dsh-connect-workbuddy 5.12.4 → 5.13.1

package/CHANGELOG.md

@@ -1,5 +1,95 @@
 # Changelog
 
+## 5.13.1 (2026-10-29)
+
+### Bug Fixes
+
+- **按句改写网关固定指纹，落在 `neutralizeChannelFingerprints` 之前（#163，2026-10-29 实测）**
+  - **新测量**：CN 网关会在匹配前规范化 U+200B；system 开头插零宽仍 11128，`Note: ` 或真改词
+    才 200。`user` / `tool` 开头不扫（18:46 连测 3 次 200），所以不碰这两个角色。
+  - **第三处是整段组合指纹**：`@` 路径那 8 句逐句单独发 200，整段一起发 400。只改开头或整段
+    `replaceAll` 都不满足维护性要求；按句改才能既拆掉组合指纹，又覆盖宿主改一两个词的情况。
+  - **修法**：新增 `rewriteChannelFingerprintPhrases()` 与按句表（identity、coding agent、Web GUI、
+    `Agent Teams is available in this session`、`@` 路径整段逐句），在 `prepareChatBody()` 里
+    `keepPromptLast` 之后、`neutralizeChannelFingerprints` **之前**调用；只遍历 `system` /
+    `assistant` 的 string content 与 array text part，`user` / `tool`、工具调用、图片不动；无命中
+    逐字节不变，函数幂等。
+  - **测试**：新增 `tests/issue163-sentence-rewrite.spec.ts`（三处 span 消失、普通对话不变、
+    幂等、assistant 改写、array part、user/tool 不动、无命中 no-op）；同步更新 `issue98*` /
+    `upstream` / `identity-clause-break` 里旧的「中性头 + 原文」断言。`pnpm run check` 通过。
+
+- **自动「继续」降为最后兜底：默认 1 次，文案不再承诺有效（#163）**
+  - **证据**：固定 system 指纹每轮逐字节相同；同一 body 打上百次都是 400，只改三处才 200
+    （freedomx86 17:44）；现场 3 次自动续发、Windpixy 反复继续/新老会话、QIYU 三级救援全跑完
+    仍 400；appulsexi-maker 19:12 的零历史新会话、只有 system 一条，仍 11128。新回合换不掉
+    固定 system 内容，自动续发对这一族无效。
+  - **修法**：`DEFAULT_MAX_CONSECUTIVE` 与 schema / 客户端默认 3 → **1**；卡片、配置描述、
+    README 与 `docs/PINNED-11128-RETRY.md` 改为「最后兜底，不是 11128 的修复；固定指纹由按句
+    改词处理，只有随轮次变化的内容才可能靠它碰过」。
+  - 仍然默认关闭；每次仍真实消耗一次请求。**行为面**未变（只认 `channel_reject`、不换号、
+    不碰子代理、成功/真人消息清零）。
+
+- **换 provider 后，另一家的 thinking 不再被摊成 assistant 正文发给 WorkBuddy（#163 现场）**
+  - **现场**：`session-bb9396be` 在 02:03:43 从 `dsh-opencode-go/deepseek-v4.1-flash` 切到
+    `workbuddy/deepseek-v4.1-flash`，02:04:35 起连续 4 个回合 400/11128；错误里三条 assistant 的
+    14,410 / 4,225 / 5,138 字，逐字等于切换前 seq 98/109/114 的 reasoning 块。
+  - **机制**：宿主把另一家的 assistant 轮次重建为 `dsh-foreign`，pi-ai 把无签名的 thinking 块
+    改写成可见 `text`；WorkBuddy 网关扫描 assistant 消息，把它当成未授权渠道。`dropForeignThinking`
+    本来就是修这个的，但默认关闭，且卡片上没有开关。
+  - **修法**：`withLegacyContext` 在 `alignAssistantIdentities` 之后**无条件**丢弃**跨 provider** 的
+    foreign thinking（`api: dsh-foreign`，或 provider 不属于本 bundle 的两条路由）；同一路由内换
+    模型（`hy3` → `deepseek-v4.1-flash`）仍由 `dropForeignThinking` 显式开关控制。跨 provider 的
+    思考块没有签名、本来就不可能作为 reasoning 重放，丢弃不改变语义；文本与工具调用不动。
+  - **诊断**：自动丢弃时写一条 warn（仅在开关关闭时），`latestForeignThinking` 仍照旧上报。
+  - **测试**：`tests/issue147-foreign-thinking.spec.ts` 新增三条（跨 provider 选中、同路由模型
+    切换不选、global 路由对齐后不误伤）；`tests/issue147-model-leg-wiring.spec.ts` 新增两条（两个
+    generation × 两个入口的 `dsh-foreign` 回合在开关关闭时也被丢弃）。
+
+## 5.13.0 (2026-10-28)
+
+> 用户贴的那条失败：`本轮运行失败400: {"message":"workbuddy 上游失败：被网关的渠道校验拦截（不是账号、
+> 额度或网络问题）（http 400）（code 11128，requestId …）。…","type":"channel_reject"}`，
+> 以及一句明确的需求：「当我收到这样的信息的时候，自动发送继续，并且如果连续收到3次就不再发送」。
+> 这条需求成立的前提是搞清楚**为什么重发可能有用**，因为插件自己在 `perturbChannelFingerprints` 旁的
+> 注释一直说「给定提示词被拒是确定性的」，而现场报告反复说「再发一次就过了」。两者其实不矛盾：**新回合
+> 是一份重新组装的请求**（surface 重排、注入块位置变化、学到扰动偏好后第一发就带扰动），所以「再发一次」
+> 不是把被拒的字节原样再塞一遍——那是 `channel_reject` 被排除在 `isFailoverWorthy` 之外的同一条理由。
+
+### Features
+
+- **可选：渠道门拒绝（`channel_reject` / 11128）之后自动再发一次「继续」，连续上限 3 次**
+  - **为什么需要它**：这一类失败在插件里是**三重不救**——不换号（`isFailoverWorthy` 刻意排除：网关读的是
+    消息开头，换账号只会每个账号白烧一次真实请求）、不在原地重试（同一请求内的三级救援阶梯
+    `forceNeutralHead` → 一次零宽扰动 → 密集零宽扰动已经跑完）、宿主也不重试（400 不在
+    `DEFAULT_RETRYABLE_CODES` 里，`LvFailure.code` 还会被 pi-ai 按 `/\b400\b/` 重新分类成
+    `INVALID_REQUEST`）。于是这一轮直接结束，用户看到的就是那句 400。
+  - **它做什么**：`session/event` 上认 `turn/end` + `reason.kind === 'error'` + 这一类失败 → 等 300ms →
+    `agent.followup(createUserMessage(...))` 发一条 `继续`。**不做**任何换号、换区、改请求体的事。
+  - **上限的语义是「连续」**（`maxConsecutive`，默认 3）：一次 `completed` 回合、或一条
+    `source.kind === 'user'` 的消息立即清零；**插件自己发的那条不清零**——否则我们自己发的消息会把计数
+    抹掉，上限永远不生效（这条单独有测试钉住）。`aborted` + `reason.kind === 'user'`（用户点了停止）
+    也清零，同 `dsh-purge` / `auto-continue` 的处置。
+  - **不做的四件事**：子代理会话一律不碰（它的回合由父代理驱动）；`status === 'running'` 时不发（宿主可能
+    自己起了新回合）；收件箱里有排队内容时不发（用户可能正在打字，抢在前面会让模型先答错东西）；
+    `turn/start` 一来就取消已排定的那一条。
+  - **失败如何识别**：`code === 'channel_reject'`，或消息里带插件自己的 kind 字面量 / 它自己的那句
+    「渠道校验拦截」。**刻意不用 `code` 单值判定**——宿主那一份 `code` 极可能已经被 pi-ai 从文本重分类成
+    `INVALID_REQUEST`，只看它会漏掉每一次真实失败。
+  - **默认关闭**，因为每次都会真实消耗一次请求，与 `usageIdentity` / `imageToolEnabled` 同一条规则。
+    它是本插件里**唯一改完即生效**的上游类开关：引擎每次失败现读配置，不必重载插件（因此它**不在**那组
+    「改完需重载」的提示里，而是自己一组）。
+  - **卡片**：「能力」栏新增一个开关（`.dsm-workbuddy-channel-continue-check`），展开时回报上限与发送
+    文本；这两个值卡片只读不写，写入时整块带上，一次布尔写不会把它们擦回默认（同 `sessionTitle` 的处置）。
+  - **测试**：`tests/channel-continue.spec.ts`（引擎 30 例，含上限、清零、不清零、子代理、running、
+    收件箱忙、seq 去重、卸载、会话数上限、事件总线缺失时功能失效而非拖垮插件）、
+    `tests/channel-continue-wiring.spec.ts`（真 `apply()` 挂载：真的订阅了、真的读到活配置、
+    真的随 fiber 卸载）、`tests/card-channel-continue.spec.tsx`（渲染与写入契约）、
+    `tests/web-status.spec.ts`（`__save` 白名单整块接受）。
+  - **溯源**：「连续失败上限」的语义来自 `dsh-client-auto-continue`（MIT，HsiangNianian），
+    「哪些失败码不续 / 收件箱忙不插队 / 用 `source.kind` 区分真人介入」来自 `dsh-purge`
+    （MIT，YuJunZhiXue）。两者都只是**思路参照**，未复制源码；相对它们本实现是收窄。
+    已同步写入 `THIRD_PARTY_NOTICES.md`、两份 README 的致谢与 `docs/DESIGN.md` §5.3 的分发表。
+
 ## 5.12.4 (2026-10-28)
 
