marker is
+* normalised to ASCII by {@link normalizedPrefixLength}, which is also the only
+* way to catch a block that spells the two sides differently.
+*/
+const MARKUP_PREFIXES = [
+	`｜｜DSML｜｜`,
+	"||DSML||",
+	"|DSML|"
+];
+/** What the full-width marker looks like after {@link normalizedPrefixLength}. */
+const ASCII_PREFIXES = ["||DSML||", "|DSML|"];
+/**
+* Tag names that can OPEN a block worth recovering.
+*
+* Deliberately tiny. `parameter` and the model's ad-hoc tag names are NOT here:
+* they only ever appear inside a block, so treating one as a block start would
+* hold a response hostage waiting for a close that naming never promised.
+*/
+const BLOCK_TAGS = ["tool_calls", "invoke"];
+/**
+* Tag names whose content belongs to the markup rather than to the answer.
+*
+* Used by {@link stripMarkup} to decide whether removing a marker-bearing tag
+* should also remove everything up to its matching close. An INVENTED name is
+* not here on purpose: `<｜DSML｜ validate>` brackets nothing, so removing it
+* means removing the tag and nothing else.
+*/
+const KEYWORD_TAGS = [
+	"tool_calls",
+	"tool-calls",
+	"toolcalls",
+	"invoke",
+	"parameter",
+	"calls",
+	"tool"
+];
+/** Tag names normalised to their canonical spelling. */
+const CANONICAL_TAG_NAMES = /* @__PURE__ */ new Map([
+	["tool_calls", "tool_calls"],
+	["tool-calls", "tool_calls"],
+	["toolcalls", "tool_calls"],
+	["invoke", "invoke"],
+	["parameter", "parameter"]
+]);
+/**
+* Canonical names accepted ONLY in a marker form.
+*
+* `<toolcalls>` without the marker is somebody's HTML, not the model's markup;
+* the marker is what makes the misspelling meaningful.
+*/
+const MARKER_ONLY_TAG_NAMES = /* @__PURE__ */ new Set(["tool-calls", "toolcalls"]);
+/** Fence markers at the start of a line. */
+const FENCE_MARKERS = ["```", "~~~"];
+/**
+* Find every span that must not be scanned for markup.
+*
+* One pass, not a predicate call per character: the reference asks
+* `is_inside_markdown_fence(text, i)` inside a per-character loop, which is
+* quadratic in the size of the buffer. The buffer holds a whole block, and a
+* block can be large (a file's worth of arguments), so the port computes the
+* spans once and walks them.
+*
+* Semantics match the reference: fences only count at the start of a line,
+* code spans are runs of one or two backticks, and an unterminated span runs to
+* the end of the text (the closer may still be in flight).
+*/
+function ignoredSpans(text) {
+	const spans = [];
+	let i = 0;
+	let fence;
+	let fenceStart = 0;
+	while (i < text.length) {
+		const atLineStart = i === 0 || text.charAt(i - 1) === "\n";
+		if (fence !== void 0) {
+			if (atLineStart && text.startsWith(fence, i)) {
+				const lineEnd = text.indexOf("\n", i);
+				const end = lineEnd === -1 ? text.length : lineEnd + 1;
+				spans.push({
+					start: fenceStart,
+					end,
+					open: false
+				});
+				fence = void 0;
+				i = end;
+				continue;
+			}
+			i += 1;
+			continue;
+		}
+		if (atLineStart) {
+			const marker = FENCE_MARKERS.find((candidate) => text.startsWith(candidate, i));
+			if (marker !== void 0) {
+				fence = marker;
+				fenceStart = i;
+				i += marker.length;
+				continue;
+			}
+		}
+		if (text.charAt(i) === "`") {
+			const end = codeSpanEnd(text, i);
+			if (end === -1) {
+				spans.push({
+					start: i,
+					end: text.length,
+					open: true
+				});
+				break;
+			}
+			spans.push({
+				start: i,
+				end,
+				open: false
+			});
+			i = end;
+			continue;
+		}
+		const xml = xmlIgnoredEnd(text, i);
+		if (xml !== void 0) {
+			spans.push(xml);
+			if (xml.end >= text.length && xml.open) break;
+			i = xml.end;
+			continue;
+		}
+		i += 1;
+	}
+	if (fence !== void 0) spans.push({
+		start: fenceStart,
+		end: text.length,
+		open: true
+	});
+	return spans;
+}
+/**
+* End of the inline code span starting at `start`, or -1 when there is none.
+*
+* Three or more backticks are a fence, not a code span — {@link ignoredSpans}
+* handles those, and conflating the two is how a fence's opening ticks get
+* mistaken for an unclosed inline span.
+*/
+function codeSpanEnd(text, start) {
+	let ticks = 0;
+	let i = start;
+	while (i < text.length && text.charAt(i) === "`") {
+		ticks += 1;
+		i += 1;
+	}
+	if (ticks === 0 || ticks >= 3) return -1;
+	let end = i;
+	while (end < text.length) {
+		if (text.charAt(end) !== "`") {
+			end += 1;
+			continue;
+		}
+		let closingTicks = 0;
+		let j = end;
+		while (j < text.length && text.charAt(j) === "`") {
+			closingTicks += 1;
+			j += 1;
+		}
+		if (closingTicks === ticks) return j;
+		end = j;
+	}
+	return -1;
+}
+/** CDATA / comment / processing instruction at `index`, if one starts there. */
+function xmlIgnoredEnd(text, index) {
+	for (const [open, close] of [
+		["<![CDATA[", "]]>"],
+		["<!--", "-->"],
+		["<?", "?>"]
+	]) {
+		if (!text.startsWith(open, index)) continue;
+		const found = text.indexOf(close, index + open.length);
+		if (found === -1) return {
+			start: index,
+			end: text.length,
+			open: true
+		};
+		return {
+			start: index,
+			end: found + close.length,
+			open: false
+		};
+	}
+}
+/**
+* Index just past the ignored span containing `index`, or `index` unchanged.
+*
+* `cursor` is a hint into the sorted span list; callers that walk positions in
+* order get O(1) amortised lookup, which is why the parameter exists.
+*/
+function skipIgnored(spans, index, cursor) {
+	while (cursor.at < spans.length) {
+		const span = spans[cursor.at];
+		if (span === void 0 || index < span.start) return index;
+		if (index < span.end) return span.end;
+		cursor.at += 1;
+	}
+	return index;
+}
+/**
+* Length of the marker prefix at `index`, or 0 when none is there.
+*
+* Two passes on purpose. The literal spellings are tried first; then the text
+* is normalised character by character, which is the only way to recognise a
+* block that mixes the two bar styles — and mixing is normal: one captured
+* emission spelled the opening tags with single bars and the closer with double.
+*/
+function prefixLengthAt(text, index) {
+	for (const prefix of MARKUP_PREFIXES) if (text.startsWith(prefix, index)) return prefix.length;
+	const normalized = normalizeFullwidth(text.slice(index, index + 8));
+	for (const prefix of ASCII_PREFIXES) if (normalized.startsWith(prefix)) return prefix.length;
+	return 0;
+}
+/** Is a single character usable inside a tag name? Mirrors Python's `isalnum()`. */
+function isNameCharacter(text, index) {
+	return /[\p{L}\p{N}_-]/u.test(text.charAt(index));
+}
+/** Read a tag name at `index` (after any marker prefix). */
+function readName(text, index) {
+	const prefixLength = prefixLengthAt(text, index);
+	const marked = prefixLength > 0;
+	let position = index + prefixLength;
+	while (position < text.length && /\s/.test(text.charAt(position))) position += 1;
+	const start = position;
+	while (position < text.length && isNameCharacter(text, position)) position += 1;
+	if (position === start) return {
+		name: "",
+		end: index,
+		marked
+	};
+	return {
+		name: text.slice(start, position).toLowerCase(),
+		end: position,
+		marked
+	};
+}
+/**
+* Scan a tag at `index`, or nothing when there is not one.
+*
+* Any name is accepted (the model invents parameter tags freely); only the ones
+* in {@link CANONICAL_TAG_NAMES} are normalised, and the misspellings are
+* normalised only in a marker form — `<toolcalls>` alone is somebody's HTML.
