dsh-connect-workbuddy 3.3.0 → 3.4.1

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 3.4.1 (2026-10-02)
+
+### Fixes
+
+- **「要等几小时才恢复」的配额错误不再被宿主当成「等两秒就好」的瞬时抖动（issue #28）。**
+  - **现象**：上游 429 / code 6004 的原文是「您的使用量已超出频率限制，**将在 13:37:03 重置**」——要等几小时。本插件把它正确分类成 `soft_rate`（`src/upstream.ts`），但写回宿主时 `type` 与 `code` 都用了 `soft_rate` 这个内部名字。
+  - **根因**：宿主决定「这个失败要不要在原地重试」靠的是从 `type + code + message` 里匹配**几个英文措辞**（`@deepseek-ai/dsh-llm` 的 `isQuotaExceededError`）。`soft_rate` 不在那份名单里，上游原话又是中文，于是宿主只能按 `429` 的默认含义理解——进入 `RATE_LIMIT`，而 `RATE_LIMIT` **在**宿主的重试集合里（`DEFAULT_RETRYABLE_CODES`），`QUOTA` **不在**。宿主于是原地重试 5 次、指数退避，把预算烧光；而真正能救场的跨供应商故障转移（`dsh-subagent-default-model` 的 `failoverEnabled`）根本没被叫到——实测一次会话 1228 个 step、只切换过 1 次供应商、以 429 收场，`models` 里其它供应商全程闲置。
+  - **修法**：只翻译写回宿主的 `code`——`soft_rate` → `quota_exceeded`（宿主认得这个词，且它符合上游实际在说的事）。**HTTP 状态码仍是 429**（那才是上游返回的东西，改成 402 是谎报），上游原话仍原样留在 `message` 里给人看。`type` 保持插件自己的内部名字，便于读日志与报错。
+  - **只翻译这一处**：其余 kind 本来就落在重试集合之外（`hard_credit` 402 → 按状态就是 QUOTA，`session_dead` 401 → AUTH，502/400 → OTHER），所以**不做多余翻译**——没有人需要的翻译只是等着漂移的谎言。插件**自己的**错误（`unauthorized` / `not_found` / `host_not_allowed` / `internal`）也一律不翻译：把自身的 401/404 说成「配额用尽」，会让宿主去为一个换供应商也治不好的错误做故障转移。
+  - 测试直接调用**宿主自己的** `isQuotaExceededError`（`@deepseek-ai/dsh-llm` 导出）来钉住这件事，而不是在测试里抄一份正则——抄一份只能证明两份副本今天一致。三次变异验证：撤回翻译 / 把翻译扩大到所有 kind / 让本地错误也翻译，均会变红。
+
+## 3.4.0 (2026-10-02)
+
+### Fixes
+
+- **账号池不再被一次瞬时故障永久打死：`unavailable` / `failed` 现在有 30 分钟冷却。**
+  - **原来的形状**：`exclusionOf` 只给 `rate-limited` / `out-of-credit` 判冷却到期，`unavailable` / `failed` 一律无条件出池且**不带恢复时间**。而自动复测定时器已在 3.2.0 删除，能刷新它的只剩手动「测试」——**一次 502 或一次网络抖动就能把一个健康账号永久踢出池子**。
+  - **症状**：池内每个成员都被这样剔除后，池子没有任何候选，`failoverAccountFor` 第一轮即返回 `undefined`，自动换号无处可去，上游原始 429/502 直接报给用户——界面上「账号池已启用」与「请求失败」同时成立，且报错没有 `(after trying N accounts)`（因为只试了 1 个账号）。
+  - **现在的形状**：`unavailable` / `failed` 与限流同形，走 `retryDue()`；上游没给时间就按 `POOL_UNKNOWN_COOLDOWN_MS`（30 分钟）兜底。冷却在**排序时求值**，所以不需要定时器——到点的成员在下一次请求自动变回候选。`credential-rejected` 与 `not-found` 保持永不冷却：一个要重新登录，一个是本区域不再提供的模型，等待都修不好。
+  - 反转了 `tests/account-pool.spec.ts` 里一条**明确钉住旧行为**的测试（其原注释即写明「这是留给未来主动决定的反转」），并在测试内记录反转理由。
+
+- **自己中止的请求不再被记成账号故障。** 客户端断开时 `res.on('close')` 会 abort 上游调用，`fetch` 抛出的 `AbortError` 经 `chatStream` 统一成 `status: 0, kind: 'server'`，读起来与「网络真的断了」完全一样——于是**关一次面板就可能把正在服务的账号记成 `unavailable`**。换号循环本来就有 `controller.signal.aborted` 守卫，但那只管「要不要继续换号」，不管「要不要把这次失败记成测量」；`reportFailures()` 现在同样短路。
+
+- **换号路径不再抓积分。** `failoverAccountFor` 用的是 `poolMembersOf`（逐成员 `fetchCredits`），而它自己上方的注释写着「不得再花请求去决定谁服务」——一次失败的对话因此先变成 N 个额外上游请求才发出重试。改用 `localPoolMembers`，与 `applyPoolSelection` 对齐；有新鲜快照时积分仍然参与排序。
+
+- **探测请求补上超时（10 秒）。** `probeChat` 在没有 signal 时完全没有上限，而池的批量测试是**串行**且不传 signal——一个挂住的连接会阻塞整批，且界面上看不出是哪一个成员。现在给「等待响应」设 10 秒上限（远高于正常网关的首字节，远低于用户的耐心），并与调用方传入的 signal 用 `AbortSignal.any` 合并，单模型路由的取消行为不变。
+  - **上限只覆盖等待响应**：`fetch` 一 resolve 就 `clearTimeout`，绝不在读取 body 期间继续计时——否则一个健康但偏慢的模型会和死端点共用同一块表，这正是此处不能用裸 `AbortSignal.timeout` 的原因。
+
+- **两句会误导人的文案改掉了。** `row.probeUnavailable` 去掉了「这是网络问题，**不是模型问题**」——`unavailable` 这个分类里同时装着网关 5xx、DNS 失败与请求超时，对后两者这个断言并不成立（5xx 恰恰是上游侧的问题）。新文案只陈述可核实的事实：「连不上上游——上游没有给出可用答复」，具体原因由旁边记录的 `message` 给出。
+- `row.poolNoCandidateHint` 不再叫人「重新检测账号，或在桌面端重新登录」。池内全不可用时那个建议是错的：限流、积分耗尽与瞬时故障都会**自动回池**（上游给的时间，没给就 30 分钟兜底），只有「凭据被拒」才需要重新登录。原话会让用户去做一件没有任何用处的事。
+- 顺带修掉 3 处本地化文案里的字面量 Markdown（`**真实体积**`、`**不会**`、`**手动动作**`）。React 不解析 Markdown，它们此前是原样把星号画在界面上的——与本轮改掉的两处属于同一类缺陷。
+- **池表与模型行不再把上游报文原样贴一遍。** 限流账号的记录文本就是 `{"code":6004,"msg":"…将在 2026-10-02 06:53:43 重置…","requestId":"…"}`——与旁边刚显示的绝对时刻完全重复；加上新的相对说法后会变成同一时间印三次，后面还跟一个没人看的 requestId。规则现在只在 `src/client/probe-reason.ts` 里写一次、两处共用：
+  - **标签本身已说清的结果**（`rate-limited` / `out-of-credit`，它们都带恢复时刻）**不内联任何正文**；
+  - 其余结果内联**短**形式：JSON 信封里取 `msg` 那句人话，`transport error: ` 这个英文前缀也去掉（中文卡片上它只是噪声），整段封顶 72 字符——一行的病态正文不该把整张表挤出屏幕；
+  - 完整原文挂在 `title` 上，**缩短不等于丢掉**（含 requestId），悬停即可看到。
+  - 例外是有意的：`credential-rejected` / `not-found` 不在「已说清」之列——它们的标签只给结论（「重新登录」「没有这个模型」），上游原话才是让结论可核实的东西。
+
+### Features
+
+- **池表能说清「为什么出池」了。** `WorkBuddyPoolProbe` 新增 `message`：落盘前经 `redactUpstreamText` 脱敏（与探测路径共用同一实现），卡片在结果后追加 `· <上游原话>`。此前 DNS 失败、网关 502、被中止的请求在池表里渲染成**逐字相同**的一句话，用户拿到的是无法行动的提示。字段可选，旧记录照常读取而不被当成损坏。
+
+- **冷却时间现在同时给出「还要等多久」。** 卡片一直只印上游给出的绝对时刻（`05:23:27`）——它回答「何时」，但要读者自己拿当前时间去减，这一步正是让冷却难以行动的地方。现在它旁边多一个相对说法：`05:23:27 之后可再用 · 约 1 小时后`。
+  - 粒度按距离切换：不足 1 分钟 → 「即将恢复」；不足 1 小时 → 「约 N 分钟后」；不足 2 天 → 「约 N 小时后」；再远 → 「约 N 天后」。**小时档从整点开始**（不是 90 分钟）——因为用户自己描述那个 69 分钟后的时刻时写的就是「约 1 小时后」，阈值放高反而会把触发这个改动的那个例子渲染成「约 69 分钟」。天档切在 **2 天**而不是 1 天，否则 36 小时会印成「约 1 天后」，少说 12 小时。
+  - **只对上游给过的时间生效**：`cooldownOf` 返回 `{}`（上游没说时间）时仍然只说「上游未给出何时恢复」，绝不编造倒计时——这是本功能一贯的红线，本次没有新增任何时间来源，只是把已有的那个换个说法。已经到点的时刻返回空串而不是「0 分钟后」。
+  - 模型行与池表两处都接上了；绝对时刻仍是主文案，相对说法是附加的便利。
+
+### Docs
+
