dsh-connect-workbuddy 4.4.2 → 4.4.3

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 4.4.3 (2026-10-13)
+
+### Fixes
+
+- **插件页里 `dsh-connect-workbuddy` 的设置项整片空白，且不报任何错。**（issue #55）
+  - **现象**：侧边栏「插件」→「已安装」→ 点进 `dsh-connect-workbuddy`，详情页里本该出现的 WorkBuddy 卡片（国内版 / 国际版两个标签页、扫码登录、账号检测、积分、模型勾选）**整个不见**，没有占位、没有报错、控制台也干净。报告者按另一份 AI 建议在 `node_modules` 里打补丁续了一版，但那是打在产品产物上、升级即失效。
+  - **根因是两处叠加，各自都足以让卡片消失**：
+    - **① 注册用的 key 与页面查找用的 name 不是同一个东西。** `plugins.bundle.config` / `plugins.row.config` 是 **keyed** 槽位（`kind: 'keyed'`，每个 `key` 每个优先级只能有一条）。插件页渲染它们时用的是 `renderSlot('plugins.bundle.config', { view: 'page' }, { entryKey: pkg.name })`，而 `pkg.name` 来自插件管理器清单里的**包名**；渲染前还要先过一道 `ledger.bundles.has(pkg.name)` —— 而这个 Set 装的正是各注册条目的 `key`。**两侧都是精确相等比较，比的都是包名，没有一处回落到 Loader 条目 id**。所以清单里叫 `dsh-connect-workbuddy`、而卡片只注册在 `include:dsh-connect-workbuddy` 下时，查找必然落空：整段不渲染，`apply()` 平静结束。
+    - **② 注册这件事被挂在了「namespace 到达」的边沿上。** 卡片原本只在 `configForms.whileServed()` 的 `register` 回调里注册，而这个回调只在 **unserved→served 的跳变**上跑一次。若 settings 镜像始终不上报本插件的 namespace（名字不在候选表里、settings 面答得晚或答失败、该部署本就没把插件挂成可配置条目），这个跳变永远不会发生，`registerAllSlots()` 一次都不执行。因为整个 `apply` 体包在只打日志的 try/catch 里，**UI 就这样静默空白** —— 报告者遇到的那份补丁也正是这条。
+  - **修法**：① 卡片的 `plugins.bundle.config` / `plugins.row.config` 注册改为覆盖包名的**所有拼写**（`WORKBUDDY_CARD_KEYS`：裸包名 + `include:` 前缀形式，行 key 为 `<包名>#<包名>`）。这些 key 各占一个 cell，属于**无遮蔽的重复条目**而非冲突，所以「全注册一遍」严格优于赌一个。② 注册**不再等待边沿**：`whileServed` 保留原语义（等 namespace 真到了再重绑一次、拿到可写表单），同时无条件先注册一遍；卡片在没有 `settingsScope` 时本就以**只读**形态渲染，这与「宿主没有 settings 面」的既有降级路径是同一条。
+  - **顺带修掉一个会让上面②反而变成「整片空白 2.0」的顺序坑**：`rebindSlots()` 必须**先 dispose 再 register**。keyed 槽位会拒绝一个仍然存活的 key（`already has an entry for key …`），而每次注册都有各自的 try/catch 把它吞成一行 `console.error` —— 于是「先注册后 dispose」的结果是：旧条目刚被拆掉、新条目全被拒绝，账本归空。这一点由新增用例显式钉住，并在变异验证（把顺序改回去）下变红。
+  - **守卫**：新增 `tests/issue55-card-not-registered.spec.ts`（8 例），按**页面真正读的那个账本**断言：裸名与 `include:` 前缀两种清单名下 `ledger.bundles.has(pkg.name)` 都为真；namespace 永不到达时仍完成注册；namespace 已经到了时不产生重复注册（不触发 keyed 冲突）；无 settings 面的宿主仍注册（只读降级）；以及上面那条 dispose/register 顺序。`tests/client-fallback.spec.ts` 的手工镜像同步更新（注册数 3→5）。
+
+- **14003 是模型级、逐请求的软限流，却被当成账号级失败：换号循环把池内每个账号各锁 30 分钟。**（issue #56）
+  - **现象**：报告者的决定性对照 —— **同一凭据、同一时刻**，除 `model` 一个字段外逐字节相同的请求，`deepseek-v4.1-flash`（×0）3 发只成 1 发、`deepseek-v4.1-flash-sg`（×0.03）同样 1/3、而 `glm-5.3-flash` / `hy3` / `kimi-k2.6` 全部 **3/3**。同一秒内同账号别的模型全部正常，所以**账号没有被限流**。上游原话也把维度说明白了：`displayTips` = 「建议等待约 1 分钟后重试，**或切换到负载较低的模型**」。而插件的实际效果是：三个账号全部变 `rate-limited`，用户在此后约 30 分钟里完全无法交流 —— 把上游说的一分钟放大了 30 倍，还放大到了整个账号池。
+  - **根因**：`classifyUpstreamError()` 把 429 一律归为 `soft_rate`。14003 的报文里**没有任何日期时间**，所以 `parseUpstreamResetAt()` 返回 `undefined` → `cooldownOf()` 返回 `{}` → `retryDue()` 落到 `probe.atMs + 18e5`（`POOL_UNKNOWN_COOLDOWN_MS` = 30 分钟）。三重放大同时发生：**等太久**、**锁错对象**（锁的是账号，而限制跟着模型走）、**把每个账号都锁一遍**（failover 逐个撞同一堵墙，每撞一次就给一个本来健康的账号写入一条 `live-request` 的限流记录，覆盖掉它先前的 `ok` 测量）。
+  - **修法**（四处，各自独立可验）：
+    - **分类**：新增 `model_busy` 这一 kind（`UpstreamErrorKind` / `WorkBuddyProbeOutcome` / `WorkBuddyPoolExclusion` 三处词汇表各加一枚），判据是 **`"code":14003` 这一带引号的 key 形式** —— 不用 `displayTips` 文案当判据，否则一个恰好提到「负载较低的模型」的网关横幅也会被改判。检查放在**积分标记之后**（两者同时出现时仍按「要充值」这条可执行的结论走）、**普通 429 分支之前**。
+    - **时长**：`MODEL_BUSY_COOLDOWN_MS = 2 分钟`，与上游「约 1 分钟」同量级（取 2 而非 1，是为了越过这一阵而不是踩在边上）。`cooldownOf()` 为 `model-busy` 补上这个兜底，并把 `retrySource` 标成新的 `'upstream-tips'` —— 它如实说明这个数字的来路是**上游给的数量级**，不是上游给的时刻。
+    - **不换号**：`isFailoverWorthy()` 把 `model_busy` 与 `client` 一起排除。换号撞的是同一堵墙，只会每个账号各花一次请求去学到第一发已经说过的事实，并往每个账号写一条假测量。失败**仍然如实上报一次**（卡片要靠它显示「为什么这个账号不在池里」）。
+    - **如实告知**：shim 给 `model_busy` 单独一条错误文案 —— 沿用上游自己的话（「请求过于频繁，请稍后重试。」）+ `requestId`，并明确写出**这不是账号被限流、换账号没用、建议等待约 1 分钟或切换模型**。卡片侧新增 `row.probeModelBusy*` / `row.poolExcludedModelBusy` 文案，池表里「模型繁忙」与「被限流」**分开显示**（把模型的问题写在账号名旁边，正是让报告者去找一个并不存在的坏账号的原因）。
+  - **顺带对齐两处**：`probe-reason.ts` 把 `model-busy` 列入「标签已说清、不再内联原始报文」的集合（该报文只是 14003 信封，会把补救办法挤掉）；`AccountPool` 的状态色把 `model-busy` 归入琥珀（会自行恢复、账号没坏）而非红色。
+  - **守卫**：新增 `tests/issue56-model-scoped-throttle.spec.ts`（14 例），用报告者的原文报文当 fixture：分类正确（14003→`model-busy`，6004→`soft_rate` 不变）、不误伤（只有文案没有 code、或 requestId 恰好含 `14003`，都仍是普通限流）、与积分同时出现时仍判积分、冷却时长为分钟级且带 `'upstream-tips'` 来源、有真实时刻时以时刻为准、模型级账号在一分钟后回到池内而普通限流仍在池外。`tests/shim-failover.spec.ts` 新增 3 例：`model_busy` **不走**换号（池里明明有候选也不问）、失败仍上报且只报一次、用户看到的是「模型繁忙」而不是「账号被限流」。
+  - **刻意保留的重复**：`MODEL_BUSY_COOLDOWN_MS` 在 `src/probe.ts` 与 `src/account-pool.ts` 各声明一次。两者不能互相 import（一个是 Host 侧探测、一个是纯排序规则，后者刻意不依赖前者），所以由一条测试断言两个声明**必须相等** —— 探测写一种冷却、排序读另一种，就会悄悄把这个缺陷重新打开。
+