+*/
+function scanTag(text, index) {
+	if (text.charAt(index) !== "<") return void 0;
+	let position = index + 1;
+	let closing = false;
+	if (text.charAt(position) === "/") {
+		closing = true;
+		position += 1;
+	}
+	while (position < text.length && /\s/.test(text.charAt(position))) position += 1;
+	const read = readName(text, position);
+	if (read.name === "") return void 0;
+	const canonical = CANONICAL_TAG_NAMES.get(read.name);
+	const name = canonical !== void 0 && !(MARKER_ONLY_TAG_NAMES.has(read.name) && !read.marked) ? canonical : read.name;
+	const attributesStart = read.end;
+	let selfClosing = false;
+	let cursor = read.end;
+	while (cursor < text.length) {
+		const character = text.charAt(cursor);
+		if (character === ">") return {
+			start: index,
+			end: cursor,
+			name,
+			closing,
+			selfClosing,
+			marked: read.marked,
+			attributes: text.slice(attributesStart, cursor).trim()
+		};
+		if (character === "/" && text.charAt(cursor + 1) === ">") {
+			selfClosing = true;
+			return {
+				start: index,
+				end: cursor + 1,
+				name,
+				closing,
+				selfClosing,
+				marked: read.marked,
+				attributes: text.slice(attributesStart, cursor).trim()
+			};
+		}
+		cursor += 1;
+	}
+}
+/** The next markup tag outside every ignored span, at or after `from`. */
+function findTag(text, spans, from) {
+	const cursor = { at: 0 };
+	let index = Math.max(from, 0);
+	while (index < text.length) {
+		const skipped = skipIgnored(spans, index, cursor);
+		if (skipped !== index) {
+			index = skipped;
+			continue;
+		}
+		if (text.charAt(index) === "<") {
+			const tag = scanTag(text, index);
+			if (tag !== void 0) return tag;
+		}
+		index += 1;
+	}
+}
+/**
+* The close tag matching `open`, or nothing when it has not arrived yet.
+*
+* Depth counting so a nested block of the same name cannot terminate its parent
+* early. This is gate 1's teeth: no close, no call.
+*/
+function findMatchingClose(text, spans, open) {
+	let depth = 1;
+	let index = open.end + 1;
+	while (index < text.length) {
+		const tag = findTag(text, spans, index);
+		if (tag === void 0) return void 0;
+		if (tag.name === open.name) {
+			if (tag.closing) {
+				depth -= 1;
+				if (depth === 0) return tag;
+			} else if (!tag.selfClosing) depth += 1;
+		}
+		index = tag.end + 1;
+	}
+}
+/**
+* The first block-opening tag in `text`, with its close when one has arrived.
+*
+* The close is OPTIONAL on purpose, and the two callers need it differently:
+* the buffer holds from `open` while it is missing (gate 1 — the block may
+* still complete), whereas parsing already-complete text stops rather than
+* correcting a broken block and then trusting what follows it.
+*/
+function findFirstOpener(text, spans) {
+	let index = 0;
+	while (index < text.length) {
+		const tag = findTag(text, spans, index);
+		if (tag === void 0) return void 0;
+		if (!tag.closing && BLOCK_TAGS.includes(tag.name)) {
+			const close = findMatchingClose(text, spans, tag);
+			return close === void 0 ? { open: tag } : {
+				open: tag,
+				close
+			};
+		}
+		index = tag.end + 1;
+	}
+}
+/** Decode the five predefined XML entities plus numeric references. */
+function decodeEntities(text) {
+	if (!text.includes("&")) return text;
+	const named = /* @__PURE__ */ new Map([
+		["amp", "&"],
+		["lt", "<"],
+		["gt", ">"],
+		["quot", "\""],
+		["apos", "'"]
+	]);
+	return text.replace(/&(#[0-9]+|#x[0-9a-f]+|[a-z]+);/gi, (whole, body) => {
+		if (body.startsWith("#")) {
+			const hex = body.charAt(1).toLowerCase() === "x";
+			const digits = hex ? body.slice(2) : body.slice(1);
+			const code = Number.parseInt(digits, hex ? 16 : 10);
+			if (!Number.isFinite(code) || code <= 0 || code > 1114111) return whole;
+			return String.fromCodePoint(code);
+		}
+		return named.get(body.toLowerCase()) ?? whole;
+	});
+}
+/** `name="value"` / `name='value'` pairs, entities decoded. */
+function parseAttributes(text) {
+	const attributes = {};
+	const pattern = /([a-z0-9_:-]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/gi;
+	let match = pattern.exec(text);
+	while (match !== null) {
+		const key = match[1];
+		const value = match[2] ?? match[3];
+		if (key !== void 0 && value !== void 0) attributes[key] = decodeEntities(value);
+		match = pattern.exec(text);
+	}
+	return attributes;
+}
+/**
+* Parse the parameters inside one block body.
+*
+* Two shapes, in the order the model prefers them:
+*   - `<｜DSML｜parameter name="cmd">value</…parameter>` (the explicit form);
+*   - `<cmd>value</cmd>` (the tag name IS the parameter name), used only when
+*     the explicit form has not already claimed that name — otherwise a nested
+*     tag echoing it would overwrite the real value.
+*
+* A `CDATA` body is taken verbatim; everything else is entity-decoded.
+*
+* Every scanner here computes its ignored spans from the string it is about to
+* scan. Span offsets are only meaningful against the text they were measured
+* on, and a body is a substring of its parent — reusing the parent's offsets
+* would misplace every fence and silently turn "quoted markup" into "called
+* markup", which is gate 4's worst failure. Each of these strings is small, so
+* recomputing is cheaper than passing a coordinate system around.
+*/
+function parseParameters(body) {
+	const parameters = {};
+	const spans = ignoredSpans(body);
+	let index = 0;
+	while (index < body.length) {
+		const tag = findTag(body, spans, index);
+		if (tag === void 0) break;
+		if (tag.closing || tag.selfClosing) {
+			index = tag.end + 1;
+			continue;
+		}
+		const close = findMatchingClose(body, spans, tag);
+		if (close === void 0) {
+			index = tag.end + 1;
+			continue;
+		}
+		const value = body.slice(tag.end + 1, close.start).trim();
+		const attributes = parseAttributes(tag.attributes);
+		const explicitName = tag.name === "parameter" ? attributes["name"] : void 0;
+		const name = explicitName ?? tag.name;
+		if (name !== void 0 && name !== "" && (explicitName !== void 0 || parameters[name] === void 0)) parameters[name] = value.startsWith("<![CDATA[") && value.endsWith("]]>") ? value.slice(9, -3) : nestedOrText(value);
+		index = close.end + 1;
+	}
+	return parameters;
+}
+/** A value that itself contains a complete tag pair is a nested object. */
+function nestedOrText(value) {
+	if (!value.includes("<") || !value.includes(">")) return decodeEntities(value);
+	const nested = parseParameters(value);
+	return Object.keys(nested).length > 0 ? nested : decodeEntities(value);
+}
+/**
+* One block's worth of text → the calls it declares, or nothing.
+*
+* This is where gates 2 and 4 live. Returning nothing is the COMMON case for
+* mistaken input and is not an error: callers must show the block verbatim.
+*/
+function parseBlock(block, gate) {
+	const calls = [];
+	const spans = ignoredSpans(block);
+	let index = 0;
+	while (index < block.length) {
+		const tag = findTag(block, spans, index);
+		if (tag === void 0) break;
+		if (!tag.closing && tag.name === "invoke") {
+			const close = findMatchingClose(block, spans, tag);
+			if (close === void 0) break;
+			const call = parseInvoke(tag, close, block, gate);
+			if (call !== void 0) calls.push(call);
+			index = close.end + 1;
+			continue;
+		}
+		index = tag.end + 1;
+	}
+	return calls;
+}
+/** One `<invoke>` element → a call, or nothing when a gate refuses it. */
+function parseInvoke(open, close, block, gate) {
+	const name = parseAttributes(open.attributes)["name"];
+	if (name === void 0 || name === "") return void 0;
+	if (!gate.declaredNames.has(name)) return void 0;
+	const pinned = gate.pinnedToolName;
+	if (pinned !== void 0 && pinned !== "auto" && pinned !== "required" && pinned !== "none" && pinned !== name) return;
+	const parameters = parseParameters(block.slice(open.end + 1, close.start));
+	const required = gate.requiredParameters?.get(name);
+	if (required !== void 0 && required.some((parameter) => parameters[parameter] === void 0)) return void 0;
+	return {
+		id: `call_${randomUUID().replace(/-/g, "").slice(0, 24)}`,
+		name,
+		arguments: JSON.stringify(parameters)
+	};
+}
+/**
+* `text` with every markup block removed — the check behind {@link hasProse}.
+*
+* ANY marker-bearing tag counts as markup, whatever it is called. Keying on the
+* known names alone was the first attempt and it got the one shape this project
+* has actually captured wrong: `<｜DSML｜ validate>` carries an invented name
+* (`validate` is the TOOL name, written where `invoke name="…"` belongs), so a
+* keyword-only rule left it standing, the response was classified as prose, and
+* the retry-when-the-turn-produced-nothing rule could never fire for the very
+* leak it was written for — a check that never fires, which is the trap this
+* project has already paid for twice.