 > issue #159 的**报告现象成立，归因不成立**。现场确实出现了「三级救援一级都没跑」的 `11128`，但把它

package/README.en.md

@@ -52,6 +52,15 @@ It depends on the WorkBuddy client's own endpoints (not a public API), so the pl
 - **Optional: make the usage page record these calls like the official client's (5.8.0, issue #132, OFF by default)** — with `usageIdentity` on, chat requests carry `X-IDE-Name: WorkBuddy` (plus `X-IDE-Type: CLI` and a version taken from the existing product UA, not a second hard-coded number), so the usage page's client column is no longer blank, and the conversation-identity triple becomes the official **32-character lower-case hex UUIDv7** with `X-Request-ID` alongside it — the gateway echoes that id as the SSE `id` and writes it into the usage page, so hyphenated v4 ids made one account's rows look like two different clients — while "fresh per request, all distinct" has not been relaxed. **`User-Agent` is untouched under either setting**: billing and rate limits recognise the CLI channel. The image endpoint does not follow this switch; it keeps the shape measured on 2026-10-21. It is off by default because the shape fixes nothing on its own (the three `11128` doors read message openings, a missing conversation id, and whether the first message is a system prompt — no header moves any of them) and the only measurement is a reporter's on an older build, so a purely cosmetic alignment does not get to put every account at risk first. There is also an opt-in `keepPromptLast` (**off by default**): the usage page takes the request text from the LAST `user` message, and the host appends its time samples, runtime context and `<system-reminder>` blocks AFTER what you actually typed, so that column recorded injected text; when enabled it moves those injected blocks **above the real prompt** — order only, except that the recorded prompt's own leading `<acp …>mNNNNN</acp>` marker is stripped (leave it and that column still opens with a marker, i.e. nothing was fixed); earlier messages **keep** theirs, because the model cites history by those ids and the only id that can never matter is the message being answered now. It stays off by default because the order is something the upstream counts and a few leading characters are removed from the real prompt. The move matches only the host's own injected prefixes, and a conversation with no injected tail is untouched byte for byte — marker included — pinned by tests written for both.
 - **Optional: move each new session's title request onto the hidden lightweight model (issue #133, OFF by default)** — the DSH host fires one title-generation request per new session through the same provider as the conversation, so it is billed at the main paid model's rate. With `sessionTitle.enabled` on, a request the plugin recognises as a title (its only user message opens with the host's template `Generate the session title from this JSON array of human messages:`) is re-pointed at `sessionTitle.model` (default `wb-lite`). The reporter measured 0 credits for those calls, with three caveats: it is still a real upstream request and counts toward request volume; the measurement is the reporter's account, not reproduced here; detection is fail-closed — if the host rewords the template the rewrite silently stops and billing reverts, and ordinary conversations are never touched. If the upstream rejects the model, only that session's title fails once; the conversation is unaffected. Like `usageIdentity` / `keepPromptLast` / `extraInjectedPrefixes` in the bullets above, `sessionTitle` is read once when the plugin mounts: **after editing `cordis.patch.yml`, reload the plugin or restart DSH for the change to take effect** — hot edits do not apply.
 - **Benefits: a marker for what is unclaimed, plus a per-account Claim button** — the card marks, account by account, anything in the upstream's benefit campaigns (compensation / gifts) that **has not been claimed yet**. The data comes from the upstream's own two status endpoints; in the marking stage the plugin is **read-only** and never calls the two write endpoints. Three display rules all follow the upstream's state: `active && !claimed` shows the row, `claimed` removes it entirely, and an expired campaign (upstream flips `active` to `false`) disappears by itself — the plugin **never compares `end_time` against the local clock**, so a skewed machine cannot argue with the server; `end_time` only drives the "three days left" highlight. `active` alone is not enough to decide: an already-claimed account still reports `active: true`, and reading it alone would leave a claimed campaign hanging there forever. The read reuses the check-in pipeline (once per account, cached for 30 minutes, no request while the account pool is off), and a failing endpoint counts as "unread" rather than caching "nobody has benefits". Each row ends in a solid amber **Claim pill**, and one click claims **one campaign of one account**: there is no "claim everything", because a click spends one irrevocable real entitlement — and the write route **requires `accountId`**, so the request itself cannot batch. Before writing it **re-reads** the status and decides again; anything already claimed or expired returns 409 without touching upstream. After a successful claim it answers with the upstream's **fresh reading** and refreshes the card, with no optimistic update — even a silent upstream failure cannot leave a false "claimed" behind — and it also drops that account's cached benefit state, so the pill cannot linger on a stale status.
+- **Optional: a LAST-RESORT 「继续」 when the gateway refuses the request (OFF by default, 1 send by default)** — when the upstream rejects with `400` and business code `11128` the turn simply ends: the plugin does not retry inside that request (its three-rung ladder already ran), it does not swap accounts (the gate matches message contents, and every account sends the same ones), and the host does not retry. **This is not a fix for 11128.** Fixed system fingerprints (the identity / Web GUI / @-path paragraph from #163) are byte-identical every turn, so resending only pays for the same 400 again; since 5.13.1 `prepareChatBody` rewrites known phrases sentence by sentence. Only content that happens to change between turns can be helped by a new turn. Turning on the card's Capabilities switch makes the engine wait 300 ms and send `继续` through `agent.followup` (`source.kind` is `workbuddy-continue`, **not** `user`). **The cap counts CONSECUTIVE sends** (`channelRejectContinue.maxConsecutive`, default **1**; the old default of 3 is disproven — if one cannot help, three cannot): one successful turn, or one message you type yourself, resets it; the plugin's own message does not. Subagent sessions are never touched, and neither is a session already running or with something queued. **Every send spends a real request**, hence OFF by default; it is also the only upstream-shaped switch whose change **takes effect immediately**. It can be set directly in `cordis.patch.yml`:
+
+  ```yaml
+  channelRejectContinue:
+    enabled: true
+    maxConsecutive: 1
+    text: 继续
+  ```
+
 - **Actionable advice when a credential is refused** — when the upstream rejects the selected account's token, the plugin actually **probes** the other local sign-ins: if one still answers, it tells you to switch to it (with a one-click switch) instead of vaguely asking you to sign in again — re-authenticating fixes nothing while you are pinned to a revoked backup. Only when there is genuinely no other local account does it ask you to sign in again.
 - **Add accounts by QR sign-in, import/export them in bulk, test or delete them one by one** — the WorkBuddy desktop app is no longer a prerequisite: the card's **Sign in with QR code** button (labelled **Sign in on the web** for the international build — that region uses a browser login page, there is no QR; it sits just above **More settings** and acts immediately, with nothing to save) opens a dialog and takes you **straight to the authorization page** in your browser; if the browser blocks that, the dialog's link, copy and **Open page again** are the fallback. Every credential lands in the plugin's own vault (`$DSH_HOME/workbuddy-vault/<region>/<accountId>.json`, one file per account), and the desktop app's auth files stay **read-only and are never modified**. Each row of the account table gains **Test** and **Remove**: a row test reuses the same probe as the batch run, so the two are comparable; removing deletes only the copy the plugin stored and **hides** the account: it disappears at once and the automatic poll cannot bring it back, while **Detect accounts again** restores it (signing in or importing the same account clears the hide too). **The desktop app's sign-in is never touched** — removing means "this plugin no longer lists it", not "sign out of the app". **Export / import accounts** moves credentials to another machine: pick accounts to export a JSON file → choose a file and read a **redacted preview** (field names and whether a token is present; the token itself never enters the preview) → tick what to import. An import overwrites per account rather than duplicating, and **only a record positively identified as belonging to that region is stored** — a domain the plugin cannot classify is skipped and counted as skipped. See [Account pool](#account-pool).
 - **Credits live in the account pool** — the member table shows each account's remaining credits and nearest expiry, and credits are the ranking's second key (more credits serves first). The queries are **read-only** and consume no credits.
@@ -483,8 +492,9 @@ Marketplace screenshots and GitHub README badges are two separate mechanisms:
 - **Switching region makes the context "grow", and can hit `code 11115` immediately — the gateway is not over-charging you.** The same history is counted under different buckets in the two regions, and the root cause is how the host's bundled `@earendil-works/pi-ai` replays history. It evaluates `isSameModel` for every assistant message (`transform-messages.js:68`, keyed on provider **and** api **and** model id all being equal): for a message that fails, its thinking is **downgraded to ordinary content** (`:88–96` — not dropped), and content is what the gateways count, while thinking goes out in a different field. This plugin registers the domestic and international editions as **two provider ids** (`workbuddy` / `workbuddy-global`, see [How it works](#how-it-works)) that carry the **same model id** — so one region switch moves **all the other side's thinking into the content bucket at once**. That is the cause of issue #59's "the same conversation history is charged 1.374M by the international gateway and 708K by the domestic one (1.94×)"; switching back is the same formula read the other way, 0.696×.
   - Three consequences you can see: a region switch can move the token count by ±30%–94%, and **how far depends only on the other side's thinking character count, not on total history length**; **switching models inside one region** triggers the same downgrade (the model leg of `isSameModel`), so the count can move without a region switch at all — the downgrade itself cannot be removed, but **its becoming prose can**, see `dropForeignThinking` below; and that jump lands on top of the host's current compaction threshold (`min(0.8 × window, window − 128000 − 65536)`), so a session that was comfortably under the limit can hit `code 11115 prompt is too long` the moment you switch region.
   - **The downgrade is not only a counting problem: the reasoning becomes the answer, and the model then copies that shape (issue #147).** The bullet above covers what the downgrade does to BILLING; this one covers what it does to CONTENT. For a message where `isSameModel` fails, pi-ai does not drop its thinking — it rewrites each block to `{type:'text'}` (`transform-messages.js:87–90`), i.e. the answer channel. So after a provider switch, **another model's internal working notes are presented as this turn's reply**, and a model that reads "all of my past reasoning was plain text" keeps writing its plan into the text channel from then on. The reporter measured one real turn: 56 of 80 assistant messages carried an answer while their own `reasoning` was ≤ 1 character, 20 of those held English working notes totalling 58,960 characters, and CJK fell to 1.37% of the 60,984 visible characters where the previous six turns had been entirely Chinese. It also pushed the session from 696,966 to 758,005 total tokens against an 800,000 compaction threshold.
-    - **`dropForeignThinking` (off by default)**: when on, this plugin **removes** those foreign thinking blocks before the request goes out, instead of letting them be flattened into prose. Removal rather than preservation, because these blocks are built by the host's `foreignAssistant()` and carry **no `thinkingSignature`** — even claimed as our own turn they could never be replayed as signed reasoning, so their only possible contribution to the wire was the prose they became. Text blocks and tool calls are never touched, and neither is any message's identity.
-    - With the switch off the request is **byte-for-byte** what earlier builds sent: it changes bytes the upstream counts, so it is an explicit opt-in on the same rule as `usageIdentity`.
+    - **Cross-provider foreign thinking is dropped unconditionally; the `dropForeignThinking` switch only covers a model switch inside one route (off by default)**: this plugin **removes** those foreign thinking blocks before the request goes out, instead of letting them be flattened into prose. Removal rather than preservation, because these blocks are built by the host's `foreignAssistant()` and carry **no `thinkingSignature`** — even claimed as our own turn they could never be replayed as signed reasoning, so their only possible contribution to the wire was the prose they became. Text blocks and tool calls are never touched, and neither is any message's identity.
+    - **No switch for the cross-provider leg**: after a provider switch the host rebuilds the other provider's assistant turns as `dsh-foreign`, and pi-ai flattens their thinking into assistant text; the WorkBuddy gateway scans assistant messages, so the whole turn is refused with `11128` (issue #163's measured scene: 14,410 / 4,225 / 5,138 characters of reasoning replayed as prose, with all three in-place rescue rungs and three auto-`继续` attempts failing). Those blocks could never be replayed as reasoning anyway, so dropping them is a correction rather than a preference and does not wait for an opt-in. `dropForeignThinking` only widens the same repair to a model switch **inside one route** (`hy3` → `deepseek-v4.1-flash`, both served by this bundle and stamped `provider: workbuddy`); for that leg the off path is still **byte-for-byte** what earlier builds sent.
+    - An automatic drop writes a warn (only while the switch is off) and still reports through `latestForeignThinking`, so the log names which blocks that request removed.
     - The ORDER is load-bearing: the repair runs **after** `alignAssistantIdentities`. A global-region turn of this plugin's own arrives carrying `api: 'dsh-foreign'` too (the host's replay-degrade path), so diagnosing first would classify it as foreign and delete its reasoning — exactly issue #102 in reverse. `tests/issue147-foreign-thinking.spec.ts` pins the order through pi-ai's real `transformMessages`.
     - Turns already recorded in history are **not** retroactively repaired: they are already stored as prose, and the switch governs later requests only. Starting a new session after the provider switch is the direct way out.
     - **It also covers switching MODELS inside one region** (`hy3` → `deepseek-v4.1-flash`, both served by this plugin, both stamped `provider: workbuddy`). The provider and api legs are equal there, so only the `model` leg separates the turn from the request — and 5.12.0's predicate compared just the first two, so that switch detected **nothing** and the switch looked broken. The model id comes from the request entry points (`model.id` on `stream` / `streamSimple`); omitting it keeps 5.12.0's behaviour exactly, which is why the card's read-only path is unaffected (it reads `lastForeignThinking`, which the request path fills).
@@ -511,6 +521,11 @@ This project builds on work others have published. Sources and licenses are cred
 - [Sliverkiss/workbuddy2api](https://github.com/Sliverkiss/workbuddy2api) (MIT) — reference implementation of the WorkBuddy upstream protocol (the `copilot.tencent.com` wire behavior), referenced via `dsh-workbuddy-connect`.
 - [hawklithm/workbuddy2api](https://github.com/hawklithm/workbuddy2api) (MIT, Copyright (c) 2026 Mayer) — **the only entry in this list that is a CODE PORT rather than a design reference**: its `src/codebuddy_proxy/dsml_parser.py` is a DSML tool-call parser for a proxy in front of the same WorkBuddy/CodeBuddy upstream, and this project ported it to `src/dsml-recovery.ts` (the tag state machine, ignored-region detection, missing-wrapper repair, recursive parameter parsing, and the streaming buffer), adding the two gates it does not have (a tool name must be declared in THIS request; no declared tools means no recovery at all). The three deliberate deviations are listed in that file's header; the formal attribution is in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
 