+- README 的「账号为什么出池」表按新规则改写：区分「限流/欠费/瞬时故障会自动回池」与「凭据被拒/模型不存在只能手动重测」，并删掉已不存在的「定时器」表述。
+- 清理死代码：`POOL_TICK_MS`、`POOL_MIN_INTERVAL_MINUTES`、`poolDueAt`、`duePoolRegions`、`PoolScheduleInput` / `PoolScheduleResult` 及其单元测试全部删除。它们自 3.2.0 起已无任何生产调用（构建时已被 tree-shake），却仍被测试覆盖——于是「测试全绿」对「账号会不会回来」这个问题什么也没说明。
+
 ## 3.3.0 (2026-10-01)
 
 ### Features

package/README.md

@@ -135,17 +135,20 @@ DSH PiAiAdapter（每个 provider 一套）
 | 探测结果 | 对轮换的意义 |
 | --- | --- |
 | 可用 | 可入选 |
-| 被限流 | **暂时**出池，按上游给出的重置时间自动回池（上游没说时间就如实说没说，**不编造倒计时**） |
+| 被限流 | **暂时**出池，按上游给出的重置时间自动回池（上游没说时间就按 30 分钟兜底，**不编造倒计时**） |
 | 积分耗尽 | 出池，按月周期包的刷新时间回池 |
-| 凭据被拒 / 模型不存在 / 连不上上游 / 失败 | 出池，直到下一次探测刷新结果 |
+| 连不上上游 / 失败 | **暂时**出池，30 分钟后自动回池——这类结果说的往往不是账号，而是一次网络抖动或上游 5xx |
+| 凭据被拒 / 模型不存在 | 出池，**只能靠手动「测试」回池**：一个需要重新登录，一个是本区域不再提供该模型，等待都修不好 |
 
-关键一条：**「被限流」不等于不可用**。它恰恰是最值得等的那一类状态——把它当成永久失效剔除，正好丢掉池子里本来最能用的账号。
+关键一条：**「被限流」「连不上上游」都不等于不可用**。它们恰恰是最值得等的那两类状态——当成永久失效剔除，正好丢掉池子里本来最能用的账号，而且**当池内每个成员都被这样剔除时，池子就没有任何候选，自动换号会无处可去**，你只会看到上游原始报错。
+
+**为什么只有限流/欠费/瞬时故障会自己回池**：这三类要么由上游写明了恢复时间，要么由插件按 30 分钟兜底；而「凭据被拒」「模型不存在」等待都无意义，只能由你手动重测或重新登录来刷新。插件**不再有自动复测定时器**（见下），所以后两类的唯一出路就是手动动作。
 
 ### 保存与草稿：为什么卡片上有两个「保存」
 
 模型管理一个、账号池一个，这是**刻意保留**而非漏合并：两者的草稿域不同，合并后一次写入失败会连累另一边（模型目录写不进去，就连池偏好也存不了）；一个共享的「放弃」还会在一次误点里同时丢掉两份草稿。两边都是**验证写入**——**写不成功不丢弃草稿**，否则用户的编辑就永久丢了。
 
-池里还有一类状态**不走草稿**：探测结果、冷却时间、当前轮换到的账号。它们是**观测事实**，由插件自己高频写入。原因很实际——草稿是覆盖式的，若观测结果也进草稿，你手工点一次「保存」就可能把定时器刚写进去的结果**回退成几分钟前的旧值**。
+池里还有一类状态**不走草稿**：探测结果、冷却时间、当前轮换到的账号。它们是**观测事实**，由插件自己高频写入。原因很实际——草稿是覆盖式的，若观测结果也进草稿，你手工点一次「保存」就可能把插件刚写进去的结果**回退成几分钟前的旧值**。
 
 ## 安装
 

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { E as legacyWorkbuddyOwnAuthPath, H as WORKBUDDY_APP_EXECUTABLE_ENV, N as WorkBuddyUpstreamClient, S as defaultDesktopAuthDirs, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, x as defaultDesktopAuthCandidates } from "./host-heartbeat-t93cLCoW.js";
+import { E as legacyWorkbuddyOwnAuthPath, H as WORKBUDDY_APP_EXECUTABLE_ENV, N as WorkBuddyUpstreamClient, S as defaultDesktopAuthDirs, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, x as defaultDesktopAuthCandidates } from "./host-heartbeat-DSO-07lc.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -525,6 +525,133 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
+		//#region src/client/ndjson.ts
+		/**
+		* Read a newline-delimited JSON body, one object at a time.
+		*
+		* NDJSON rather than SSE or a hand-rolled frame format because the pool's batch
+		* is a list of INDEPENDENT results: one line per result needs no state machine,
+		* survives a partially-delivered batch, and lets the reader act on account N
+		* while account N+1 is still being tested.
+		*
+		* A malformed line is SKIPPED, not fatal. The stream carries live progress, so
+		* discarding the rest of a batch because one frame did not parse would throw away
+		* rows the user already watched arrive — and a truncated final line is a normal
+		* way for a stream to end when something upstream misbehaves.
+		*
+		* @module dsh-connect-workbuddy/client/ndjson
+		*/
+		/** Hand each parsed object to `onLine`, in order, as it arrives. */
+		async function readNdjson(body, onLine) {
+			const reader = body?.getReader();
+			if (reader === void 0) return;
+			const decoder = new TextDecoder();
+			const emit = (line) => {
+				const trimmed = line.trim();
+				if (trimmed === "") return;
+				try {
+					const parsed = JSON.parse(trimmed);
+					if (typeof parsed === "object" && parsed !== null) onLine(parsed);
+				} catch {}
+			};
+			let buffer = "";
+			try {
+				for (;;) {
+					const { done, value } = await reader.read();
+					if (done) break;
+					buffer += decoder.decode(value, { stream: true });
+					const lines = buffer.split("\n");
+					buffer = lines.pop() ?? "";
+					for (const line of lines) emit(line);
+				}
+				buffer += decoder.decode();
+				emit(buffer);
+			} finally {
+				reader.releaseLock();
+			}
+		}
+		//#endregion
+		//#region src/client/probe-reason.ts
+		/**
+		* Outcomes whose label + stated recovery time ARE the whole story.
+		*
+		* Both carry a reset instant, which the row prints right beside them; their
+		* bodies restate that instant and add a `code`/`requestId` pair nobody reads.
+		*
+		* `credential-rejected` and `not-found` are deliberately NOT here: their labels
+		* state a conclusion ("sign in again", "no such model"), and the upstream's own
+		* words are what make that conclusion checkable rather than asserted.
+		*/
+		const SELF_EXPLANATORY = /* @__PURE__ */ new Set(["rate-limited", "out-of-credit"]);
+		/**
+		* Longest inline reason kept.
+		*
+		* A cap rather than a wrapper: one pathological body must not push the rest of
+		* the table off screen. 72 characters holds a full transport error and a full
+		* upstream sentence, while stopping well short of a raw JSON document.
