dsh-connect-workbuddy 3.4.1 → 3.4.3

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog
 
+## 3.4.3 (2026-10-03)
+
+### Features
+
+- **装在非默认目录的 Windows 安装也能找到了：注册表回退（issue #30）。**
+  - **现象**：WorkBuddy 桌面端装在 `E:\workbuddy`、`F:\AGENTS\WorkBuddy` 这类非默认位置时，插件报「未登录」——而用户明明已经登录。
+  - **根因**：`workbuddyAppExecutableCandidates()` 只探四个**默认布局**路径（`%LOCALAPPDATA%\Programs\WorkBuddy`、`%LOCALAPPDATA%\WorkBuddy`、`%ProgramFiles%\WorkBuddy`、`%ProgramFiles(x86)%\WorkBuddy`）。装在别处时四个候选全落空，于是拿不到加密字段的密钥，**已登录的账号被报成未登录**。README 的答案是手工设 `WORKBUDDY_APP_EXECUTABLE`——而安装器其实早就把答案记在注册表里了。
+  - **修法**：四个候选全落空后，在 `win32` 上查询卸载注册表（`HKCU` / `HKLM` / `HKLM\WOW6432Node` 三处），从 `DisplayIcon` 优先、`InstallLocation` 兜底推出可执行文件路径。路径必须 basename 为 `WorkBuddy.exe` 且 `existsSync` 通过才会被采用（该路径最终会传给 `execFile`）；注册表只是**回退**，默认安装零开销。`queryRegistry` 作为可注入 seam，测试不依赖主机状态。
+  - `doctor` 现在同时报告**来源**（`via env` / `default-layout` / `registry`）：只看路径的话，「默认布局命中」和「回退救了你」输出的字符串一模一样，而这正是用户排查时唯一有用的区别。
+
+### Fixes
+
+- **Windows 路径不再用宿主平台的分隔符构造（非 Windows 上会静默失效）。**
+  - **现象**：在 Linux/macOS 上构建/运行时，Windows 专用路径会带上 `/` 分隔符，永远不可能命中真实安装。
+  - **根因**：`workbuddyAppExecutableCandidates()` 的四个 Windows 候选、以及注册表回退的 `normalizeRegistryExecutable()` / `registryInstallLocationFromQuery()`，都用了 `path.join` / `path.basename`——它们跟随**运行平台**，不是数据的平台。在 POSIX 宿主上 `basename('E:\workbuddy\WorkBuddy.exe')` 返回整串，于是**每一个合法路径都被 basename 白名单拒绝**，注册表回退等于从未生效。
+  - **修法**：凡处理 Windows 数据一律改用 `path.win32.join` / `path.win32.basename`——**分隔符由数据决定，不由宿主决定**。
+  - **测试同样是错的**：期望值也用 `join()` 构造，生产与测试一起漂移，所以本地绿、CI（ubuntu）绿，而 Windows 上根本不命中。已改为 `win32.*` 并补一条**形状守卫**（断言每个 Windows 候选都不含 `/`、末段为 `WorkBuddy.exe`），变异验证（把 `win32.join` 换回 `join`）必红。
+  - 顺带修正一条与环境耦合的断言：原测试断言 `darwin` 返回 `undefined`，但本机装了 WorkBuddy 时 macOS 分支会**合法**命中，于是「开发者机器红、CI 绿」。该用例真正要断言的是注册表 seam 未被调用，已按此重写。
+
+### Fixes
+
+- **403「request illegal」（11140）不再伪装成登录故障。**
+
+  国际网关的真实失败（2026-09-29 抓包）：同一凭据下 `GET /v3/config` 返回 200，聊天 `POST /v2/chat/completions` 却被 403 拒绝，响应体逐字为：
+
+```json
+{"code":11140,"msg":"request illegal","requestId":"3498bf50-98a9-4746-962e-c14016b8c578","displayMsg":{"en":"The content did not pass the safety review. Please adjust and retry.","zh":"内容未通过安全审核，请调整后重试。"},"actions":["SUBMIT_FEEDBACK","COPY_ERROR","EDIT_INPUT"]}
+```
+
+  - **根因**：`classifyUpstreamError` 只认积分、会话失效、限流三类标记，11140 落进兜底的 `client`；shim 把 `client` 映射成 400，DSH 侧进一步归为 AUTH。用户看到的是「登录坏了」——实际是服务端内容策略拒绝，重新登录、刷新 token 都不会有效。
+  - **改动**：
+    - `upstream.ts` 新增 `policy_reject` 分类（标记 `request illegal` / `"code":11140`，在通用 4xx 之前判定）与 `parseUpstreamErrorDetail()`（从 JSON 失败体提取 `code` / `requestId` / `displayMsg`，非 JSON 返回 `undefined`，不猜）；chat 失败结果附带 `detail`。
+    - `shim.ts` 把 `policy_reject` 映射回 403，错误消息从解析字段合成：官方文案（zh 优先，回落 en、`msg`）+ `code 11140` + `requestId` +「重新登录不会解决；可在桌面端用同一账号验证，或切换区域/账号后重试」；不再把整段原始 JSON 嵌进 message。
+    - **写回宿主的 `code` 是 `policy_reject`，不是上游的数值码 11140**（2026-10-03 适配 3.4.1 的 `hostErrorCode`）。宿主按稳定的机器可读类别路由，`11140` 不是它认识的类别；而 3.4.1 建立的规则是「只有 429/6004 需要翻译成宿主认得的词」。`policy_reject` 在 403 下本就落在重试集合之外，**不需要**翻译；更要紧的是**不能**被翻译进集合——内容策略拒绝是确定性的，原地重试只会把预算烧在一次必然再被拒的请求上，跨供应商故障转移也治不了策略判定。
+    - 探针 `outcomeOfFailure` 在 401/403 一刀切**之前**先判 `policy_reject`，卡片新增「服务端按内容策略拒绝」文案（中英）。探针与真实请求复用同一分类函数，对同一响应的判定不会分歧。
+    - **账号池不再因一次策略拒绝把健康账号永久踢出**（适配 3.4.2 时发现的连带问题）：`policy-rejected` 是新 outcome，在 `exclusionOf` 里落进了 `default` 分支被标成 `unusable`——而 `unusable` 刻意**不带冷却**，于是账号会被**永久**移出池子，且卡片会显示「不可用」。这是错的：策略拒绝针对的是**那一条请求的内容**，不是这个账号，同一个账号换一条消息照样能服务。现按 `ok` 处理（测量照常记录，卡片能解释发生了什么，但不影响它继续被计费），并补守卫 + 变异验证。
+  - **守卫（先红后绿）**：`upstream.spec` / `shim.spec` / `probe.spec` 新增 8 例——分类（完整/最小 403 体 → `policy_reject`）、字段解析（zh 优先、缺 `displayMsg` 回落 `msg`、非 JSON 为 `undefined`）、shim 端到端（重放上面那段真实 403 体，断言 403 + `policy_reject` + **`code` 为 `policy_reject`** + 官方文案 + requestId，而不是 400）、探针（11140 → `policy-rejected`）。7 例先在未修复代码上跑红、实现后转绿；1 例良性对照（良性 403 / HTML 403 仍判 `client` / `credential-rejected`）双向保持绿——防止修复把无辜的 403 一起吞掉。
+
+## 3.4.2 (2026-10-03)
+
+### Fixes
+
+- **换号重试之间补上 2 秒间隔，不再零延迟连发。**
+  - **现象**：一次请求撞上限流后，换号循环会**零间隔**地把池里剩下的账号挨个试一遍——实测 4 个账号在 **35 秒内全部失败**（最后两次只隔 1 秒），而它们全部撞的是同一个 429。
+  - **根因**：上游的限流（业务码 6004）**按请求体积/频率触发**，零间隔连发等于自己把每个候选都推到同一堵墙上。批量测试早就为此在账号之间等 `POOL_BATCH_GAP_MS`（400ms），**换号循环却什么都没有**——两者的差别没有理由。
+  - **修法**：每次换号前等待 `FAILOVER_ACCOUNT_GAP_MS`（2 秒）。比批测的 400ms 更长，因为换号重试是**用户在等的真实请求**，不是探测——它需要给上游的窗口留出喘息，而不只是避免自己踩到限流。
+  - **等待是可中断的**：客户端断开时立刻结束等待并退出循环，不会白等 2 秒，也不会拿一个已经作废的 signal 去把剩余账号试完。
+  - 顺带修正：等待结束后重新检查一次中断状态——否则客户端已断开时，剩余账号会被逐个发出去（每个都立即因 signal 作废而失败），白白写下一串假的账号失败测量。
+  - 测试：新增一条用例钉住「两次尝试之间确实等待了 ≥1.9 秒」，变异验证（把间隔改成 0）必红。
+
 ## 3.4.1 (2026-10-02)
 