+### References for the auto-continue semantics
+
+- [HsiangNianian/dsh-auto-continue](https://github.com/HsiangNianian/dsh-auto-continue) (MIT) — the source of the "consecutive-failure cap" semantics: the counter increments on send, stops at the cap, resets on a successful turn, and skips subagent sessions. This project's `channelRejectContinue` takes only that layer, not its engine.
+- [YuJunZhiXue/dsh-purge](https://github.com/YuJunZhiXue/dsh-purge) (MIT) — three concrete practices: which failure codes must not be continued (quota / rate limit / transport), do not queue behind a busy inbox, and use a message's `source.kind` to tell human intervention from the plugin's own message.
+
 ### Baseline for the plugin presentation and structure
 
 - [dingminhua/dsh-connect-trae](https://github.com/dingminhua/dsh-connect-trae) (MIT, Copyright (c) 2026 LaoDing) — the plugin's presentation is kept consistent with it: the settings-card structure and interaction, the model-management (refresh → select → save) and account-selection model, the read-only host↔client route shape, and the npm release engineering.

package/README.md

@@ -61,6 +61,15 @@
 - **可选：让上游用量页把这笔记成官方客户端发的那笔（5.8.0，issue #132，默认关闭）** —— 开 `usageIdentity` 后 chat 请求带上 `X-IDE-Name: WorkBuddy`（连同 `X-IDE-Type: CLI` 与版本号；版本号取自现有的产品 UA，不留第二个硬编码数字），用量页的「使用端」由此不再空白；会话身份三件套同时改成官方客户端那种 **32 位十六进制 UUIDv7** 并补上 `X-Request-ID`——网关把这个 id 回显成 SSE 的 `id` 并写进用量页，此前带连字符的 v4 与官方记录摆在同一页上像两种客户端；**每请求现生成、互不相同**这条没有放松。**`User-Agent` 在两种取值下都一字未动**——账单与限流认的是 CLI 通道；生图路径也不跟着这个开关变，它保持自己 2026-10-21 实测过的形状。**默认关**的理由：形状本身不修任何东西（`11128` 的三道门读的是消息开头、会话 id 有没有、首条是不是 system，头改不动其中任何一条），而实测证据来自报告者的账号与旧版本、本插件未在真机复现——一次纯显示对齐不该让所有账号先承担风险。另有可选的 `keepPromptLast`（**默认关闭**）：用量页的「请求」列取自 body 里**最后一条** `user` 消息，而宿主把时间采样、运行时上下文、`<system-reminder>` 追加在你真正输入的那句**之后**，那一列于是常年记的是注入块；开启后把这些注入块**搬到真实输入之前**（只变顺序；另外会剥掉**被记录那一条**真实输入前面的 `<acp …>mNNNNN</acp>` 标记，否则那一列仍然以标记开头而等于没修，更早的消息一律保留自己的标记，因为模型靠它们引用历史）。默认关的理由是它会改变上游会数到的消息顺序、并删掉真实输入的几个前导字符；搬移只匹配宿主自己的注入前缀，而普通对话在没有注入尾块时逐字节不变（连标记也不剥）——这两点各有专门测试钉住。
 - **可选：把每个新会话的标题请求改到隐藏轻量模型（issue #133，默认关闭）** —— DSH 宿主每个新会话会发一次标题生成请求，走的是与对话相同的 provider，于是这笔按主付费模型的费率计费。开启 `sessionTitle.enabled` 后，插件把能按宿主标题模板（`Generate the session title from this JSON array of human messages:` 开头、整条 body 只有这一条 user 消息）识别出的标题请求改写到 `sessionTitle.model`（默认 `wb-lite`）。报告者实测该模型对这类请求 **0 积分**，但注意三点：这仍是**真实上游请求**，请求数照算；证据是报告者账号级的，本插件未复现；识别按 fail-closed 设计——宿主若改模板，改写静默停止、回到原计费，不会误伤普通对话。若上游拒绝该模型，只是该会话标题生成失败一次，不影响主对话。另外，`sessionTitle` 与本条及上一条的 `usageIdentity` / `keepPromptLast` / `extraInjectedPrefixes` 一样，都是插件挂载时读一次配置：**改完 `cordis.patch.yml` 后需要重载插件或重启 DSH 才生效**，热改不生效。
 - **福利活动：待领取标记 + 单账号「领取」按钮** —— 卡片会逐账号标出上游活动（补偿 / 赠礼）里**还没领的那一份**，数据来自上游自己的两个状态接口，标记阶段**只读**、两个写接口一次都不调用。显示规则完全由上游状态决定：`active && !claimed` 才显示，`claimed` 整行消失，活动过期（`active` 翻 `false`）自动消失——**不用本地时钟去比 `end_time`**，本机时间偏了也不会与服务端打架；`end_time` 只用于 3 天内临期高亮。`active` 单独看不行：已领取的账号 `active` 仍为 `true`，只看它会让领过的账号永远挂着待领取。读取复用签到的管线（每账号一次、30 分钟缓存、账号池关闭时不发请求），任一接口失败按「未读」处理，不会把一次失败缓存成「全都没福利」。行尾是一个实心琥珀色的**胶囊按钮「领取」**，一次只领**一个账号的一个活动**：没有「全部领取」，因为一次点击花掉的是一份不可撤销的真实权益，写路由也**强制要求 `accountId`**，请求本身无法批量领取。领取前**重新读取**状态再判定，已领取或已过期一律 409 且不调用上游；领取后用上游的**新读数**作答并刷新卡片，不做乐观更新——即使上游静默失败也不会留下「已领取」的假象，成功后同时清掉该账号的福利缓存，按钮不会顶着旧状态赖着不走。
+- **可选：被网关渠道校验拦截后的最后兜底「继续」（默认关闭，默认只发 1 次）** —— 上游用 `400` + 业务码 `11128` 拒绝时，这一轮就此结束：插件不会在原请求里重试（三级救援已跑完），不会换号（网关匹配的是消息内容，每个账号发出去都一样），宿主也不重试。**它不是 11128 的修复**：固定 system 指纹（#163 的 identity / Web GUI / @ 路径整段）每一轮逐字节相同，重发只会再付一次同一个 400；5.13.1 起这些由 `prepareChatBody` 的按句改词处理。只有被拒内容刚好随轮次变化的窄情况，才可能靠新回合碰过去。开启卡片「能力」栏的开关后，插件检测到这一类失败、等 300ms、用 `agent.followup` 发一条 `继续`（`source.kind` 是 `workbuddy-continue`，**不是** `user`）。**上限数的是「连续」次数**（`channelRejectContinue.maxConsecutive`，默认 **1**；旧默认 3 已证伪——1 次救不了，3 次也救不了）：成功一轮、或你自己发一条消息，计数清零；插件自己发的不清零。子代理会话一律不碰；会话正在跑、或收件箱已有排队内容时也不发。**每次都会真实消耗一次请求**，所以默认关闭；它也是本插件里**唯一一个改完即生效**的上游类开关。与其它上游开关一样，也能直接在 `cordis.patch.yml` 里写：
+
+  ```yaml
+  channelRejectContinue:
+    enabled: true
+    maxConsecutive: 1
+    text: 继续
+  ```
+
 - **凭据失效时给出可执行的建议** —— 上游拒绝当前账号的 token 时，插件会**实际探测**本机其他账号：若有账号仍然可用，就直接告诉你「切换到它即可」（并附一键切换），而不是笼统地让你重新登录——被钉在一个作废的旧备份上时，重新登录并不能解决问题。只有本机确实没有别的账号可切换时，才会提示重新登录。
 - **扫码添加账号、批量导入导出、逐账号测试/删除** —— 不必先装 WorkBuddy 桌面 App：卡片里的「扫码登录」按钮（国际版为「网页登录」——那边是浏览器登录页，没有二维码；这一行就在「更多设置」上方，点一下立即生效，不需要保存）点开即弹出对话框，并在浏览器里**自动打开**授权页；被浏览器拦截时对话框内提供链接、复制与「重新打开页面」兜底。所有凭据统一落到插件自己的凭据库（`$DSH_HOME/workbuddy-vault/<region>/<accountId>.json`，一账号一文件），**桌面 App 的认证文件始终只读、永不被改动**。账号表格每一行右侧有「测试」与「删除」：测试与批量测试走同一套探测，结果可比；删除只删插件自己存的那份，并把这个账号**暂时隐藏**：删掉后立刻消失，也不会被自动轮询带回来；点「重新检测账号」即可找回（重新登录或导入同一账号也会清除隐藏记录）。**桌面 App 的登录始终不动**——删除是「本插件不再列出它」，不是退出 App 登录。「导出 / 导入账号」可把凭据搬到另一台机器：多选导出 JSON → 选文件后先看**脱敏预览**（只显示字段与是否有 token，明文不进预览）→ 勾选导入。导入按账号去重覆盖，**只有确认属于该区域**的记录才入库，认不出的域名会被跳过并如实计入「已跳过」。详见[账号池](#账号池)。
 - **积分信息在账号池里** —— 成员表逐账号显示剩余积分与最近到期时间，排序的第二键就是积分（谁多谁优先）。查询是**只读**的、不消耗积分。
@@ -312,6 +321,8 @@ dsh plugin --profile web exec dsh-connect-workbuddy status
 