+		*/
+		const REASON_LIMIT = 72;
+		/** The inline reason for one measurement, or `undefined` when it adds nothing. */
+		function inlineProbeReason(outcome, message) {
+			if (message === void 0 || message === "") return void 0;
+			if (SELF_EXPLANATORY.has(outcome)) return void 0;
+			const text = (humanSentenceOf(message) ?? stripTransportPrefix(message)).trim();
+			return text === "" ? void 0 : truncate(text);
+		}
+		function truncate(text) {
+			return text.length <= REASON_LIMIT ? text : `${text.slice(0, 71)}…`;
+		}
+		/** `{"code":6004,"msg":"…","requestId":"…"}` → the `msg` sentence, if it has one. */
+		function humanSentenceOf(message) {
+			if (!message.startsWith("{")) return void 0;
+			let parsed;
+			try {
+				parsed = JSON.parse(message);
+			} catch {
+				return;
+			}
+			if (typeof parsed !== "object" || parsed === null) return void 0;
+			const msg = parsed["msg"];
+			return typeof msg === "string" && msg !== "" ? msg : void 0;
+		}
+		/** `transport error: TimeoutError: …` → `TimeoutError: …`. */
+		function stripTransportPrefix(message) {
+			return message.replace(/^transport error:\s*/u, "");
+		}
+		//#endregion
+		//#region src/client/remaining.ts
+		const MINUTE_MS = 6e4;
+		const HOUR_MS = 60 * MINUTE_MS;
+		const DAY_MS = 24 * HOUR_MS;
+		/**
+		* How far out hours stop being the useful unit.
+		*
+		* Below this, hours; at or above it, days. The cut is at TWO days rather than
+		* one so that 30 hours reads as "约 30 小时后" instead of rounding to "约 1 天后",
+		* which would understate it by six hours.
+		*/
+		const DAYS_AT_MS = 2 * DAY_MS;
+		/**
+		* A short "约 N 分钟后 / 约 N 小时后 / 约 N 天后", or `''` once the moment passed.
+		*
+		* The empty string is the contract callers depend on: an elapsed cooldown means
+		* the account is already back, so appending "in 0 minutes" would assert the
+		* opposite of the state the card is showing. Callers append this only when it is
+		* non-empty.
+		*
+		* Rounding is deliberately coarse — "约 1 小时后" for 69 minutes is what a reader
+		* wants, and a precision that changes every minute would be noise rather than
+		* information. The absolute instant sits right beside it for anyone who needs it.
+		*/
+		function remainingText(t, untilMs, nowMs) {
+			const left = untilMs - nowMs;
+			if (left <= 0) return "";
+			if (left < MINUTE_MS) return t("row.remainingImminent");
+			if (left < HOUR_MS) return t("row.remainingMinutes", { count: Math.round(left / MINUTE_MS) });
+			if (left < DAYS_AT_MS) return t("row.remainingHours", { count: Math.round(left / HOUR_MS) });
+			return t("row.remainingDays", { count: Math.round(left / DAY_MS) });
+		}
+		//#endregion
 		//#region src/account-pool.ts
 		/**
 		* The checked ids that still resolve to a local sign-in, in the caller's order.
@@ -1022,44 +1149,83 @@ window.__ModuleLoader__.load({
 					count: memberCount,
 					model: pool?.targetModelId ?? ""
 				}), "info");
+				/**
+				* One test row into the activity log.
+				*
+				* Shared by the STREAMED shape (a line per account) and the whole-batch
+				* shape (an older Host's single document), so the two can never report the
+				* same measurement differently — the failure mode this file's history is
+				* mostly made of.
+				*/
+				const logTestRow = (row) => {
+					const outcome = row?.result?.outcome;
+					if (outcome === void 0) {
+						appendLog(t("row.poolLogTestRowMalformed", { accountName: row?.accountName === "" || row?.accountName === void 0 ? t("row.accountUnnamed") : row.accountName }), "warn");
+						return;
+					}
+					appendLog(t("row.poolLogTestRow", {
+						accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName,
+						outcome: outcomeText(t, outcome)
+					}), outcomeOk(outcome) ? "ok" : "warn");
+				};
 				try {
 					const response = await fetch(withWorkBuddyRegionAndAction(WORKBUDDY_POOL_PATH, region, action), {
 						method: "POST",
 						headers: { accept: "application/json" },
 						credentials: "same-origin"
 					});
-					const body = await response.json().catch(() => void 0);
-					if (!response.ok) throw new Error(poolFailureText(t, {
-						status: response.status,
-						reason: body?.reason,
-						error: body?.error
-					}));
-					if (!mounted.current) return;
-					if (action === "checkin") {
-						for (const row of body?.rows ?? []) if (row.status === "claimed") appendLog(t("row.poolLogCheckinClaimed", {
-							accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName,
-							credit: String(row.credit ?? 0)
-						}), "ok");
-						else if (row.status === "already") appendLog(t("row.poolLogCheckinAlready", { accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName }), "info");
-						else appendLog(t("row.poolLogCheckinFailed", {
-							accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName,
-							message: row.message ?? t("row.requestFailed")
-						}), "error");
-						appendLog(t("row.poolLogCheckinDone"), "ok");
-					} else {
-						for (const row of body?.rows ?? []) {
-							const outcome = row?.result?.outcome;
-							if (outcome === void 0) {
-								appendLog(t("row.poolLogTestRowMalformed", { accountName: row?.accountName === "" || row?.accountName === void 0 ? t("row.accountUnnamed") : row.accountName }), "warn");
-								continue;
+					let failed = false;
+					if ((response.headers.get("content-type") ?? "").includes("ndjson")) {
+						if (!response.ok) throw new Error(poolFailureText(t, { status: response.status }));
+						let sawRow = false;
+						await readNdjson(response.body, (line) => {
+							const row = line["row"];
+							if (row !== void 0) {
+								sawRow = true;
+								if (mounted.current) logTestRow(row);
+								return;
 							}
-							appendLog(t("row.poolLogTestRow", {
+							const reason = line["reason"];
+							if (typeof reason === "string") {
+								failed = true;
+								const message = poolFailureText(t, {
+									status: 200,
+									reason,
+									error: typeof line["error"] === "string" ? line["error"] : void 0
+								});
+								if (mounted.current) {
+									setActionError(message);
+									appendLog(t("row.poolLogBatchFailed", { message }), "error");
+								}
+							}
+						});
+						if (!mounted.current) return;
+						if (!failed && sawRow) appendLog(t("row.poolLogTestDone"), "ok");
+					} else {
+						const body = await response.json().catch(() => void 0);
+						if (!response.ok) throw new Error(poolFailureText(t, {
+							status: response.status,
+							reason: body?.reason,
+							error: body?.error
+						}));
+						if (!mounted.current) return;
+						if (action === "checkin") {
+							for (const row of body?.rows ?? []) if (row.status === "claimed") appendLog(t("row.poolLogCheckinClaimed", {
+								accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName,
+								credit: String(row.credit ?? 0)
+							}), "ok");
+							else if (row.status === "already") appendLog(t("row.poolLogCheckinAlready", { accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName }), "info");
+							else appendLog(t("row.poolLogCheckinFailed", {
 								accountName: row.accountName === "" ? t("row.accountUnnamed") : row.accountName,
-								outcome: outcomeText(t, outcome)
-							}), outcomeOk(outcome) ? "ok" : "warn");