+- **`14018`「积分耗尽」被判成普通限流：marker 表漏了复数形式，用户拿到的建议从「去充值」变成「等一等」。**（issue #56 的追加报告）
+  - **来源**：这条是报告者在回答「`14018` 是否与 `14003` 同族」时**顺手挖出来的**，不在原 issue 范围内。
+  - **现象**：上游对「这个账号在这些模型上没积分了」返回 `429` / `code 14018`，报文逐字为
+    `{"error":{"data":{"code":14018,"msg":"Credits exhausted. Please visit the link below to purchase add-on packs and get more credits: …"}}}`。
+  - **根因**：`HARD_CREDIT_MARKERS` 里写的是 **`'credit exhausted'`（单数）**，而上游发的是 **`"Credits exhausted."`（复数 + 大写 C）**。`'credits exhausted.'.includes('credit exhausted')` 是 **false** —— `s` 正好夹在两个词中间。**八条英文 marker 逐条试过，全部未命中**；中文 marker 也不在报文里，救不了。于是它落到通用 429 分支：`classifyUpstreamError → soft_rate`、`outcomeOfFailure → rate-limited`、`cooldownOf → {}`。
+  - **后果**：一条本该读成「**去充值**」的失败被降级成「**等一等**」，用户看到「稍后重试」而正确答案是「这个号的积分用完了」。这与 issue #56 那个「把一分钟放大成半小时」是**同一类放大，只是入口不同**。
+  - **报告者同时做了两条反证，都很关键**：① 特意在**网络层**确认真实 HTTP 状态是 **429 而不是 402** —— 因为 `classifyUpstreamError()` 第一行就是 `if (status === 402) return 'hard_credit'`，若上游真发 402 则这条 bug 根本不成立；② 用 **3 账号 × 4 模型** 的矩阵证明 `14018` 是**账号级**而非模型级（账号 B 余额 100 上 `hy4-preview` 0/2，而余额 379/350 的 A/C 服务同一模型 2/2；同号上免费模型 `hy3`/`deepseek-v4.1-flash` 均 2/2 而计费模型全挂）⇒ **`14018` 保持账号级路径，不与 `14003` 合并**。
+  - **修法**（两条都采用，因为它们防的是不同失效）：
+    1. 补 **`'credits exhausted'`** 复数形式，并**保留单数**（网关改过措辞，只认今天这一种的表就是同一个坑的下一轮）；
+    2. 新增按 **`"code":14018`** 的带引号 key 判定（`CREDITS_EXHAUSTED_CODE`），与既有的 `MODEL_BUSY_CODE` 同构 —— 措辞**完全改掉**的报文也能正确归类，且不受大小写与单复数影响。
+  - **顺序**：code 判定放在中文/英文 marker **之后**、`model_busy` **之前**，因此一条同时携带 `14018` 与 `14003` 的报文读作「去充值」（那是可执行的结论）。
+  - **未改动**：`exclusionOf` 对 `out-of-credit` 在**无时刻**时仍走 `POOL_UNKNOWN_COOLDOWN_MS` 通用兜底。这是**既有行为**，本版未动 —— 积分耗尽只能靠充值或周期刷新解除，与 `14003` 的秒级恢复性质不同。已在 issue 里如实说明并请报告者判断是否另案处理。
+  - **守卫**：新增 `tests/issue56-credits-exhausted-code.spec.ts`（9 例），**用报告者贴的报文原文当 fixture**（含尾随空格与 `{"error":{"data":…}}` 嵌套 —— 它和 `14003` 的扁平信封不同，本身就是「按散文做表很脆」的又一证据）。既钉住 `14018 → hard_credit → out-of-credit`，也钉住「两者必须分开」与「配额刷新点仍被采用」。变异验证：同时还原复数 marker 与 code 判定，**9 例中 5 例变红**，恢复后全绿。
+
+- **客户端注册后打印一行摘要，把「静默空白」变成一眼可诊断。**（issue #55 报告者的建议）
+  - **动机来自报告者的原话**：整片 UI 消失与一切正常在页面上**完全无法区分**，因为他（和后来的我们）定位耗时几乎全花在那个只打日志的静默 `try/catch` 上。
+  - 现在每个 rebind 结束都会打一行**成功路径**的 `console.info`：
+    `[dsh-connect-workbuddy] registered 5 slots (settings form: bound)` 或
+    `[dsh-connect-workbuddy] registered 5 slots (settings form: none — card is read-only)`。
+    后者正是「公网域名部署」那一类场景（客户端根本不发 `/api/settings/describe`，命名空间永不到达）会打出的样子：一眼看出「注册成功但表单只读」，而不是对着空白页猜。
+  - 刻意用 `console.info` 而非 `warn`/`error`：健康路径打警告会训练用户忽略真正出事的那条通道。
+  - **未采纳**「把 `apply()` 拆成多个 try/catch」：外层兜底的作用是「槽位 API 变更时降级为日志，而不是让宿主弹 `Failed to load plugins` 红条」，拆开会让部分 UI 失败时更难判断整体状态。加了摘要后日志已能定位到具体哪几个没上。
+
+- **换号提示把「积分耗尽」说成「被限流」，用户被叫去等一个不会来的恢复。**（issue #56 报告者指出）
+  - **来源**：报告者在同一份追加报告里顺带指出 `src/shim.ts` 的 `failoverReasonText()` 把 `soft_rate` 与 `hard_credit` **并列成同一句 `'rate limited'`**，并预期「§三 修好之后这个号会走 `hard_credit` ⇒ 用户能拿到『积分耗尽』而不是『被限流』」。**这个预期当时并不成立** —— 卡片/池表一侧确实会显示「积分耗尽」（`poolExcludedOutOfCredit`），但**回复里的换号提示**仍读作「rate limited」，而那正是用户在对话中最先看到的那一句。
+  - **为什么必须分开**：两者**都会出池、都会触发换号**（另一个账号可能确实有余额），但**补救办法不同类**——限流会在上游给出的时刻自行解除，积分耗尽在充值或周期刷新之前**永不会**好。共用一句话等于叫人去等一件不会发生的事，而正确动作是去充值或换号。
+  - **修法**：`hard_credit` 拆出独立的 `'out of credits'`。**未改动** `isFailoverWorthy()`：`hard_credit` 依旧可换号（换到有余额的账号是可行的自救），只是提示词如实说明原因。
+  - **守卫**：`tests/shim-failover.spec.ts` 新增 1 例，断言耗尽场景的提示含 `out of credits` 且**不含** `rate limited`，同时确认它**仍然换号**（`seen == ['selected', 'other']`）。变异验证：把两个 case 合并回 `'rate limited'`，该例立即变红，恢复后全绿。
+
+### Docs
+
+- 无。本版含上述修复与配套测试。
+
 ## 4.4.2 (2026-10-13)
 
 ### Fixes

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, Z as findWorkbuddyAppExecutableWithSource, a as readHostHeartbeat, at as hostPeersInfo, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-CBFAiYPg.js";
+import { C as defaultDesktopAuthDirs, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, O as legacyWorkbuddyOwnAuthPath, S as defaultDesktopAuthCandidates, Z as findWorkbuddyAppExecutableWithSource, a as readHostHeartbeat, at as hostPeersInfo, c as WORKBUDDY_CONNECT_VERSION, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, j as workbuddyOwnAuthPath, l as piAiRuntimeInfo, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, y as WorkBuddyCredentialStore } from "./host-heartbeat-C8imAyWG.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/client.js

@@ -326,6 +326,31 @@ window.__ModuleLoader__.load({
 			"include:dsh-connect-workbuddy",
 			WORKBUDDY_SETTINGS_NS
 		];
+		/**
+		* The `<package name>` keys under which the card registers itself in the
+		* Plugins panel.