 **这条路到底绕开了什么，说清楚。** 提供方那条路要让请求看起来像 CodeBuddy 客户端才能过网关的渠道校验，4.15.x 起那条校验已经升级成「按提示词中段做精确子串匹配」，靠句读处插零宽空格躲开——这是军备竞赛，而且不再免费：issue #98 里已经出现**账号级**限制（`code 11140`，「账号存在异常行为，已被限制使用」）。
 
+> **2026-10-29 的 #163 复测更新**：零宽这条路已经被网关堵死——CN 网关在匹配前会规范化 U+200B，system 开头每个词边界都插零宽仍然 11128。现在改为**按句改词**（`rewriteChannelFingerprintPhrases`，落在 `neutralizeChannelFingerprints` 之前），只改命中句、其余逐字节不动，也不再需要把提示词伪装成第三方 agent。细节见 CHANGELOG 的 Unreleased。
+
 CLI 路线逃掉的是**客户端指纹层**，不是账号层。它用 `CODEBUDDY_AUTH_TOKEN` 把本插件 vault 里的同一个 WorkBuddy 账号交给 CLI，所以「跟网关说话的是真的 CodeBuddy CLI 进程、没有身份要伪造、因此账号不会被限制」这句话**不成立**：身份仍然是同一批账号，`11140` 是账号级的，同一批账号在 CLI 路线上一样受限。真正被绕开的只有「这条请求的客户端指纹像不像 CodeBuddy」——这一层是真实的收益（渠道校验不会再因为提示词里有句读而拒你），但它不等于「免封」。两条路是互补的容错，不是替代。
 
 ### 前提
@@ -498,8 +509,9 @@ else { await envelope.response.text() /* 或者按 SSE 消费 */ }
   - **本插件已在 4.9.0 起从插件侧绕开它**：两条路由注册的 **model 身份统一为 `workbuddy`**（`src/adapter.ts` 的 `WORKBUDDY_MODEL_IDENTITY`），也就是模型自己声明的 `provider` 字段两边相同，于是 `isSameModel` 成立、换区不再把 thinking 降级成正文。**路由 id 没有合并**——它仍是 `workbuddy` / `workbuddy-global`，各自指向自己的 shim、目录与凭据，所以一侧故障不会带走另一侧，模型选择器也仍是两组。**4.9.0/4.9.1 的这版修复漏了一半，国际版整区不可用（issue #75）**：上面的说法只对 `getModel(provider, id)` 这一条按**参数**查表的路径成立；真正跑聊天的 `models.streamSimple(model, …)` 第一步是 `requireProvider(model)` = `providers.get(model.provider)`（`models.js:351–355`），查的是**模型上盖的那个字段**。于是国内版（路由 `workbuddy`、盖 `workbuddy`）自洽，国际版（路由 `workbuddy-global`、盖 `workbuddy`）在只注册了 `workbuddy-global` 的注册表里查不到，**每一个请求都在发出前就抛 `Unknown provider: workbuddy`**——一次也会失败，且报错里不带任何 WorkBuddy 字样，看起来像宿主坏了。**4.9.2 起改为：每条路由把自己的注册表同时登记上「路由 id」和「共享身份」两个键**（`src/adapter.ts` 的 `modelIdentityKeysOf`），模型上盖的身份仍然两边相同（#59 不回退），而 `requireProvider` 在国际版自己的注册表里也能查到、并拿到**国际版自己的** provider 对象（含它自己的 shim 地址与凭据）。pi-ai 的注册表本来就是 `Map`（`models.js:37` 的 `providers.set(provider.id, provider)`，键取的是 **provider 对象的 `id`**，不是 profiles 映射的键），所以这是注册表原生支持的事；**路由集合、模型选择器、目录与凭据都没有变化**，多出来的那个键不出现在任何 UI 里。回归测试 `tests/issue75-global-provider-dispatch.spec.ts` 走的是宿主的真实构造（`createModels` + `setProvider` + `streamSimple`），并保留一个反证用例固定住旧的失败文案。详见 `docs/audit/ISSUE59-OPTIONS.md` 的「#75 CORRECTION」一节。
   - 升级后仍可能看到计数变化的部分：**在同一区域内换模型**仍会降级（`model` 那条腿是真的换了模型，thinking 签名未必对新模型有效，保留才是错的）——降级本身无法消除，但**它变成正文这件事可以**，见下面 `dropForeignThinking` 那一条；**升级之前就录在历史里的消息**带着旧的按区域 id，重放时仍按旧规则降级——这种历史只会越聊越少，不会反过来影响新录的消息。
   - **降级不只是计数问题：思考会变成正文，模型随后照抄这个格式（issue #147）。** 上一条说的是「thinking 被降级」对计费的影响，这条说的是它对**内容**的影响。pi-ai 对 `isSameModel` 不成立的消息**不是丢弃** thinking，而是把它改写成 `{type:'text'}`（`transform-messages.js:87–90`）——也就是答案通道。于是跨 provider 切换后，**另一个模型的内部工作笔记会作为本轮回答呈现**，模型读到「我过去的思考都是正文」这个形状后，接下来的每一轮都继续把计划写进正文。报告者在一轮真实会话里量到：80 条 assistant 消息中 56 条带正文而自身 `reasoning` ≤ 1 字符，其中 20 条是英文工作笔记、合计 58,960 字符；整轮 60,984 字符正文里 CJK 只剩 1.37%，而此前 6 轮的可见回复全是中文。它同时把会话从 696,966 推到 758,005 total token（压缩阈值 800,000）。
-    - **开关 `dropForeignThinking`（默认关闭）**：打开后，本插件在请求发出前**删掉**那些「本来会被压成正文」的外来 thinking 块。之所以是删而不是保留：这些块由宿主以 `foreignAssistant()` 构造，**不带 `thinkingSignature`**，即使被当成自己的轮次也无法作为带签名的 reasoning 重放——它们对线上唯一的贡献就是被压成的那段正文。正文块与工具调用一律不动，每条消息的身份也不动。
-    - 关闭时**一个字节都不变**，与之前版本完全一致——它改的是上游会数到的字节，所以按 `usageIdentity` 的同一条规矩做成显式 opt-in。
+    - **跨 provider 的 foreign thinking 无条件丢弃；开关 `dropForeignThinking` 只负责同一路由内换模型（默认关闭）**：本插件在请求发出前**删掉**那些「本来会被压成正文」的外来 thinking 块。之所以是删而不是保留：这些块由宿主以 `foreignAssistant()` 构造，**不带 `thinkingSignature`**，即使被当成自己的轮次也无法作为带签名的 reasoning 重放——它们对线上唯一的贡献就是被压成的那段正文。正文块与工具调用一律不动，每条消息的身份也不动。
+    - **跨 provider 不设开关**：换 provider 后宿主把另一家的 assistant 轮次重建成 `dsh-foreign`，pi-ai 会把它们的 thinking 摊成 assistant 正文；WorkBuddy 网关正好扫描 assistant 消息，于是整轮以 `11128` 被拒（issue #163 的现场：14,410 / 4,225 / 5,138 字的 reasoning 被当成正文重放，三次原地救援与三轮自动「继续」全失败）。这些块本来就不可能作为 reasoning 重放，丢弃是纠正而不是偏好，所以不等待用户 opt-in。`dropForeignThinking` 只把同样的修复扩展到**同一路由内换模型**（`hy3` → `deepseek-v4.1-flash`，两边都由本插件提供、都盖 `provider: workbuddy`）；那一条的关闭路径仍**一个字节都不变**。
+    - 自动丢弃时写一条 warn（仅在开关关闭时），`latestForeignThinking` 仍照旧上报，日志里能看出这次请求删掉了哪些块。
     - 顺序很关键：修复跑在 `alignAssistantIdentities` **之后**。国际区自己的轮次到达时也带 `api: 'dsh-foreign'`（宿主的重放降级路径），先诊断会把它误判成外来轮次并删掉它自己的推理——那正是 #102 的反向回归。`tests/issue147-foreign-thinking.spec.ts` 用真实 pi-ai 的 `transformMessages` 钉住了这个顺序。
     - 已经录进历史的坏轮次**不会**被追溯修复：它们已经作为正文存在会话里，开关只管之后的请求。想彻底摆脱，切换 provider 后新开会话是最直接的办法。
     - **它同时覆盖「同一个区域内换模型」**（`hy3` → `deepseek-v4.1-flash`，两者都由本插件提供、都盖 `provider: workbuddy`）。这时 provider 与 api 两条腿都相等，判据只差 `model` 一条腿——5.12.0 的判定只比前两条，因此这种切换**一个块也检不出**，开关看起来无效。判断所需的 model id 由请求入口（`stream` / `streamSimple` 的 `model.id`）传入；不传时行为与 5.12.0 完全一致，卡片那条只读路径因此不受影响（它读的本来就是请求路径填好的 `lastForeignThinking`）。
@@ -526,6 +538,11 @@ else { await envelope.response.text() /* 或者按 SSE 消费 */ }
 - [Sliverkiss/workbuddy2api](https://github.com/Sliverkiss/workbuddy2api)（MIT）— WorkBuddy 上游协议（`copilot.tencent.com` 的 wire behavior）的参照实现，经 `dsh-workbuddy-connect` 转引。
 - [hawklithm/workbuddy2api](https://github.com/hawklithm/workbuddy2api)（MIT，Copyright (c) 2026 Mayer）— **本项目的致谢名单里唯一一项「代码移植」而非「思路参照」**：其 `src/codebuddy_proxy/dsml_parser.py` 是一份代理同一 WorkBuddy/CodeBuddy 上游的 DSML 工具调用解析器，本项目把它移植为 `src/dsml-recovery.ts`（标签状态机、忽略区域判定、缺包裹修复、参数递归解析、流式缓冲），并在其上补了它没有的两道闸（工具名必须在本次请求声明的工具里、无声明工具完全不做恢复）。三处有意偏离逐条写在该文件头部，义务声明见 [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md)。
 