+								message: row.message ?? t("row.requestFailed")
+							}), "error");
+							appendLog(t("row.poolLogCheckinDone"), "ok");
+						} else {
+							for (const row of body?.rows ?? []) logTestRow(row);
+							appendLog(t("row.poolLogTestDone"), "ok");
 						}
-						appendLog(t("row.poolLogTestDone"), "ok");
 					}
+					if (failed) return;
 					onRefresh?.();
 				} catch (error) {
 					const message = error instanceof Error ? error.message : t("row.requestFailed");
@@ -1210,7 +1376,11 @@ window.__ModuleLoader__.load({
 			const name = account.accountName === "" ? t("row.accountUnnamed") : account.accountName;
 			const excluded = exclusionText(t, account);
 			const probe = account.probe;
-			const probeLine = probe === void 0 ? t("row.poolNeverTested") : probe.retryAtMs !== void 0 ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryAt", { at: formatShort(probe.retryAtMs) })}` : probe.outcome === "rate-limited" || probe.outcome === "out-of-credit" ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryUnknown")}` : outcomeText(t, probe.outcome);
+			const probeLine = [
+				probe === void 0 ? t("row.poolNeverTested") : probe.retryAtMs !== void 0 ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryAt", { at: formatShort(probe.retryAtMs) })}` : probe.outcome === "rate-limited" || probe.outcome === "out-of-credit" ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryUnknown")}` : outcomeText(t, probe.outcome),
+				probe?.retryAtMs === void 0 ? "" : remainingText(t, probe.retryAtMs, Date.now()),
+				probe === void 0 ? void 0 : inlineProbeReason(probe.outcome, probe.message)
+			].filter((part) => part !== void 0 && part !== "").join(" · ");
 			return (0, react.createElement)("div", {
 				className: `dsm-workbuddy-pool-row${account.current ? " dsm-workbuddy-pool-row-current" : ""}`,
 				key: account.accountId
@@ -1223,7 +1393,10 @@ window.__ModuleLoader__.load({
 			})), (0, react.createElement)("span", {
 				className: "dsm-workbuddy-usage-dot",
 				style: { background: stateColor(account) }
-			}), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-account-name" }, (0, react.createElement)("b", null, name), account.current ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-tag" }, t("row.poolCurrentBadge")) : null, (0, react.createElement)("span", { className: checked ? "dsm-workbuddy-pool-member" : "dsm-workbuddy-pool-not-member" }, checked ? t("row.poolMember") : t("row.poolNotMember")), excluded === void 0 ? probe === void 0 ? null : (0, react.createElement)("span", null, t("row.poolTestedAt", { at: formatShort(probe.atMs) })) : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-excluded" }, excluded))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-credits" }, account.credits === void 0 ? (0, react.createElement)("span", null, "—") : (0, react.createElement)("b", null, formatNumber$1(account.credits)), account.expiringSoon !== void 0 && account.expiringSoon > 0 ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-soon" }, t("row.poolCreditSoon", { count: formatNumber$1(account.expiringSoon) })) : account.nearestExpiryMs === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-soon-plain" }, t("row.poolCreditNearest", { at: formatShort(account.nearestExpiryMs) }))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-probe" }, probeLine), checkinSupported ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checkin" }, account.checkedInToday === void 0 ? (0, react.createElement)("span", {
+			}), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-account-name" }, (0, react.createElement)("b", null, name), account.current ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-current-tag" }, t("row.poolCurrentBadge")) : null, (0, react.createElement)("span", { className: checked ? "dsm-workbuddy-pool-member" : "dsm-workbuddy-pool-not-member" }, checked ? t("row.poolMember") : t("row.poolNotMember")), excluded === void 0 ? probe === void 0 ? null : (0, react.createElement)("span", null, t("row.poolTestedAt", { at: formatShort(probe.atMs) })) : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-excluded" }, excluded))), (0, react.createElement)("span", { className: "dsm-workbuddy-pool-credits" }, account.credits === void 0 ? (0, react.createElement)("span", null, "—") : (0, react.createElement)("b", null, formatNumber$1(account.credits)), account.expiringSoon !== void 0 && account.expiringSoon > 0 ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-soon" }, t("row.poolCreditSoon", { count: formatNumber$1(account.expiringSoon) })) : account.nearestExpiryMs === void 0 ? null : (0, react.createElement)("span", { className: "dsm-workbuddy-pool-soon-plain" }, t("row.poolCreditNearest", { at: formatShort(account.nearestExpiryMs) }))), (0, react.createElement)("span", {
+				className: "dsm-workbuddy-pool-probe",
+				...probe?.message === void 0 ? {} : { title: probe.message }
+			}, probeLine), checkinSupported ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checkin" }, account.checkedInToday === void 0 ? (0, react.createElement)("span", {
 				className: "dsm-workbuddy-pool-unknown",
 				title: t("row.poolNeverTested")
 			}, t("row.poolCheckinUnknown")) : account.checkedInToday ? (0, react.createElement)("span", { className: "dsm-workbuddy-pool-checked" }, t("row.poolCheckedIn")) : t("row.poolNotCheckedIn")) : null);
@@ -1866,7 +2039,20 @@ window.__ModuleLoader__.load({
 		* would look like an upstream answer while being a guess, and the user would
 		* wait for a moment that means nothing.
 		*/
-		function probeResultView(result, t) {
+		/**
+		* ` · 约 1 小时后` for a future instant, or `''` when there is none.
+		*
+		* Kept beside {@link probeResultView} rather than inlined three times so the
+		* "append only when non-empty" rule cannot drift between the two limited
+		* outcomes. The absolute instant stays the primary text: it is the upstream's
+		* own answer, and the relative form is a convenience derived from it.
+		*/
+		function retrySuffix(t, untilMs, nowMs) {
+			if (untilMs === void 0) return "";
+			const remaining = remainingText(t, untilMs, nowMs);
+			return remaining === "" ? "" : ` · ${remaining}`;
+		}
+		function probeResultView(result, t, nowMs = Date.now()) {
 			switch (result.outcome) {
 				case "ok": {
 					const elapsed = result.elapsedMs === void 0 ? void 0 : `${String(result.elapsedMs / 1e3)}s`;
@@ -1876,11 +2062,11 @@ window.__ModuleLoader__.load({
 					};
 				}
 				case "rate-limited": return {
-					text: result.retryAtMs === void 0 ? t("row.probeRateLimitedUnknown") : t("row.probeRateLimitedAt", { at: formatDate(result.retryAtMs) }),
+					text: result.retryAtMs === void 0 ? t("row.probeRateLimitedUnknown") : t("row.probeRateLimitedAt", { at: formatDate(result.retryAtMs) }) + retrySuffix(t, result.retryAtMs, nowMs),
 					tone: "warn"
 				};
 				case "out-of-credit": return {
-					text: result.retryAtMs === void 0 ? t("row.probeOutOfCreditUnknown") : t("row.probeOutOfCreditAt", { at: formatDate(result.retryAtMs) }),
+					text: result.retryAtMs === void 0 ? t("row.probeOutOfCreditUnknown") : t("row.probeOutOfCreditAt", { at: formatDate(result.retryAtMs) }) + retrySuffix(t, result.retryAtMs, nowMs),
 					tone: "bad"
 				};
 				case "credential-rejected": return {
@@ -2655,10 +2841,12 @@ window.__ModuleLoader__.load({