 ### Fixes
@@ -50,7 +100,6 @@
 
 - README 的「账号为什么出池」表按新规则改写：区分「限流/欠费/瞬时故障会自动回池」与「凭据被拒/模型不存在只能手动重测」，并删掉已不存在的「定时器」表述。
 - 清理死代码：`POOL_TICK_MS`、`POOL_MIN_INTERVAL_MINUTES`、`poolDueAt`、`duePoolRegions`、`PoolScheduleInput` / `PoolScheduleResult` 及其单元测试全部删除。它们自 3.2.0 起已无任何生产调用（构建时已被 tree-shake），却仍被测试覆盖——于是「测试全绿」对「账号会不会回来」这个问题什么也没说明。
-
 ## 3.3.0 (2026-10-01)
 
 ### Features

package/README.en.md

@@ -249,9 +249,10 @@ Marketplace screenshots and GitHub README badges are two separate mechanisms:
   - Users upgrading from before 2.0.0 may still carry the old top-level `accountId` (the migration source). It applies only to its own region and **stops applying once that region is explicitly cleared (`accounts.<region> = ""`)** — otherwise the account you cleared would be silently restored at the next startup. The card shows whether a region is "using the saved account" or "following the app's current sign-in": the restored default is usually the very account you just cleared, so without that line there is no way to tell a successful clear from a no-op.
 - **On Windows, an account change may fail to save while the profile's `cordis.patch.yml` is held open.** DSH updates that file by writing a temp file and replacing the target; an antivirus scanner, a sync client (OneDrive), or an open editor can lock it briefly, and once the replacement retries are exhausted the failed write does **not** make `set()` reject. The plugin therefore reads the value back after writing: it shows "cleared" **only once the write is confirmed on disk**, and on failure it reports the error and keeps your previous choice (never a false confirmation that the old selection silently contradicts). Close whatever holds the file and retry.
 - Windows and Linux credential paths are derived from platform conventions. On a real Windows 11 machine, `%LOCALAPPDATA%\CodeBuddyExtension\Data\Public\auth` and `%LOCALAPPDATA%\Programs\WorkBuddy\WorkBuddy.exe` **did resolve**, but **the remaining candidates and the Linux paths are still not verified on real hardware**; set `WORKBUDDY_AUTH_FILE` if yours lives elsewhere.
-- **Encrypted credentials require the desktop app to be present.** Newer desktop builds (**from 5.6.0, on macOS as well as Windows**) encrypt the token fields in the auth file, and the plugin needs that app's own native binding to obtain the field key. If the app is not installed, was uninstalled, or lives outside the probed paths (set `WORKBUDDY_APP_EXECUTABLE`), an encrypted file cannot be read — the account then shows as signed out, and the plugin **never** degrades into emitting a truncated token. `doctor` reports whether this capability is available. The key is a build-time constant that may rotate with app releases; the plugin fetches it from the local app each run and caches nothing on disk, so an app upgrade needs no plugin upgrade.
+- **Encrypted credentials require the desktop app to be present.** Newer desktop builds (**from 5.6.0, on macOS as well as Windows**) encrypt the token fields in the auth file, and the plugin needs that app's own native binding to obtain the field key. If the app is not installed, was uninstalled, or lives outside the probed paths (on Windows the install registration is consulted automatically, so a non-default install is found without configuration; set `WORKBUDDY_APP_EXECUTABLE` if that misses too), an encrypted file cannot be read — the account then shows as signed out, and the plugin **never** degrades into emitting a truncated token. `doctor` reports whether this capability is available. The key is a build-time constant that may rotate with app releases; the plugin fetches it from the local app each run and caches nothing on disk, so an app upgrade needs no plugin upgrade.
   - **The executable is located from the bundle's own declaration, not guessed from the app name.** The WorkBuddy macOS bundles declare `CFBundleExecutable` as `Electron` (not `WorkBuddy`), so the plugin reads each bundle's `Info.plist` to learn the binary's name. Both the domestic `WorkBuddy.app` and the international `WorkBuddy AI.app` are candidates, and an app filed into a subdirectory of an applications folder (e.g. `/Applications/IDE/WorkBuddy.app`) is found by a one-level scan that confirms each candidate's bundle identifier before use — so a different Electron app can never be launched by mistake.
   - **"Signed out" and "your sign-in cannot be read" are reported separately.** When an encrypted file cannot be read, the advice is to install the desktop app or point `WORKBUDDY_APP_EXECUTABLE` at it — **not** to sign in again, which cannot help: the credential is fine, the key is what is missing.
+- **A 403 "request illegal" (code 11140) is a server-side policy refusal, not a sign-in problem.** The chat gateway sometimes refuses a request outright under its content policy; the body reads `{"code":11140,"msg":"request illegal","requestId":"…","displayMsg":{"en":"The content did not pass the safety review. Please adjust and retry."}}`. The plugin used to file this under the generic `client` error (HTTP 400), which DSH then displayed as an AUTH failure — it looked like a broken sign-in, but **signing in again cannot fix it**: the credentials are fine; it is this one request that was refused. The refusal now passes through as 403 with the official message, `code 11140`, and the `requestId` (give that to official support). The `error.code` written back to the host is the stable class `policy_reject` rather than the numeric `11140`: the host decides in-place retrial from that class, and a policy refusal is deterministic — retrying only burns the budget, and `11140` is not a word the host knows, and the per-model "test" reports "refused by the server's content policy" instead of "token refused". Two ways out: send the same prompt from the WorkBuddy desktop app with the same account (if the desktop app is refused too, the limit is on the account/content side), or switch region/account and retry.
 