+*
+* Removal reaches the matching close only for names that bracket content
+* ({@link KEYWORD_TAGS}); an invented name removes just its own tag, because
+* nothing says it opens anything.
+*
+* Ignored spans are KEPT: a fenced or back-ticked quotation of the marker is
+* prose, and the rule is explicitly about a turn that produced nothing usable.
+*/
+function stripMarkup(text) {
+	const spans = ignoredSpans(text);
+	const cursor = { at: 0 };
+	let result = "";
+	let index = 0;
+	while (index < text.length) {
+		const skipped = skipIgnored(spans, index, cursor);
+		if (skipped !== index) {
+			result += text.slice(index, skipped);
+			index = skipped;
+			continue;
+		}
+		const tag = text.charAt(index) === "<" ? scanTag(text, index) : void 0;
+		if (tag === void 0 || !tag.marked) {
+			result += text.charAt(index);
+			index += 1;
+			continue;
+		}
+		const close = !tag.closing && !tag.selfClosing && KEYWORD_TAGS.includes(tag.name) ? findMatchingClose(text, spans, tag) : void 0;
+		index = close === void 0 ? tag.end + 1 : close.end + 1;
+	}
+	return result;
+}
+/**
+* Does `text` carry content outside markup blocks?
+*
+* This is what makes "the turn produced nothing usable" a checkable fact rather
+* than a guess: a response whose only content is markup residue returns false,
+* and the caller may then consider a single retry. Text inside a fence or code
+* span counts as content — a documented quotation of the marker is prose.
+*/
+function hasProse(text) {
+	return stripMarkup(text).trim() !== "";
+}
+/**
+* Which of `text`'s tail must wait for more bytes.
+*
+* Two reasons to hold, and only these two:
+*   - the tail starts a tag that is not closed yet, and could still turn out to
+*     be a block opener (`…<｜DSML｜inv`), so committing it as text would make
+*     the block unparseable;
+*   - the tail opens a code span whose closer is still in flight, because
+*     whether the following markup is *quoted* depends on that span.
+*
+* Anything else is emitted immediately. In particular a COMPLETE tag that is
+* not a block opener — `<｜DSML｜ validate>`, the shape this project actually
+* captured — is not held: it is prose as far as this layer is concerned, and
+* holding it would delay every ordinary answer that mentions the markup.
+*/
+function holdFrom(text, spans) {
+	let hold = text.length;
+	const lastLt = text.lastIndexOf("<");
+	if (lastLt !== -1 && looksLikeTagStart(text.slice(lastLt))) hold = Math.min(hold, lastLt);
+	for (const span of spans) if (span.open) hold = Math.min(hold, span.start);
+	return hold;
+}
+/**
+* Could this fragment be the beginning of a block-opening tag?
+*
+* Conservative by construction: it requires an unterminated `<`, and after
+* stripping an optional `/`, whitespace and marker, the remainder must be a
+* prefix of (or extend) a known opener. That is what keeps `a < b`, `<50%` and
+* `i < n` in ordinary prose from stalling a stream — each of them either
+* contains a `>` or fails the opener test.
+*
+* A marker that is STILL ARRIVING also holds (`<｜`, `<｜DSML`, `||D`). Without
+* that case the leading `<｜` is emitted as text the moment it arrives, and the
+* block can never be recovered afterwards because its opening tag has already
+* been split in two — a byte-by-byte feed is how this was found, and the
+* reference implementation has the same hole.
+*/
+function looksLikeTagStart(tail) {
+	if (!tail.startsWith("<")) return false;
+	if (tail.includes(">")) return false;
+	let body = tail.slice(1);
+	if (body.startsWith("/")) body = body.slice(1);
+	if (body === "" || isPartialMarker(body)) return true;
+	const prefixLength = prefixLengthAt(body, 0);
+	body = body.slice(prefixLength).trim().toLowerCase();
+	if (body === "" || isPartialMarker(body)) return true;
+	return [
+		"tool",
+		"invoke",
+		"tool_calls",
+		"tool-calls",
+		"toolcalls",
+		"tool_call",
+		"tool-call"
+	].some((opener) => opener.startsWith(body) || body.startsWith(opener));
+}
+/**
+* Is this the start of a marker whose remainder has not arrived yet?
+*
+* Compared both literally and full-width-normalised, because the model mixes
+* the two bar styles and a mixture splits at an unpredictable character.
+*/
+function isPartialMarker(body) {
+	const trimmed = body.trimStart();
+	if (trimmed === "") return true;
+	const forms = [...MARKUP_PREFIXES, ...ASCII_PREFIXES];
+	return [trimmed, normalizeFullwidth(trimmed.slice(0, 8))].some((candidate) => candidate !== "" && forms.some((form) => form.startsWith(candidate) && candidate.length < form.length));
+}
+/** Full-width ASCII (U+FF01..U+FF5E) mapped to its ASCII counterpart. */
+function normalizeFullwidth(text) {
+	let normalized = "";
+	for (const character of text) {
+		const code = character.codePointAt(0) ?? 0;
+		normalized += code >= 65281 && code <= 65374 ? String.fromCodePoint(code - 65248) : character;
+	}
+	return normalized;
+}
+/**
+* Buffers `delta.content` and commits a call only when the block that declares
+* it is complete.
+*
+* Ported from the reference's `ToolCallStreamBuffer` with its hard-won
+* behaviour intact:
+*
+*   - a block with no close tag yet holds the ENTIRE block (not a partial
+*     guess), and only the tail that could still become a tag is held back
+*     from otherwise-finished text;
+*   - a block that fails the gates is emitted VERBATIM (gate 4), not dropped;
+*   - {@link flush} hands back whatever is still held, so a truncated block
+*     loses none of its text.
+*
+* The reference's own comment explains why the tail rule is not "hold
+* everything from the first `<`": an architecture document that shows
+* `<tool_calls><invoke>` as an EXAMPLE would otherwise starve the rest of the
+* response until the stream ended, and then lose it.
+*/
+var DsmlStreamBuffer = class {
+	pending = "";
+	gate;
+	constructor(gate) {
+		this.gate = gate;
+	}
+	/** Feed one `delta.content` chunk; returns text and any call it completed. */
+	add(chunk) {
+		this.pending += chunk;
+		const parts = [];
+		const calls = [];
+		if (this.gate.declaredNames.size === 0) {
+			const text = this.pending;
+			this.pending = "";
+			return {
+				text,
+				prose: hasProse(text)
+			};
+		}
+		for (;;) {
+			const found = findFirstOpener(this.pending, ignoredSpans(this.pending));
+			if (found === void 0) break;
+			const head = this.pending.slice(0, found.open.start);
+			if (head !== "") parts.push(head);
+			if (found.close === void 0) {
+				this.pending = this.pending.slice(found.open.start);
+				return finish(parts, calls);
+			}
+			const body = this.pending.slice(found.open.start, found.close.end + 1);
+			const recovered = parseBlock(body, this.gate);
+			if (recovered.length > 0) calls.push(...recovered);
+			else parts.push(body);
+			this.pending = this.pending.slice(found.close.end + 1);
+		}
+		const hold = holdFrom(this.pending, ignoredSpans(this.pending));
+		if (hold > 0) parts.push(this.pending.slice(0, hold));
+		this.pending = this.pending.slice(hold);
+		return finish(parts, calls);
+	}
+	/** End of stream: hand back everything still held, verbatim. */
+	flush() {
+		const text = this.pending;
+		this.pending = "";
+		return {
+			text,
+			prose: hasProse(text)
+		};
+	}
+};
+/** Assemble one `add()` outcome without ever emitting a `calls: undefined` key. */
+function finish(parts, calls) {
+	const text = parts.join("");
+	const outcome = {
+		text,
+		prose: hasProse(text)
+	};
+	if (calls.length > 0) outcome.calls = [...calls];
+	return outcome;
+}
 //#endregion
 //#region src/shim.ts
 /**
@@ -519,12 +1205,352 @@ function readBody(req) {
 	});
 }
 /**
+* Rewrites the upstream SSE stream, converting markup the model wrote into the
+* text back into a real `delta.tool_calls` — and, when a whole turn produced
+* nothing but markup, holding the bytes long enough to retry ONCE.
+*
+* ============================================================================
+* Why this class exists rather than a `.pipe()`
+* ============================================================================
+*
+* Recovering a call means inspecting `delta.content` before the client sees it,
+* which the old `body.pipe(res)` could not do. The parsing rules live in
+* `src/dsml-recovery.ts`; everything here is about the STREAM's obligations:
+*
+*   1. FRAME ORDER IS NEVER CHANGED. Frames are forwarded in arrival order.
+*      The only frame this class invents is the trailing one that carries a
+*      block still unfinished at end-of-stream.
