dsh-connect-workbuddy 4.13.1 → 4.13.2

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 4.13.2 (2026-10-21)
+
+> 版本号是 **patch**：没有接口、配置项或请求结构的变更。发往上游的请求体**一个字节都没变**——4.13.0 的「渠道指纹归一化」照旧在跑，本版只改**网关已经拒绝之后**的那一段：把 11128 从「通用参数拒绝」里拆出来单独归类，并把**被拒的那条 system 提示开头**回显给读者。路由 id、模型 id、凭据、计费与换号规则一律未变（换号规则只有一处「不再多问一次」的减少，见下）。
+
+### Fixes
+
+- **issue #87 / #88 / #89 / #90 的后半段：11128 仍被归进「通用参数拒绝」，读者拿到的还是那句「请按上面的提示调整后重试」，而「上面的提示」是网关的误导文案**
+  - **报告**：4.13.0 把「为什么被拒」查清了（网关按 system 提示**开头**匹配第三方 agent 清单），并让这类请求不再发出去。但**清单是实测快照**：网关新增词条时，请求照样被拒，而插件此时给出的仍然是那句通用回复——`workbuddy 上游失败：请求被上游拒绝（http 400）（code 11128，requestId …）。这次调用没通过渠道校验，可能不是官方客户端发出的。请用官方版本重新发送。该请求被上游按参数拒绝：与网络、账号、额度都无关，换账号也不会改变结果，请按上面的提示调整后重试`。四份报告里的一共五位用户（@huaizhuanghub、@ShiningYangYXN、@yuhang0529、@haohui421 等）在这句上花了大量时间：换账号、换区域、装官方客户端、改 UA。
+  - **真实原因：`11128` 这一族里有三道门共用一个业务码，而插件只认其中一道。** 网关的 `displayTips` 对**每一道**都写成同一句「这次调用没通过渠道校验，可能不是官方客户端发出的」，所以那句话从来不是判据，只是一句放之四海皆准的托词。本版要处理的那一道是**提示开头命中**（4.13.0 已定位），而另外两道是**请求头**缺 conversation id（issue #66 已修）与**首条消息不是 system**。三道门共用 `11128`，**只有 body 能区分**。
+  - **插件此前的三个错处，逐条对应**：
+    1. **归类错了**：11128 落在 `client` 兜底类，读者拿到的是「按参数拒绝，换账号也没用」——这句本身没错，但**它没说是什么参数被拒**，于是提示词从来不在嫌疑名单上；而「不是官方客户端发出的」那句托词被原样转述，用户信了它。
+    2. **证据没有回显**：被拒的证据在**我们刚发出去的请求**里，不在上游的回复里。插件手上明明有那几行字，却只转述了上游的托词。
+    3. **探针那一侧也退化成通用失败**：探针用的是中性 system 提示（`probeRequestBody`），所以「测试能过、聊天被拒」正是这个闸的特征，而卡片当时把同一种拒绝印成「✗ 测试失败」——那一句在账号旁边，读者只会去换账号。
+  - **修法一：把「提示开头命中」这一道单独归类（`channel_reject`）**。判据是**两半都要**：body 里同时有 `"code":11128` **和** msg 的措辞（`unapproved channel` / `illegal api invocation`，大小写不敏感）。只看 code 会连另外两道门一起认领——那会让读者去改写一条根本没问题的 system 提示，比通用回复更糟；所以另外两道门（`conversation id missing`、`first message is not system prompt`）被**显式排除**。**只认 `msg`、绝不认 `displayTips`**：那句托词是全族共用的，认它等于把三道门混成一道。判据放在 `classifyUpstreamError()` 里**策略拒绝之后、429/14003 之前**，所以真正的内容拒绝（`11140`）仍走它更具体的回复。
+  - **修法二：回显被拒的那一行**。新增 `systemOpeningsOfBody()`：从**实际发出去的 body**（`prepareChatBody` 归一化之后的那一份）里取每条 system 消息的**第一行非空内容**，最多回显 3 条、每条截到 120 字符，取的是**上真实发送的字节**（所以命中已知指纹时回显的是插件加的那行占位语，不是宿主原文——这正是「证据」二字的含义）。读不出 body 时不编造，直接省略这段，但结论句仍然成立。
+  - **修法三：三条行为跟着这个归类走**，因为它们都属于「上游拒的是提示词，不是账号」这一件事：
+    - **不再换号**（`isFailoverWorthy`）：网关读的是**每条 account 都会发的那同一句提示**，换到下一个账号只会晚一轮拿到同一个 11128，而每换一次就烧一次真实额度、还往一个从没出问题的凭据上记一笔假账。
+    - **不把账号踢出池**（`exclusionOf`）：与 `policy-rejected` 同处理——测量照记（卡片要能解释发生了什么），但账号仍是候选。把它 bench 掉既浪费一个好账号，又把真正的解法（改提示词）藏起来。
+    - **探针与账号表用各自的说法**（`channel-rejected` 这个 outcome）：卡片那一行的文案是「网关拦的是提示词本身，不是这个账号——某条 system 消息的开头命中了它的第三方 agent 过滤，换账号或换区域都会得到同一个答案（测试能过、聊天被拒，正是这个原因）」，语气用 `warn` 而不是 `bad`：账号本身没问题，一行 `bad` 会把读者送回「换账号」。
+  - **回复文本长什么样**（形状与其它失败一致，报告者会原样粘进 issue，所以外框不变）：`workbuddy 上游失败：被网关的渠道校验拦截（不是账号、额度或网络问题）（http 400）（code 11128，requestId …）。命中的 system 提示开头：「You are an AI agent powered by DeepSeek Harness.」。该请求被 WorkBuddy 网关的渠道校验拦截，上游把它描述成「不是官方客户端发出的」，但那是误导性文案：网关匹配的是 system 提示的开头，与账号、积分、额度、网络都无关，换账号或换区域也不会改变结果。若这段开头来自宿主或其他插件，请修改该提示；插件已对已知的第三方 agent 指纹做归一化，新的指纹可反馈到 issue 里`