 															const result = probes[activeRegion]?.[model.id];
 															if (result === void 0) return null;
 															const view = probeResultView(result, t);
+															const reason = inlineProbeReason(result.outcome, result.message);
 															return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
 																className: `dsm-workbuddy-model-probe-result dsm-workbuddy-model-probe-result-${view.tone}`,
 																role: "status",
-																children: [view.text, result.message === void 0 ? null : " · " + result.message]
+																...result.message === void 0 ? {} : { title: result.message },
+																children: [view.text, reason === void 0 ? null : " · " + reason]
 															});
 														})()
 													]
@@ -2837,14 +3025,14 @@ window.__ModuleLoader__.load({
 			"row.probeOutOfCreditAt": "✗ Not enough credits · quota refreshes {at}",
 			"row.probeCredentialRejected": "✗ WorkBuddy refused this account's token — sign in again or pick another account",
 			"row.probeNotFound": "✗ The upstream does not know this model",
-			"row.probeUnavailable": "✗ The upstream could not be reached — this is a network problem, not the model",
+			"row.probeUnavailable": "✗ The upstream could not be reached — no usable answer came back",
 			"row.probeFailed": "✗ Test failed",
 			"row.probeFailedStatus": "✗ Test failed (HTTP {status})",
 			"row.probeError": "Could not run the test: {message}",
 			"row.cheer": "Star on GitHub",
 			"row.poolTitle": "Account pool",
 			"row.poolNoCandidate": "No account in this pool can be used right now.",
-			"row.poolNoCandidateHint": "Every account is rate-limited, out of credits, rejected, unreachable, or in a state this build cannot use. Re-check the accounts, or sign in again in the desktop app.",
+			"row.poolNoCandidateHint": "Members are rate-limited, out of credits, rejected, or unreachable. Rate limits, drained quotas and transient failures return to the pool on their own — at the time the upstream states, or after a 30-minute fallback. Only a rejected credential needs a new sign-in.",
 			"row.poolCheckinAll": "Check in all accounts",
 			"row.poolCheckingIn": "Checking in…",
 			"row.poolTestAll": "Test all accounts",
@@ -2880,6 +3068,10 @@ window.__ModuleLoader__.load({
 			"row.poolExcludedUnusable": "Unusable",
 			"row.poolRetryAt": "Back after {at}",
 			"row.poolRetryUnknown": "The upstream gave no time for when this frees up",
+			"row.remainingImminent": "any moment now",
+			"row.remainingMinutes": "in about {count} min",
+			"row.remainingHours": "in about {count} h",
+			"row.remainingDays": "in about {count} d",
 			"row.poolSettingsTitle": "Account pool settings",
 			"row.poolSettingsHint": "These are preferences: they take effect when you save (same as the model list). Test results are written automatically and are not affected by this button.",
 			"row.poolEnabled": "Enable the account pool",
@@ -3000,7 +3192,7 @@ window.__ModuleLoader__.load({
 			"row.modelCapabilityPending": "仅展示 WorkBuddy 接口明确公布的模型能力。",
 			"row.probe": "测试",
 			"row.probing": "测试中…",
-			"row.probeHint": "对该模型发一条**真实体积**的请求（约 25k 输入 token），报告它现在能不能用。上游的限流按**请求体积**触发——实测约 20k 能过、约 30k 被拒——所以小请求看着正常、长对话里却可能每次都被拒。这也是为什么每次测试都会消耗真实积分（约 0.7），且一次只测一个模型。",
+			"row.probeHint": "对该模型发一条真实体积的请求（约 25k 输入 token），报告它现在能不能用。上游的限流按请求体积触发——实测约 20k 能过、约 30k 被拒——所以小请求看着正常、长对话里却可能每次都被拒。这也是为什么每次测试都会消耗真实积分（约 0.7），且一次只测一个模型。",
 			"row.probeOk": "✓ 可用",
 			"row.probeOkMs": "✓ 可用（{ms}）",
 			"row.probeRateLimitedUnknown": "✗ 被限流 · 上游未给出何时恢复",
@@ -3009,14 +3201,14 @@ window.__ModuleLoader__.load({
 			"row.probeOutOfCreditAt": "✗ 积分不足 · 积分包 {at} 刷新",
 			"row.probeCredentialRejected": "✗ WorkBuddy 拒绝了这个账号的 token——请重新登录或换一个账号",
 			"row.probeNotFound": "✗ 上游不认识这个模型",
-			"row.probeUnavailable": "✗ 连不上上游——这是网络问题，不是模型问题",
+			"row.probeUnavailable": "✗ 连不上上游——上游没有给出可用答复",
 			"row.probeFailed": "✗ 测试失败",
 			"row.probeFailedStatus": "✗ 测试失败（HTTP {status}）",
 			"row.probeError": "无法执行测试：{message}",
 			"row.cheer": "鼓励一下",
 			"row.poolTitle": "账号池",
 			"row.poolNoCandidate": "账号池里目前没有可用的账号。",
-			"row.poolNoCandidateHint": "每个账号要么被限流、要么积分耗尽、要么被上游拒绝、要么连不上上游，或处于本版本无法使用的状态。请重新检测账号，或在桌面端重新登录。",
+			"row.poolNoCandidateHint": "成员要么在限流冷却中、要么积分耗尽、要么凭据被拒、要么上游无响应。限流、积分耗尽与瞬时故障都会自动回池——按上游给出的恢复时间，没给时间就按 30 分钟兜底，不需要你操作；只有「凭据被拒」需要重新登录。",
 			"row.poolCheckinAll": "一键签到所有账号",
 			"row.poolCheckingIn": "签到中…",
 			"row.poolTestAll": "一键测试所有账号",
@@ -3034,7 +3226,7 @@ window.__ModuleLoader__.load({
 			"row.poolTargetStaleHint": "本区域的模型目录已变化，不再包含这个模型，因此测试被停用——而不是拿一个上游可能不接受的模型去跑。请改选一个目标模型，或切回自动。",
 			"row.poolTargetStaleClear": "切回自动",
 			"row.poolTargetStaleOption": "{model}（已下架）",
-			"row.poolTargetNoneHint": "国内版的倍率要等模型目录刷新后才会出现。为了不让你在不知情的情况下花掉积分，插件**不会**自动改用收费模型——请先刷新模型目录，或自己指定一个目标模型。",
+			"row.poolTargetNoneHint": "国内版的倍率要等模型目录刷新后才会出现。为了不让你在不知情的情况下花掉积分，插件不会自动改用收费模型——请先刷新模型目录，或自己指定一个目标模型。",
 			"row.poolColumnAccount": "账号",
 			"row.poolColumnCredits": "积分",
 			"row.poolColumnProbe": "目标模型",
@@ -3052,10 +3244,14 @@ window.__ModuleLoader__.load({
 			"row.poolExcludedUnusable": "不可用",
 			"row.poolRetryAt": "{at} 之后可再用",
 			"row.poolRetryUnknown": "上游未给出何时恢复",
+			"row.remainingImminent": "即将恢复",
+			"row.remainingMinutes": "约 {count} 分钟后",
+			"row.remainingHours": "约 {count} 小时后",
+			"row.remainingDays": "约 {count} 天后",
 			"row.poolSettingsTitle": "账号池设置",
 			"row.poolSettingsHint": "下面是偏好设置：点保存才生效（与「模型管理」一致）。测试结果由插件自动写入，不受这个保存按钮影响。",
 			"row.poolEnabled": "启用账号池",
-			"row.poolEnabledHint": "开启后由本区域的账号池自动决定每一次请求用谁（可用优先，其次积分高、快过期的积分包、凭据更新的），失败时自动换下一个可用账号。关闭后插件不替你选、也不替你换：你选的账号服务每一次请求，失败就如实报错。签到与测试是**手动动作**，两种状态下都可用 —— 这个开关只管「插件要不要自己决定」。",
+			"row.poolEnabledHint": "开启后由本区域的账号池自动决定每一次请求用谁（可用优先，其次积分高、快过期的积分包、凭据更新的），失败时自动换下一个可用账号。关闭后插件不替你选、也不替你换：你选的账号服务每一次请求，失败就如实报错。签到与测试是手动动作，两种状态下都可用 —— 这个开关只管「插件要不要自己决定」。",
 			"row.poolManualAccountLabel": "使用哪个账号",
 			"row.poolManualAccountHint": "账号池关闭时，由你在这里选定服务本区域的账号。开启账号池后改由排序自动决定。",
 			"row.poolManualAccountNone": "当前没有生效的账号",

package/lib/{host-heartbeat-t93cLCoW.js → host-heartbeat-DSO-07lc.js}

@@ -416,6 +416,19 @@ const CLIENT_UA = "CLI/2.63.2 CodeBuddy/2.63.2";
 const DESKTOP_UA = "WorkBuddy/5.5.2";
 const JSON_TIMEOUT_MS = 3e4;
 const ERROR_BODY_LIMIT = 4096;
+/**
+* Ceiling for one real-volume probe to get a RESPONSE, which is not a metadata
+* call.
+*
+* Much larger than {@link JSON_TIMEOUT_MS} on purpose: a probe posts ~25k input
+* tokens, so prompt processing legitimately takes a while before the first byte
+* comes back. It exists only to stop a connection that will NEVER answer — the
+* pool's batch is serial, so one hung member would otherwise block all the rest
+* with nothing in the UI to say which one it was. Ten seconds is comfortably
+* above a working gateway's first byte and far below a user's patience; the
+* budget covers the response only, never the one-line body that follows.
+*/
+const PROBE_TIMEOUT_MS = 1e4;
 /** Insufficient-credit markers, ASCII lowercase plus the original Chinese. */
 const HARD_CREDIT_MARKERS = [
 	"insufficient credit",
@@ -946,9 +959,26 @@ var WorkBuddyUpstreamClient = class {
 	*
 	* The caller MUST drain {@link WorkBuddyProbeAnswer.response}; an unread body
 	* holds the connection open.