+### 自动续跑的语义参照
+
+- [HsiangNianian/dsh-auto-continue](https://github.com/HsiangNianian/dsh-auto-continue)（MIT）— 「连续失败上限」这套语义的来源：发出时计数自增、达到上限停止、成功回合清零、跳过子代理会话。本项目的 `channelRejectContinue` 只取这层语义，未照搬其引擎。
+- [YuJunZhiXue/dsh-purge](https://github.com/YuJunZhiXue/dsh-purge)（MIT）— 三处具体做法：哪些失败码不该续（配额/限流/传输）、收件箱有排队就不插队、以及用消息的 `source.kind` 区分真人介入与插件自己的消息。
+
 ### 插件呈现与结构的基线
 
 - [dingminhua/dsh-connect-trae](https://github.com/dingminhua/dsh-connect-trae)（MIT，Copyright (c) 2026 LaoDing）— 插件的呈现方式与其保持一致：设置卡片的结构与交互、模型管理（刷新 → 勾选 → 保存）与账号选择模型、只读的 host↔client 路由形态，以及 npm 发布工程。

package/THIRD_PARTY_NOTICES.md

@@ -35,6 +35,15 @@
 | `dsh-subagent-default-model` | <https://github.com/dingminhua/dsh-subagent-default-model> | `dsm-*` 卡片 CSS、`row.*` 文案键约定、品牌图标 | **MIT**（Copyright (c) 2026 LaoDing） |
 | `dsh-codex-connect` | <https://github.com/franksong2702/dsh-codex-connect> | DSH 插件结构与 pi-ai provider 注册的参照（经 `dsh-workbuddy-connect` 转引） | **Apache-2.0** |
 
+### 与「失败后自动续跑」相关（5.13.0 新增）
+
+| 项目 | 仓库 | 参考内容 | 许可证 |
+| --- | --- | --- | --- |
+| `dsh-client-auto-continue` | <https://github.com/HsiangNianian/dsh-auto-continue> | 「连续失败上限」这一整套语义：发出时 `consecutive` 自增、达到 `maxConsecutive` 停止、成功回合清零、`session.header.origin === 'subagent'` 跳过子代理、用 `agent.followup(createUserMessage(...))` 投递。`src/channel-continue.ts` 只取这层语义，未照搬其约 1590 行的引擎（收尾原因矩阵、自适应退避、自主循环、循环守卫、通知） | **MIT** |
+| `dsh-purge` | <https://github.com/YuJunZhiXue/dsh-purge> | `lib/continue-retry.js` 的三处做法：`NO_CONTINUE_CODES`（配额/限流/传输这类「重发也拿同一句回答」的失败不续）、`inboxBusy`（收件箱有排队就不插队）、以及用 `user/message` 的 `source.kind` 区分真人介入与插件自己的消息 | **MIT** |
+
+> 两项均为**思路参照**，未复制其源码。本项目相对两者是收窄：只认 `channel_reject` 一种失败、不换号、不原地重试、不落盘状态。逐条差异写在 `src/channel-continue.ts` 的头部注释里（`docs/DESIGN.md` §5.3 要求）。
+
 ## 三、Apache-2.0 特别说明
 
 `dsh-codex-connect` 采用 **Apache License 2.0**，其义务重于 MIT。本项目对它的参考是**间接的**：经由 `dsh-workbuddy-connect` 转引其 DSH 插件结构与 provider 注册思路。即便如此，本项目仍遵守 Apache-2.0 第 4 条的要求：

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as WorkBuddyCredentialStore, D as defaultDesktopAuthDirs, E as defaultDesktopAuthCandidates, I as workbuddyOwnAuthPath, Lt as WORKBUDDY_APP_EXECUTABLE_ENV, M as legacyWorkbuddyOwnAuthPath, S as WORKBUDDY_AUTH_FILE_ENV, Ut as findWorkbuddyAppExecutableWithSource, V as WorkBuddyUpstreamClient, Zt as hostPeersInfo, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as rosterSeenPath, f as piAiRuntimeInfo, m as FALLBACK_WORKBUDDY_MODELS_GLOBAL, o as workbuddyHostHeartbeatPath, p as FALLBACK_WORKBUDDY_MODELS, r as isHeartbeatProcessAlive, u as describeRosterSeenPayload } from "./host-heartbeat-guET27pw.js";
+import { C as WorkBuddyCredentialStore, D as defaultDesktopAuthDirs, E as defaultDesktopAuthCandidates, I as workbuddyOwnAuthPath, Lt as WORKBUDDY_APP_EXECUTABLE_ENV, M as legacyWorkbuddyOwnAuthPath, S as WORKBUDDY_AUTH_FILE_ENV, Ut as findWorkbuddyAppExecutableWithSource, V as WorkBuddyUpstreamClient, Zt as hostPeersInfo, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, d as rosterSeenPath, f as piAiRuntimeInfo, m as FALLBACK_WORKBUDDY_MODELS_GLOBAL, o as workbuddyHostHeartbeatPath, p as FALLBACK_WORKBUDDY_MODELS, r as isHeartbeatProcessAlive, u as describeRosterSeenPayload } from "./host-heartbeat-BtMcdOIa.js";
 import { readFile } from "node:fs/promises";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/lib/client.js