 ## Disclaimer
 

package/README.md

@@ -259,9 +259,10 @@ dsh plugin --profile desktop add /Users/dmh2002/DshProject/dsh-connect-workbuddy
   - 从 2.0.0 之前的版本升级而来的用户，设置里可能仍留有旧版的顶层 `accountId`（迁移来源）。它只作用于其所属区域，且**该区域被显式清除（`accounts.<区域> = ""`）后即不再生效**——否则清除掉的账号会在下次启动时被静默恢复。卡片会显示每个区域当前是「使用保存的账号」还是「跟随 App 当前登录」：清除后回到的默认账号往往与刚清掉的账号是同一个，没有这行提示就无法分辨清除是否生效。
 - **Windows：profile 的配置文件 `cordis.patch.yml` 被占用时，账号改动可能无法保存**。DSH 用「写临时文件 + 覆盖替换」的方式更新该文件，而杀毒软件、OneDrive 等同步盘或正在打开该文件的编辑器会短暂锁住它；重试耗尽后，写入失败**不会**让 `set()` 报错。插件因此会在写入后回读校验：**确认落盘才显示「已清除」**，失败则给出明确错误并保留原来的选择（不会显示一个旧选择默默反驳的假确认）。遇到该提示时，关闭占用该文件的程序后重试即可。
 - Windows / Linux 的凭据默认路径按平台约定推导。已在真实 Windows 11 上确认 `%LOCALAPPDATA%\CodeBuddyExtension\Data\Public\auth` 与 `%LOCALAPPDATA%\Programs\WorkBuddy\WorkBuddy.exe` 命中，**其余候选与 Linux 路径仍未经真机验证**；必要时可通过环境变量 `WORKBUDDY_AUTH_FILE` 指定实际位置。
-- **加密凭据依赖桌面 App 在场**：新版桌面端（**5.6.0 起，macOS 与 Windows 同样如此**）加密了 auth 文件里的 token 字段，插件需要调用该 App 自身的原生绑定才能取回字段密钥。因此 App 若未安装、被卸载，或安装在探测路径之外（用 `WORKBUDDY_APP_EXECUTABLE` 指定），加密文件就读不出来——此时账号会显示为未登录，而**不会**退化成读出一个残缺的 token。`doctor` 会报告这项能力是否可用。该密钥是构建期常量，随 App 版本可能轮换；插件每次向本机 App 现取，不缓存到磁盘，所以 App 升级后无需升级插件。
+- **加密凭据依赖桌面 App 在场**：新版桌面端（**5.6.0 起，macOS 与 Windows 同样如此**）加密了 auth 文件里的 token 字段，插件需要调用该 App 自身的原生绑定才能取回字段密钥。因此 App 若未安装、被卸载，或安装在探测路径之外（**Windows 上会自动回退查安装注册表**，仍找不到时用 `WORKBUDDY_APP_EXECUTABLE` 指定），加密文件就读不出来——此时账号会显示为未登录，而**不会**退化成读出一个残缺的 token。`doctor` 会报告这项能力是否可用。该密钥是构建期常量，随 App 版本可能轮换；插件每次向本机 App 现取，不缓存到磁盘，所以 App 升级后无需升级插件。
   - **App 可执行文件按 bundle 自身声明定位，不按 App 名猜**：WorkBuddy 的 macOS bundle 里 `CFBundleExecutable` 是 `Electron`（不是 `WorkBuddy`），因此插件读取 bundle 的 `Info.plist` 来决定二进制名。国内版 `WorkBuddy.app` 与国际版 `WorkBuddy AI.app` 都在候选内；App 被归入 `/Applications` 子目录（如 `/Applications/IDE/WorkBuddy.app`）时，插件还会向下扫一层并用 bundle id 确认身份后才使用——**不会**因为同名的其他 Electron 应用而误启动它。
   - **「未登录」与「登录信息读不出来」是两件事**：加密文件读不出时，插件给出的建议是「安装桌面 App / 用 `WORKBUDDY_APP_EXECUTABLE` 指定其位置」，而**不是**「重新登录一次」——后者对这种情况无效（凭据本身是好的，缺的是密钥）。
+- **403「request illegal」（code 11140）是服务端策略拒绝，不是登录问题**：聊天网关有时会按内容策略直接拒绝一次请求，响应体形如 `{"code":11140,"msg":"request illegal","requestId":"…","displayMsg":{"zh":"内容未通过安全审核，请调整后重试。"}}`。此前插件把它归为通用 `client` 错误返回 400，DSH 侧又显示成 AUTH 异常——看起来像「登录坏了」，但**重新登录解决不了它**：凭据本身是好的，被拒的是这一次请求。现在这类拒绝按 403 原样透传，消息里带官方文案、`code 11140` 和 `requestId`（联系官方支持时提供）。写回宿主的 `error.code` 是 `policy_reject` 这个稳定类别（而非数值 `11140`）：宿主按类别决定要不要原地重试，而策略拒绝是确定性的——重试只会白烧预算，`11140` 也不是宿主认得的词；模型行的「测试」也显示「服务端按内容策略拒绝」而非「token 被拒」。遇到时的两个出口：在 WorkBuddy 桌面端用同一账号发同样的内容验证（桌面端同样被拒，说明限制在账号/内容侧）；或切换区域/账号后重试。
 
 ## 免责声明
 

package/docs/WINDOWS.md

@@ -30,6 +30,12 @@ Windows 在本项目里不是「顺带能跑」的平台，而是**有专属分
 
 **通用注意**：路径一律经 `path.join` 构造，**不得写死 POSIX 分隔符**。历史上正因此挂过 CI——`2.0.11` 新增的 darwin 候选断言写死了 `/Applications/WorkBuddy.app/...`，生产代码没问题（用 `join`），错的是测试：它断言的是「跑测试的机器是 POSIX」而非「候选列表对不对」，于是 Windows 必挂、macOS 恒绿。现有回归守卫：候选路径不得**混用**分隔符。
 
+**更隐蔽的反向形态**：处理 **Windows 专用**数据（注册表值、`%LOCALAPPDATA%` 等 Windows 环境变量）时，`path.join` / `path.basename` **不是**正确答案——它们跟随**运行平台**。在 Linux/macOS 上跑，`basename('E:\workbuddy\WorkBuddy.exe')` 返回整串（`\` 在 POSIX 下不是分隔符），`join('E:\workbuddy', 'x.exe')` 产出 `E:\workbuddy/x.exe`，两者在 Windows 上都不可能命中。正确写法是 `path.win32.join` / `path.win32.basename`：**分隔符由数据决定，而不是由宿主决定**。
+
+- 生产代码里曾有两处踩到：`workbuddyAppExecutableCandidates()` 的四个 Windows 候选（`DIRTY` 形态的分隔符 → 非 Windows 宿主上构造出的路径永远不存在，且**它的测试用 `join()` 构造期望值，以同样的方式被改坏，于是双双通过**），以及注册表回退的 `normalizeRegistryExecutable()` / `registryInstallLocationFromQuery()`。
+- 因此**测试的期望值也必须用 `win32.*` 构造**：用 `join()` 拼 Windows 期望值时，生产与测试会一起漂移，CI 在 ubuntu 上照样绿——这正是上一条「断言的是宿主而非逻辑」的同一种错，只是方向相反。
+- 判断标准很简单：**这个字符串里出现 `\` 或盘符了吗？**有 → `win32.*`；是 POSIX 绝对路径或拼接本机路径 → 用 `join`。
+
 ## 2. 证据分级（写结论时必须用对档位）
 