+*
+*   2. HOLDS ARE TEMPORARY AND PAY FOR THEMSELVES. Nothing is held unless the
+*      answer so far consists only of markup: the moment real prose or a real
+*      call appears, everything held is flushed in order and the stream returns
+*      to plain pass-through. An ordinary answer therefore pays no latency at
+*      all, and no byte is ever discarded while a retry is still possible.
+*
+*   3. A RETRY MUST NOT SPLICE TWO ANSWERS TOGETHER. That constraint is why the
+*      hold exists: because no content frame has been written yet, the caller
+*      can discard this attempt and re-send the same body. The existing
+*      failover loop makes the same promise for failures BEFORE the stream
+*      starts (see its comment in `chatCompletions`); this extends it to the
+*      one case that can only be recognised after the fact.
+*
+*   4. NOTHING IS INVENTED WHEN THE UPSTREAM ALREADY SPEAKS STRUCTURED CALLS.
+*      Once a native `delta.tool_calls` appears, recovery switches off for the
+*      rest of the response — two live call channels for one answer is worse
+*      than either one alone.
+*/
+var RecoveryStream = class {
+	res;
+	logger;
+	carry = "";
+	decoder = new TextDecoder("utf-8");
+	/** Frames received after the hold began, in arrival order. */
+	held = [];
+	/**
+	* The hold window, as two separate facts.
+	*
+	* `windowOpened` becomes true at the FIRST content-bearing frame and stays
+	* true: before it, frames carry no answer (a role delta, a keep-alive) and go
+	* straight out; from it on, they are held until the answer is known to be
+	* real. `windowClosed` means "an answer was delivered", after which every
+	* frame passes through again — for the rest of the response, because a turn
+	* that has already produced prose can no longer be replaced by a retry.
+	*/
+	windowOpened = false;
+	windowClosed = false;
+	wroteContent = false;
+	sawResidue = false;
+	sawDone = false;
+	/**
+	* Set once the upstream speaks structured calls.
+	*
+	* Sticky for the whole response on purpose: recovering markup into a second
+	* call channel after the upstream already produced a real one would hand the
+	* client two answers to the same question.
+	*/
+	nativeCallsSeen = false;
+	buffer;
+	constructor(res, gate, logger) {
+		this.res = res;
+		this.logger = logger;
+		this.buffer = gate === void 0 ? void 0 : new DsmlStreamBuffer(gate);
+	}
+	/** True when a call or real prose has reached the client. */
+	get delivered() {
+		return this.wroteContent;
+	}
+	/** True when the held bytes contain markup the gates refused. */
+	get residueSeen() {
+		return this.sawResidue;
+	}
+	/** Record that text the gates refused was seen (markup residue, not prose). */
+	noteResidue(seen) {
+		this.sawResidue ||= seen;
+	}
+	/** Drain one upstream body into the client. */
+	async consume(body) {
+		if (body === null) return;
+		const source = Readable.fromWeb(body);
+		try {
+			for await (const chunk of source) this.push(this.decoder.decode(chunk, { stream: true }));
+		} catch (error) {
+			this.logger?.warn("dsh-connect-workbuddy: upstream stream failed mid-flight", error);
+		}
+		const tail = this.carry;
+		this.carry = "";
+		if (tail !== "") this.handleFrame(tail);
+	}
+	/**
+	* Close the response: emit the block still unfinished at end-of-stream, then
+	* everything held, then the terminator.
+	*/
+	finish() {
+		const flushed = this.buffer?.flush();
+		if (flushed !== void 0 && flushed.text !== "") {
+			this.noteResidue(!flushed.prose);
+			this.emitContent(flushed.text);
+		}
+		this.closeWindow();
+		if (!this.sawDone && this.res.writable) this.res.write("data: [DONE]\n\n");
+		if (this.res.writable) this.res.end();
+	}
+	/** Drop held bytes without writing them (used when a retry replaced them). */
+	discard() {
+		this.held = [];
+		this.windowClosed = true;
+	}
+	/** Split incoming bytes into whole SSE frames, handling chunk boundaries. */
+	push(text) {
+		this.carry += text;
+		let start = 0;
+		for (;;) {
+			const newline = this.carry.indexOf("\n", start);
+			if (newline === -1) break;
+			if (this.carry.slice(start, newline).trim() === "") {
+				const frame = this.carry.slice(0, newline + 1);
+				this.carry = this.carry.slice(newline + 1);
+				start = 0;
+				this.handleFrame(frame);
+				continue;
+			}
+			start = newline + 1;
+		}
+	}
+	/** Handle one complete frame, rewriting it only when recovery produced something. */
+	handleFrame(frame) {
+		const payload = dataPayload(frame);
+		if (payload === void 0) {
+			this.send(frame, false);
+			return;
+		}
+		if (payload === "[DONE]") {
+			this.sawDone = true;
+			this.send(frame, false);
+			return;
+		}
+		let chunk;
+		try {
+			chunk = JSON.parse(payload);
+		} catch {
+			this.send(frame, false);
+			return;
+		}
+		const choices = chunk["choices"];
+		const choice = Array.isArray(choices) ? choices[0] : void 0;
+		if (typeof choice !== "object" || choice === null || Array.isArray(choice)) {
+			this.send(frame, false);
+			return;
+		}
+		const choiceRecord = choice;
+		const deltaValue = choiceRecord["delta"];
+		const delta = typeof deltaValue === "object" && deltaValue !== null && !Array.isArray(deltaValue) ? deltaValue : void 0;
+		if (delta === void 0) {
+			this.send(frame, false);
+			return;
+		}
+		const nativeCalls = delta["tool_calls"];
+		if (Array.isArray(nativeCalls) && nativeCalls.length > 0) {
+			this.nativeCallsSeen = true;
+			this.windowOpened = true;
+			this.send(frame, false);
+			this.wroteContent = true;
+			this.closeWindow();
+			return;
+		}
+		const content = delta["content"];
+		if (typeof content !== "string" || content === "") {
+			const reason = finishReasonOf(choiceRecord);
+			if (reason !== "") this.drainBuffer();
+			this.send(frame, reason !== "");
+			return;
+		}
+		if (this.buffer === void 0 || this.nativeCallsSeen) {
+			this.windowOpened = true;
+			this.closeWindow();
+			this.res.write(frame);
+			this.wroteContent = true;
+			return;
+		}
+		this.windowOpened = true;
+		const outcome = this.buffer.add(content);
+		if (outcome.calls !== void 0 && outcome.calls.length > 0) {
+			this.send(callsFrame(chunk, choiceRecord, outcome.calls), false);
+			this.wroteContent = true;
+			this.closeWindow();
+			if (outcome.text !== "") this.res.write(contentFrame(chunk, choiceRecord, outcome.text));
+			return;
+		}
+		this.noteResidue(!outcome.prose && outcome.text !== "");
+		if (outcome.text === "") {
+			this.send(contentFrame(chunk, choiceRecord, ""), false);
+			return;
+		}
+		if (outcome.prose) {
+			this.send(contentFrame(chunk, choiceRecord, outcome.text), false);
+			this.wroteContent = true;
+			this.closeWindow();
+			return;
+		}
+		this.send(contentFrame(chunk, choiceRecord, outcome.text), false);
+	}
+	/**
+	* Hand back whatever the buffer is still holding, right now.
+	*
+	* Called before a terminator frame is forwarded. `flush()` ends the buffer's
+	* attempt — if content somehow keeps arriving afterwards it starts a fresh
+	* one, which is the correct reading of a stream that declared itself finished.
+	*/
+	drainBuffer() {
+		const flushed = this.buffer?.flush();
+		if (flushed === void 0 || flushed.text === "") return;
+		this.noteResidue(!flushed.prose);
+		this.emitContent(flushed.text);
+	}
+	/**
+	* Emit text the buffer was still holding when the stream ended.
+	*
+	* It goes through `send` + `closeWindow` rather than straight to the socket on
+	* purpose: a `finish_reason` frame may already be queued, and this text is
+	* content that logically precedes it. Writing directly would put the answer
+	* after its own terminator — a client that stops accumulating at
+	* `finish_reason` would silently lose the tail.
+	*/
+	emitContent(text) {
+		const chunk = { choices: [{
+			index: 0,
+			delta: {},
+			finish_reason: ""
+		}] };
+		const choiceRecord = {
+			index: 0,
+			delta: {},
+			finish_reason: ""
+		};
+		this.windowOpened = true;
+		const frame = contentFrame(chunk, choiceRecord, text);
+		if (text.trim() !== "") {
+			this.send(frame, false);
+			this.wroteContent = true;
+			this.closeWindow();
+			return;
+		}
+		this.send(frame, false);
+	}
+	/** Queue a frame while the window is open, or write it once it has closed. */
+	send(frame, final) {
+		if (this.windowClosed || !this.windowOpened) {
+			this.res.write(frame);
+			return;
+		}
+		const entry = {
+			frame,
+			final
+		};
+		if (!final) {
+			const at = this.held.findIndex((item) => item.final);
+			if (at !== -1) {
+				this.held.splice(at, 0, entry);
+				return;
+			}
+		}
+		this.held.push(entry);
+	}
+	/**
+	* An answer has been delivered: flush everything held, in order, and never
+	* hold again for this response.