+  - **宿主那一侧也核过了（本版刻意**不**改的地方）**：这个失败写给宿主的 `code` 就是 `channel_reject`（**不翻译**），状态 400 ⇒ 宿主分类为 `INVALID_REQUEST`。这一类**不在**宿主的原地重试集合（`RATE_LIMIT` / `SERVER` / `TIMEOUT` / `TRANSPORT` / `EMPTY_RESPONSE`）里——这是对的：闸的判决对同一段提示是确定的，重试只是把同一串字节再发一遍。宿主 `failureMessage()` 只对 `QUOTA` / `ACCOUNT_QUOTA` / `AUTH` 等少数几类**丢掉插件自己的文案**，本类不在其中，所以上面那句原样到达读者。
+  - **代价与边界（如实登记）**：① 回显的是**提示开头**，不是整个提示——闸只看开头，其余内容无辜，不该被抄进 issue；② 只对**body 能区分**的那一道门生效，另外两道门（请求头缺 id、首条不是 system）维持原分类，它们各有各的修法；③ 提示开头若本身就是敏感内容，读者粘进 issue 时要注意（插件不做脱敏，**上游原文回显与 issue 传播是使用者自己的决定**）；④ 4.13.0 的「已知指纹归一化」清单仍是实测快照，本版**不扩大**它——归一化是修复，单独归类是**兜底**，两者不互相替代。
+
+### Tests
+
+- **`tests/issue90-channel-reject.spec.ts` 新增 24 条用例**（含 3 组）：把「认得这道门」与「**认错**这道门」分开钉，后者才是本版的真正难点：
+  - **认门（6 条）**：真实 CN 网关的 11128 报文逐字节捕获 → 归为 `channel_reject`（修复前是 `client`）；只认 `msg` 不认 `displayTips`（三道门共用的那句托词不足以认领任何一道）；另外两道 11128 门**保持原分类**（认错会让读者去改一条没问题的提示）；code 与措辞**两半都要**（换个业务码引同样的英文短语不是这道门）；真正的内容拒绝（`11140`）仍走它更具体的回复；请求 id 里恰好含 `11128` 不被误认。
+  - **探针与账号池（2 条）**：探针把这个拒绝报成 `channel-rejected` 而不是 `failed`（后者在卡片上是「✗ 测试失败」，是唯一会引人去换账号的标签）；`exclusionOf()` 对它返回 `undefined`——账号不被踢出池。
+  - **回显取什么（6 条）**：每条 system 消息各取第一行；**取的是归一化之后真正上线的字节**（已知指纹回显的是占位行，不是宿主原文）；病态长行截到 120 字符而不是把整个提示倒出来；最多 3 条；读不出来的 body 一律返回 `[]` 且**不抛**（丢掉测量不是可以接受的代价）；`content` 是数组而非字符串的消息被跳过。
+  - **渲染出来的回复（6 条）**：真的挂起 **shim**（真 body 准备 + 真失败渲染），只把上游应答换成固定报文：回复里有被拒的那一行、有 `code 11128`、有 `requestId`、有「换账号或换区域也不会改变结果」、有「误导性文案」，并且**没有**旧那句「换账号也不会改变结果，请按上面的提示调整后重试」；回显的是**归一化后**的内容；宿主没给 system 消息时回显插件补的那行占位语（`ensureSystemHead` 保证有头，所以这是离「没有提示可引」最近的一种）；**没有把一次换号花掉**（failover 回调被调用 0 次，且回复不声称「已尝试 N 个账号」——那是 issue #78 的老坑）；宿主面拿到的是 400 + `channel_reject`。
+  - **卡片文案（2 条）**：中英文都与「策略拒绝」「通用失败」不同（共用字符串会让「测试能过、聊天被拒」读成内容拒绝，而那有完全相反的下一步）；**所有 `row.probe*` 文案里不含 `**` 粗体标记**——探针结论是当作纯文本渲染进 `<p>` 的，带标记就会在屏幕上显示成字面的星号。
+  - **宿主那一侧（2 条，issue #84 的做法）**：用**真实 pi-ai 客户端**打**真实 shim**，再问**宿主自己的判定函数**——`isQuotaExceededError()` 必须为假（为真则宿主会用自己的「额度已用尽」顶掉插件的句子，正是 issue #84 的那个坑），且文本里必须有「命中的 system 提示开头」与「换账号或换区域也不会改变结果」，**且不能有**「请用官方版本重新发送」那句托词。
+  - **变异验证**：`git checkout src/upstream.ts src/shim.ts` 回退修复后，本文件 **17 条**失败（归类回 `client`、回显消失、换号又发生、探针退回 `failed`、宿主侧被判成额度失败）；仍然通过的 7 条正是护栏（另外两道 11128 门的原分类、`11140` 的原分类、账号不被踢出池、不浪费换号、卡片文案互不相同、文案不带 `**`）。
+
 ## 4.13.1 (2026-10-21)
 
 > 版本号是 **patch**：没有接口、配置项或请求结构的变更。发往上游的请求体**一个字节都没变**——修的是「请求根本没被发出去」这条本地失败路径：目录里没有 reasoning 元数据的模型，此前在组装请求时就被本地判定失败（`UNSUPPORTED_REASONING_EFFORT`），网络一个字节都没出。路由 id、模型 id、凭据、计费与换号规则一律未变。

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as WORKBUDDY_APP_EXECUTABLE_ENV, C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, at as findWorkbuddyAppExecutableWithSource, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, pt as hostPeersInfo, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-CwdR6teZ.js";
+import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as WORKBUDDY_APP_EXECUTABLE_ENV, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, mt as hostPeersInfo, o as workbuddyHostHeartbeatPath, ot as findWorkbuddyAppExecutableWithSource, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-BJAL9pEe.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -902,6 +902,7 @@ window.__ModuleLoader__.load({