 | 档位 | 含义 | 实例 |

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { E as legacyWorkbuddyOwnAuthPath, H as WORKBUDDY_APP_EXECUTABLE_ENV, N as WorkBuddyUpstreamClient, S as defaultDesktopAuthDirs, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, x as defaultDesktopAuthCandidates } from "./host-heartbeat-DSO-07lc.js";
+import { E as legacyWorkbuddyOwnAuthPath, H as WORKBUDDY_APP_EXECUTABLE_ENV, J as findWorkbuddyAppExecutableWithSource, N as WorkBuddyUpstreamClient, S as defaultDesktopAuthDirs, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, x as defaultDesktopAuthCandidates } from "./host-heartbeat-D5ArLcFf.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts
@@ -63,7 +63,8 @@ async function doctor(jsonOutput) {
 	const desktopPresent = await anyStore.desktopFilePresent();
 	const heartbeat = await readHostHeartbeat();
 	const hostAlive = heartbeat !== void 0 && isHeartbeatProcessAlive(heartbeat);
-	const appExecutable = findWorkbuddyAppExecutable();
+	const discoveredApp = findWorkbuddyAppExecutableWithSource();
+	const appExecutable = discoveredApp?.executable;
 	const regionLists = await Promise.all(REGIONS.map(async (region) => ({
 		region,
 		accounts: await makeStore(region).accounts()
@@ -106,6 +107,13 @@ async function doctor(jsonOutput) {
 		*/
 		atRestDecryption: {
 			appExecutable: appExecutable ?? `(not found; set WORKBUDDY_APP_EXECUTABLE)`,
+			/**
+			* Where the path came from. `registry` means the app is installed outside
+			* the default layout and the Windows uninstall registration found it; the
+			* absence of this field (older reports) is why the hint below can now name
+			* the mechanism instead of telling every user to set the env var.
+			*/
+			appExecutableSource: discoveredApp?.source,
 			available: appExecutable !== void 0
 		},
 		ownAuthFiles: {
@@ -137,7 +145,7 @@ async function doctor(jsonOutput) {
 		hints: [
 			...anySignedIn ? [] : ["Sign in once in the WorkBuddy desktop app (either region), then run status again."],
 			...desktopPresent ? [] : [`No WorkBuddy desktop auth file at the expected path; set ${WORKBUDDY_AUTH_FILE_ENV} if it lives elsewhere.`],
-			...appExecutable === void 0 ? [`The WorkBuddy desktop app was not found, so encrypted credential fields cannot be opened; set ${WORKBUDDY_APP_EXECUTABLE_ENV} to its executable if it is installed elsewhere.`] : [],
+			...appExecutable === void 0 ? [`The WorkBuddy desktop app was not found, so encrypted credential fields cannot be opened. On Windows the install registration was already checked, so the app is either not installed or its uninstall entry is missing; set ${WORKBUDDY_APP_EXECUTABLE_ENV} to its executable if it is installed elsewhere.`] : [],
 			...hostAlive ? [] : ["Host bundle not running in this DSH profile (or the process exited). The browser card and providers are unavailable until DSH starts the plugin."],
 			...piAi.generation === "legacy" && piAi.resolvedLocally ? [`This plugin resolves pi-ai ${piAi.version ?? "(unreadable version)"} (the 0.85 context shape) while DSH 0.2.0+ hosts normalize with 0.87; the adapter bridges that gap, but if tools still misbehave, remove any nested pi-ai copy so the plugin resolves the host's.`] : []
 		]
@@ -147,7 +155,7 @@ async function doctor(jsonOutput) {
 		`WorkBuddy Connect ${WORKBUDDY_CONNECT_VERSION} on ${process.version}`,
 		...piAi.resolvedLocally ? [`pi-ai runtime: ${piAi.generation}${piAi.version === void 0 ? "" : ` ${piAi.version}`} (${piAi.resolvedFrom}) — ${report.piAiRuntime.adapterBehaviour}`] : [`pi-ai runtime: ${piAi.generation}, host-provided (no local copy; DSH 0.2.0+ ships 0.87.1) — passes provider contexts through unchanged`],
 		`Desktop auth file: ${report.desktopAuthFile.present ? "present" : "missing"} (${report.desktopAuthFile.path})`,
-		`Encrypted-credential support: ${report.atRestDecryption.available ? "available" : "unavailable"} (${report.atRestDecryption.appExecutable})`,
+		`Encrypted-credential support: ${report.atRestDecryption.available ? "available" : "unavailable"} (${report.atRestDecryption.appExecutable}${report.atRestDecryption.appExecutableSource === void 0 ? "" : `, via ${report.atRestDecryption.appExecutableSource}`})`,
 		`Host bundle: ${hostAlive ? `running (pid ${heartbeat.pid})` : heartbeat !== void 0 ? "stale heartbeat (process exited)" : "not started"}`,
 		...regionLists.flatMap(({ region, accounts }) => [`${REGION_LABELS[region]} accounts: ${accounts.length} (own copy ${workbuddyOwnAuthPath(region)})`, ...accounts.map((account) => `  - ${account.accountName === "" ? "(unnamed)" : account.accountName} (${account.id})${account.selected ? " [selected]" : ""} expires ${new Date(account.tokenExpiresAtMs).toISOString()}`)]),
 		`Static fallback models: CN ${report.fallbackModels.cn}, Global ${report.fallbackModels.global}`,

package/lib/client.js

@@ -2073,6 +2073,10 @@ window.__ModuleLoader__.load({
 					text: t("row.probeCredentialRejected"),
 					tone: "bad"
 				};
+				case "policy-rejected": return {
+					text: t("row.probePolicyRejected"),
+					tone: "bad"
+				};
 				case "not-found": return {
 					text: t("row.probeNotFound"),
 					tone: "bad"
@@ -3024,6 +3028,7 @@ window.__ModuleLoader__.load({
 			"row.probeOutOfCreditUnknown": "✗ Not enough credits · the upstream gave no time for when it frees up",
 			"row.probeOutOfCreditAt": "✗ Not enough credits · quota refreshes {at}",
 			"row.probeCredentialRejected": "✗ WorkBuddy refused this account's token — sign in again or pick another account",
+			"row.probePolicyRejected": "✗ WorkBuddy's server refused this request under its content policy — re-signing in won't help; try the desktop app or another region/account",
 			"row.probeNotFound": "✗ The upstream does not know this model",
 			"row.probeUnavailable": "✗ The upstream could not be reached — no usable answer came back",
 			"row.probeFailed": "✗ Test failed",
@@ -3200,6 +3205,7 @@ window.__ModuleLoader__.load({
 			"row.probeOutOfCreditUnknown": "✗ 积分不足 · 上游未给出何时恢复",
 			"row.probeOutOfCreditAt": "✗ 积分不足 · 积分包 {at} 刷新",
 			"row.probeCredentialRejected": "✗ WorkBuddy 拒绝了这个账号的 token——请重新登录或换一个账号",
+			"row.probePolicyRejected": "✗ WorkBuddy 服务端按内容策略拒绝了这次请求——重新登录无效；可在桌面端验证或切换区域/账号",
 			"row.probeNotFound": "✗ 上游不认识这个模型",
 			"row.probeUnavailable": "✗ 连不上上游——上游没有给出可用答复",
 			"row.probeFailed": "✗ 测试失败",