+	*/
+	closeWindow() {
+		this.windowClosed = true;
+		const pending = this.held;
+		this.held = [];
+		for (const entry of pending) this.res.write(entry.frame);
+	}
+};
+/** The SSE `data:` payload of one frame, or nothing when it carries none. */
+function dataPayload(frame) {
+	for (const line of frame.split("\n")) {
+		const trimmed = line.trimEnd();
+		if (!trimmed.startsWith("data:")) continue;
+		return trimmed.slice(5).trim();
+	}
+}
+/** A frame's `finish_reason`, or '' when it carries none. */
+function finishReasonOf(choice) {
+	const reason = choice["finish_reason"];
+	return typeof reason === "string" ? reason : "";
+}
+/**
+* One frame carrying recovered calls.
+*
+* The shape is OpenAI's: `index` per call, `type: "function"`, arguments as a
+* JSON STRING. `finish_reason` becomes `tool_calls` — without it a client that
+* waits for the reason before executing an assembled call would never run it.
+*/
+function callsFrame(chunk, choice, calls) {
+	const toolCalls = calls.map((call, index) => ({
+		index,
+		id: call.id,
+		type: "function",
+		function: {
+			name: call.name,
+			arguments: call.arguments
+		}
+	}));
+	const next = {
+		...chunk,
+		choices: [{
+			...choice,
+			delta: { tool_calls: toolCalls },
+			finish_reason: "tool_calls"
+		}]
+	};
+	return `data: ${JSON.stringify(next)}\n\n`;
+}
+/** One frame carrying replacement text for a frame whose content was consumed. */
+function contentFrame(chunk, choice, content) {
+	const delta = {
+		...choice["delta"],
+		content
+	};
+	const next = {
+		...chunk,
+		choices: [{
+			...choice,
+			delta
+		}]
+	};
+	return `data: ${JSON.stringify(next)}\n\n`;
+}
+/**
 * Start the loopback endpoint. Requests must carry the shim's shared secret;
 * the loopback bind alone is not a trust boundary.
 */
 function createWorkBuddyShim(options) {
 	const { store, client, catalog } = options;
 	const logger = options.logger;
+	const failoverAccount = options.failoverAccount;
+	const prepareAccount = options.prepareAccount;
+	const onAccountFailure = options.onAccountFailure;
 	const SHARED_SECRET = randomBytes(32).toString("base64url");
 	/** Constant-time bearer check; absent or mismatched bearers are rejected. */
 	function bearerOk(req) {
@@ -593,11 +1619,27 @@ function createWorkBuddyShim(options) {
 			else res.end();
 		}
 	}
+	/**
+	* Failure classes worth retrying against another account.
+	*
+	* `client` is deliberately NOT one of them: the upstream rejected the
+	* REQUEST (malformed body, unsupported field), so every account answers the
+	* same 400 and walking the rest of the pool only multiplies the wait before
+	* the user sees an error they must act on anyway. Everything else describes a
+	* PER-ACCOUNT condition — a rate limit, exhausted credits, a dead session, a
+	* gateway that failed this one call — which another account may well survive.
+	*/
+	function isFailoverWorthy(kind) {
+		return kind !== "client";
+	}
 	async function chatCompletions(req, res) {
 		if (!isJsonContentType(req)) {
 			writeOpenAIError(res, 415, "unsupported_media_type", "Content-Type must be application/json");
 			return;
 		}
+		await prepareAccount?.().catch((error) => {
+			logger?.warn("dsh-connect-workbuddy: pool account selection failed", error);
+		});
 		let credential;
 		try {
 			credential = await store.resolve();
@@ -608,10 +1650,64 @@ function createWorkBuddyShim(options) {
 		const raw = (await readBody(req)).toString("utf8");
 		const prepared = prepareChatBody(raw);
 		const controller = new AbortController();
-		req.on("close", () => controller.abort());
-		const result = await client.chatStream(credential, prepared, controller.signal);
+		res.on("close", () => controller.abort());
+		let result = await client.chatStream(credential, prepared, controller.signal);
+		const triedAccountIds = [];
+		/**
+		* Tell the plugin about a failed attempt so it can store the measurement.
+		*
+		* Every failed attempt is reported exactly once, INCLUDING the last one — an
+		* account that failed with nobody left to try it is precisely the one the
+		* next request must avoid, so reporting only the attempts that had a
+		* successor would miss the case that matters most.
+		*
+		* Reported after the loop rather than inside it, so the account that broke
+		* out of the loop is not also reported by the post-loop call. Not awaited: the
+		* user is waiting on the retry, and the write only affects later requests.
+		*/
+		const failures = [];
+		const recordAttempt = (credential, failure) => {
+			if (failure.ok) return;
+			failures.push({
+				accountId: workbuddyAccountId(credential),
+				failure
+			});
+		};
+		const reportFailures = () => {
+			if (onAccountFailure === void 0) {
+				failures.length = 0;
+				return;
+			}
+			for (const entry of failures.splice(0, failures.length)) {
+				if (entry.failure.ok) continue;
+				try {
+					onAccountFailure(entry.accountId, {
+						status: entry.failure.status,
+						kind: entry.failure.kind,
+						message: entry.failure.message
+					});
+				} catch (error) {
+					logger?.warn("dsh-connect-workbuddy: recording an account failure failed", error);
+				}
+			}
+		};
+		while (!result.ok && isFailoverWorthy(result.kind) && failoverAccount !== void 0) {
+			if (controller.signal.aborted) break;
+			recordAttempt(credential, result);
+			triedAccountIds.push(workbuddyAccountId(credential));
+			const next = await failoverAccount(triedAccountIds).catch(() => void 0);
+			if (next === void 0) break;
+			if (triedAccountIds.includes(workbuddyAccountId(next))) break;
+			logger?.warn(`dsh-connect-workbuddy: retrying chat on another pool account after ${result.kind} (http ${result.status})`);
+			credential = next;
+			result = await client.chatStream(credential, prepared, controller.signal);
+		}
+		if (failures.length === 0 || failures[failures.length - 1]?.accountId !== workbuddyAccountId(credential)) recordAttempt(credential, result);
+		reportFailures();
 		if (!result.ok) {
-			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status}): ${result.message.slice(0, 400)}`);
+			const attempts = triedAccountIds.length;
+			const note = attempts > 1 ? ` (after trying ${attempts} accounts)` : "";
+			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status})${note}: ${result.message.slice(0, 400)}`);
 			return;
 		}
 		res.writeHead(200, {
@@ -620,16 +1716,41 @@ function createWorkBuddyShim(options) {
 			"Connection": "keep-alive",
 			"X-Accel-Buffering": "no"
 		});
-		let sawDone = false;
-		const body = Readable.fromWeb(result.response.body);
-		body.on("data", (chunk) => {
-			if (chunk.includes("[DONE]")) sawDone = true;
-		});
-		body.on("error", (error) => {
-			logger?.warn("dsh-connect-workbuddy: upstream stream failed mid-flight", error);
-			if (!sawDone && res.writable) res.end("data: [DONE]\n\n");
-		});
-		body.pipe(res);
+		const declared = declaredTools(prepared);
+		const gate = declared === void 0 ? void 0 : {
+			declaredNames: declared.names,
+			requiredParameters: declared.requiredParameters,
+			...declared.pinnedToolName === void 0 ? {} : { pinnedToolName: declared.pinnedToolName }
+		};
+		const writer = new RecoveryStream(res, gate, logger);
+		await writer.consume(result.response.body);
+		if (gate !== void 0 && !writer.delivered && writer.residueSeen && !controller.signal.aborted) {
+			logger?.warn("dsh-connect-workbuddy: the turn produced DSML markup only; retrying it once");
+			const retryTried = [...triedAccountIds, workbuddyAccountId(credential)];
+			let retryCredential = credential;
+			for (;;) {
+				const attempt = await client.chatStream(retryCredential, prepared, controller.signal);
+				if (attempt.ok) {
+					writer.discard();
+					const retried = new RecoveryStream(res, gate, logger);
+					await retried.consume(attempt.response.body);
+					retried.finish();
+					reportFailures();
+					return;
+				}
+				recordAttempt(retryCredential, attempt);
+				if (!isFailoverWorthy(attempt.kind) || failoverAccount === void 0) break;
+				if (controller.signal.aborted) break;
+				const next = await failoverAccount(retryTried).catch(() => void 0);
+				if (next === void 0) break;
+				if (retryTried.includes(workbuddyAccountId(next))) break;
+				retryTried.push(workbuddyAccountId(next));
+				retryCredential = next;
+			}
+			logger?.warn("dsh-connect-workbuddy: markup-only retry did not start; showing the original text");
+		}
+		writer.finish();
+		reportFailures();
 	}
 	return {
 		ready,
@@ -1213,15 +2334,6 @@ function effectiveMembersOf(orderedIds, listedIds) {
 	return orderedIds.filter((id) => listedIds.has(id));
 }
 /**
-* The account to bill, or undefined when the pool has no usable member.