 				case "model-busy": return retryDue(probe, nowMs, 12e4) ? void 0 : "model-busy";
 				case "out-of-credit": return retryDue(probe, nowMs) ? void 0 : "out-of-credit";
 				case "policy-rejected": return;
+				case "channel-rejected": return;
 				default: return "unusable";
 			}
 		}
@@ -1016,6 +1017,7 @@ window.__ModuleLoader__.load({
 				case "model-busy": return t("row.poolExcludedModelBusy");
 				case "out-of-credit": return t("row.poolExcludedOutOfCredit");
 				case "credential-rejected": return t("row.probeCredentialRejected");
+				case "channel-rejected": return t("row.probeChannelRejected");
 				case "not-found": return t("row.probeNotFound");
 				case "unavailable": return t("row.probeUnavailable");
 				default: return t("row.probeFailed");
@@ -1204,6 +1206,7 @@ window.__ModuleLoader__.load({
 			"out-of-credit",
 			"credential-rejected",
 			"policy-rejected",
+			"channel-rejected",
 			"unavailable",
 			"not-found",
 			"failed"
@@ -4823,6 +4826,10 @@ window.__ModuleLoader__.load({
 					text: t("row.probePolicyRejected"),
 					tone: "bad"
 				};
+				case "channel-rejected": return {
+					text: t("row.probeChannelRejected"),
+					tone: "warn"
+				};
 				case "not-found": return {
 					text: t("row.probeNotFound"),
 					tone: "bad"
@@ -7211,6 +7218,7 @@ window.__ModuleLoader__.load({
 			"row.probeOutOfCreditAt": "✗ Not enough credits · quota refreshes {at}",
 			"row.probeCredentialRejected": "✗ WorkBuddy refused this account's token — sign in again or pick another account",
 			"row.probePolicyRejected": "✗ WorkBuddy's server refused this request under its content policy — re-signing in won't help; try the desktop app or another region/account",
+			"row.probeChannelRejected": "✗ The gateway refused the PROMPT itself, not this account — the opening of a system message matched its third-party-agent filter, so another account or region answers the same way",
 			"row.probeNotFound": "✗ The upstream does not know this model",
 			"row.probeUnavailable": "✗ The upstream could not be reached — no usable answer came back",
 			"row.probeFailed": "✗ Test failed",
@@ -7536,6 +7544,7 @@ window.__ModuleLoader__.load({
 			"row.probeOutOfCreditAt": "✗ 积分不足 · 积分包 {at} 刷新",
 			"row.probeCredentialRejected": "✗ WorkBuddy 拒绝了这个账号的 token——请重新登录或换一个账号",
 			"row.probePolicyRejected": "✗ WorkBuddy 服务端按内容策略拒绝了这次请求——重新登录无效；可在桌面端验证或切换区域/账号",
+			"row.probeChannelRejected": "✗ 网关拦的是提示词本身，不是这个账号——某条 system 消息的开头命中了它的第三方 agent 过滤，换账号或换区域都会得到同一个答案（测试能过、聊天被拒，正是这个原因）",
 			"row.probeNotFound": "✗ 上游不认识这个模型",
 			"row.probeUnavailable": "✗ 连不上上游——上游没有给出可用答复",
 			"row.probeFailed": "✗ 测试失败",

package/lib/{host-heartbeat-CwdR6teZ.js → host-heartbeat-BJAL9pEe.js}

@@ -1281,6 +1281,44 @@ const POLICY_REJECT_MARKERS = ["request illegal", "\"code\":11140"];
 */
 const MODEL_BUSY_CODE = "\"code\":14003";
 /**
+* Business code of the gateway's CHANNEL gate (`11128`, "Illegal API invocation
+* from an unapproved channel").