+	*
+	* ALWAYS bounded in time. The pool's batch runner is serial and passes no
+	* signal, so without a ceiling here one stalled connection blocks every account
+	* behind it — the batch looks hung with no way to tell which member did it.
+	* A supplied signal is COMBINED with the timeout rather than replacing it, so
+	* the single-model route keeps its cancellation behaviour and still cannot
+	* hang forever.
+	*
+	* The ceiling covers ONLY the wait for a response — it is cleared the moment
+	* `fetch` resolves. Holding a timer over the body would put a healthy but slow
+	* model on the same clock as a dead endpoint, and the whole point of the
+	* period is to answer "did the upstream answer at all". A probe asks for a
+	* single token, so the body that follows is one SSE line.
 	*/
 	async probeChat(credential, bodyJson, signal) {
 		let response;
+		const ceiling = new AbortController();
+		const timer = setTimeout(() => {
+			ceiling.abort(/* @__PURE__ */ new Error(`no response within ${PROBE_TIMEOUT_MS}ms`));
+		}, PROBE_TIMEOUT_MS);
 		try {
 			response = await fetch(`${chatBase(credential)}/v2/chat/completions`, {
 				method: "POST",
@@ -957,7 +987,7 @@ var WorkBuddyUpstreamClient = class {
 					"Authorization": `Bearer ${credential.accessToken}`
 				},
 				body: bodyJson,
-				...signal === void 0 ? {} : { signal }
+				signal: signal === void 0 ? ceiling.signal : AbortSignal.any([signal, ceiling.signal])
 			});
 		} catch (error) {
 			return {
@@ -966,6 +996,8 @@ var WorkBuddyUpstreamClient = class {
 				retryAfter: null,
 				body: `transport error: ${String(error)}`
 			};
+		} finally {
+			clearTimeout(timer);
 		}
 		const retryAfter = response.headers.get("retry-after");
 		if (response.ok) return {
@@ -2520,7 +2552,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "3.3.0";
+const WORKBUDDY_CONNECT_VERSION = "3.4.1";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -631,6 +631,19 @@ declare class WorkBuddyUpstreamClient {
    *
    * The caller MUST drain {@link WorkBuddyProbeAnswer.response}; an unread body
    * holds the connection open.
+   *
+   * ALWAYS bounded in time. The pool's batch runner is serial and passes no
+   * signal, so without a ceiling here one stalled connection blocks every account
+   * behind it — the batch looks hung with no way to tell which member did it.
+   * A supplied signal is COMBINED with the timeout rather than replacing it, so
+   * the single-model route keeps its cancellation behaviour and still cannot
+   * hang forever.
+   *
+   * The ceiling covers ONLY the wait for a response — it is cleared the moment
+   * `fetch` resolves. Holding a timer over the body would put a healthy but slow
+   * model on the same clock as a dead endpoint, and the whole point of the
+   * period is to answer "did the upstream answer at all". A probe asks for a
+   * single token, so the body that follows is one SSE line.
    */
   probeChat(credential: WorkBuddyCredential, bodyJson: string, signal?: AbortSignal): Promise<WorkBuddyProbeAnswer>;
   /** POST the token-refresh endpoint; the caller merges the outcome. */
@@ -1518,6 +1531,20 @@ interface WorkBuddyPoolProbe {
    * must never be turned into a locally invented countdown.
    */
   retryAtMs?: number;
+  /**
+   * The upstream's own words on the failure, already redacted.
+   *
+   * Kept so the card can say WHY an account left the pool instead of repeating
+   * one generic sentence for a DNS failure, a gateway 502 and a request the user
+   * cancelled alike. Those three used to render as the SAME line, which left the
+   * user with a message they could not act on and no way to tell a broken
+   * account from a broken network.
+   *
+   * ABSENT for a success, and for any measurement written before this field
+   * existed: an `outcome` without a `message` is a complete, valid record, so
+   * old probe files stay readable rather than being discarded.
+   */
+  message?: string;
 }
 /** One account's live credit situation, as the pool ranks it. */
 interface WorkBuddyPoolCredits {
@@ -1924,6 +1951,15 @@ interface WorkBuddyWebPoolAccount {
     atMs: number;
     /** Only when the upstream named a time; never invented locally. */
     retryAtMs?: number;
+    /**
+     * Why it failed, in the upstream's own redacted words.
+     *
+     * Carried so the pool table can distinguish a DNS failure from a gateway
+     * 502 from a request the user cancelled, instead of repeating one generic
+     * sentence for all three. ABSENT on success and on measurements written
+     * before this field existed, so the card must render the bare outcome then.
+     */
+    message?: string;
   };
   /** Set when this account cannot serve right now. */
   excludedBy?: WorkBuddyWebPoolExclusion;
@@ -2193,8 +2229,15 @@ interface WorkBuddyPoolDeps {
    * reports "unavailable" instead of appearing to succeed.
    */
   checkin?(region: WorkBuddyRegion): Promise<readonly WorkBuddyPoolCheckinRow[]>;
-  /** Test every account of one region against the resolved target model. */
-  test?(region: WorkBuddyRegion, modelId: string): Promise<readonly WorkBuddyPoolTestRow[]>;
+  /**
+   * Test every account of one region against the resolved target model.
+   *
+   * `onRow` is optional and exists so the route can STREAM each account as it
+   * finishes. An older Host ignores it and answers with the whole batch at once;
+   * the route handles both, because a missing reporter must degrade to the
+   * previous behaviour rather than to no rows at all.
+   */
+  test?(region: WorkBuddyRegion, modelId: string, onRow?: (row: WorkBuddyPoolTestRow) => void): Promise<readonly WorkBuddyPoolTestRow[]>;
   /** The region's live catalog, used to resolve the free target model. */
   catalog?(region: WorkBuddyRegion): readonly WorkBuddyModelInfo[];
 }

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as readAtRestKey, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, J as isEncryptedFieldWrapper, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as openEncryptedField, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as macosBundleExecutable, Y as isWorkbuddyBundle, Z as macosNestedAppBundles, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as workbuddyAppExecutableCandidates, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-t93cLCoW.js";
+import { $ as readAtRestKey, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, J as isEncryptedFieldWrapper, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as openEncryptedField, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as macosBundleExecutable, Y as isWorkbuddyBundle, Z as macosNestedAppBundles, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as workbuddyAppExecutableCandidates, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-DSO-07lc.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1171,6 +1171,46 @@ const KIND_STATUS = {
 	server: 502,
 	client: 400
 };
+/**
+* The `code` spelling the HOST is expected to classify each upstream failure by.
+*
+* The host decides whether a failed request may be retried IN PLACE (5 attempts
+* with backoff) or must be handed to cross-provider failover by reading English
+* phrases out of `type + " " + code + " " + message` — see
+* `isQuotaExceededError` in `@deepseek-ai/dsh-llm`. Only `RATE_LIMIT`, `SERVER`,
+* `TIMEOUT`, `TRANSPORT` and `EMPTY_RESPONSE` are in its retry set, so the
+* spelling decides which of two very different things happens next.
+*
+* `soft_rate` is the one kind that spelling got wrong. The upstream's 429 says
+* "usage exceeds the frequency limit, and it resets at 13:37" — hours away, not
+* two seconds. Sent as `soft_rate` it reads as an ordinary rate limit, enters
+* the in-place retry set, and spends the whole retry budget on an endpoint that
+* cannot recover within it; by the time cross-provider failover is offered, the
+* turn has already failed. The upstream's own words are Chinese, so the
+* phrase-based classifier cannot see the distinction either — the label is the
+* only channel left to carry it.
+*
+* `quota_exceeded` is the minimal honest translation: it is the WORDS the host
+* recognises, and it matches what the upstream is actually saying. The HTTP
+* status stays 429 (that is what the upstream returned — relabelling it 402
+* would misreport the upstream), and the upstream's own message is still passed
+* through verbatim for a human to read.
+*
+* Every other kind already lands outside the retry set by its status alone
+* (`hard_credit` 402 → quota, `session_dead` 401 → auth, 502/400 → other), so
+* none of them is listed: a translation nobody needs is a lie waiting to drift.
+*/
+const KIND_HOST_CODE = { soft_rate: "quota_exceeded" };
+/**
+* The `code` to write for an upstream failure, given its classified kind.
+*
+* `type` deliberately stays the plugin's own kind: it is what a human reads in
+* a log or a bug report, and it keeps the two fields individually meaningful.