-*
-* A thin selector over {@link rankPool} so the winner is decided in exactly one
-* place: every caller that needs "who serves now" gets the same answer.
-*/
-function pickAccount(members, nowMs) {
-	return rankPool(members, nowMs).find((row) => row.excludedBy === void 0)?.account;
-}
-/**
 * The credit figure used for ordering.
 *
 * Absent credits rank as zero. Deliberately NOT "unknown ranks first": an
@@ -1255,94 +2367,6 @@ function pickFreeModel(catalog) {
 	return best;
 }
 /**
-* A latest-wins guard for one region's asynchronous work.
-*
-* Exists because `applyRotation` awaits (it fetches credits per member), so two
-* overlapping calls can interleave: a slow call that read "rotation is ON" can
-* resume AFTER a newer call cleared the override for "rotation is OFF" and write
-* the stale account back — leaving the card showing the pool switched off while
-* a rotated account is still billed.
-*
-* `begin()` claims a new generation and returns a probe; the caller must check
-* it after EVERY await and bail when it reports stale. Extracted as a pure
-* factory rather than inlined so the rule is unit-testable: an inlined token is
-* only observable by reproducing a real interleaving, which is slow and easy to
-* get subtly wrong (a harness that never actually overlaps passes either way).
-*/
-function createLatestWins() {
-	const generations = {};
-	return { begin(key) {
-		const generation = (generations[key] ?? 0) + 1;
-		generations[key] = generation;
-		return () => generations[key] !== generation;
-	} };
-}
-/**
-* How often the pool scheduler wakes to check whether a region is due.
-*
-* A fixed, coarse heartbeat rather than one timer per region: the heartbeat
-* itself does no network work (it only reads config and compares timestamps),
-* so it is free, and it makes re-arming on a config change unnecessary — the
-* next tick simply reads the new interval.
-*/
-const POOL_TICK_MS = 6e4;
-/**
-* Whether an automatic test is due for one region.
-*
-* `lastRunMs === undefined` means "never armed", and returns FALSE: the clock
-* starts when the scheduler first sees the region, so enabling the pool does
-* not immediately spend credits at startup or after a restart. Waiting one
-* interval is the least surprising reading of "test every N minutes" — the
-* alternative (fire immediately) would bill the user on every launch.
-*
-* Pure and total so the scheduling rule can be pinned without real timers.
-*/
-function poolDueAt(input) {
-	if (input.lastRunMs === void 0) return false;
-	const minutes = Math.max(5, Math.round(input.intervalMinutes));
-	return input.nowMs - input.lastRunMs >= minutes * 6e4;
-}
-/**
-* Decide which regions a scheduler tick should run.
-*
-* The FIRST sighting of an enabled region ARMS its clock instead of running it.
-* That split is the whole reason this is a function rather than an `if`:
-* {@link poolDueAt} answers "has enough time passed", which is FALSE for a
-* region that has never run — so a scheduler that only armed the clock when it
-* decided to run would never arm it at all, and the scheduled test would
-* silently never fire. Returning the clock state explicitly makes that
-* impossible to get wrong, and testable without real timers.
-*
-* A region that is switched off keeps NO clock: enabling it later must wait a
-* full interval rather than inheriting a stale timestamp and firing at once.
-*/
-function duePoolRegions(input) {
-	const due = [];
-	const next = {};
-	for (const region of input.regions) {
-		if (!input.enabledOf(region)) continue;
-		const last = input.state[region];
-		if (last === void 0) {
-			next[region] = input.nowMs;
-			continue;
-		}
-		if (!poolDueAt({
-			lastRunMs: last,
-			intervalMinutes: input.intervalMinutesOf(region),
-			nowMs: input.nowMs
-		})) {
-			next[region] = last;
-			continue;
-		}
-		next[region] = input.nowMs;
-		due.push(region);
-	}
-	return {
-		due,
-		next
-	};
-}
-/**
 * Resolve the model the pool should test against.
 *
 * A user-specified id always wins (it is a preference, not a computed default),
@@ -1935,7 +2959,6 @@ async function workBuddyWebPool(deps, region) {
 	const byId = new Map(members.map((member) => [member.account.id, member]));
 	const rankedIds = new Set(ranked.map((row) => row.account.id));
 	const others = await pool.otherAccounts?.(region) ?? [];
-	const rotatedTo = await pool.rotatedToAccountId?.(region).catch(() => void 0);
 	const checkedIn = await pool.checkedInToday?.(region).catch(() => ({})) ?? {};
 	const accounts = [...ranked.map((row) => ({
 		account: row.account,
@@ -1967,14 +2990,12 @@ async function workBuddyWebPool(deps, region) {
 	});
 	return {
 		enabled: preferences.enabled,
-		rotateByCredits: preferences.rotateByCredits,
-		autoTestIntervalMinutes: preferences.autoTestIntervalMinutes,
+		checkinSupported: pool.checkinSupported?.(region) === true,
 		...target.modelId === void 0 ? {} : { targetModelId: target.modelId },
 		...target.staleModelId === void 0 ? {} : { staleTargetModelId: target.staleModelId },
 		targetModelSource: target.source,
 		memberAccountIds: preferences.memberAccountIds,
 		effectiveMemberAccountIds: effectiveMembersOf(accounts.map((account) => account.accountId), new Set(preferences.memberAccountIds)),
-		...rotatedTo === void 0 ? {} : { rotatedToAccountId: rotatedTo },
 		accounts,
 		catalog: deps.displayModels(region).map((model) => ({
 			id: model.id,
@@ -2120,10 +3141,6 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 					error: "account pool unavailable"
 				});
 				try {
-					if (!pool.preferences(region).enabled) return json(res, 409, {
-						reason: "pool-disabled",
-						error: "account pool is disabled for this region"
-					});
 					const savedMembers = pool.preferences(region).memberAccountIds;
 					if ((await pool.effectiveMemberAccountIds?.(region).catch(() => void 0) ?? savedMembers).length === 0) {
 						const noneChecked = savedMembers.length === 0;
@@ -2133,6 +3150,10 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						});
 					}
 					if (action === "checkin") {
+						if (pool.checkinSupported?.(region) !== true) return json(res, 409, {
+							reason: "checkin-unsupported",
+							error: "this region does not offer a daily check-in"
+						});
 						if (pool.checkin === void 0) return json(res, 503, {
 							reason: "pool-unavailable",
 							error: "pool check-in unavailable"
@@ -2331,9 +3352,7 @@ const modelConfig = z.object({
 * one "Save" press overwrite results the timer had just written.
 */
 const poolConfig = z.object({
-	enabled: z.boolean().default(false).description("Whether the account pool is active for this region (opt-in)"),
-	rotateByCredits: z.boolean().default(false).description("Whether the plugin may switch the billed account by credits (opt-in; disables manual selection)"),
-	autoTestIntervalMinutes: z.number().step(1).min(5).max(1440).default(30).description("Minutes between automatic pool tests (5..1440)"),
+	enabled: z.boolean().default(false).description("Whether this region's account pool is active (opt-in). While on, a failed chat request is retried against the other usable pool members before the error is reported."),
 	targetModelId: z.string().default("").description("Model id to test; empty means pick a zero-multiplier model from this region's catalog"),
 	memberAccountIds: z.array(z.string()).default([]).description("Account ids checked into this pool (opt-in; empty means the pool covers nothing)")
 });
@@ -2521,14 +3540,6 @@ function apply(ctx, config) {
 	* immediately instead of waiting out the TTL.
 	*/
 	const checkinStateCache = {};
-	/**
-	* Latest-wins guard for `applyRotation`, keyed by region.
-	*
-	* Declared here (near the top of `apply`) rather than beside `applyRotation`
-	* itself: that function is CALLED from the startup path above its definition,
-	* so a `const` declared down there would be in its temporal dead zone.
-	*/
-	const rotationGuard = createLatestWins();
 	const settingsNs = settingsNamespaceOf(ctx);
 	const stacks = {};
 	for (const region of REGION_KEYS) {
@@ -2546,7 +3557,27 @@ function apply(ctx, config) {
 				store,
 				client,
 				catalog,
-				logger: ctx.logger
+				logger: ctx.logger,
+				/**
+				* Pool routing, bound to THIS region.