@@ -844,6 +844,41 @@ window.__ModuleLoader__.load({
 			return [...seen];
 		}
 		/**
+		* The `channelRejectContinue` block's defaults, mirroring the Host schema.
+		*
+		* Duplicated here rather than imported from the Host entry on purpose: this
+		* module is the browser half's node-free boundary (`src/index.ts` pulls in the
+		* whole provider stack), and the two values must agree, which a test pins.
+		*/
+		const CHANNEL_CONTINUE_DEFAULTS = {
+			enabled: false,
+			maxConsecutive: 1,
+			text: "继续"
+		};
+		/**
+		* Read the `channelRejectContinue` block out of a settings snapshot.
+		*
+		* Same defensive shape as {@link sessionTitleOf}: anything missing or malformed
+		* resolves to the schema's own defaults, so the card shows what the plugin will
+		* actually do instead of an empty control — and an absent block reads as OFF,
+		* because enabling this spends real requests without the user typing anything.
+		*
+		* @param configured - the whole settings snapshot.
+		* @returns the three values the switch renders.
+		*/
+		function channelRejectContinueOf(configured) {
+			const raw = unwrapVolatileDeep(configured?.["channelRejectContinue"]);
+			const block = typeof raw === "object" && raw !== null && !Array.isArray(raw) ? raw : {};
+			const max = block["maxConsecutive"];
+			const capped = typeof max === "number" && Number.isFinite(max) ? Math.min(10, Math.max(1, Math.trunc(max))) : CHANNEL_CONTINUE_DEFAULTS.maxConsecutive;
+			const text = block["text"];
+			return {
+				enabled: block["enabled"] === true,
+				maxConsecutive: capped,
+				text: typeof text === "string" && text.trim() !== "" ? text.trim() : CHANNEL_CONTINUE_DEFAULTS.text
+			};
+		}
+		/**
 		* Write one upstream-identity switch, verifying it landed.
 		*
 		* Same two writers as {@link writeCliBridgeEnabled} and for the same measured
@@ -876,7 +911,7 @@ window.__ModuleLoader__.load({
 			}
 			if (delivered) {
 				const after = scope.getSnapshot().value;
-				if (field === "usageIdentity" || field === "keepPromptLast" ? upstreamSwitchOf(after, field) === value : field === "sessionTitle" ? JSON.stringify(sessionTitleOf(after)) === JSON.stringify(value) : JSON.stringify(extraInjectedPrefixesOf(after)) === JSON.stringify([...value])) return;
+				if (field === "usageIdentity" || field === "keepPromptLast" ? upstreamSwitchOf(after, field) === value : field === "sessionTitle" ? JSON.stringify(sessionTitleOf(after)) === JSON.stringify(value) : field === "channelRejectContinue" ? JSON.stringify(channelRejectContinueOf(after)) === JSON.stringify(value) : JSON.stringify(extraInjectedPrefixesOf(after)) === JSON.stringify([...value])) return;
 			}
 			throw hostError instanceof Error ? hostError : new WorkBuddySettingsWriteError(field, "neither the Host save endpoint nor the settings scope persisted the value");
 		}
@@ -5041,7 +5076,7 @@ window.__ModuleLoader__.load({
    CONTRAST colour, so a ticked box painted itself as a heavy black pill — the
    loudest object in a section made of plain 13px text. */
 .dsm-workbuddy-pref input{flex:none;cursor:pointer;accent-color:var(--dsw-alias-brand-primary,#5686fe)}
-.dsm-workbuddy-pref-check,.dsm-workbuddy-image-tool-check,.dsm-workbuddy-video-tool-check,.dsm-workbuddy-cli-bridge-check,.dsm-workbuddy-upstream-check{inline-size:15px;block-size:15px;margin:3px 0 0}
+.dsm-workbuddy-pref-check,.dsm-workbuddy-image-tool-check,.dsm-workbuddy-video-tool-check,.dsm-workbuddy-cli-bridge-check,.dsm-workbuddy-upstream-check,.dsm-workbuddy-channel-continue-check{inline-size:15px;block-size:15px;margin:3px 0 0}
 /* The upstream-identity switches are their own group, so they get a divider
    above them instead of relying on spacing alone: they change the request the
    whole plugin sends, not a per-region display choice, and reading them as the
@@ -6655,6 +6690,8 @@ window.__ModuleLoader__.load({
 			const [keepPromptLastBusy, setKeepPromptLastBusy] = (0, react.useState)(false);
 			const [sessionTitleOn, setSessionTitleOn] = (0, react.useState)(void 0);
 			const [sessionTitleBusy, setSessionTitleBusy] = (0, react.useState)(false);
+			const [channelRejectContinueOn, setChannelRejectContinueOn] = (0, react.useState)(void 0);
+			const [channelRejectContinueBusy, setChannelRejectContinueBusy] = (0, react.useState)(false);
 			/**
 			* Probe results, keyed by region then model id.
 			*
@@ -7166,6 +7203,22 @@ window.__ModuleLoader__.load({
 			/** The custom injected prefixes in effect, used only to REPORT their count. */
 			const extraInjectedPrefixes = () => extraInjectedPrefixesOf(settingsScope?.getSnapshot().value);
 			/**
+			* The auto-continue block after a channel-gate refusal (see
+			* `src/channel-continue.ts`), read the three-level way the other switches are.
+			*
+			* The cap and the text are read from the committed document rather than
+			* mirrored in card state: only `enabled` has a control here, so a local copy of
+			* the other two would be a second source of truth for values this card can
+			* only READ.
+			*/
+			const channelRejectContinueValue = () => {
+				const committed = channelRejectContinueOf(settingsScope?.getSnapshot().value);
+				return channelRejectContinueOn === void 0 ? committed : {
+					...committed,
+					enabled: channelRejectContinueOn
+				};
+			};
+			/**
 			* Flip one upstream-identity switch.
 			*
 			* No `refreshUsage` afterwards, unlike the CLI switch: these change the shape
@@ -7175,13 +7228,16 @@ window.__ModuleLoader__.load({
 			*/
 			const toggleUpstreamSwitch = async (field, enabled) => {
 				if (settingsScope === void 0) return;
-				const setBusy = field === "usageIdentity" ? setUsageIdentityBusy : field === "keepPromptLast" ? setKeepPromptLastBusy : setSessionTitleBusy;
-				const setOwn = field === "usageIdentity" ? setUsageIdentityOn : field === "keepPromptLast" ? setKeepPromptLastOn : setSessionTitleOn;
+				const setBusy = field === "usageIdentity" ? setUsageIdentityBusy : field === "keepPromptLast" ? setKeepPromptLastBusy : field === "sessionTitle" ? setSessionTitleBusy : setChannelRejectContinueBusy;
+				const setOwn = field === "usageIdentity" ? setUsageIdentityOn : field === "keepPromptLast" ? setKeepPromptLastOn : field === "sessionTitle" ? setSessionTitleOn : setChannelRejectContinueOn;
 				setBusy(true);
 				try {
 					await writeUpstreamSwitch(settingsScope, field, field === "sessionTitle" ? {
 						...sessionTitleOf(settingsScope.getSnapshot().value),
 						enabled
+					} : field === "channelRejectContinue" ? {
+						...channelRejectContinueOf(settingsScope.getSnapshot().value),
+						enabled
 					} : enabled);
 					if (mounted.current) setOwn(enabled);
 				} catch (error) {
@@ -8302,6 +8358,61 @@ window.__ModuleLoader__.load({
 					})]
 				}, field))]
 			});
+			/**
+			* The opt-in auto-continue after a channel-gate refusal.
+			*
+			* Its own group, NOT a row in {@link upstreamSwitches} above, because it
+			* breaks that group's one shared promise: those four are sampled when the
+			* plugin mounts and need a reload, while this one is read on every failure and
+			* takes effect immediately. Hiding that difference behind a shared hint would
+			* teach the user the wrong rule for exactly the switch where being wrong is
+			* expensive — this one spends real requests.
+			*
+			* The cap and the text are REPORTED while the switch is on, not edited: both
+			* already live in the config file, and the cap is the one number the user asked
+			* to be exactly 3, so an unvalidated free-text field here would be a second way
+			* to get it wrong.
+			*/
+			const channelRejectContinuePreference = /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+				className: "dsm-workbuddy-prefs",
+				children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+					className: "dsm-workbuddy-pref dsm-workbuddy-upstream-pref",
+					title: t("row.channelRejectContinueHint"),
+					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+						type: "checkbox",
+						className: "dsm-workbuddy-channel-continue-check",
+						checked: channelRejectContinueValue().enabled,
+						disabled: !canWrite || saving || poolBusy || channelRejectContinueBusy,
+						onChange: (event) => {
+							toggleUpstreamSwitch("channelRejectContinue", event.target.checked);
+						}
+					}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+						className: "dsm-workbuddy-pref-copy",
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "dsm-workbuddy-pref-label",
+								children: t("row.channelRejectContinueLabel")
+							}),
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+								className: "dsm-workbuddy-pref-hint",
+								children: t("row.channelRejectContinueHint")
+							}),
+							channelRejectContinueValue().enabled ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+								className: "dsm-workbuddy-pref-hint",
+								children: [
+									t("row.channelRejectContinueLimit"),
+									" ",
+									String(channelRejectContinueValue().maxConsecutive),
+									" · ",
+									t("row.channelRejectContinueText"),
+									" ",
+									channelRejectContinueValue().text
+								]
+							}) : null
+						]
+					})]
+				})
+			});
 			const creditPreferences = /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: "dsm-workbuddy-prefs",
 				children: [
@@ -8866,7 +8977,8 @@ window.__ModuleLoader__.load({
 											children: t("row.panelCapabilitiesHint")
 										}),
 										creditPreferences,
-										upstreamSwitches
+										upstreamSwitches,
+										channelRejectContinuePreference
 									]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
@@ -11038,6 +11150,10 @@ window.__ModuleLoader__.load({
 			"row.sessionTitleHint": "The host fires one title request per new session and bills it at the main model rate. This re-points that one request at a hidden lightweight model. The request still happens either way. Off by default.",
 			"row.sessionTitleModel": "Target model:",
 			"row.extraPrefixesCount": "Custom injected prefixes in effect:",
+			"row.channelRejectContinueLabel": "Resend 「继续」 after the gateway refuses the request",
+			"row.channelRejectContinueHint": "LAST RESORT, not a fix for 11128. When the gateway answers 400 with code 11128 (「被网关的渠道校验拦截」), the turn just fails: the plugin never retries it in place and never swaps accounts, because the gate matches the message contents and every account sends the same ones. Fixed system fingerprints are byte-identical every turn, so resending only pays for the same 400 again; since 5.13.1 `prepareChatBody` rewrites known phrases instead. The narrow case this can help is content that changes between turns. It sends the text below as a NEW turn and spends a real request each time. Stops after N CONSECUTIVE sends (default 1); one successful turn, or one message you type yourself, resets the count. Subagent sessions are never touched. Off by default. Takes effect immediately, no reload.",
+			"row.channelRejectContinueLimit": "Max consecutive sends:",
+			"row.channelRejectContinueText": "Text sent:",
 			"row.cliBridgeLabel": "Let the local CodeBuddy CLI do the work",
 			"row.cliBridgeHint": "Adds the codebuddy_ask tool and the /codebuddy command. Each call spends CodeBuddy quota. injectResult only affects /codebuddy — its result is injected back into the session, costing one DSH turn when the session is idle; tool calls never read it. Rate-limited: 6 turns per session per hour, 20 per process per hour, one turn at a time. Off by default.",
 			"row.cliBridgeModelLabel": "CLI model",
@@ -11468,6 +11584,10 @@ window.__ModuleLoader__.load({
 			"row.sessionTitleHint": "宿主每个新会话都会发一次标题请求，并按主模型费率计费；开启后这一次改投隐藏的轻量模型。请求无论开不开都会发出。默认关闭。",
 			"row.sessionTitleModel": "目标模型：",
 			"row.extraPrefixesCount": "生效的自定义注入前缀：",
+			"row.channelRejectContinueLabel": "被网关渠道校验拦截后，自动再发一次「继续」",
+			"row.channelRejectContinueHint": "最后兜底，不是 11128 的修复。上游用 400 + code 11128（「被网关的渠道校验拦截」）拒绝时，这一轮就直接失败了：插件不会在原地重试，也不会换号——网关匹配的是消息内容，每个账号发出去都一样。固定 system 指纹每一轮逐字节相同，重发只会再付一次同一个 400；5.13.1 起由 `prepareChatBody` 按句改词处理。只有被拒内容刚好随轮次变化的窄情况才可能靠新回合碰过去。它会把下面这句作为新回合发出，每次真实消耗一次请求；默认只发 1 次、默认关闭；连续计数，成功一轮或你自己发一条消息即清零。子代理会话一律不碰，改完立即生效，不必重载插件。",
+			"row.channelRejectContinueLimit": "连续发送上限：",
+			"row.channelRejectContinueText": "发送的文本：",
 			"row.cliBridgeLabel": "允许调用本机 CodeBuddy CLI 干活",
 			"row.cliBridgeHint": "开启后多出 codebuddy_ask 工具与 /codebuddy 指令；每次调用花 CodeBuddy 配额。injectResult 只影响 /codebuddy：其结果回注会话，会话空闲时多花一次 DSH 回合；工具调用不读它。限流：每会话每小时 6 回合、每进程每小时 20 回合、同时只跑一个回合。默认关闭。",
 			"row.cliBridgeModelLabel": "CLI 模型",