+		*
+		* `plugins.bundle.config` and `plugins.row.config` are KEYED slots: the page
+		* renders them with `entryKey: pkg.name`, and it decides whether to render the
+		* section at all from `ledger.bundles.has(pkg.name)` — a `Set` of exactly the
+		* `key` values registered on that slot, compared against the plugin-manager
+		* inventory's own package name. Both halves of that comparison are EXACT and
+		* neither side is the settings namespace: the inventory name comes from the
+		* profile's package list, while a deployment may mount the same code under a
+		* different Loader entry id.
+		*
+		* That is the whole of issue #55. A deployment whose inventory name is
+		* `dsh-connect-workbuddy` and whose card registered only under
+		* `include:dsh-connect-workbuddy` gets NO card and NO error: the keyed lookup
+		* finds nothing, the section is simply not rendered, and `apply()` finished
+		* happily. Since the keys live in separate cells (one entry per `key` per
+		* priority), registering under every spelling at once is a shadowing-free
+		* duplicate rather than a conflict, and is strictly safer than betting on one.
+		*
+		* The bare package name is FIRST because it is the common case — a profile that
+		* installs the package by name mounts it under that name.
+		*/
+		const WORKBUDDY_CARD_KEYS = ["dsh-connect-workbuddy", "include:dsh-connect-workbuddy"];
 		//#endregion
 		//#region src/client/account-selection.ts
 		/**
@@ -656,6 +681,7 @@ window.__ModuleLoader__.load({
 		function exclusionText(t, excludedBy) {
 			switch (excludedBy) {
 				case "rate-limited": return t("row.poolExcludedRateLimited");
+				case "model-busy": return t("row.poolExcludedModelBusy");
 				case "out-of-credit": return t("row.poolExcludedOutOfCredit");
 				case "credential-rejected": return t("row.poolExcludedRejected");
 				case "not-found": return t("row.probeNotFound");
@@ -786,14 +812,25 @@ window.__ModuleLoader__.load({
 		/**
 		* Outcomes whose label + stated recovery time ARE the whole story.
 		*
-		* Both carry a reset instant, which the row prints right beside them; their
-		* bodies restate that instant and add a `code`/`requestId` pair nobody reads.
+		* `rate-limited` and `out-of-credit` both carry a reset instant, which the row
+		* prints right beside them; their bodies restate that instant and add a
+		* `code`/`requestId` pair nobody reads.
+		*
+		* `model-busy` belongs here for the opposite reason: its label states the whole
+		* finding INCLUDING the remedy ("this model is loaded right now · not your
+		* account — wait about a minute or switch models"). The recorded body is the
+		* upstream's `14003` envelope, and appending it in a 72-character cell would
+		* bury the remedy under the JSON the label was written to translate.
 		*
 		* `credential-rejected` and `not-found` are deliberately NOT here: their labels
 		* state a conclusion ("sign in again", "no such model"), and the upstream's own
 		* words are what make that conclusion checkable rather than asserted.
 		*/
-		const SELF_EXPLANATORY = /* @__PURE__ */ new Set(["rate-limited", "out-of-credit"]);
+		const SELF_EXPLANATORY = /* @__PURE__ */ new Set([
+			"rate-limited",
+			"model-busy",
+			"out-of-credit"
+		]);
 		/**
 		* Longest inline reason kept.
 		*
@@ -1159,6 +1196,7 @@ window.__ModuleLoader__.load({
 			switch (outcome) {
 				case "ok": return t("row.probeOk");
 				case "rate-limited": return t("row.poolExcludedRateLimited");
+				case "model-busy": return t("row.poolExcludedModelBusy");
 				case "out-of-credit": return t("row.poolExcludedOutOfCredit");
 				case "credential-rejected": return t("row.probeCredentialRejected");
 				case "not-found": return t("row.probeNotFound");
@@ -1201,7 +1239,7 @@ window.__ModuleLoader__.load({
 		}
 		/** A dot colour for one account's state. */
 		function stateColor(account) {
-			if (account.excludedBy !== void 0) return account.excludedBy === "rate-limited" || account.excludedBy === "unavailable" ? "var(--dsw-alias-state-warn-primary, #f59e0b)" : "var(--dsw-alias-state-error-primary, #ef4444)";
+			if (account.excludedBy !== void 0) return account.excludedBy === "rate-limited" || account.excludedBy === "model-busy" || account.excludedBy === "unavailable" ? "var(--dsw-alias-state-warn-primary, #f59e0b)" : "var(--dsw-alias-state-error-primary, #ef4444)";
 			if (account.probe === void 0) return "var(--dsw-alias-label-dimmed, #9aa0a6)";
 			return outcomeOk(account.probe.outcome) ? "var(--dsw-alias-state-success-primary, #22a06b)" : "var(--dsw-alias-state-warn-primary, #f59e0b)";
 		}
@@ -1770,7 +1808,7 @@ window.__ModuleLoader__.load({
 			const name = account.accountName === "" ? t("row.accountUnnamed") : account.accountName;
 			const excluded = exclusionText(t, account.excludedBy);
 			const probe = account.probe;
-			const outcomeLine = probe === void 0 ? t("row.poolNeverTested") : probe.retryAtMs !== void 0 ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryAt", { at: formatShort(probe.retryAtMs) })}` : probe.outcome === "rate-limited" || probe.outcome === "out-of-credit" ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryUnknown")}` : outcomeText(t, probe.outcome);
+			const outcomeLine = probe === void 0 ? t("row.poolNeverTested") : probe.retryAtMs !== void 0 ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryAt", { at: formatShort(probe.retryAtMs) })}` : probe.outcome === "rate-limited" || probe.outcome === "model-busy" || probe.outcome === "out-of-credit" ? `${outcomeText(t, probe.outcome)} · ${t("row.poolRetryUnknown")}` : outcomeText(t, probe.outcome);
 			const remaining = probe?.retryAtMs === void 0 ? "" : remainingText(t, probe.retryAtMs, Date.now());
 			const reason = probe === void 0 ? void 0 : inlineProbeReason(probe.outcome, probe.message);
 			const age = probe === void 0 ? void 0 : probeAgeText(t, probe.atMs, Date.now());
@@ -3572,6 +3610,10 @@ window.__ModuleLoader__.load({