+*
+* The quoted-key form for the same reason as the markers above: a request id is
+* hexadecimal and can contain the digits `11128` by coincidence.
+*
+* A DIFFERENT gate from the one {@link conversationHeaders} works around, which
+* also answers `11128` (`conversation id missing`). The code is the same
+* because the gateway reuses it for every rule in that family; the BODY is what
+* tells them apart, so {@link isChannelRejectBody} requires both halves.
+*/
+const CHANNEL_REJECT_CODE = "\"code\":11128";
+/**
+* Wording that identifies the CHANNEL half of `11128` (the other halves being
+* `conversation id missing` and `first message is not system prompt`).
+*
+* Matched against the upstream's `msg`, NEVER against `displayTips`. That is not
+* a style choice: the tips are the SAME misleading sentence for every member of
+* the `11128` family — "这次调用没通过渠道校验，可能不是官方客户端发出的" — which is
+* why matching them would claim the conversation-id gate too and blame the
+* prompt's opening for a header problem this plugin already fixes.
+*
+* Lower-cased before the search. Two spellings are listed because the observed
+* bodies name the code and the phrase together
+* (`{"code":11128,"msg":"Illegal API invocation from an unapproved channel"}`),
+* and either half is enough to identify it.
+*/
+const CHANNEL_REJECT_MARKERS = ["unapproved channel", "illegal api invocation"];
+/**
+* The other gates that answer the SAME business code.
+*
+* Excluded explicitly so a body that also carries the channel wording can never
+* be read as the prompt rule: a confidently wrong diagnosis is worse here than
+* the generic `client` reply, because it sends the user to rewrite a system
+* prompt that is not at fault.
+*/
+const OTHER_CHANNEL_CODE_GATES = ["conversation id missing", "first message is not system prompt"];
+/**
 * Whether a failure body is the MODEL-scoped throttle rather than an account
 * limit.
 *
@@ -1300,6 +1338,72 @@ const MODEL_BUSY_CODE = "\"code\":14003";
 function isModelBusyBody(body) {
 	return body.includes(MODEL_BUSY_CODE);
 }
+/**
+* Whether a failure body is the gateway's CHANNEL gate rather than the other
+* `11128` ({@link conversationHeaders}' `conversation id missing`).
+*
+* Both halves are required. The code alone would claim the conversation-id gate
+* too, and its reply would then blame the prompt's opening for a request-header
+* problem the plugin already fixed — a confidently wrong diagnosis is worse
+* here than the generic `client` reply, because it sends the user to rewrite a
+* system prompt that is not at fault.
+*/
+function isChannelRejectBody(body) {
+	if (!body.includes(CHANNEL_REJECT_CODE)) return false;
+	const lower = body.toLowerCase();
+	if (OTHER_CHANNEL_CODE_GATES.some((marker) => lower.includes(marker))) return false;
+	return CHANNEL_REJECT_MARKERS.some((marker) => lower.includes(marker));
+}
+/**
+* The OPENINGS of the `system` messages in a prepared request body.
+*
+* This is the evidence the channel gate actually reacts to, and echoing it is
+* what turns "the upstream refused" into "the upstream refused because of this
+* line" — the reader can then fix the prompt or report the new opening, instead
+* of cycling accounts that cannot change a byte of it.
+*
+* Each entry is the first non-empty line, clipped: a fingerprint lives at the
+* START of the content, so the rest of a 10 KB system prompt is noise that
+* would bury the one sentence worth reading. At most three entries are kept —
+* the gate scans every `system` message, but a body with more than three of them
+* is already worth showing compactly.