package/lib/{host-heartbeat-guET27pw.js → host-heartbeat-BtMcdOIa.js}

@@ -3503,6 +3503,91 @@ function scansOpening(role) {
 	return name === "system" || name === "assistant";
 }
 /**
+* The gateway's current content fingerprints, and same-meaning rewrites for
+* them (issue #163).
+*
+* WHY REWRITE INSTEAD OF ZERO-WIDTH. On 2026-10-29 two independent probes
+* measured that the CN gateway normalizes invisible characters before matching:
+* the DSH identity with U+200B at every word boundary still answers 11128.
+* `breakIdentityClauses` and both perturbation rungs therefore cannot help this
+* family. A real wording change is what the same probes measured as 200.
+*
+* WHY SENTENCE-LEVEL, NOT ONE WHOLE-PARAGRAPH LITERAL. The third fingerprint is
+* an eight-sentence, roughly 800-character @-path paragraph. Two reporters
+* measured that each sentence alone answers 200 and the whole paragraph answers
+* 400 — it is a COMBINATION, not a single listed sentence. Replacing the
+* paragraph as one literal would stop matching the moment the host changes one
+* word; replacing every sentence breaks the combination and keeps working when
+* only some of the text moves. The rows below are the table proposed in issue
+* #163 (yicneggima-glitch, 18:56; QIYU-PLUS, 18:57), with the identity and Web
+* GUI rows both probes measured.
+*
+* `from` strings are matched ANYWHERE, not just at an opening, because the
+* measured rule is position-independent. Only a hit is replaced; every other
+* byte is left alone, so an ordinary conversation is unchanged.
+*/
+const CHANNEL_GATE_PHRASES = [
+	["You are an AI agent powered by DeepSeek Harness", "You are an AI agent running inside DeepSeek Harness"],
+	["You are a coding agent powered by the ", "You are a coding agent running on the "],
+	["You are interacting with the user through the DeepSeek Harness Web GUI", "You are working with the user inside the DeepSeek Harness Web GUI"],
+	["Agent Teams is available in this session", "Agent Teams is enabled for this session"],
+	["Tokens prefixed with @ are paths the user explicitly referenced.", "Paths that begin with @ are the ones the user explicitly referenced."],
+	["Relative paths resolve from the workspace root;", "Relative paths are resolved against the workspace root;"],
+	["absolute paths identify files or directories on the host.", "absolute paths point at files or directories on the host."],
+	["A trailing slash marks a directory:", "A trailing slash indicates a directory:"],
+	["list it when its contents matter.", "list it whenever its contents matter."],
+	["Anything else is a file:", "Everything else is a file:"],
+	["use the read tool when its contents are needed,", "use the read tool whenever you need its contents,"],
+	["and do not claim to have inspected it before reading.", "and never claim to have inspected it before reading it."],
+	["@\"...\" quotes a path containing spaces.", "A path containing spaces is quoted with @\"...\"."]
+];
+/**
+* Rewrite the measured gate phrases in one text part.
+*
+* Exported for the tests and for callers that build a body themselves. It is
+* idempotent: every `to` string is different from its `from` string and no
+* rewrite recreates another `from` string, so a second pass is a no-op.
+*/
+function rewriteChannelFingerprintPhrases(text) {
+	let out = text;
+	for (const [from, to] of CHANNEL_GATE_PHRASES) if (out.includes(from)) out = out.replaceAll(from, to);
+	return out;
+}
+/**
+* Apply {@link rewriteChannelFingerprintPhrases} to every scanned text part.
+*
+* `system` and `assistant` only (the roles the gate reads). `user` and `tool`
+* are deliberately untouched: QIYU-PLUS re-measured both on 2026-10-29 and
+* both answer 200 with the DSH identity at an opening, and rewriting a user's
+* own words would change the conversation for no gate.
+*/
+function rewriteChannelFingerprintPhrasesInBody(obj) {
+	const messages = obj["messages"];
+	if (!Array.isArray(messages)) return;
+	for (const value of messages) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) continue;
+		const message = value;
+		if (!scansOpening(message["role"])) continue;
+		const content = message["content"];
+		if (typeof content === "string") {
+			const next = rewriteChannelFingerprintPhrases(content);
+			if (next !== content) message["content"] = next;
+			continue;
+		}
+		if (!Array.isArray(content)) continue;
+		for (const part of content) {
+			if (typeof part !== "object" || part === null || Array.isArray(part)) continue;
+			const record = part;
+			const type = record["type"];
+			if (typeof type !== "string" || type.trim().toLowerCase() !== "text") continue;
+			const text = record["text"];
+			if (typeof text !== "string") continue;
+			const next = rewriteChannelFingerprintPhrases(text);
+			if (next !== text) record["text"] = next;
+		}
+	}
+}
+/**
 * Move every scanned message (`system` and `assistant`) off the content
 * fingerprint above by prepending the placeholder head.
 *
@@ -4153,6 +4238,7 @@ function prepareChatBody(source, options) {
 	}
 	ensureSystemHead(obj);
 	if (options?.keepPromptLast === true && Array.isArray(obj["messages"])) keepPromptLast(obj["messages"], injectedPrefixPattern(options.extraInjectedPrefixes));
+	rewriteChannelFingerprintPhrasesInBody(obj);
 	neutralizeChannelFingerprints(obj);
 	normalizeToolChoice(obj);
 	dropRefusedReasoning(obj);
@@ -7711,7 +7797,7 @@ function describeRosterSeenPayload(raw) {
 //#endregion
 //#region src/version.ts
 /** The npm package version this build was produced from. */
-const WORKBUDDY_CONNECT_VERSION = "5.12.4";
+const WORKBUDDY_CONNECT_VERSION = "5.13.1";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -2334,12 +2334,21 @@ interface WorkBuddyAdapterOptions {
    */
   piAiGeneration?: PiAiGeneration;
   /**
-   * Drop foreign thinking blocks pi-ai would publish as prose (issue #147).
-   *
-   * OFF by default, and read LIVE (a getter, not a boolean) so the switch takes
-   * effect on the next request without reloading the plugin: turning it on
-   * mid-session is the whole point — the user sees the working-notes turn,
-   * flips the switch, and the next turn is answered normally.
+   * Drop SAME-ROUTE foreign thinking blocks pi-ai would publish as prose
+   * (issue #147).
+   *
+   * CROSS-PROVIDER turns are dropped unconditionally: after a provider switch
+   * the host rebuilds the other provider's assistant turns as `dsh-foreign`,
+   * their unsigned thinking blocks can never be replayed, and pi-ai would
+   * otherwise flatten them into assistant prose that the WorkBuddy gateway
+   * refuses with 11128 (issue #163's measured scene). This switch only widens
+   * the repair to a model switch INSIDE one of this bundle's own routes.
+   *
+   * OFF by default for that same-route leg, and read LIVE (a getter, not a
+   * boolean) so the switch takes effect on the next request without reloading
+   * the plugin: turning it on mid-session is the whole point — the user sees
+   * the working-notes turn, flips the switch, and the next turn is answered
+   * normally.
    */
   dropForeignThinking?: () => boolean;
   /**
@@ -5200,6 +5209,37 @@ interface Config {
      */
     model?: string;
   };
+  /**
+   * 被网关渠道校验拦截（`channel_reject` / 11128）之后自动再发一次「继续」，
+   * 可选、有上限。默认关闭。
+   *
+   * 这条失败**不换号也不重试**（`isFailoverWorthy` 刻意把它排除在外：网关匹配的
+   * 是消息开头，换账号只会每个账号白烧一次请求），所以这一轮就此结束，用户看到的
+   * 是「本轮运行失败400: … 被网关的渠道校验拦截 …」。固定指纹由 `prepareChatBody`
+   * 的按句改词处理；这条开关只是**最后兜底**：只有被拒内容刚好随轮次变化的窄情况
+   * 才可能靠新回合碰过去。固定 system 指纹每轮相同，重发也救不了（#163 实测）。
+   *
+   * 默认关闭的理由与 {@link Config.usageIdentity} 相同：它会在用户没有发消息的
+   * 情况下花掉真实请求，属于必须显式授权的开销。上限默认 1 次：1 次救不了，3 次也
+   * 救不了，旧默认 3 只会把同一个 400 付三遍。
+   */
+  channelRejectContinue?: {
+    /**
+     * 是否启用自动续发。只有显式 `true` 才算开启。
+     */
+    enabled?: boolean;
+    /**
+     * 连续自动续发的次数上限（默认 1，夹在 1..10）。
+     *
+     * 「连续」是关键：一次成功回合、或者用户自己发了一条消息，计数立刻清零。
+     * 所以上限拦的是「一直过不去就一直试」，而不是这个会话一生的总次数。
+     */
+    maxConsecutive?: number;
+    /**
+     * 续发时发送的文本，默认「继续」。
+     */
+    text?: string;
+  };
 }
 /**
  * Mark a schema's field as volatile on the DSH lines that support it.