package/lib/{host-heartbeat-DSO-07lc.js → host-heartbeat-D5ArLcFf.js}

@@ -1,7 +1,7 @@
 import { readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { createDecipheriv, createHash } from "node:crypto";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, win32 } from "node:path";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { execFile, execFileSync } from "node:child_process";
@@ -202,6 +202,167 @@ function macosBundleExecutable(bundle) {
 	return join(bundle, "Contents", "MacOS", name);
 }
 /**
+* The executable path WorkBuddy's own uninstall registration points at, or
+* undefined when the app was never registered.
+*
+* Why this exists: the four directory candidates in
+* {@link workbuddyAppExecutableCandidates} encode the DEFAULT install layout.
+* An app installed anywhere else — a second drive (the observed case was
+* `E:\workbuddy\WorkBuddy.exe`) — is installed and signed in, yet every
+* candidate misses, so the encrypted credential file cannot be opened and a
+* user who IS signed in is reported as signed out. The README's answer was to
+* set `WORKBUDDY_APP_EXECUTABLE` by hand; the installer already recorded the
+* answer, so this reads it instead.
+*
+* The registration is the app's own claim about itself, which is what makes it
+* safe to hand the path to the credential probe: a display name alone would be
+* a guess, whereas the path here was written by the installer that placed the
+* binary. The value is still checked against {@link APP_EXECUTABLE_NAME} and for
+* existence before use, and the callers fall through to the documented hint when
+* it is absent.
+*
+* The read is done through ALL THREE uninstall views, because the hive a
+* registration lands in depends on how the app was installed: per-user
+* (`/currentuser`, the layout WorkBuddy uses) registers under `HKCU`, a
+* machine-wide install under `HKLM`, and a 32-bit machine-wide one under
+* `HKLM\...\WOW6432Node`. A hive that does not exist or is unreadable is the
+* normal case on a machine without the app, not an error: every failure path
+* returns undefined so the caller can try the next candidate.
+*/
+function windowsRegistryAppExecutable(query = queryRegistry) {
+	for (const root of [
+		"HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+		"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
+		"HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
+	]) {
+		const listing = query([
+			"query",
+			root,
+			"/s",
+			"/f",
+			"WorkBuddy",
+			"/t",
+			"REG_SZ"
+		]);
+		if (listing === void 0) continue;
+		const executable = registryExecutableFromQuery(listing);
+		if (executable !== void 0) return executable;
+		const fromDirectory = registryInstallLocationFromQuery(listing);
+		if (fromDirectory !== void 0) return fromDirectory;
+	}
+}
+/**
+* Parse `reg query` output for the value that names the installed executable.
+*
+* `reg query` prints keys as `HKEY_CURRENT_USER\...\Uninstall\<id>` followed by
+* indented `    ValueName    REG_SZ    Data` lines. Only `DisplayIcon` is
+* trusted here: it is the one value the installer writes pointing AT the
+* binary. The value is normalised by {@link normalizeRegistryExecutable}, which
+* strips the quotes and the icon index and rejects anything that is not the
+* desktop executable.
+*/
+function registryExecutableFromQuery(output) {
+	for (const rawLine of output.split(/\r?\n/u)) {
+		const match = /^\s*DisplayIcon\s+REG_SZ\s+(.*?)\s*$/u.exec(rawLine);
+		if (match === null) continue;
+		const executable = normalizeRegistryExecutable(match[1]);
+		if (executable !== void 0) return executable;
+	}
+}
+/**
+* The `WorkBuddy.exe` under an `InstallLocation`-style registry directory.
+*
+* Kept separate from {@link registryExecutableFromQuery} because the two values
+* mean different things: `DisplayIcon` NAMES a file, whereas the directory has
+* to have {@link APP_EXECUTABLE_NAME} joined onto it, and the result must still
+* be checked for existence by the caller's probe.
+*
+* `win32.join` rather than the host's `join`: the input is a Windows registry
+* value on EVERY machine this function can be called on. `path.join` is the
+* running platform's, so a suite on Linux/macOS would mangle `E:\workbuddy`
+* into `E:\workbuddy/WorkBuddy.exe` and the caller's `existsSync` could never
+* match it. The separator here is fixed by the DATA, not by the host.
+*/
+function registryInstallLocationFromQuery(output) {
+	for (const rawLine of output.split(/\r?\n/u)) {
+		const match = /^\s*InstallLocation\s+REG_SZ\s+(.*?)\s*$/u.exec(rawLine);
+		if (match === null) continue;
+		const directory = stripRegistryQuotes(match[1]);
+		if (directory === void 0 || directory === "") continue;
+		return win32.join(directory, APP_EXECUTABLE_NAME);
+	}
+}
+/**
+* A registry executable value reduced to a usable path, or undefined when it
+* cannot be one.
+*
+* `DisplayIcon` is stored as `"E:\workbuddy\WorkBuddy.exe",0`. The quotes and
+* the icon index are stripped, and a value that names something other than the
+* desktop executable — an `.ico`, an uninstaller, another product's binary — is
+* rejected rather than launched. A bare path without quotes is accepted too,
+* because not every installer writes the indexed form.
+*
+* The basename test uses `win32.basename` for the reason given on
+* {@link registryInstallLocationFromQuery}: the separator belongs to the
+* registry value (always Windows), so the host's `basename` — which does not
+* treat `\` as a separator — would return the whole string and reject every
+* legitimate path.
+*/
+function normalizeRegistryExecutable(value) {
+	const unquoted = stripRegistryQuotes(value);
+	if (unquoted === void 0 || unquoted === "") return void 0;
+	const withoutIndex = unquoted.replace(/,\s*-?\d+\s*$/u, "");
+	if (withoutIndex === "") return void 0;
+	if (win32.basename(withoutIndex).toLowerCase() !== APP_EXECUTABLE_NAME.toLowerCase()) return void 0;
+	return withoutIndex;
+}
+/**
+* The path inside a `DisplayIcon`/`InstallLocation` value, unquoted.
+*
+* Registry data may be written either quoted (`"E:\workbuddy\WorkBuddy.exe",0`)
+* or bare. Only a leading quote is treated as quoting: a bare `C:\dir\a"b.exe`
+* is a real (if unusual) filename and must not be truncated at the quote.
+*/
+function stripRegistryQuotes(value) {
+	const trimmed = value.trim();
+	if (trimmed === "") return void 0;
+	if (!trimmed.startsWith("\"")) return trimmed;
+	const closing = trimmed.indexOf("\"", 1);
+	if (closing === -1) return void 0;
+	return trimmed.slice(1, closing).trim();
+}
+/**
+* Run `reg query` and return its stdout, or undefined when it cannot be run.
+*
+* `windowsHide` is REQUIRED, not cosmetic: the DSH Desktop host is an Electron
+* GUI process with no console, so spawning a console program without it flashes
+* a visible black window on every probe. The same reason is recorded for the
+* heartbeat probe in `host-heartbeat.ts` and in `docs/WINDOWS.md` §1-3.
+*
+* `execFileSync` (not `execFile`) keeps this synchronous so the candidates list
+* stays a pure function of its inputs: it is called during `findWorkbuddyApp`
+* `Executable`, which `readAtRestKey()` and the `doctor` command both treat as
+* a plain lookup. The read is bounded by the registry query's own output and
+* happens at most once per discovery.
+*/
+function queryRegistry(args) {
+	try {
+		return execFileSync("reg", [...args], REGISTRY_PROBE_OPTIONS);
+	} catch {
+		return;
+	}
+}
+/**
+* Options for the registry probe; `windowsHide` is mandatory (see above), and
+* the timeout matches `fetchAtRestKeyPayload()`'s: a hung `reg` must not wedge
+* the synchronous discovery path forever.
+*/
+const REGISTRY_PROBE_OPTIONS = {
+	encoding: "utf8",
+	windowsHide: true,
+	timeout: 1e4
+};
+/**
 * Candidate paths of the WorkBuddy desktop executable, in probe order.
 *
 * The Windows build is the one that encrypts credentials, so Windows leads;
@@ -224,7 +385,7 @@ function workbuddyAppExecutableCandidates(platform = process.platform, home = ho
 		const local = env["LOCALAPPDATA"]?.trim();
 		const programFiles = env["ProgramFiles"]?.trim();
 		const programFilesX86 = env["ProgramFiles(x86)"]?.trim();
-		candidates.push(local === void 0 || local === "" ? void 0 : join(local, "Programs", "WorkBuddy", APP_EXECUTABLE_NAME), local === void 0 || local === "" ? void 0 : join(local, "WorkBuddy", APP_EXECUTABLE_NAME), programFiles === void 0 || programFiles === "" ? void 0 : join(programFiles, "WorkBuddy", APP_EXECUTABLE_NAME), programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : join(programFilesX86, "WorkBuddy", APP_EXECUTABLE_NAME));
+		candidates.push(local === void 0 || local === "" ? void 0 : win32.join(local, "Programs", "WorkBuddy", APP_EXECUTABLE_NAME), local === void 0 || local === "" ? void 0 : win32.join(local, "WorkBuddy", APP_EXECUTABLE_NAME), programFiles === void 0 || programFiles === "" ? void 0 : win32.join(programFiles, "WorkBuddy", APP_EXECUTABLE_NAME), programFilesX86 === void 0 || programFilesX86 === "" ? void 0 : win32.join(programFilesX86, "WorkBuddy", APP_EXECUTABLE_NAME));