+*
+* Never throws: a malformed body is the upstream's to reject, and losing the
+* failure measurement is not an acceptable price for reading an excerpt.
+*/
+function systemOpeningsOfBody(bodyJson) {
+	let parsed;
+	try {
+		parsed = JSON.parse(bodyJson);
+	} catch {
+		return [];
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return [];
+	const messages = parsed["messages"];
+	if (!Array.isArray(messages)) return [];
+	const openings = [];
+	for (const value of messages) {
+		if (openings.length >= 3) break;
+		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+		const message = value;
+		const role = message["role"];
+		if (typeof role !== "string" || role.trim().toLowerCase() !== "system") continue;
+		const content = message["content"];
+		if (typeof content !== "string") continue;
+		const opening = firstLineOf(content).replace(/\s+/gu, " ").trim();
+		if (opening !== "") openings.push(clip(opening, SYSTEM_OPENING_LIMIT));
+	}
+	return openings;
+}
+/** Longest system-prompt opening echoed back to the user, in characters. */
+const SYSTEM_OPENING_LIMIT = 120;
+function firstLineOf(content) {
+	const newline = content.indexOf("\n");
+	return newline === -1 ? content : content.slice(0, newline);
+}
+function clip(text, limit) {
+	return text.length <= limit ? text : `${text.slice(0, limit - 1)}…`;
+}
 /** Classify an upstream failure from its HTTP status and body excerpt. */
 function classifyUpstreamError(status, body) {
 	if (status === 402) return "hard_credit";
@@ -1308,6 +1412,7 @@ function classifyUpstreamError(status, body) {
 	if (body.includes(CREDITS_EXHAUSTED_CODE)) return "hard_credit";
 	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
 	for (const marker of POLICY_REJECT_MARKERS) if (body.includes(marker)) return "policy_reject";
+	if (isChannelRejectBody(body)) return "channel_reject";
 	if (isModelBusyBody(body)) return "model_busy";
 	if (status === 429) return "soft_rate";
 	if (status === 404) return "not_found";
@@ -4410,7 +4515,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.13.1";
+const WORKBUDDY_CONNECT_VERSION = "4.13.2";
 //#endregion
 //#region src/host-heartbeat.ts
 /**
@@ -4568,4 +4673,4 @@ async function clearHostHeartbeat() {
 	await rm(workbuddyHostHeartbeatPath(), { force: true });
 }
 //#endregion
-export { WORKBUDDY_APP_EXECUTABLE_ENV as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, lastRefusalFor as J, REFUSES_OFF_MODEL_IDS as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, withEffectiveOff as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offRefused as X, offDefaultFor as Y, recordRefusal as Z, WORKBUDDY_AUTH_FILENAME as _, readHostHeartbeat as a, findWorkbuddyAppExecutableWithSource as at, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, macosBundleExecutable as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, readAtRestKey as dt, clearAtRestKeyCache as et, WorkBuddyCatalog as f, workbuddyAppExecutableCandidates as ft, ENCRYPTED_CREDENTIAL_CODE as g, writeFileAtomic as gt, fallbackModelsFor as h, withFileLock as ht, processStartTimeMs as i, findWorkbuddyAppExecutable as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, macosNestedAppBundles as lt, deriveCatalog as m, resolveDshHome as mt, clearHostHeartbeat as n, deriveAtRestKeyId as nt, workbuddyHostHeartbeatPath as o, isEncryptedFieldWrapper as ot, applyContextBudgets as p, hostPeersInfo as pt, defaultOffModelIds as q, isHeartbeatProcessAlive as r, fetchAtRestKeyPayload as rt, writeHostHeartbeat as s, isWorkbuddyBundle as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, deriveAtRestKey as tt, FALLBACK_WORKBUDDY_MODELS as u, openEncryptedField as ut, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };
+export { withEffectiveOff as $, workbuddyAccountId as A, modelIdOfBody as B, defaultDesktopAuthDirs as C, isVaultAccountId as D, isEncryptedCredentialError as E, WorkBuddyUpstreamClient as F, regionOf as G, parseReasoning as H, classifyUpstreamError as I, defaultOffModelIds as J, systemOpeningsOfBody as K, declaredTools as L, CREDENTIAL_REJECTED_CODE as M, WORKBUDDY_FALLBACK_SYSTEM_PROMPT as N, legacyWorkbuddyOwnAuthPath as O, WorkBuddyCredentialRejectedError as P, recordRefusal as Q, isCredentialRejectedError as R, defaultDesktopAuthCandidates as S, hasEncryptedCredentialFields as T, parseUpstreamModel as U, parseCreditMultiplier as V, prepareChatBody as W, offDefaultFor as X, lastRefusalFor as Y, offRefused as Z, WORKBUDDY_AUTH_FILENAME as _, writeFileAtomic as _t, readHostHeartbeat as