 					text: result.retryAtMs === void 0 ? t("row.probeRateLimitedUnknown") : t("row.probeRateLimitedAt", { at: formatDate(result.retryAtMs) }) + retrySuffix(t, result.retryAtMs, nowMs),
 					tone: "warn"
 				};
+				case "model-busy": return {
+					text: result.retryAtMs === void 0 ? t("row.probeModelBusyUnknown") : t("row.probeModelBusyAt", { at: formatDate(result.retryAtMs) }) + retrySuffix(t, result.retryAtMs, nowMs),
+					tone: "warn"
+				};
 				case "out-of-credit": return {
 					text: result.retryAtMs === void 0 ? t("row.probeOutOfCreditUnknown") : t("row.probeOutOfCreditAt", { at: formatDate(result.retryAtMs) }) + retrySuffix(t, result.retryAtMs, nowMs),
 					tone: "bad"
@@ -5314,6 +5356,8 @@ window.__ModuleLoader__.load({
 			"row.probeOkMs": "✓ Usable ({ms})",
 			"row.probeRateLimitedUnknown": "✗ Rate limited · the upstream gave no time for when it frees up",
 			"row.probeRateLimitedAt": "✗ Rate limited · usable again after {at}",
+			"row.probeModelBusyUnknown": "✗ This model is loaded right now · not your account — another account will not help; wait about a minute or switch models",
+			"row.probeModelBusyAt": "✗ This model is loaded right now · not your account; retry after {at}, or switch models",
 			"row.probeOutOfCreditUnknown": "✗ Not enough credits · the upstream gave no time for when it frees up",
 			"row.probeOutOfCreditAt": "✗ Not enough credits · quota refreshes {at}",
 			"row.probeCredentialRejected": "✗ WorkBuddy refused this account's token — sign in again or pick another account",
@@ -5394,6 +5438,7 @@ window.__ModuleLoader__.load({
 			"row.poolCreditSoon": "{count} expiring within 3 days",
 			"row.poolCreditNearest": "Nearest package expires {at}",
 			"row.poolExcludedRateLimited": "Rate limited",
+			"row.poolExcludedModelBusy": "Model busy",
 			"row.poolExcludedOutOfCredit": "Out of credits",
 			"row.poolExcludedRejected": "Rejected",
 			"row.poolExcludedUnusable": "Unusable",
@@ -5574,6 +5619,8 @@ window.__ModuleLoader__.load({
 			"row.probeOkMs": "✓ 可用（{ms}）",
 			"row.probeRateLimitedUnknown": "✗ 被限流 · 上游未给出何时恢复",
 			"row.probeRateLimitedAt": "✗ 被限流 · {at} 之后可再用",
+			"row.probeModelBusyUnknown": "✗ 该模型当前负载较高 · 不是账号被限流——换账号没用，建议等待约 1 分钟或切换模型",
+			"row.probeModelBusyAt": "✗ 该模型当前负载较高 · 不是账号被限流；{at} 之后可重试，或切换模型",
 			"row.probeOutOfCreditUnknown": "✗ 积分不足 · 上游未给出何时恢复",
 			"row.probeOutOfCreditAt": "✗ 积分不足 · 积分包 {at} 刷新",
 			"row.probeCredentialRejected": "✗ WorkBuddy 拒绝了这个账号的 token——请重新登录或换一个账号",
@@ -5654,6 +5701,7 @@ window.__ModuleLoader__.load({
 			"row.poolCreditSoon": "{count} 积分 3 天内过期",
 			"row.poolCreditNearest": "最近积分包 {at} 过期",
 			"row.poolExcludedRateLimited": "被限流",
+			"row.poolExcludedModelBusy": "模型繁忙",
 			"row.poolExcludedOutOfCredit": "积分耗尽",
 			"row.poolExcludedRejected": "被拒绝",
 			"row.poolExcludedUnusable": "不可用",
@@ -5802,7 +5850,15 @@ window.__ModuleLoader__.load({
 				const softGet = (name) => ctx.get(name);
 				let settingsScope;
 				const forms = softGet("configForms");
-				/** Register one card slot; returns its disposer, or undefined if it failed. */
+				/**
+				* Register one card slot; returns its disposer, or undefined if it failed.
+				*
+				* `ctx.slots.inject(name, …)` resolves as soon as the slot is DECLARED (the
+				* Plugins page declares all three ledgers — `plugins.item`,
+				* `plugins.bundle.config`, `plugins.row.config` — as children of its own
+				* registration), and is otherwise queued until a later declaration. So a
+				* registration here is not lost just because the page has not mounted yet.
+				*/
 				const registerCard = (slotName, key) => {
 					try {
 						return ctx.slots.inject(slotName, () => ctx.slots.register({
@@ -5861,9 +5917,21 @@ window.__ModuleLoader__.load({
 				* registrations must move TOGETHER: see {@link bindSettingsScope} for why a
 				* late-arriving namespace has to produce fresh registrations rather than a
 				* mutated closure.
+				*
+				* The card registers under EVERY spelling of its package name (see
+				* {@link WORKBUDDY_CARD_KEYS}): the Plugins page looks a
+				* configuration up by exact `key` equality against the inventory's package
+				* name, and a deployment is free to name the install row whatever it likes
+				* — issue #55 is exactly that mismatch, which renders an empty page and
+				* reports nothing at all.
 				*/
+				const registerAllSlots = () => [
+					...WORKBUDDY_CARD_KEYS.map((key) => registerCard("plugins.bundle.config", key)),
+					...WORKBUDDY_CARD_KEYS.map((key) => registerCard("plugins.row.config", `${key}#${key}`)),
+					registerComposerCredits()
+				].filter((disposer) => disposer !== void 0);
 				/**
-				* Disposers of the slots registered for the CURRENT namespace binding.
+				* Disposers of the slots registered for the CURRENT binding.
 				*
 				* Declared before {@link bindSettingsScope} because that function closes
 				* over it and reassigns it; the binding is only armed at the end of `apply`,
@@ -5871,11 +5939,30 @@ window.__ModuleLoader__.load({
 				* ordering a non-requirement rather than a trap.
 				*/
 				let liveDisposers = [];
-				const registerAllSlots = () => [
-					registerCard("plugins.bundle.config", "dsh-connect-workbuddy"),
-					registerCard("plugins.row.config", "dsh-connect-workbuddy#dsh-connect-workbuddy"),
-					registerComposerCredits()
-				].filter((disposer) => disposer !== void 0);
+				/**
+				* Replace the live registrations with a fresh set.
+				*
+				* ORDER MATTERS: dispose FIRST, then register.
+				*
+				* The ledger is a KEYED slot with one entry per `key` per priority, so
+				* registering a key that is still live THROWS (`already has an entry for
+				* key …`). Every registration in this entry is isolated by its own
+				* try/catch, so the failure is not visible — the throw is logged and the
+				* key is simply left with NO entry, because the old one was just disposed
+				* by the `previous` loop. Registering before disposing therefore produces
+				* an EMPTY ledger, which is a worse version of the very defect this
+				* function exists to prevent.