 	} else if (platform === "darwin") for (const name of MACOS_APP_BUNDLE_NAMES) candidates.push(readBundleExecutable(join("/Applications", name)), readBundleExecutable(join(home, "Applications", name)));
 	return candidates.filter((candidate) => candidate !== void 0 && candidate !== "");
 }
@@ -298,13 +459,55 @@ function macosNestedAppBundles(parent) {
 	return bundles;
 }
 /**
+* Locate the desktop executable AND say how it was found.
+*
+* Kept beside {@link findWorkbuddyAppExecutable} rather than folded into it
+* because the two answer different questions: callers on the credential path
+* only want the path, whereas `doctor` must explain the discovery. Sharing the
+* candidate list keeps them from drifting.
+*/
+function findWorkbuddyAppExecutableWithSource(platform = process.platform, home = homedir(), env = process.env, readRegistryAppPath = windowsRegistryAppExecutable) {
+	const fromEnv = env[WORKBUDDY_APP_EXECUTABLE_ENV]?.trim();
+	for (const candidate of workbuddyAppExecutableCandidates(platform, home, env)) {
+		try {
+			if (!existsSync(candidate)) continue;
+		} catch {
+			continue;
+		}
+		return {
+			executable: candidate,
+			source: fromEnv !== void 0 && fromEnv !== "" && candidate === fromEnv ? "env" : "default-layout"
+		};
+	}
+	if (platform === "win32") {
+		const fromRegistry = readRegistryAppPath();
+		if (fromRegistry !== void 0) try {
+			if (existsSync(fromRegistry)) return {
+				executable: fromRegistry,
+				source: "registry"
+			};
+		} catch {}
+	}
+	const executable = findWorkbuddyAppExecutable(platform, home, env, readRegistryAppPath);
+	return executable === void 0 ? void 0 : {
+		executable,
+		source: "nested-bundle"
+	};
+}
+/**
 * The first candidate that exists as a file, or undefined when the desktop app
 * is not installed where this platform expects it.
 */
-function findWorkbuddyAppExecutable(platform = process.platform, home = homedir(), env = process.env) {
+function findWorkbuddyAppExecutable(platform = process.platform, home = homedir(), env = process.env, readRegistryAppPath = windowsRegistryAppExecutable) {
 	for (const candidate of workbuddyAppExecutableCandidates(platform, home, env)) try {
 		if (existsSync(candidate)) return candidate;
 	} catch {}
+	if (platform === "win32") {
+		const fromRegistry = readRegistryAppPath();
+		if (fromRegistry !== void 0) try {
+			if (existsSync(fromRegistry)) return fromRegistry;
+		} catch {}
+	}
 	if (platform === "darwin") for (const parent of ["/Applications", join(home, "Applications")]) for (const bundle of macosNestedAppBundles(parent)) {
 		const executable = macosBundleExecutable(bundle);
 		if (executable === void 0) continue;
@@ -449,12 +652,19 @@ const HARD_CREDIT_MARKERS = [
 ];
 /** Session-invalidation markers that mean "sign in again in the WorkBuddy app". */
 const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
+/**
+* Content-policy refusal markers from the chat gateway. The quoted-key form
+* avoids substring hits inside unrelated values (request ids are hex and can
+* contain `11140` by coincidence).
+*/
+const POLICY_REJECT_MARKERS = ["request illegal", "\"code\":11140"];
 /** Classify an upstream failure from its HTTP status and body excerpt. */
 function classifyUpstreamError(status, body) {
 	if (status === 402) return "hard_credit";
 	const lower = body.toLowerCase();
 	for (const marker of HARD_CREDIT_MARKERS) if (lower.includes(marker.toLowerCase()) || body.includes(marker)) return "hard_credit";
 	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
+	for (const marker of POLICY_REJECT_MARKERS) if (body.includes(marker)) return "policy_reject";
 	if (status === 429) return "soft_rate";
 	if (status === 404) return "not_found";
 	if (status >= 500) return "server";
@@ -462,6 +672,34 @@ function classifyUpstreamError(status, body) {
 	return "client";
 }
 /**
+* Parse the known-good fields out of an upstream failure body. Non-JSON
+* bodies (HTML error pages, empty strings) yield undefined rather than a guess.
+*/
+function parseUpstreamErrorDetail(body) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		return;
+	}
+	if (typeof parsed !== "object" || parsed === null) return void 0;
+	const raw = parsed;
+	let displayMsg;
+	const display = raw.displayMsg;
+	if (typeof display === "string") displayMsg = display;
+	else if (typeof display === "object" && display !== null) {
+		const localized = display;
+		const pick = localized.zh ?? localized.en;
+		if (typeof pick === "string") displayMsg = pick;
+	}
+	if (displayMsg === void 0 && typeof raw.msg === "string") displayMsg = raw.msg;
+	const detail = {};
+	if (typeof raw.code === "number") detail.upstreamCode = raw.code;
+	if (typeof raw.requestId === "string") detail.requestId = raw.requestId;
+	if (displayMsg !== void 0) detail.displayMsg = displayMsg;
+	return detail;
+}
+/**
 * Region for a login domain; an empty domain means CN (matching upstream tooling).
 *
 * The international product is reachable under TWO brand domains: the WorkBuddy
@@ -944,7 +1182,8 @@ var WorkBuddyUpstreamClient = class {
 			ok: false,
 			status: response.status,
 			kind: classifyUpstreamError(response.status, text),
-			message: text
+			message: text,
+			detail: parseUpstreamErrorDetail(text)
 		};
 	}
 	/**
@@ -2552,7 +2791,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "3.4.1";
+const WORKBUDDY_CONNECT_VERSION = "3.4.3";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -2710,4 +2949,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { readAtRestKey as $, CREDENTIAL_REJECTED_CODE as A, prepareChatBody as B, defaultDesktopAuthPath as C, parseWorkBuddyAuth as D, legacyWorkbuddyOwnAuthPath as E, declaredTools as F, deriveAtRestKeyId as G, WORKBUDDY_APP_EXECUTABLE_ENV as H, isCredentialRejectedError as I, isEncryptedFieldWrapper as J, fetchAtRestKeyPayload as K, parseCreditMultiplier as L, WorkBuddyCredentialRejectedError as M, WorkBuddyUpstreamClient as N, workbuddyAccountId as O, classifyUpstreamError as P, openEncryptedField as Q, parseReasoning as R, defaultDesktopAuthDirs as S, isEncryptedCredentialError as T, clearAtRestKeyCache as U, regionOf as V, deriveAtRestKey as W, macosBundleExecutable as X, isWorkbuddyBundle as Y, macosNestedAppBundles as Z, WORKBUDDY_AUTH_FILE_ENV as _, readHostHeartbeat as a, authFileName as b, WORKBUDDY_CONNECT_VERSION as c, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, workbuddyAppExecutableCandidates as et, WorkBuddyCatalog as f, WORKBUDDY_AUTH_FILENAME as g, ENCRYPTED_CREDENTIAL_CODE as h, processStartTimeMs as i, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as j, workbuddyOwnAuthPath as k, piAiRuntimeInfo as l, fallbackModelsFor as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, deriveCatalog as p, findWorkbuddyAppExecutable as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, FALLBACK_WORKBUDDY_MODELS as u, WorkBuddyCredentialStore as v, hasEncryptedCredentialFields as w, defaultDesktopAuthCandidates as x, WorkBuddyEncryptedCredentialError as y, parseUpstreamModel as z };
+export { openEncryptedField as $, CREDENTIAL_REJECTED_CODE as A, prepareChatBody as B, defaultDesktopAuthPath as C, parseWorkBuddyAuth as D, legacyWorkbuddyOwnAuthPath as E, declaredTools as F, deriveAtRestKeyId as G, WORKBUDDY_APP_EXECUTABLE_ENV as H, isCredentialRejectedError as I, findWorkbuddyAppExecutableWithSource as J, fetchAtRestKeyPayload as K, parseCreditMultiplier as L, WorkBuddyCredentialRejectedError as M, WorkBuddyUpstreamClient as N, workbuddyAccountId as O, classifyUpstreamError as P, macosNestedAppBundles as Q, parseReasoning as R, defaultDesktopAuthDirs as S, isEncryptedCredentialError as T, clearAtRestKeyCache as U, regionOf as V, deriveAtRestKey as W, isWorkbuddyBundle as X, isEncryptedFieldWrapper as Y, macosBundleExecutable as Z, WORKBUDDY_AUTH_FILE_ENV as _, readHostHeartbeat as a, authFileName as b, WORKBUDDY_CONNECT_VERSION as c, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, readAtRestKey as et, WorkBuddyCatalog as f, WORKBUDDY_AUTH_FILENAME as g, ENCRYPTED_CREDENTIAL_CODE as h, processStartTimeMs as i, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as j, workbuddyOwnAuthPath as k, piAiRuntimeInfo as l, fallbackModelsFor as m, clearHostHeartbeat as n, workbuddyHostHeartbeatPath as o, deriveCatalog as p, findWorkbuddyAppExecutable as q, isHeartbeatProcessAlive as r, writeHostHeartbeat as s, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, workbuddyAppExecutableCandidates as tt, FALLBACK_WORKBUDDY_MODELS as u, WorkBuddyCredentialStore as v, hasEncryptedCredentialFields as w, defaultDesktopAuthCandidates as x, WorkBuddyEncryptedCredentialError as y, parseUpstreamModel as z };