a, findWorkbuddyAppExecutable as at, WorkBuddyEncryptedCredentialError as b, WORKBUDDY_CONNECT_VERSION as c, isWorkbuddyBundle as ct, FALLBACK_WORKBUDDY_MODELS_GLOBAL as d, openEncryptedField as dt, WORKBUDDY_APP_EXECUTABLE_ENV as et, WorkBuddyCatalog as f, readAtRestKey as ft, ENCRYPTED_CREDENTIAL_CODE as g, withFileLock as gt, fallbackModelsFor as h, resolveDshHome as ht, processStartTimeMs as i, fetchAtRestKeyPayload as it, workbuddyOwnAuthPath as j, parseWorkBuddyAuth as k, piAiRuntimeInfo as l, macosBundleExecutable as lt, deriveCatalog as m, hostPeersInfo as mt, clearHostHeartbeat as n, deriveAtRestKey as nt, workbuddyHostHeartbeatPath as o, findWorkbuddyAppExecutableWithSource as ot, applyContextBudgets as p, workbuddyAppExecutableCandidates as pt, REFUSES_OFF_MODEL_IDS as q, isHeartbeatProcessAlive as r, deriveAtRestKeyId as rt, writeHostHeartbeat as s, isEncryptedFieldWrapper as st, WORKBUDDY_HOST_HEARTBEAT_FILENAME as t, clearAtRestKeyCache as tt, FALLBACK_WORKBUDDY_MODELS as u, macosNestedAppBundles as ut, WORKBUDDY_AUTH_FILE_ENV as v, defaultDesktopAuthPath as w, authFileName as x, WorkBuddyCredentialStore as y, knownRegionOf as z };

package/lib/index.d.ts

@@ -609,7 +609,27 @@ type UpstreamErrorKind = 'hard_credit' |
  * retrying, or switch to a less busy model." Both halves are rendered to the
  * user; the second one is the actual remedy.
  */
-'model_busy' | 'session_dead' | 'policy_reject' | 'not_found' | 'server' | 'client';
+'model_busy' | 'session_dead' | 'policy_reject' |
+/**
+ * The gateway's channel gate refused the request itself (business code
+ * 11128, "Illegal API invocation from an unapproved channel").
+ *
+ * Deliberately its own kind, because its `displayTips` — "this call failed
+ * channel verification, possibly because it was not sent from an official
+ * client" — names the account or the client version, and NEITHER is the
+ * cause. The gate matches the OPENING of a `system` message against a list of
+ * known third-party-agent prompts, so the same credential answers 200 to a
+ * probe and 400 to a real chat request one second later (issues #87 / #88 /
+ * #89 / #90). Filing it as `client` was technically true and practically
+ * useless: the generic "refused on its parameters" sentence left the reader
+ * to try another account, which cannot change a byte of the prompt.
+ *
+ * NOT failover-worthy for the same reason: every account sends the same
+ * system prompt, so a second account answers the same 11128 one round trip
+ * later and each attempt teaches the pool a false fact about a credential
+ * that was never the problem.
+ */
+'channel_reject' | 'not_found' | 'server' | 'client';
 /** Reasoning capability as the upstream catalog declares it. */
 interface WorkBuddyReasoning {
   supportedEfforts?: readonly string[];
@@ -2034,8 +2054,16 @@ declare function probeRequestBody(modelId: string, inputTokens?: number): string
  * loaded, everywhere, for everyone; a 6004 says THIS ACCOUNT exceeded a volume
  * limit. Reporting both as `rate-limited` made the pool bench every account for
  * the cooldown of one, which is the outage issue #56 describes.
+ *
+ * `channel-rejected` is a third split, and it is the one that answers the
+ * question the probe itself raises: the probe's own system prompt is a neutral
+ * one-liner, so it can return `ok` on a model whose real chat requests are all
+ * refused with `11128`. Filing that as `failed` (the generic bucket) made the
+ * pair "test passes, chat fails, every account" look like a flaky upstream
+ * instead of what it is — the gateway objecting to the PROMPT, not the account
+ * (issues #87–#90).
  */
-type WorkBuddyProbeOutcome = 'ok' | 'rate-limited' | 'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
+type WorkBuddyProbeOutcome = 'ok' | 'rate-limited' | 'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'channel-rejected' | 'unavailable' | 'not-found' | 'failed';
 /**
  * One probe result, as the card renders it.
  *
@@ -2122,9 +2150,10 @@ declare function cooldownOf(input: {
  * answer means. The extra splits here are `credential-rejected`, which the
  * upstream signals with a non-JSON 401/403 edge page and which needs completely
  * different advice (re-auth, not "wait"), `policy-rejected`, a JSON 403
- * content-policy refusal where re-auth advice would be actively misleading, and
+ * content-policy refusal where re-auth advice would be actively misleading,
  * `model-busy`, the model-scoped 14003 throttle that must NOT be benched as an
- * account failure (issue #56).