+				*/
+				const rebindSlots = () => {
+					for (const dispose of liveDisposers) try {
+						dispose();
+					} catch {}
+					liveDisposers = [];
+					liveDisposers = registerAllSlots();
+					try {
+						console.info(`[dsh-connect-workbuddy] registered ${String(liveDisposers.length)} slots (settings form: ${settingsScope === void 0 ? "none — card is read-only" : "bound"})`);
+					} catch {}
+				};
 				/**
 				* Bind `settingsScope` to whichever namespace the Host really serves, and
 				* RE-REGISTER every slot when that answer changes.
@@ -5916,10 +6003,7 @@ window.__ModuleLoader__.load({
 					ctx.effect(() => forms.whileServed(WORKBUDDY_SETTINGS_NAMESPACE_CANDIDATES, (served) => {
 						const ns = WORKBUDDY_SETTINGS_NAMESPACE_CANDIDATES.find((candidate) => served.has(candidate)) ?? [...served].find((entry) => /workbuddy/i.test(entry));
 						settingsScope = ns === void 0 ? void 0 : forms.get(ns);
-						for (const dispose of liveDisposers) try {
-							dispose();
-						} catch {}
-						liveDisposers = registerAllSlots();
+						rebindSlots();
 						return () => {
 							for (const dispose of liveDisposers) try {
 								dispose();
@@ -5927,6 +6011,7 @@ window.__ModuleLoader__.load({
 							liveDisposers = [];
 						};
 					}), "dsh-connect-workbuddy: settings namespace binding");
+					rebindSlots();
 				};
 				bindSettingsScope();
 			} catch (error) {

package/lib/{host-heartbeat-CBFAiYPg.js → host-heartbeat-C8imAyWG.js}

@@ -918,17 +918,38 @@ const ERROR_BODY_LIMIT = 4096;
 * budget covers the response only, never the one-line body that follows.
 */
 const PROBE_TIMEOUT_MS = 1e4;
-/** Insufficient-credit markers, ASCII lowercase plus the original Chinese. */
+/**
+* Insufficient-credit markers.
+*
+* ENGLISH IS MATCHED CASE-INSENSITIVELY (see {@link classifyUpstreamError}) so
+* each entry is spelled once, lowercase. Chinese has no case, so those entries
+* are the upstream's own wording.
+*
+* `credits exhausted` is listed alongside `credit exhausted` because the
+* upstream ships the PLURAL — measured 2026-10-13 on a live `14018`:
+*
+*   {"error":{"data":{"code":14018,"msg":"Credits exhausted. Please visit the
+*    link below to purchase add-on packs and get more credits: …"}}}
+*
+* The singular-only entry silently missed it (`'credits exhausted.'.includes(
+* 'credit exhausted')` is FALSE — the `s` sits between the two words), so a
+* failure whose entire point is "go top up" was reported as "wait a bit" and
+* benched a healthy account for the 30-minute fallback. Both spellings are kept
+* because the gateway has been observed to change its wording; neither is
+* assumed to be the only one.
+*/
 const HARD_CREDIT_MARKERS = [
 	"insufficient credit",
 	"no credit",
 	"credit exhausted",
+	"credits exhausted",
 	"out of credit",
 	"quota exceeded",
 	"quota exhaust",
 	"payment required",
 	"credit not enough",
 	"not enough credit",
+	"credits not enough",
 	"积分不足",
 	"额度不足",
 	"余额不足",
@@ -936,6 +957,21 @@ const HARD_CREDIT_MARKERS = [
 	"额度用尽",
 	"没有积分"
 ];
+/**
+* Business code of the exhaustion refusal (`14018`).
+*
+* The CODE, not the prose — see {@link HARD_CREDIT_MARKERS} for the wording bug
+* this guards against. Marker tables rot in a way codes do not: the gateway can
+* reword its sentence without changing the contract it advertises, and the
+* failure is silent (the branch simply stops matching). A code cannot drift like
+* that, and matching it in quoted-key form keeps a request id that happens to
+* contain the digits from promoting an unrelated body.
+*
+* ONLY a corroborating signal, never a substitute: the code is checked in
+* addition to the markers, so a body that names the code AND reads as a policy
+* refusal still resolves by the marker table's order.
+*/
+const CREDITS_EXHAUSTED_CODE = "\"code\":14018";
 /** Session-invalidation markers that mean "sign in again in the WorkBuddy app". */
 const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
 /**
@@ -944,13 +980,44 @@ const SESSION_DEAD_MARKERS = ["Offline user session not found", "12153"];
 * contain `11140` by coincidence).
 */
 const POLICY_REJECT_MARKERS = ["request illegal", "\"code\":11140"];
+/**
+* Business code of the MODEL-scoped throttle (`14003`, "too many requests").
+*
+* The quoted-key form for the same reason as the policy markers: a request id is
+* hexadecimal and can contain the digits `14003` by coincidence, and a bare
+* substring search over an arbitrary failure body is how a red herring gets
+* promoted into a routing decision.
+*/
+const MODEL_BUSY_CODE = "\"code\":14003";
+/**
+* Whether a failure body is the MODEL-scoped throttle rather than an account
+* limit.
+*
+* `14003` and `6004` are different codes from the same gateway and mean
+* different things. Measured on one credential at one moment, with requests that
+* differed ONLY in `model`, three attempts each: `deepseek-v4.1-flash`
+* (multiplier x0.00) answered 1/3 and refused 2/3 with `429 / 14003`, while
+* `glm-5.3-flash`, `hy3` and `kimi-k2.6` answered 3/3 — the SAME account, the
+* SAME second. A 6004, by contrast, carries a `将在 … UTC+8 重置` sentence and
+* is per-account.
+*
+* So the criterion is the CODE alone, matched in its quoted-key form so a
+* request id that happens to contain the digits cannot promote it. Exported so
+* the probe and the chat path cannot drift into two different answers about one
+* body.
+*/
+function isModelBusyBody(body) {
+	return body.includes(MODEL_BUSY_CODE);
+}
 /** Classify an upstream failure from its HTTP status and body excerpt. */
 function classifyUpstreamError(status, body) {
 	if (status === 402) return "hard_credit";
 	const lower = body.toLowerCase();
 	for (const marker of HARD_CREDIT_MARKERS) if (lower.includes(marker.toLowerCase()) || body.includes(marker)) return "hard_credit";
+	if (body.includes(CREDITS_EXHAUSTED_CODE)) return "hard_credit";
 	for (const marker of SESSION_DEAD_MARKERS) if (body.includes(marker)) return "session_dead";
 	for (const marker of POLICY_REJECT_MARKERS) if (body.includes(marker)) return "policy_reject";
+	if (isModelBusyBody(body)) return "model_busy";
 	if (status === 429) return "soft_rate";
 	if (status === 404) return "not_found";
 	if (status >= 500) return "server";
@@ -3733,7 +3800,7 @@ function generationOf(version) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "4.4.2";
+const WORKBUDDY_CONNECT_VERSION = "4.4.3";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -565,7 +565,38 @@ declare class WorkBuddyCredentialStore {
 /** WorkBuddy region selected by the credential's login domain. */
 type WorkBuddyRegion = 'cn' | 'global';
 /** Upstream failure classes the shim maps onto distinct HTTP answers. */
-type UpstreamErrorKind = 'hard_credit' | 'soft_rate' | 'session_dead' | 'policy_reject' | 'not_found' | 'server' | 'client';
+type UpstreamErrorKind = 'hard_credit' |
+/**
+ * The upstream's own volume limit (business code 6004, or a 429 whose body
+ * names a reset time). A statement about the ACCOUNT: it comes with a
+ * timestamp, it lasts, and another account is a real way around it.