+* Only `code` carries the host-facing translation.
+*/
+function hostErrorCode(kind) {
+	return KIND_HOST_CODE[kind] ?? kind;
+}
 function writeJson(res, status, body) {
 	const payload = JSON.stringify(body);
 	res.writeHead(status, {
@@ -1179,11 +1219,19 @@ function writeJson(res, status, body) {
 	});
 	res.end(payload);
 }
-function writeOpenAIError(res, status, kind, message) {
+/**
+* Write a JSON error the way an OpenAI-compatible client expects.
+*
+* `code` defaults to `type`, which is right for every error THIS shim raises on
+* its own (`unauthorized`, `not_found`, …): those are not upstream failures and
+* must not be disguised as one. The upstream failure path passes an explicit
+* `code` so the host classifies it correctly — see {@link KIND_HOST_CODE}.
+*/
+function writeOpenAIError(res, status, kind, message, code) {
 	writeJson(res, status, { error: {
 		message,
 		type: kind,
-		code: kind
+		code: code ?? kind
 	} });
 }
 /** Read a request body with a size cap; over-limit bodies fail the request. */
@@ -1674,11 +1722,10 @@ function createWorkBuddyShim(options) {
 			});
 		};
 		const reportFailures = () => {
-			if (onAccountFailure === void 0) {
-				failures.length = 0;
-				return;
-			}
-			for (const entry of failures.splice(0, failures.length)) {
+			const batch = failures.splice(0, failures.length);
+			if (onAccountFailure === void 0) return;
+			if (controller.signal.aborted) return;
+			for (const entry of batch) {
 				if (entry.failure.ok) continue;
 				try {
 					onAccountFailure(entry.accountId, {
@@ -1707,7 +1754,7 @@ function createWorkBuddyShim(options) {
 		if (!result.ok) {
 			const attempts = triedAccountIds.length;
 			const note = attempts > 1 ? ` (after trying ${attempts} accounts)` : "";
-			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status})${note}: ${result.message.slice(0, 400)}`);
+			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status})${note}: ${result.message.slice(0, 400)}`, hostErrorCode(result.kind));
 			return;
 		}
 		res.writeHead(200, {
@@ -1993,12 +2040,18 @@ const PROBE_MESSAGE_LIMIT = 300;
 /**
 * Redact token-shaped content out of upstream text before it is stored or sent.
 *
-* Duplicated from the route layer on purpose rather than imported: this module
-* is the one that reads raw failure bodies, so the redaction belongs at the
-* point of capture. A probe failure body is the one place a raw upstream string
-* from an arbitrary endpoint enters the plugin's data flow.
+* Lives here rather than in the route layer because this module is the one that
+* reads raw failure bodies, so the redaction belongs at the point of capture. A
+* probe failure body is the one place a raw upstream string from an arbitrary
+* endpoint enters the plugin's data flow.
+*
+* EXPORTED because a failed CHAT request now persists its reason into the pool
+* store too (`recordAccountFailure` in `src/index.ts`), and that text is a raw
+* upstream body as well. One implementation, so the two writers cannot drift
+* into redacting differently — the same "one definition" rule this codebase
+* applies to `effectiveMembersOf`.
 */
-function redact(text) {
+function redactUpstreamText(text) {
 	return text.replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]").slice(0, PROBE_MESSAGE_LIMIT);
 }
 /**
@@ -2021,7 +2074,7 @@ async function probeModel(input) {
 		return {
 			modelId: input.modelId,
 			outcome: "unavailable",
-			message: redact(error instanceof Error ? error.message : String(error))
+			message: redactUpstreamText(error instanceof Error ? error.message : String(error))
 		};
 	}
 	const elapsedMs = Date.now() - startedAt;
@@ -2051,7 +2104,7 @@ async function probeModel(input) {
 		outcome,
 		elapsedMs,
 		status: answer.status,
-		...body === "" ? {} : { message: redact(body) },
+		...body === "" ? {} : { message: redactUpstreamText(body) },
 		...cooldownOf({
 			outcome,
 			retryAfter: answer.retryAfter,
@@ -2135,12 +2188,21 @@ async function checkinOne(target, deps) {
 * exactly the silent spend the plan forbids.
 *
 * Never throws: a failed probe is a ROW, not an aborted batch.
+*
+* `onRow` fires the moment one account's row exists, which is what lets a caller
+* report progress. The loop is SERIAL by design (one account at a time — hitting
+* the whole pool at once is the fastest way to trip the upstream's volume limit),
+* so without this a caller cannot say anything until the SLOWEST member answers:
+* one stuck account made a working batch look like a dead button. The return
+* value is unchanged, so every existing caller keeps all rows at the end.
 */
-async function testAllAccounts(targets, modelId, deps) {
+async function testAllAccounts(targets, modelId, deps, onRow) {
 	const rows = [];
 	for (const [index, target] of targets.entries()) {
 		if (index > 0) await (deps.wait ?? defaultWait)(400);
-		rows.push(await testOne(target, modelId, deps));
+		const row = await testOne(target, modelId, deps);
+		rows.push(row);
+		onRow?.(row);
 	}
 	return rows;
 }
@@ -2186,6 +2248,11 @@ async function testOne(target, modelId, deps) {
 *
 * `atMs` is stamped here, once for the batch, so the card's "tested N minutes
 * ago" reflects when the batch finished rather than drifting per row.
+*
+* `message` is carried through as well. `probeModel` already redacted it before
+* returning, so persisting it cannot leak a token, and without it the pool table
+* could only repeat one generic sentence for a DNS failure, a gateway 502 and a
+* cancelled request alike.
 */
 function probeUpdatesOf(rows) {
 	const atMs = Date.now();
@@ -2195,7 +2262,8 @@ function probeUpdatesOf(rows) {
 		updates[row.accountId] = {
 			outcome: row.result.outcome,
 			atMs,
-			...row.result.retryAtMs === void 0 ? {} : { retryAtMs: row.result.retryAtMs }
+			...row.result.retryAtMs === void 0 ? {} : { retryAtMs: row.result.retryAtMs },
+			...row.result.message === void 0 ? {} : { message: row.result.message }
 		};
 	}
 	return updates;
@@ -2227,18 +2295,37 @@ function messageOf(error) {
 *
 * - A `credential-rejected` account is excluded regardless of any cooldown: its
 *   token is not accepted, so waiting cannot help and the user must re-auth.
-* - A limited outcome is checked against its stated (or fallback) cooldown, so
-*   an account whose limit has already reset is back in the pool without
-*   needing another test first.
+* - A limited, unreachable or failed outcome is checked against its stated (or
+*   fallback) cooldown, so an account whose limit has already reset — or whose
+*   gateway blipped once — is back in the pool without needing another test
+*   first.
 * - An `ok` measurement, and no measurement at all, are both candidates. The
 *   latter matters: a freshly discovered account has never been tested and must
 *   not be invisible.
 *
+* WHY TRANSIENT OUTCOMES GET A COOLDOWN. They are not statements about the
+* ACCOUNT. A transport failure can be a DNS blip, and — before the shim learned
+* to skip reporting an aborted request — it was routinely the user closing the
+* panel mid-flight. A 5xx is the gateway's afternoon, not this account's health.
+* Excluding them permanently meant one transient event idled a perfectly good
+* account until the user happened to press "test" again, and with every member
+* so idled the pool had no candidate at all: failover then had nowhere to go and
+* the raw upstream error was reported as-is. The cooldown is what makes the pool
+* RECOVER instead of staying broken.
+*
+* `not-found` and `credential-rejected` deliberately get none: one describes a
+* model the region no longer offers (a catalog fact, not a transient one) and
+* the other needs the user to sign in again. Neither is fixed by waiting, and
+* pretending otherwise would re-bill a token the upstream has already refused.
+*
 * Each unusable outcome keeps its OWN value rather than being folded into
 * `credential-rejected`. The fold made one row state two contradictory things —
 * the name column said "被拒绝" (sign in again) while the probe column, reading
 * the same measurement, said "连不上上游——这是网络问题，不是模型问题" — and it
 * told a user whose upstream had merely blipped that their sign-in was bad.
+* (That label has since been made cause-NEUTRAL: it used to assert "not the
+* model" for a bucket that also holds gateway 5xx and request timeouts, where
+* the claim is simply unfounded. The recorded `message` now carries the cause.)