+				*
+				* The region is captured in the closure rather than passed per call: each
+				* region owns its own store, pool and shim, and routing that consulted the
+				* other region's members would bill an account from a different account
+				* pool than the one in play.
+				*
+				* `prepareAccount` runs before every request (so the ranking decides who
+				* serves), `failoverAccount` runs after a failure (so the ranking decides
+				* who to try next). Both are resolved lazily — they read pool plumbing
+				* defined below — but never called before it exists: the shim only takes
+				* traffic once the provider is registered, which happens after this whole
+				* setup completes.
+				*/
+				prepareAccount: () => applyPoolSelection(region),
+				failoverAccount: (triedAccountIds) => failoverAccountFor(region, triedAccountIds),
+				onAccountFailure: (accountId, failure) => {
+					recordAccountFailure(region, accountId, failure);
+				}
 			})
 		};
 	}
@@ -2708,11 +3739,11 @@ function apply(ctx, config) {
 		* stacks of accounts, so one region's pool can never rank or bill the
 		* other's accounts.
 		*
-		* `rotateByCredits` is consumed HERE, by the credential store's selection
-		* hook, rather than by writing `config.accounts[region]`. That separation
-		* is the whole reason "turn rotation off" cleanly restores the user's own
-		* choice: rotation decides who serves at runtime and never overwrites the
-		* record of what the user picked.
+		* The pool decides who serves a FAILED request (see `failoverAccountFor`),
+		* and it does so without writing `config.accounts[region]`: a retry borrows
+		* another member's credential for that one request, leaving the record of
+		* what the user picked — and the account the next request starts from —
+		* untouched.
 		*/
 		pool: {
 			preferences: (region) => poolPreferencesOf(current(), region),
@@ -2773,17 +3804,18 @@ function apply(ctx, config) {
 				}));
 				return Object.fromEntries(entries.filter((entry) => entry !== void 0));
 			},
-			/**
-			* The account rotation last moved to, read from the store's runtime
-			* override. Absent means rotation is not currently redirecting billing.
-			*/
-			async rotatedToAccountId(region) {
-				return stacks[region].store.rotatedAccount();
-			},
 			async currentAccountId(region) {
+				await applyPoolSelection(region).catch(() => void 0);
 				const credential = await stacks[region].store.current().catch(() => void 0);
-				return credential === void 0 ? void 0 : workbuddyAccountId(credential);
+				if (credential === void 0) return void 0;
+				if (await servingAccountIsExcluded(region).catch(() => false)) return void 0;
+				return workbuddyAccountId(credential);
 			},
+			/**
+			* Only the CN app rewards a daily check-in; the international region has
+			* no equivalent here, so its card must not offer the action.
+			*/
+			checkinSupported: (region) => region === "cn",
 			checkin: async (region) => {
 				const rows = await checkinAllAccounts(await poolTargets(region), poolRunnerDeps(region));
 				for (const row of rows) {
@@ -2796,7 +3828,6 @@ function apply(ctx, config) {
 			test: async (region, modelId) => {
 				const rows = await testAllAccounts(await poolTargets(region), modelId, poolRunnerDeps(region));
 				await writePoolProbes(region, probeUpdatesOf(rows));
-				await applyRotation(region);
 				return rows;
 			},
 			catalog: (region) => displayModels(current(), region)
@@ -2820,33 +3851,159 @@ function apply(ctx, config) {
 		}
 	};
 	/**
-	* Apply the pool's rotation to one region's store.
+	* The next account to try for a request whose current account just failed,
+	* or `undefined` when this region's pool has nobody left.
 	*
-	* The store's runtime override is set only when rotation is switched ON and a
-	* usable account exists; otherwise it is CLEARED, which restores the user's
-	* own selection immediately. Clearing on every non-rotating path is what
-	* makes "turn rotation off" complete rather than leaving a stale override
-	* billing under a switch that reads as off.
+	* Reads the pool's EXISTING measurements instead of probing: a request that
+	* just failed must not spend further requests deciding who serves next (and a
+	* probe of the target model would itself be billed). Candidates are this
+	* region's checked-in members in rank order, minus everyone this request has
+	* already tried, minus anyone a measurement says cannot serve right now — a
+	* limited account whose stated cooldown has not elapsed, or one whose
+	* credential the upstream rejected.
 	*
-	* Never writes settings: the user's saved choice is untouched throughout.
+	* The pool switch gates this: off means the user's account serves every
+	* request and a failure is reported as-is, exactly as before the pool existed.
+	*
+	* Reads the candidate through `credentialFor()`, never `resolve()`: the saved
+	* selection and the store's runtime state stay untouched, so this is
+	* per-request borrowing rather than a silent change of who pays.
 	*/
-	const applyRotation = async (region) => {
-		const store = stacks[region].store;
-		const stale = rotationGuard.begin(region);
-		const preferences = poolPreferencesOf(current(), region);
-		if (!preferences.enabled || !preferences.rotateByCredits) {
-			store.setRotatedAccount(void 0);
-			return;
+	const failoverAccountFor = async (region, triedAccountIds) => {
+		if (!poolPreferencesOf(current(), region).enabled) return void 0;
+		const tried = new Set(triedAccountIds);
+		for (const row of rankPool(await poolMembersOf(region), Date.now())) {
+			if (row.excludedBy !== void 0) continue;
+			if (tried.has(row.account.id)) continue;
+			const credential = await stacks[region].store.credentialFor(row.account.id);
+			if (credential !== void 0) return credential;
 		}
-		const members = await poolMembersOf(region);
-		if (stale()) return;
-		const picked = pickAccount(members, Date.now());
-		const latest = poolPreferencesOf(current(), region);
-		if (!latest.enabled || !latest.rotateByCredits) {
+	};
+	/**
+	* The last CREDITS reading per region, so a request can rank by balance
+	* without fetching one.
+	*
+	* Credits are the ranking's second key, and they cost an upstream call per
+	* member. A chat request must never pay that: it happens on the hot path, and
+	* `fetchCredits` per member would turn one page of conversation into N extra
+	* requests. So the request path uses whatever the pool last read (the card's
+	* 60-second poll, a batch test, or a save) and simply skips the key when the
+	* snapshot is too old to speak for today's balances.
+	*/
+	const creditsSnapshot = {};
+	/** How long a credits reading may steer routing. */
+	const CREDITS_SNAPSHOT_MS = 6e5;
+	/** When each region's snapshot was taken, for the freshness check above. */
+	const creditsSnapshotAt = {};
+	/**
+	* One region's pool members from LOCAL sources only: the credential store and
+	* the probe store, plus the credits snapshot when it is fresh.
+	*
+	* The request path calls this on every chat completion, so it must not touch
+	* the network. `poolMembersOf` is the honest-but-expensive version (it fetches
+	* credits per member) and stays on the card's route, which is where those
+	* readings come from in the first place.
+	*/
+	async function localPoolMembers(region) {
+		const accounts = await poolMemberAccounts(region);
+		const probes = await readPoolProbes(region);
+		const credits = Date.now() - (creditsSnapshotAt[region] ?? 0) <= CREDITS_SNAPSHOT_MS ? creditsSnapshot[region] : void 0;
+		return accounts.map((account) => {
+			const reading = credits?.get(account.id);
+			return {
+				account: {
+					id: account.id,
+					accountName: account.accountName
+				},
+				...reading === void 0 ? {} : { credits: reading },
+				...probes[account.id] === void 0 ? {} : { probe: probes[account.id] },
+				tokenExpiresAtMs: account.tokenExpiresAtMs
+			};
+		});
+	}
+	/**
+	* Record a failure a LIVE request hit, so the NEXT request starts from a
+	* usable account.
+	*
+	* Without this the ranking only knew what the manual batch test had measured:
+	* an account that had just answered 429 carried no measurement, so
+	* `exclusionOf` returned "candidate" and the ranking kept picking it — every
+	* request paid one failed round trip before failing over. Keeping traffic off
+	* an account the upstream just refused is the pool's whole point
+	* (`account-pool.ts` says exactly that about `rate-limited`), and it only
+	* works if live failures count as measurements.
+	*
+	* Deliberately NOT recorded for `client` (HTTP 400): the upstream rejected the
+	* REQUEST, which says nothing about the account, and recording it would
+	* sideline a good account over a bad body.
+	*
+	* The reset time comes from the upstream's own words — the 429 body carries
+	* 「将在 … 重置」 — which `cooldownOf` parses. When it states no time, the store's
+	* own short window applies rather than a guess at a long one.