package/lib/index.d.ts

@@ -435,7 +435,7 @@ declare class WorkBuddyCredentialStore {
 /** WorkBuddy region selected by the credential's login domain. */
 type WorkBuddyRegion = 'cn' | 'global';
 /** Upstream failure classes the shim maps onto distinct HTTP answers. */
-type UpstreamErrorKind = 'hard_credit' | 'soft_rate' | 'session_dead' | 'not_found' | 'server' | 'client';
+type UpstreamErrorKind = 'hard_credit' | 'soft_rate' | 'session_dead' | 'policy_reject' | 'not_found' | 'server' | 'client';
 /** Reasoning capability as the upstream catalog declares it. */
 interface WorkBuddyReasoning {
   supportedEfforts?: readonly string[];
@@ -532,6 +532,8 @@ type WorkBuddyChatResult = {
   status: number;
   kind: UpstreamErrorKind;
   message: string;
+  /** Structured fields lifted from a JSON failure body, when there were any. */
+  detail?: UpstreamErrorDetail | undefined;
 };
 /**
  * Chat answer that also carries the response headers.
@@ -554,6 +556,15 @@ interface WorkBuddyProbeAnswer {
 }
 /** Classify an upstream failure from its HTTP status and body excerpt. */
 declare function classifyUpstreamError(status: number, body: string): UpstreamErrorKind;
+/** Structured fields lifted out of a JSON upstream failure body. */
+interface UpstreamErrorDetail {
+  /** Numeric upstream error code, e.g. 11140 for a content-policy refusal. */
+  upstreamCode?: number;
+  /** Upstream request id — the handle support asks for. */
+  requestId?: string;
+  /** Best human-facing message: `displayMsg.zh`, falling back to `.en`, then `msg`. */
+  displayMsg?: string;
+}
 /**
  * Region for a login domain; an empty domain means CN (matching upstream tooling).
  *
@@ -1170,7 +1181,7 @@ declare function macosNestedAppBundles(parent: string): string[];
  * The first candidate that exists as a file, or undefined when the desktop app
  * is not installed where this platform expects it.
  */
-declare function findWorkbuddyAppExecutable(platform?: NodeJS.Platform, home?: string, env?: NodeJS.ProcessEnv): string | undefined;
+declare function findWorkbuddyAppExecutable(platform?: NodeJS.Platform, home?: string, env?: NodeJS.ProcessEnv, readRegistryAppPath?: () => string | undefined): string | undefined;
 /**
  * Ask the installed desktop app for its key payload by running its own binary
  * as plain Node (`ELECTRON_RUN_AS_NODE`) and calling the native binding.
@@ -1387,7 +1398,7 @@ declare function probeRequestBody(modelId: string): string;
  * outcome the feature exists for: it means "this model works, but not right
  * now". Everything else is a real, actionable failure or a success.
  */
-type WorkBuddyProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'unavailable' | 'not-found' | 'failed';
+type WorkBuddyProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
 /**
  * One probe result, as the card renders it.
  *
@@ -1455,9 +1466,10 @@ declare function cooldownOf(input: {
  *
  * Built on `classifyUpstreamError` rather than re-testing status codes, so a
  * probe and a real chat request can never disagree about what the same upstream
- * answer means. The extra split here is `credential-rejected`, which the
+ * answer means. The extra splits here are `credential-rejected`, which the
  * upstream signals with a non-JSON 401/403 edge page and which needs completely
- * different advice (re-auth, not "wait").
+ * different advice (re-auth, not "wait"), and `policy-rejected`, a JSON 403
+ * content-policy refusal where re-auth advice would be actively misleading.
  */
 declare function outcomeOfFailure(status: number, body: string): WorkBuddyProbeOutcome;
 /**
@@ -1902,7 +1914,7 @@ type WorkBuddyWebUsage =
  * here because this module is the node-free bridge and must not import the
  * Host-side probe module (which pulls in the credential type).
  */
-type WorkBuddyWebProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'unavailable' | 'not-found' | 'failed';
+type WorkBuddyWebProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
 /** One model's probe result, as the card renders it. */
 interface WorkBuddyWebProbeResult {
   modelId: string;