 * The distinctions are already computed upstream in `outcomeOfFailure`
 * (`src/probe.ts:290-299`); this only stops discarding them.
 */
@@ -2248,14 +2335,22 @@ function exclusionOf(probe, nowMs) {
 		case "ok": return;
 		case "credential-rejected": return "credential-rejected";
 		case "not-found": return "not-found";
-		case "unavailable": return "unavailable";
-		case "failed": return "failed";
+		case "unavailable": return retryDue(probe, nowMs) ? void 0 : "unavailable";
+		case "failed": return retryDue(probe, nowMs) ? void 0 : "failed";
 		case "rate-limited": return retryDue(probe, nowMs) ? void 0 : "rate-limited";
 		case "out-of-credit": return retryDue(probe, nowMs) ? void 0 : "out-of-credit";
 		default: return "unusable";
 	}
 }
-/** Whether a limited account's cooldown has elapsed (or was never stated). */
+/**
+* Whether an account's cooldown has elapsed (or was never stated).
+*
+* The fallback is the ONLY thing a transient outcome relies on: `cooldownOf`
+* attaches `retryAtMs` for a rate limit or a drained quota, never for a
+* transport failure, so `atMs + POOL_UNKNOWN_COOLDOWN_MS` is what brings those
+* back. That is deliberate — the alternative is a permanent exclusion decided by
+* an event that said nothing about the account.
+*/
 function retryDue(probe, nowMs) {
 	return nowMs >= (probe.retryAtMs ?? probe.atMs + 18e5);
 }
@@ -2430,7 +2525,7 @@ const POOL_STORE_PREFIX = ".workbuddy-pool";
 function isProbe(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const candidate = value;
-	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number");
+	return typeof candidate["outcome"] === "string" && typeof candidate["atMs"] === "number" && (candidate["retryAtMs"] === void 0 || typeof candidate["retryAtMs"] === "number") && (candidate["message"] === void 0 || typeof candidate["message"] === "string");
 }
 /**
 * One region's path for measured pool facts.
@@ -2444,9 +2539,11 @@ function workbuddyPoolStorePath(region) {
 /**
 * Read one region's measured facts.
 *
-* Contains NO credentials — only outcome words and timestamps — so it is not
-* written with the credential store's stricter secrecy requirements, though it
-* still uses the same atomic-write helpers.
+* Contains NO credentials. The one free-text field is `message`, and it is
+* REDACTED BY THE WRITER before it ever reaches this file (`probe.ts`'s
+* `redactUpstreamText`), so a token-shaped string cannot survive into storage.
+* Because of that the file is not written with the credential store's stricter
+* secrecy requirements, though it still uses the same atomic-write helpers.
 *
 * Returns an empty map for a missing, unreadable, malformed, or
 * version-mismatched file: all four mean "nothing measured yet", which is a
@@ -2475,7 +2572,8 @@ async function readPoolProbes(region) {
 		probes[accountId] = {
 			outcome: probe.outcome,
 			atMs: probe.atMs,
-			...probe.retryAtMs === void 0 ? {} : { retryAtMs: probe.retryAtMs }
+			...probe.retryAtMs === void 0 ? {} : { retryAtMs: probe.retryAtMs },
+			...probe.message === void 0 ? {} : { message: probe.message }
 		};
 	}
 	return probes;
@@ -2980,7 +3078,8 @@ async function workBuddyWebPool(deps, region) {
 			...measured?.probe === void 0 ? {} : { probe: {
 				outcome: measured.probe.outcome,
 				atMs: measured.probe.atMs,
-				...measured.probe.retryAtMs === void 0 ? {} : { retryAtMs: measured.probe.retryAtMs }
+				...measured.probe.retryAtMs === void 0 ? {} : { retryAtMs: measured.probe.retryAtMs },
+				...measured.probe.message === void 0 ? {} : { message: measured.probe.message }
 			} },
 			...row?.excludedBy === void 0 ? {} : { excludedBy: row.excludedBy },
 			current: account.id === currentAccountId,
@@ -3175,12 +3274,32 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						reason: target.source === "stale" ? "target-model-stale" : "no-free-model",
 						error: target.source === "stale" ? "the saved target model is no longer offered by this region; pick another or switch back to automatic" : "no zero-multiplier model in this region; refresh the catalog or set a target model"
 					});
-					const rows = await pool.test(region, target.modelId);
-					return json(res, 200, {
+					res.writeHead(200, {
+						"Content-Type": "application/x-ndjson",
+						"Cache-Control": "no-cache",
+						"Connection": "keep-alive",
+						"X-Accel-Buffering": "no"
+					});
+					const writeLine = (payload) => {
+						res.write(`${JSON.stringify(payload)}\n`);
+					};
+					writeLine({
 						action: "test",
-						modelId: target.modelId,
-						rows
+						modelId: target.modelId
 					});
+					try {
+						await pool.test(region, target.modelId, (row) => {
+							writeLine({ row });
+						});
+						writeLine({ done: true });
+					} catch (error) {
+						writeLine({
+							reason: "pool-failed",
+							error: safeMessage(error)
+						});
+					}
+					res.end();
+					return;
 				} catch (error) {
 					json(res, 500, {
 						reason: "pool-failed",
@@ -3825,8 +3944,8 @@ function apply(ctx, config) {
 				}
 				return rows;
 			},
-			test: async (region, modelId) => {
-				const rows = await testAllAccounts(await poolTargets(region), modelId, poolRunnerDeps(region));
+			test: async (region, modelId, onRow) => {
+				const rows = await testAllAccounts(await poolTargets(region), modelId, poolRunnerDeps(region), onRow);
 				await writePoolProbes(region, probeUpdatesOf(rows));
 				return rows;
 			},
@@ -3868,11 +3987,19 @@ function apply(ctx, config) {
 	* Reads the candidate through `credentialFor()`, never `resolve()`: the saved
 	* selection and the store's runtime state stay untouched, so this is
 	* per-request borrowing rather than a silent change of who pays.
+	*
+	* Uses `localPoolMembers`, NOT `poolMembersOf`. This runs on the failure path
+	* of a request the user is already waiting on, and `poolMembersOf` fetches
+	* credits per member — so the expensive version turned one failed request into
+	* N extra upstream calls before the retry even left. The doc above always said
+	* "must not spend further requests"; the code used to contradict it. Credits
+	* still steer the ranking when a recent snapshot exists, because
+	* `localPoolMembers` reads the one the card's poll already paid for.
 	*/
 	const failoverAccountFor = async (region, triedAccountIds) => {
 		if (!poolPreferencesOf(current(), region).enabled) return void 0;
 		const tried = new Set(triedAccountIds);
-		for (const row of rankPool(await poolMembersOf(region), Date.now())) {
+		for (const row of rankPool(await localPoolMembers(region), Date.now())) {
 			if (row.excludedBy !== void 0) continue;
 			if (tried.has(row.account.id)) continue;
 			const credential = await stacks[region].store.credentialFor(row.account.id);
@@ -3940,6 +4067,11 @@ function apply(ctx, config) {
 	* The reset time comes from the upstream's own words — the 429 body carries
 	* 「将在 … 重置」 — which `cooldownOf` parses. When it states no time, the store's
 	* own short window applies rather than a guess at a long one.
+	*
+	* The upstream's text is persisted alongside the outcome so the card can name
+	* the reason. It is REDACTED first because this message is a raw upstream body:
+	* without that, a failure containing a token-shaped string would write it into
+	* a file on disk.
 	*/
 	const recordAccountFailure = async (region, accountId, failure) => {
 		if (!poolPreferencesOf(current(), region).enabled) return;
@@ -3953,10 +4085,12 @@ function apply(ctx, config) {
 			nowMs: Date.now(),
 			body: failure.message
 		});
+		const message = failure.message === "" ? "" : redactUpstreamText(failure.message);
 		await writePoolProbes(region, { [accountId]: {
 			outcome,
 			atMs: Date.now(),
-			...retryAtMs === void 0 ? {} : { retryAtMs }
+			...retryAtMs === void 0 ? {} : { retryAtMs },
+			...message === "" ? {} : { message }
 		} });
 	};
 	/**

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "3.3.0",
+  "version": "3.4.1",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",