+ */
+'soft_rate' |
+/**
+ * MODEL-scoped throttling with no stated time (business code 14003).
+ *
+ * Deliberately its own kind, because treating it as {@link soft_rate} is a
+ * 30x amplification of an upstream that says "wait about a minute" — and it
+ * makes the pool walk every account into the same wall (issue #56).
+ *
+ * The evidence that this is the MODEL's load and not the account's, measured
+ * on one credential at one moment, byte-identical requests differing ONLY in
+ * the `model` field, three attempts each:
+ *
+ *   | model                  | multiplier | ok  | failures   |
+ *   | ---                    | ---        | --- | ---        |
+ *   | deepseek-v4.1-flash    | x0.00      | 1/3 | 429 / 14003 |
+ *   | deepseek-v4.1-flash-sg | x0.03      | 1/3 | 429 / 14003 |
+ *   | glm-5.3-flash          | x0.06      | 3/3 | —          |
+ *   | hy3                    | x0.00      | 3/3 | —          |
+ *   | kimi-k2.6              | x0.77      | 3/3 | —          |
+ *
+ * The same account served other models at the same second, so the credential
+ * was fine. The upstream's own words agree: "Wait about a minute before
+ * retrying, or switch to a less busy model." Both halves are rendered to the
+ * user; the second one is the actual remedy.
+ */
+'model_busy' | 'session_dead' | 'policy_reject' | 'not_found' | 'server' | 'client';
 /** Reasoning capability as the upstream catalog declares it. */
 interface WorkBuddyReasoning {
   supportedEfforts?: readonly string[];
@@ -1683,8 +1714,14 @@ declare function probeRequestBody(modelId: string, inputTokens?: number): string
  * `rate-limited` is split out from a generic failure because it is the one
  * outcome the feature exists for: it means "this model works, but not right
  * now". Everything else is a real, actionable failure or a success.
+ *
+ * `model-busy` is a second such split, and it is NOT cosmetic — see
+ * {@link MODEL_BUSY_COOLDOWN_MS} and `exclusionOf`. A 14003 says the MODEL is
+ * loaded, everywhere, for everyone; a 6004 says THIS ACCOUNT exceeded a volume
+ * limit. Reporting both as `rate-limited` made the pool bench every account for
+ * the cooldown of one, which is the outage issue #56 describes.
  */
-type WorkBuddyProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
+type WorkBuddyProbeOutcome = 'ok' | 'rate-limited' | 'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
 /**
  * One probe result, as the card renders it.
  *
@@ -1704,8 +1741,16 @@ interface WorkBuddyProbeResult {
   message?: string;
   /** A time the upstream named, in ms. Absent when it named none. */
   retryAtMs?: number;
-  /** Where a supplied `retryAtMs` came from, so the card can say so. */
-  retrySource?: 'retry-after' | 'upstream-message' | 'quota-refresh';
+  /**
+   * Where a supplied `retryAtMs` came from, so the card can say so.
+   *
+   * `upstream-tips` is the odd one and it says exactly what it is: the upstream
+   * stated a MAGNITUDE in prose ("wait about a minute") rather than a timestamp,
+   * and this build turned it into {@link MODEL_BUSY_COOLDOWN_MS}. Naming it
+   * separately keeps the card honest — the other three sources are the upstream
+   * giving a time, this one is the upstream giving an order of magnitude.
+   */
+  retrySource?: 'retry-after' | 'upstream-message' | 'quota-refresh' | 'upstream-tips';
 }
 /**
  * Parse a `Retry-After` header value into an absolute time.
@@ -1737,6 +1782,14 @@ declare function parseRetryAfter(value: string | null, nowMs: number): number |
  * A limited outcome with none of the three returns `{}`, which the card renders
  * as "the upstream did not say when". That remains the honest answer for a
  * genuinely timeless failure; inventing a number here would be pure fiction.
+ *
+ * `model-busy` is the ONE exception, and it is not an invented countdown: the
+ * upstream states a magnitude in prose ("about a minute") rather than a
+ * timestamp, and the card's own vocabulary has no way to render "about". A
+ * per-account fallback of 30 minutes is what it used to get, which is both wrong
+ * about the magnitude and wrong about the scope (issue #56). The returned value
+ * is {@link MODEL_BUSY_COOLDOWN_MS}, and it is used only to bench the MODEL, never
+ * an account.
  */
 declare function cooldownOf(input: {
   outcome: WorkBuddyProbeOutcome;
@@ -1754,8 +1807,10 @@ declare function cooldownOf(input: {
  * probe and a real chat request can never disagree about what the same upstream
  * answer means. The extra splits here are `credential-rejected`, which the
  * upstream signals with a non-JSON 401/403 edge page and which needs completely
- * different advice (re-auth, not "wait"), and `policy-rejected`, a JSON 403
- * content-policy refusal where re-auth advice would be actively misleading.
+ * different advice (re-auth, not "wait"), `policy-rejected`, a JSON 403
+ * content-policy refusal where re-auth advice would be actively misleading, and
+ * `model-busy`, the model-scoped 14003 throttle that must NOT be benched as an
+ * account failure (issue #56).
  */
 declare function outcomeOfFailure(status: number, body: string): WorkBuddyProbeOutcome;
 /**
@@ -2347,7 +2402,18 @@ type WorkBuddyWebUsage =
  * here because this module is the node-free bridge and must not import the
  * Host-side probe module (which pulls in the credential type).
  */
-type WorkBuddyWebProbeOutcome = 'ok' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
+type WorkBuddyWebProbeOutcome = 'ok' | 'rate-limited' |
+/**
+ * The MODEL is loaded, not the account (upstream code 14003).
+ *
+ * Kept apart from `rate-limited` because the two need OPPOSITE advice:
+ * `rate-limited` is this account's volume limit (wait, or bill another
+ * account), while `model-busy` follows the model everywhere — every account
+ * hits the same wall, so switching accounts only spends a request per account
+ * to learn what the first one already said. The remedy is the upstream's own:
+ * wait about a minute, or switch to a less busy model.
+ */
+'model-busy' | 'out-of-credit' | 'credential-rejected' | 'policy-rejected' | 'unavailable' | 'not-found' | 'failed';
 /** One model's probe result, as the card renders it. */
 interface WorkBuddyWebProbeResult {
   modelId: string;
@@ -2362,18 +2428,31 @@ interface WorkBuddyWebProbeResult {
    * A time the upstream named for using this model again, in ms.
    *
    * ABSENT means the upstream named none, and the card must say exactly that.
-   * A client-invented countdown here would be fiction. Three sources fill it:
+   * A client-invented countdown here would be fiction. Four sources fill it:
    * a real `Retry-After` header; the reset sentence the upstream writes into
    * its own failure BODY (`将在 … UTC+8 重置`, which is where this service
-   * actually puts it — its 429s carry no rate-limit header at all); or, for an
-   * exhausted quota, the region's own quota refresh point.
+   * actually puts it — its 429s carry no rate-limit header at all); the
+   * region's own quota refresh point for an exhausted quota; or, for the
+   * model-scoped 14003 throttle, the magnitude the upstream states in PROSE
+   * ("wait about a minute") — see {@link WorkBuddyWebProbeOutcome}.