+ * account failure (issue #56), and `channel-rejected`, the gateway's 11128 gate
+ * on the PROMPT's opening, which no account can change.
  */
 declare function outcomeOfFailure(status: number, body: string): WorkBuddyProbeOutcome;
 /**
@@ -2822,7 +2851,17 @@ type WorkBuddyWebProbeOutcome = 'ok' | 'rate-limited' |
  * to learn what the first one already said. The remedy is the upstream's own:
  * wait about a minute, or switch to a less busy model.
  */
-'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
+'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' |
+/**
+ * The gateway's channel gate refused the request itself (upstream code 11128).
+ *
+ * Kept apart from `failed` because its whole point is the question it answers:
+ * the probe passes and the chat fails on the SAME model and the SAME account,
+ * because the gate matches the OPENING of a `system` message and the probe's
+ * is a neutral one-liner. A generic failure would leave the user swapping
+ * accounts that cannot change a byte of their prompt (issues #87–#90).
+ */
+'channel-rejected' | 'unavailable' | 'not-found' | 'failed';
 /** One model's probe result, as the card renders it. */
 interface WorkBuddyWebProbeResult {
   modelId: string;

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as WORKBUDDY_APP_EXECUTABLE_ENV, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as lastRefusalFor, K as REFUSES_OFF_MODEL_IDS, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as withEffectiveOff, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as offRefused, Y as offDefaultFor, Z as recordRefusal, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as macosBundleExecutable, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as readAtRestKey, et as clearAtRestKeyCache, f as WorkBuddyCatalog, ft as workbuddyAppExecutableCandidates, g as ENCRYPTED_CREDENTIAL_CODE, gt as writeFileAtomic, h as fallbackModelsFor, ht as withFileLock, i as processStartTimeMs, it as findWorkbuddyAppExecutable, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as macosNestedAppBundles, m as deriveCatalog, mt as resolveDshHome, n as clearHostHeartbeat, nt as deriveAtRestKeyId, o as workbuddyHostHeartbeatPath, ot as isEncryptedFieldWrapper, p as applyContextBudgets, q as defaultOffModelIds, r as isHeartbeatProcessAlive, rt as fetchAtRestKeyPayload, s as writeHostHeartbeat, st as isWorkbuddyBundle, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as deriveAtRestKey, u as FALLBACK_WORKBUDDY_MODELS, ut as openEncryptedField, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-CwdR6teZ.js";
+import { $ as withEffectiveOff, A as workbuddyAccountId, B as modelIdOfBody, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as regionOf, H as parseReasoning, I as classifyUpstreamError, J as defaultOffModelIds, K as systemOpeningsOfBody, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as recordRefusal, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as parseUpstreamModel, V as parseCreditMultiplier, W as prepareChatBody, X as offDefaultFor, Y as lastRefusalFor, Z as offRefused, _ as WORKBUDDY_AUTH_FILENAME, _t as writeFileAtomic, a as readHostHeartbeat, at as findWorkbuddyAppExecutable, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as isWorkbuddyBundle, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, dt as openEncryptedField, et as WORKBUDDY_APP_EXECUTABLE_ENV, f as WorkBuddyCatalog, ft as readAtRestKey, g as ENCRYPTED_CREDENTIAL_CODE, gt as withFileLock, h as fallbackModelsFor, ht as resolveDshHome, i as processStartTimeMs, it as fetchAtRestKeyPayload, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, lt as macosBundleExecutable, m as deriveCatalog, n as clearHostHeartbeat, nt as deriveAtRestKey, o as workbuddyHostHeartbeatPath, p as applyContextBudgets, pt as workbuddyAppExecutableCandidates, q as REFUSES_OFF_MODEL_IDS, r as isHeartbeatProcessAlive, rt as deriveAtRestKeyId, s as writeHostHeartbeat, st as isEncryptedFieldWrapper, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as clearAtRestKeyCache, u as FALLBACK_WORKBUDDY_MODELS, ut as macosNestedAppBundles, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-BJAL9pEe.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -2276,6 +2276,7 @@ const KIND_STATUS = {
 	model_busy: 429,
 	session_dead: 401,
 	policy_reject: 403,
+	channel_reject: 400,
 	not_found: 502,
 	server: 502,
 	client: 400
@@ -2344,6 +2345,13 @@ const KIND_STATUS = {
 * reset is hours away, so the retry budget cannot produce an answer and must
 * not be spent. One word, two opposite temporal claims — so the spelling
 * follows the clock, not the status code both share.