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as readAtRestKey, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, J as isEncryptedFieldWrapper, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as openEncryptedField, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as macosBundleExecutable, Y as isWorkbuddyBundle, Z as macosNestedAppBundles, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as workbuddyAppExecutableCandidates, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-DSO-07lc.js";
+import { $ as openEncryptedField, A as CREDENTIAL_REJECTED_CODE, B as prepareChatBody, C as defaultDesktopAuthPath, D as parseWorkBuddyAuth, E as legacyWorkbuddyOwnAuthPath, F as declaredTools, G as deriveAtRestKeyId, H as WORKBUDDY_APP_EXECUTABLE_ENV, I as isCredentialRejectedError, K as fetchAtRestKeyPayload, L as parseCreditMultiplier, M as WorkBuddyCredentialRejectedError, N as WorkBuddyUpstreamClient, O as workbuddyAccountId, P as classifyUpstreamError, Q as macosNestedAppBundles, R as parseReasoning, S as defaultDesktopAuthDirs, T as isEncryptedCredentialError, U as clearAtRestKeyCache, V as regionOf, W as deriveAtRestKey, X as isWorkbuddyBundle, Y as isEncryptedFieldWrapper, Z as macosBundleExecutable, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as authFileName, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as readAtRestKey, f as WorkBuddyCatalog, g as WORKBUDDY_AUTH_FILENAME, h as ENCRYPTED_CREDENTIAL_CODE, i as processStartTimeMs, j as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, k as workbuddyOwnAuthPath, l as piAiRuntimeInfo, m as fallbackModelsFor, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as deriveCatalog, q as findWorkbuddyAppExecutable, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as workbuddyAppExecutableCandidates, u as FALLBACK_WORKBUDDY_MODELS, v as WorkBuddyCredentialStore, w as hasEncryptedCredentialFields, x as defaultDesktopAuthCandidates, y as WorkBuddyEncryptedCredentialError, z as parseUpstreamModel } from "./host-heartbeat-D5ArLcFf.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1118,6 +1118,19 @@ function finish(parts, calls) {
 * @module dsh-connect-workbuddy/shim
 */
 const REQUEST_BODY_LIMIT = 67108864;
+/**
+* Pause between failover attempts, after one account's request failed.
+*
+* The upstream's rate limit (6004) fires on request volume — firing retries at
+* zero gap makes every candidate hit the same wall, and 4 accounts can all fail
+* in under a second. The batch test already waits `POOL_BATCH_GAP_MS` (400ms)
+* between accounts for exactly this reason; the failover loop used to wait
+* nothing. 2 seconds is longer than the batch's 400 because a failover retry is
+* a real request the user is waiting on, not a probe — it needs enough room for
+* the upstream's window to breathe, not just enough to avoid self-inflicted
+* rate-limiting.
+*/
+const FAILOVER_ACCOUNT_GAP_MS = 2e3;
 /** Loopback hostnames the shim's own in-process client uses. */
 const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"127.0.0.1",
@@ -1167,6 +1180,7 @@ const KIND_STATUS = {
 	hard_credit: 402,
 	soft_rate: 429,
 	session_dead: 401,
+	policy_reject: 403,
 	not_found: 502,
 	server: 502,
 	client: 400
@@ -1199,6 +1213,16 @@ const KIND_STATUS = {
 * Every other kind already lands outside the retry set by its status alone
 * (`hard_credit` 402 → quota, `session_dead` 401 → auth, 502/400 → other), so
 * none of them is listed: a translation nobody needs is a lie waiting to drift.
+*
+* `policy_reject` is deliberately NOT listed either, for a sharper reason than
+* the others: the obvious candidate translation would be the upstream's own
+* numeric code (11140), but that is not a class the host knows, so it would take
+* the host's generic path and add nothing over `policy_reject`. It needs no
+* translation to stay outside the retry set (403), and it must NOT be translated
+* INTO the set — a content-policy refusal is deterministic, so retrying it in
+* place would spend the retry budget on a request the server will refuse again,
+* and cross-provider failover cannot help a policy decision either. The code the
+* host receives therefore names the class honestly.
 */
 const KIND_HOST_CODE = { soft_rate: "quota_exceeded" };
 /**
@@ -1745,6 +1769,16 @@ function createWorkBuddyShim(options) {
 			const next = await failoverAccount(triedAccountIds).catch(() => void 0);
 			if (next === void 0) break;
 			if (triedAccountIds.includes(workbuddyAccountId(next))) break;
+			if (controller.signal.aborted) break;
+			await new Promise((resolve) => {
+				if (controller.signal.aborted) return resolve();
+				const timer = setTimeout(resolve, FAILOVER_ACCOUNT_GAP_MS);
+				controller.signal.addEventListener("abort", () => {
+					clearTimeout(timer);
+					resolve();
+				}, { once: true });
+			});
+			if (controller.signal.aborted) break;
 			logger?.warn(`dsh-connect-workbuddy: retrying chat on another pool account after ${result.kind} (http ${result.status})`);
 			credential = next;
 			result = await client.chatStream(credential, prepared, controller.signal);
@@ -1754,6 +1788,16 @@ function createWorkBuddyShim(options) {
 		if (!result.ok) {
 			const attempts = triedAccountIds.length;
 			const note = attempts > 1 ? ` (after trying ${attempts} accounts)` : "";
+			if (result.kind === "policy_reject") {
+				const detail = result.detail;
+				const lead = detail?.displayMsg ?? result.message.slice(0, 200);
+				const meta = ["服务端策略拒绝"];
+				if (detail?.upstreamCode !== void 0) meta.push(`code ${detail.upstreamCode}`);
+				if (detail?.requestId !== void 0) meta.push(`requestId ${detail.requestId}`);
+				const message = `${lead}（${meta.join("，")}）${note}。该请求被 WorkBuddy 服务端策略拒绝，重新登录不会解决；可在 WorkBuddy 桌面端用同一账号验证，或切换区域/账号后重试`;
+				writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, message, hostErrorCode(result.kind));
+				return;
+			}
 			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status})${note}: ${result.message.slice(0, 400)}`, hostErrorCode(result.kind));
 			return;
 		}
@@ -2003,12 +2047,16 @@ function cooldownOf(input) {
 *
 * Built on `classifyUpstreamError` rather than re-testing status codes, so a
 * probe and a real chat request can never disagree about what the same upstream
-* answer means. The extra split here is `credential-rejected`, which the
+* answer means. The extra splits here are `credential-rejected`, which the
 * upstream signals with a non-JSON 401/403 edge page and which needs completely
-* different advice (re-auth, not "wait").
+* different advice (re-auth, not "wait"), and `policy-rejected`, a JSON 403
+* content-policy refusal where re-auth advice would be actively misleading.
 */
 function outcomeOfFailure(status, body) {
-	if (status === 401 || status === 403) return "credential-rejected";
+	if (status === 401 || status === 403) {
+		if (classifyUpstreamError(status, body) === "policy_reject") return "policy-rejected";
+		return "credential-rejected";
+	}
 	switch (classifyUpstreamError(status, body)) {
 		case "soft_rate": return "rate-limited";
 		case "hard_credit": return "out-of-credit";
@@ -2339,6 +2387,7 @@ function exclusionOf(probe, nowMs) {
 		case "failed": return retryDue(probe, nowMs) ? void 0 : "failed";
 		case "rate-limited": return retryDue(probe, nowMs) ? void 0 : "rate-limited";
 		case "out-of-credit": return retryDue(probe, nowMs) ? void 0 : "out-of-credit";
+		case "policy-rejected": return;
 		default: return "unusable";
 	}
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "3.4.1",
+  "version": "3.4.3",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",