    */
   retryAtMs?: number;
-  /** Which of those three sources supplied {@link retryAtMs}. */
-  retrySource?: 'retry-after' | 'upstream-message' | 'quota-refresh';
+  /** Which of those four sources supplied {@link retryAtMs}. */
+  retrySource?: 'retry-after' | 'upstream-message' | 'quota-refresh' | 'upstream-tips';
 }
 /** Why one account is currently out of the pool. */
-type WorkBuddyWebPoolExclusion = 'unusable' | 'rate-limited' | 'out-of-credit' | 'credential-rejected' | 'not-found' | 'unavailable' | 'failed';
+type WorkBuddyWebPoolExclusion = 'unusable' | 'rate-limited' |
+/**
+ * The MODEL this account was measured against is loaded, not the account.
+ *
+ * Mirrors the same-named member of `WorkBuddyPoolExclusion` in
+ * `./account-pool.ts`, and mirrored here for the same reason as the outcome
+ * vocabulary above: this module is the node-free bridge and must not import
+ * the Host-side pool module. The card renders it with its own label, because
+ * showing "被限流" next to an ACCOUNT name asserts something the measurement
+ * does not say (issue #56).
+ */
+'model-busy' | 'out-of-credit' | 'credential-rejected' | 'not-found' | 'unavailable' | 'failed';
 /**
  * One account's row in the pool, as the card renders it.
  *

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as isWorkbuddyBundle, A as workbuddyAccountId, B as parseCreditMultiplier, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, H as parseUpstreamModel, I as classifyUpstreamError, J as deriveAtRestKeyId, K as clearAtRestKeyCache, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as isEncryptedFieldWrapper, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as prepareChatBody, V as parseReasoning, W as regionOf, X as findWorkbuddyAppExecutable, Y as fetchAtRestKeyPayload, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as writeFileAtomic, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as macosBundleExecutable, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as workbuddyAppExecutableCandidates, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as openEncryptedField, o as workbuddyHostHeartbeatPath, ot as resolveDshHome, p as applyContextBudgets, q as deriveAtRestKey, r as isHeartbeatProcessAlive, rt as readAtRestKey, s as writeHostHeartbeat, st as withFileLock, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosNestedAppBundles, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-CBFAiYPg.js";
+import { $ as isWorkbuddyBundle, A as workbuddyAccountId, B as parseCreditMultiplier, C as defaultDesktopAuthDirs, D as isVaultAccountId, E as isEncryptedCredentialError, F as WorkBuddyUpstreamClient, G as WORKBUDDY_APP_EXECUTABLE_ENV, H as parseUpstreamModel, I as classifyUpstreamError, J as deriveAtRestKeyId, K as clearAtRestKeyCache, L as declaredTools, M as CREDENTIAL_REJECTED_CODE, N as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, O as legacyWorkbuddyOwnAuthPath, P as WorkBuddyCredentialRejectedError, Q as isEncryptedFieldWrapper, R as isCredentialRejectedError, S as defaultDesktopAuthCandidates, T as hasEncryptedCredentialFields, U as prepareChatBody, V as parseReasoning, W as regionOf, X as findWorkbuddyAppExecutable, Y as fetchAtRestKeyPayload, _ as WORKBUDDY_AUTH_FILENAME, a as readHostHeartbeat, b as WorkBuddyEncryptedCredentialError, c as WORKBUDDY_CONNECT_VERSION, ct as writeFileAtomic, d as FALLBACK_WORKBUDDY_MODELS_GLOBAL, et as macosBundleExecutable, f as WorkBuddyCatalog, g as ENCRYPTED_CREDENTIAL_CODE, h as fallbackModelsFor, i as processStartTimeMs, it as workbuddyAppExecutableCandidates, j as workbuddyOwnAuthPath, k as parseWorkBuddyAuth, l as piAiRuntimeInfo, m as deriveCatalog, n as clearHostHeartbeat, nt as openEncryptedField, o as workbuddyHostHeartbeatPath, ot as resolveDshHome, p as applyContextBudgets, q as deriveAtRestKey, r as isHeartbeatProcessAlive, rt as readAtRestKey, s as writeHostHeartbeat, st as withFileLock, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as macosNestedAppBundles, u as FALLBACK_WORKBUDDY_MODELS, v as WORKBUDDY_AUTH_FILE_ENV, w as defaultDesktopAuthPath, x as authFileName, y as WorkBuddyCredentialStore, z as knownRegionOf } from "./host-heartbeat-C8imAyWG.js";
 import z from "@deepseek-ai/schemastery";
 import { readFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1177,6 +1177,7 @@ function isJsonContentType(req) {
 const KIND_STATUS = {
 	hard_credit: 402,
 	soft_rate: 429,
+	model_busy: 429,
 	session_dead: 401,
 	policy_reject: 403,
 	not_found: 502,
@@ -1221,8 +1222,19 @@ const KIND_STATUS = {
 * place would spend the retry budget on a request the server will refuse again,
 * and cross-provider failover cannot help a policy decision either. The code the
 * host receives therefore names the class honestly.
+*
+* `model_busy` gets the same `quota_exceeded` translation as `soft_rate`, and
+* for a sharper version of the same reason: it arrives as a 429, and the host's
+* in-place retry set is exactly where a request that is about to be refused
+* again must not go. A model that is loaded for everyone will not clear inside
+* one turn's backoff, so spending five attempts on it delays the honest answer
+* without ever producing one. `type` still says `model_busy`, which is what a
+* human reads and what routes the wording below.
 */
-const KIND_HOST_CODE = { soft_rate: "quota_exceeded" };
+const KIND_HOST_CODE = {
+	soft_rate: "quota_exceeded",
+	model_busy: "quota_exceeded"
+};
 /**
 * The `code` to write for an upstream failure, given its classified kind.
 *
@@ -1713,8 +1725,9 @@ function describeAccount(credential) {
 function failoverReasonText(failure) {
 	if (failure.ok) return "unusable";
 	switch (failure.kind) {
-		case "soft_rate":
-		case "hard_credit": return "rate limited";
+		case "soft_rate": return "rate limited";
+		case "hard_credit": return "out of credits";
+		case "model_busy": return "throttled on this model (not the account)";
 		case "session_dead": return "signed out";
 		case "policy_reject": return "rejected by policy";
 		case "not_found": return "model unavailable";
@@ -1837,12 +1850,24 @@ function createWorkBuddyShim(options) {
 	* `client` is deliberately NOT one of them: the upstream rejected the
 	* REQUEST (malformed body, unsupported field), so every account answers the
 	* same 400 and walking the rest of the pool only multiplies the wait before
-	* the user sees an error they must act on anyway. Everything else describes a
-	* PER-ACCOUNT condition — a rate limit, exhausted credits, a dead session, a
-	* gateway that failed this one call — which another account may well survive.
+	* the user sees an error they must act on anyway.
+	*
+	* `model_busy` is NOT one of them either, and the distinction is the whole of
+	* issue #56. The 14003 throttle belongs to the MODEL — the upstream's own
+	* message says so ("switch to a less busy model") and the reporter's
+	* measurement confirms it: same credential, same second, other models answer.
+	* So a second account does not answer better than the first; it answers the
+	* same 14003, one round trip later, and each attempt writes a rate-limited
+	* measurement onto an account that was never the problem. The measured outcome
+	* was a pool in which every member had been taught a false fact, and a user
+	* who could not talk to the model for half an hour.
+	*
+	* Everything else describes a PER-ACCOUNT condition — a volume limit,
+	* exhausted credits, a dead session, a gateway that failed this one call —
+	* which another account may well survive.