+*
+* `channel_reject` is not listed, and the reason is the same rule applied to a
+* third clock: the gate's verdict is DETERMINISTIC for a given prompt, so an
+* in-place retry would spend the budget re-sending bytes it already refused, and
+* cross-provider failover cannot help either (every account sends that same
+* prompt). Its 400 already places it outside the host's retry set, so `type`
+* alone, untranslated, is the honest spelling.
 */
 const KIND_HOST_CODE = { soft_rate: "quota_exceeded" };
 /**
@@ -2916,6 +2924,7 @@ function failoverReasonText(failure) {
 		case "model_busy": return "该模型当前繁忙（不是账号问题）";
 		case "session_dead": return "登录已失效";
 		case "policy_reject": return "被服务端策略拒绝";
+		case "channel_reject": return "被网关的渠道校验拦截（不是账号、额度或网络问题）";
 		case "not_found": return "模型不可用";
 		case "server": return "上游异常";
 		case "client": return "请求被上游拒绝";
@@ -3247,7 +3256,7 @@ function createWorkBuddyShim(options) {
 	* which another account may well survive.
 	*/
 	function isFailoverWorthy(kind) {
-		return kind !== "client" && kind !== "model_busy";
+		return kind !== "client" && kind !== "model_busy" && kind !== "channel_reject";
 	}
 	async function chatCompletions(req, res) {
 		if (!isJsonContentType(req)) {
@@ -3375,6 +3384,18 @@ function createWorkBuddyShim(options) {
 				writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, message, hostErrorCode(result.kind));
 				return;
 			}
+			if (result.kind === "channel_reject") {
+				const detail = result.detail;
+				const meta = [];
+				if (detail?.upstreamCode !== void 0) meta.push(`code ${detail.upstreamCode}`);
+				if (detail?.requestId !== void 0) meta.push(`requestId ${detail.requestId}`);
+				const stamp = meta.length === 0 ? "" : `（${meta.join("，")}）`;
+				const openings = systemOpeningsOfBody(prepared);
+				const evidence = openings.length === 0 ? "" : `命中的 system 提示开头：${openings.map((opening) => `「${opening}」`).join("、")}。`;
+				const message = `workbuddy 上游失败：${failoverReasonText(result)}（http ${result.status}）${note}${stamp}。${evidence}该请求被 WorkBuddy 网关的渠道校验拦截，上游把它描述成「不是官方客户端发出的」，但那是误导性文案：网关匹配的是 system 提示的开头，与账号、积分、额度、网络都无关，换账号或换区域也不会改变结果。若这段开头来自宿主或其他插件，请修改该提示；插件已对已知的第三方 agent 指纹做归一化，新的指纹可反馈到 issue 里`;
+				writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, message, hostErrorCode(result.kind));
+				return;
+			}
 			const detail = result.detail;
 			const meta = [];
 			if (detail?.upstreamCode !== void 0) meta.push(`code ${detail.upstreamCode}`);
@@ -3734,9 +3755,10 @@ function cooldownOf(input) {
 * answer means. The extra splits here are `credential-rejected`, which the
 * upstream signals with a non-JSON 401/403 edge page and which needs completely
 * different advice (re-auth, not "wait"), `policy-rejected`, a JSON 403
-* content-policy refusal where re-auth advice would be actively misleading, and
+* content-policy refusal where re-auth advice would be actively misleading,
 * `model-busy`, the model-scoped 14003 throttle that must NOT be benched as an
-* account failure (issue #56).
+* account failure (issue #56), and `channel-rejected`, the gateway's 11128 gate
+* on the PROMPT's opening, which no account can change.
 */
 function outcomeOfFailure(status, body) {
 	if (status === 401 || status === 403) {
@@ -3748,6 +3770,7 @@ function outcomeOfFailure(status, body) {
 		case "model_busy": return "model-busy";
 		case "hard_credit": return "out-of-credit";
 		case "session_dead": return "credential-rejected";
+		case "channel_reject": return "channel-rejected";
 		case "not_found": return "not-found";
 		default: return status === 0 || status >= 500 ? "unavailable" : "failed";
 	}
@@ -4096,6 +4119,7 @@ function exclusionOf(probe, nowMs) {
 		case "model-busy": return retryDue(probe, nowMs, 12e4) ? void 0 : "model-busy";
 		case "out-of-credit": return retryDue(probe, nowMs) ? void 0 : "out-of-credit";
 		case "policy-rejected": return;
+		case "channel-rejected": return;
 		default: return "unusable";
 	}
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型（国内版与国际版）接入 DeepSeek Harness：每次刷新按上游目录自动读取每个模型的积分倍率，支持逐模型图片输入开关、多账号切换与账号池自动换号，并提供每日签到、卡片与输入框里的胶囊积分读数等只读积分概览。",
-  "version": "4.13.1",
+  "version": "4.13.2",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",