+	*/
+	const recordAccountFailure = async (region, accountId, failure) => {
+		if (!poolPreferencesOf(current(), region).enabled) return;
+		if (failure.kind === "client") return;
+		const members = poolPreferencesOf(current(), region).memberAccountIds;
+		if (members.length > 0 && !members.includes(accountId)) return;
+		const outcome = outcomeOfFailure(failure.status, failure.message);
+		const { retryAtMs } = cooldownOf({
+			outcome,
+			retryAfter: null,
+			nowMs: Date.now(),
+			body: failure.message
+		});
+		await writePoolProbes(region, { [accountId]: {
+			outcome,
+			atMs: Date.now(),
+			...retryAtMs === void 0 ? {} : { retryAtMs }
+		} });
+	};
+	/**
+	* Point this region's store at whoever the pool's ranking says should serve.
+	*
+	* Called once per chat request. With the pool ON the ranking decides the
+	* serving account — the whole point of the switch, and the reason the card can
+	* show a "current account" that is not simply the saved selection. With the
+	* pool OFF the override is CLEARED, which restores the user's own choice
+	* immediately: leaving a stale override in place would keep billing under a
+	* switch that reads as off.
+	*
+	* The override is runtime-only and never written to settings, so the user's
+	* recorded choice survives untouched either way — turning the pool off gives
+	* it back verbatim.
+	*
+	* Best-effort: a failure here leaves the previous state in effect, and the
+	* request still goes out (to the user's account when the pool is off, which is
+	* the safe default).
+	*/
+	const applyPoolSelection = async (region) => {
+		const store = stacks[region].store;
+		if (!poolPreferencesOf(current(), region).enabled) {
 			store.setRotatedAccount(void 0);
 			return;
 		}
-		store.setRotatedAccount(picked?.id);
+		const winner = rankPool(await localPoolMembers(region), Date.now()).find((row) => row.excludedBy === void 0);
+		store.setRotatedAccount(winner?.account.id);
+	};
+	/**
+	* Whether the account the store would bill is one the pool has measured as
+	* unusable.
+	*
+	* The two questions differ exactly when the pool runs out of usable members: a
+	* REQUEST still has to go somewhere (the saved selection), but the CARD must
+	* not label that account "in use" while the same table says it is rate-limited.
+	* One screen contradicting itself is how a user learns to trust neither half —
+	* and "the pool moved to an available account" is unverifiable if the display
+	* keeps naming an account the table calls excluded.
+	*/
+	const servingAccountIsExcluded = async (region) => {
+		if (!poolPreferencesOf(current(), region).enabled) return false;
+		const credential = await stacks[region].store.current().catch(() => void 0);
+		if (credential === void 0) return false;
+		const servingId = workbuddyAccountId(credential);
+		const row = rankPool(await localPoolMembers(region), Date.now()).find((candidate) => candidate.account.id === servingId);
+		return row !== void 0 && row.excludedBy !== void 0;
 	};
 	/**
 	* One region's POOL members, each with its credits and last measurement.
@@ -2864,7 +4021,7 @@ function apply(ctx, config) {
 		const store = stacks[region].store;
 		const accounts = await poolMemberAccounts(region);
 		const probes = await readPoolProbes(region);
-		return await Promise.all(accounts.map(async (account) => {
+		const rows = await Promise.all(accounts.map(async (account) => {
 			const credential = await store.credentialFor(account.id).catch(() => void 0);
 			const credits = credential === void 0 ? void 0 : await client.fetchCredits(credential).catch(() => void 0);
 			return {
@@ -2881,14 +4038,15 @@ function apply(ctx, config) {
 				tokenExpiresAtMs: account.tokenExpiresAtMs
 			};
 		}));
+		creditsSnapshot[region] = new Map(rows.filter((row) => row.credits !== void 0).map((row) => [row.account.id, row.credits]));
+		creditsSnapshotAt[region] = Date.now();
+		return rows;
 	}
 	/** One region's pool preferences, with the schema's defaults applied. */
 	const poolPreferencesOf = (config, region) => {
 		const pool = regionStateOf(config, region).pool;
 		return {
 			enabled: pool?.enabled === true,
-			rotateByCredits: pool?.rotateByCredits === true,
-			autoTestIntervalMinutes: pool?.autoTestIntervalMinutes ?? 30,
 			targetModelId: pool?.targetModelId ?? "",
 			memberAccountIds: pool?.memberAccountIds ?? []
 		};
@@ -2951,10 +4109,8 @@ function apply(ctx, config) {
 	});
 	ctx.on("loader/volatile-update", () => {
 		applySelection(current());
-		for (const region of REGION_KEYS) applyRotation(region).catch(() => {});
 	});
 	applySelection(config);
-	for (const region of REGION_KEYS) applyRotation(region).catch(() => {});
 	(async () => {
 		try {
 			const region = await legacyAttributionRegion(current(), async (candidate) => stacks[candidate].store.accounts());
@@ -2964,85 +4120,6 @@ function apply(ctx, config) {
 		} catch {}
 	})();
 	let stopped = false;
-	/**
-	* When each region's automatic test last ran, in epoch ms.
-	*
-	* In-memory only, and deliberately NOT persisted: it exists to space out
-	* runs within one session. Persisting it would make a restart skip a test the
-	* user was owed, and losing it only costs one interval.
-	*/
-	const poolLastRunMs = {};
-	/**
-	* The pool scheduler: ONE heartbeat for both regions.
-	*
-	* A single timer rather than one per region, because the tick does no network
-	* work of its own — it reads the config, compares timestamps, and only then
-	* runs a batch. That also means a settings change needs no re-arming: the next
-	* tick reads whatever interval is now saved.
-	*
-	* This is what makes the "自动测试间隔" setting real. Before it existed the
-	* interval was stored and never consumed, so the card promised a behaviour the
-	* plugin did not have.
-	*/
-	ctx.effect(() => {
-		const timer = setInterval(() => {
-			(async () => {
-				if (stopped) return;
-				const schedule = duePoolRegions({
-					state: poolLastRunMs,
-					regions: REGION_KEYS,
-					enabledOf: (region) => poolPreferencesOf(current(), region).enabled && regionEnabled(current(), region),
-					intervalMinutesOf: (region) => poolPreferencesOf(current(), region).autoTestIntervalMinutes,
-					nowMs: Date.now()
-				});
-				for (const region of REGION_KEYS) {
-					const next = schedule.next[region];
-					if (next === void 0) delete poolLastRunMs[region];
-					else poolLastRunMs[region] = next;
-				}
-				for (const region of schedule.due) await runScheduledPoolTest(region).catch(() => {});
-			})();
-		}, POOL_TICK_MS);
-		return () => {
-			clearInterval(timer);
-		};
-	}, "dsh-connect-workbuddy: account pool scheduler");
-	/**
-	* One scheduled pass for a region: test the pool's members, then re-rank.
-	*
-	* Never bills a paid model on a timer: the target is the user's saved model
-	* when it resolves, and the region's FREE model when the saved one has left
-	* the catalog. An unresolvable target with no free model available stops the
-	* pass — the free-target rule is what stops a timer from spending credits.
-	*
-	* The free FALLBACK for a stale saved model is D3's fix, not a convenience.
-	* The scheduler's job is to keep MEASUREMENTS fresh, and a measurement is
-	* what keeps rotation off a dead account. It used to return early whenever
-	* `resolveTargetModel` produced no id — which is exactly what a saved model
-	* that left the catalog produces — so a stale *display preference* froze the
-	* measurement loop for the whole region. The two exclusions then behaved
-	* asymmetrically: a `rate-limited` member clears by the clock alone
-	* (`exclusionOf` consults `retryAtMs`), while an `unavailable` member can
-	* only be cleared by a NEW probe — and no probe was ever written. The member
-	* hung in the pool's "excluded" state indefinitely, until the user noticed
-	* the stale model and fixed it by hand.
-	*
-	* The manual batch route keeps refusing a stale target (`reason:
-	* 'target-model-stale'`): there the user asked to test THAT model, so
-	* substituting another one would answer a question they did not ask. Here
-	* nobody asked for anything; the pass exists to refresh the pool's own
-	* picture, so it must not be starved by a configuration error it can work
-	* around without spending anything.
-	*/
-	async function runScheduledPoolTest(region) {
-		const targets = await poolTargets(region);
-		if (targets.length === 0) return;
-		const catalog = displayModels(current(), region);
-		const modelId = resolveTargetModel(catalog, poolPreferencesOf(current(), region).targetModelId).modelId ?? pickFreeModel(catalog)?.id;
-		if (modelId === void 0) return;
-		await writePoolProbes(region, probeUpdatesOf(await testAllAccounts(targets, modelId, poolRunnerDeps(region))));
-		await applyRotation(region);
-	}
 	ctx.effect(() => () => {
 		stopped = true;
 		for (const region of REGION_KEYS) stacks[region].shim.close();