 	*/
 	function isFailoverWorthy(kind) {
-		return kind !== "client";
+		return kind !== "client" && kind !== "model_busy";
 	}
 	async function chatCompletions(req, res) {
 		if (!isJsonContentType(req)) {
@@ -1949,6 +1974,16 @@ function createWorkBuddyShim(options) {
 				writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, message, hostErrorCode(result.kind));
 				return;
 			}
+			if (result.kind === "model_busy") {
+				const detail = result.detail;
+				const lead = detail?.displayMsg ?? result.message.slice(0, 200);
+				const meta = ["模型当前负载较高"];
+				if (detail?.upstreamCode !== void 0) meta.push(`code ${detail.upstreamCode}`);
+				if (detail?.requestId !== void 0) meta.push(`requestId ${detail.requestId}`);
+				const message = `${lead}（${meta.join("，")}）${note}。这不是账号被限流——同一凭据下换一个模型即可正常使用；插件不会为此切换账号，因为该限制跟随模型本身。建议等待约 1 分钟后重试，或切换到负载较低的模型`;
+				writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, message, hostErrorCode(result.kind));
+				return;
+			}
 			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status})${note}: ${result.message.slice(0, 400)}`, hostErrorCode(result.kind));
 			return;
 		}
@@ -2009,6 +2044,21 @@ function createWorkBuddyShim(options) {
 //#endregion
 //#region src/probe.ts
 /**
+* How long to bench a MODEL that answered 14003 with no stated time.
+*
+* One minute, because that is what the upstream itself says: the failure body
+* carries `displayTips.zh` = "建议等待约 1 分钟后重试，或切换到负载较低的模型"
+* (and its English twin "Wait about a minute before retrying, or switch to a
+* less busy model"). A fallback coarser than the upstream's own advice is not
+* conservatism, it is a different and worse claim: issue #56 reports 14003 being
+* multiplied into 30 minutes per account, which turned a one-minute model
+* hiccup into a half-hour outage across the whole pool.
+*
+* Two minutes rather than one, because a probe costs a full request and the
+* point of the wait is to be past the burst, not to land exactly on its edge.
+*/
+const MODEL_BUSY_COOLDOWN_MS$1 = 12e4;
+/**
 * The system message every probe carries.
 *
 * Not decoration: the international gateway rejects a conversation that does not
@@ -2215,6 +2265,14 @@ function parseUpstreamResetAt(message) {
 * A limited outcome with none of the three returns `{}`, which the card renders
 * as "the upstream did not say when". That remains the honest answer for a
 * genuinely timeless failure; inventing a number here would be pure fiction.
+*
+* `model-busy` is the ONE exception, and it is not an invented countdown: the
+* upstream states a magnitude in prose ("about a minute") rather than a
+* timestamp, and the card's own vocabulary has no way to render "about". A
+* per-account fallback of 30 minutes is what it used to get, which is both wrong
+* about the magnitude and wrong about the scope (issue #56). The returned value
+* is {@link MODEL_BUSY_COOLDOWN_MS}, and it is used only to bench the MODEL, never
+* an account.
 */
 function cooldownOf(input) {
 	const fromHeader = parseRetryAfter(input.retryAfter, input.nowMs);
@@ -2231,6 +2289,10 @@ function cooldownOf(input) {
 		retryAtMs: input.quotaRefreshAtMs,
 		retrySource: "quota-refresh"
 	};
+	if (input.outcome === "model-busy") return {
+		retryAtMs: input.nowMs + MODEL_BUSY_COOLDOWN_MS$1,
+		retrySource: "upstream-tips"
+	};
 	return {};
 }
 /**
@@ -2240,8 +2302,10 @@ function cooldownOf(input) {
 * probe and a real chat request can never disagree about what the same upstream
 * answer means. The extra splits here are `credential-rejected`, which the
 * upstream signals with a non-JSON 401/403 edge page and which needs completely
-* different advice (re-auth, not "wait"), and `policy-rejected`, a JSON 403
-* content-policy refusal where re-auth advice would be actively misleading.
+* different advice (re-auth, not "wait"), `policy-rejected`, a JSON 403
+* content-policy refusal where re-auth advice would be actively misleading, and
+* `model-busy`, the model-scoped 14003 throttle that must NOT be benched as an
+* account failure (issue #56).
 */
 function outcomeOfFailure(status, body) {
 	if (status === 401 || status === 403) {
@@ -2250,6 +2314,7 @@ function outcomeOfFailure(status, body) {
 	}
 	switch (classifyUpstreamError(status, body)) {
 		case "soft_rate": return "rate-limited";
+		case "model_busy": return "model-busy";
 		case "hard_credit": return "out-of-credit";
 		case "session_dead": return "credential-rejected";
 		case "not_found": return "not-found";
@@ -2527,6 +2592,23 @@ function defaultWait(ms) {
 function messageOf$1(error) {
 	return (error instanceof Error ? error.message : String(error)).slice(0, 300);
 }
+//#endregion
+//#region src/account-pool.ts
+/**
+* How long an account stays out of the pool when the upstream stated no time.
+*
+* A conservative FALLBACK, not a measurement: it applies whenever a failed
+* outcome carries no `retryAtMs`, which is every rate limit that came without a
+* reset sentence AND every transient failure (a transport error, a 5xx). In both
+* cases "when can I use this again" has no honest answer.
+*
+* The two failure directions it avoids: keeping the account in the pool would
+* re-bill it immediately and re-trip the same limit; dropping it FOREVER would
+* discard a working account over an event that said nothing about it. A short,
+* stated cooldown is the least-wrong of the two — and it is what lets the pool
+* heal itself, since nothing else re-probes an excluded member.
+*/
+const POOL_UNKNOWN_COOLDOWN_MS = 18e5;
 /**
 * Whether one account can be billed at `nowMs`.
 *
@@ -2578,6 +2660,7 @@ function exclusionOf(probe, nowMs) {
 		case "unavailable": return retryDue(probe, nowMs) ? void 0 : "unavailable";
 		case "failed": return retryDue(probe, nowMs) ? void 0 : "failed";
 		case "rate-limited": return retryDue(probe, nowMs) ? void 0 : "rate-limited";
+		case "model-busy": return retryDue(probe, nowMs, 12e4) ? void 0 : "model-busy";
 		case "out-of-credit": return retryDue(probe, nowMs) ? void 0 : "out-of-credit";
 		case "policy-rejected": return;
 		default: return "unusable";
@@ -2591,9 +2674,14 @@ function exclusionOf(probe, nowMs) {
 * transport failure, so `atMs + POOL_UNKNOWN_COOLDOWN_MS` is what brings those
 * back. That is deliberate — the alternative is a permanent exclusion decided by
 * an event that said nothing about the account.
+*
+* `fallbackMs` lets one outcome carry a SHORTER clock than the generic one: the
+* model-scoped throttle is upstream's own "about a minute", and applying the
+* half-hour account fallback to it is issue #56. It is a parameter rather than a
+* second function so every outcome keeps sharing one definition of "due".
 */
-function retryDue(probe, nowMs) {
-	return nowMs >= (probe.retryAtMs ?? probe.atMs + 18e5);
+function retryDue(probe, nowMs, fallbackMs = POOL_UNKNOWN_COOLDOWN_MS) {
+	return nowMs >= (probe.retryAtMs ?? probe.atMs + fallbackMs);
 }
 /**
 * Rank a pool's members best-first.

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型接入 DeepSeek Harness，并提供只读的积分概览与模型管理。",
-  "version": "4.4.2",
+  "version": "4.4.3",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",