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as parseCreditMultiplier, $t as withFileLock, A as isEncryptedCredentialError, At as pickMediaModel, B as WorkBuddyCredentialRejectedError, Bt as deriveAtRestKeyId, C as WorkBuddyCredentialStore, Ct as IMAGE_TAG_TEXT_TO_IMAGE, D as defaultDesktopAuthDirs, Dt as imageMimeForPath, E as defaultDesktopAuthCandidates, Et as imageDataUrl, F as workbuddyAccountId, Ft as imageDefaultFor, G as forceNeutralHead, Gt as isWorkbuddyBundle, H as channelGateMemberOf, Ht as findWorkbuddyAppExecutable, I as workbuddyOwnAuthPath, It as nativeModalityOf, J as isCredentialRejectedError, Jt as openEncryptedField, K as isContextTooLongBody, Kt as macosBundleExecutable, L as CONTEXT_OVERFLOW_MARKER, Lt as WORKBUDDY_APP_EXECUTABLE_ENV, M as legacyWorkbuddyOwnAuthPath, Mt as parseQueueAnswer, N as parseWorkBuddyAuth, Nt as queueNoticeText, O as defaultDesktopAuthPath, Ot as isBareBase64Image, P as preferredAccountName, Pt as NATIVE_MODALITY_BY_MODEL_ID, Q as openingEvidenceOfBody, Qt as resolveDshHome, R as CREDENTIAL_REJECTED_CODE, Rt as clearAtRestKeyCache, S as WORKBUDDY_AUTH_FILE_ENV, St as IMAGE_TAG_IMAGE_TO_IMAGE, T as authFileName, Tt as WorkBuddyImageError, U as classifyUpstreamError, V as WorkBuddyUpstreamClient, Vt as fetchAtRestKeyPayload, W as declaredTools, Wt as isEncryptedFieldWrapper, X as knownRegionOf, Xt as workbuddyAppExecutableCandidates, Y as isFirstMessageGateBody, Yt as readAtRestKey, Z as modelIdOfBody, _ as deriveCatalog, _t as WorkBuddyVideoError, a as readHostHeartbeat, at as requestEvidenceOf, b as ENCRYPTED_CREDENTIAL_CODE, bt as resolveVideoParams, c as WORKBUDDY_CONNECT_VERSION, ct as REFUSES_OFF_MODEL_IDS, dt as offDefaultFor, en as writeFileAtomic, et as parseReasoning, f as piAiRuntimeInfo, ft as offRefused, g as applyContextBudgets, gt as VIDEO_TAG_TEXT_TO_VIDEO, h as WorkBuddyCatalog, ht as VIDEO_TAG_IMAGE_TO_VIDEO, i as processStartTimeMs, it as regionOf, j as isVaultAccountId, jt as sniffImageMime, k as hasEncryptedCredentialFields, kt as parseImageDataUrl, l as createFileRosterSeenStore, lt as defaultOffModelIds, m as FALLBACK_WORKBUDDY_MODELS_GLOBAL, mt as withEffectiveOff, n as clearHostHeartbeat, nt as perturbChannelFingerprints, o as workbuddyHostHeartbeatPath, ot as rewriteSessionTitleModel, p as FALLBACK_WORKBUDDY_MODELS, pt as recordRefusal, q as isConversationIdGateBody, qt as macosNestedAppBundles, r as isHeartbeatProcessAlive, rt as prepareChatBody, s as writeHostHeartbeat, st as attachBusyLevels, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as parseUpstreamModel, ut as lastRefusalFor, v as fallbackModelsFor, vt as parseSupportedSecondsRange, w as WorkBuddyEncryptedCredentialError, wt as MAX_INPUT_IMAGE_BYTES, x as WORKBUDDY_AUTH_FILENAME, xt as DEFAULT_IMAGE_SIZE, y as withoutRouters, yt as pickVideoModel, z as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, zt as deriveAtRestKey } from "./host-heartbeat-guET27pw.js";
+import { $ as parseCreditMultiplier, $t as withFileLock, A as isEncryptedCredentialError, At as pickMediaModel, B as WorkBuddyCredentialRejectedError, Bt as deriveAtRestKeyId, C as WorkBuddyCredentialStore, Ct as IMAGE_TAG_TEXT_TO_IMAGE, D as defaultDesktopAuthDirs, Dt as imageMimeForPath, E as defaultDesktopAuthCandidates, Et as imageDataUrl, F as workbuddyAccountId, Ft as imageDefaultFor, G as forceNeutralHead, Gt as isWorkbuddyBundle, H as channelGateMemberOf, Ht as findWorkbuddyAppExecutable, I as workbuddyOwnAuthPath, It as nativeModalityOf, J as isCredentialRejectedError, Jt as openEncryptedField, K as isContextTooLongBody, Kt as macosBundleExecutable, L as CONTEXT_OVERFLOW_MARKER, Lt as WORKBUDDY_APP_EXECUTABLE_ENV, M as legacyWorkbuddyOwnAuthPath, Mt as parseQueueAnswer, N as parseWorkBuddyAuth, Nt as queueNoticeText, O as defaultDesktopAuthPath, Ot as isBareBase64Image, P as preferredAccountName, Pt as NATIVE_MODALITY_BY_MODEL_ID, Q as openingEvidenceOfBody, Qt as resolveDshHome, R as CREDENTIAL_REJECTED_CODE, Rt as clearAtRestKeyCache, S as WORKBUDDY_AUTH_FILE_ENV, St as IMAGE_TAG_IMAGE_TO_IMAGE, T as authFileName, Tt as WorkBuddyImageError, U as classifyUpstreamError, V as WorkBuddyUpstreamClient, Vt as fetchAtRestKeyPayload, W as declaredTools, Wt as isEncryptedFieldWrapper, X as knownRegionOf, Xt as workbuddyAppExecutableCandidates, Y as isFirstMessageGateBody, Yt as readAtRestKey, Z as modelIdOfBody, _ as deriveCatalog, _t as WorkBuddyVideoError, a as readHostHeartbeat, at as requestEvidenceOf, b as ENCRYPTED_CREDENTIAL_CODE, bt as resolveVideoParams, c as WORKBUDDY_CONNECT_VERSION, ct as REFUSES_OFF_MODEL_IDS, dt as offDefaultFor, en as writeFileAtomic, et as parseReasoning, f as piAiRuntimeInfo, ft as offRefused, g as applyContextBudgets, gt as VIDEO_TAG_TEXT_TO_VIDEO, h as WorkBuddyCatalog, ht as VIDEO_TAG_IMAGE_TO_VIDEO, i as processStartTimeMs, it as regionOf, j as isVaultAccountId, jt as sniffImageMime, k as hasEncryptedCredentialFields, kt as parseImageDataUrl, l as createFileRosterSeenStore, lt as defaultOffModelIds, m as FALLBACK_WORKBUDDY_MODELS_GLOBAL, mt as withEffectiveOff, n as clearHostHeartbeat, nt as perturbChannelFingerprints, o as workbuddyHostHeartbeatPath, ot as rewriteSessionTitleModel, p as FALLBACK_WORKBUDDY_MODELS, pt as recordRefusal, q as isConversationIdGateBody, qt as macosNestedAppBundles, r as isHeartbeatProcessAlive, rt as prepareChatBody, s as writeHostHeartbeat, st as attachBusyLevels, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, tt as parseUpstreamModel, ut as lastRefusalFor, v as fallbackModelsFor, vt as parseSupportedSecondsRange, w as WorkBuddyEncryptedCredentialError, wt as MAX_INPUT_IMAGE_BYTES, x as WORKBUDDY_AUTH_FILENAME, xt as DEFAULT_IMAGE_SIZE, y as withoutRouters, yt as pickVideoModel, z as WORKBUDDY_FALLBACK_SYSTEM_PROMPT, zt as deriveAtRestKey } from "./host-heartbeat-BtMcdOIa.js";
 import z from "@deepseek-ai/schemastery";
 import { appendFile, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -1745,6 +1745,39 @@ function isForeignAssistant(message, identity, requestModelId) {
 	return typeof model === "string" && model !== requestModelId;
 }
 /**
+* Whether this assistant turn came from a DIFFERENT PROVIDER/route, rather than
+* from a different model on one of this bundle's own routes.
+*
+* WHY THIS DISTINCTION EXISTS (issue #163's live scene). A session switched
+* from `dsh-opencode-go` to a WorkBuddy route mid-turn. The host rebuilt the
+* other provider's assistant turns as `dsh-foreign`, and pi-ai rewrote their
+* unsigned `thinking` blocks into visible `text` — 14,410 / 4,225 / 5,138
+* characters in the measured scene. WorkBuddy's gateway scans every assistant
+* message and refused the turn with business code 11128; all three in-place
+* rescue rungs and three auto-`继续` attempts failed because the bytes never
+* changed.
+*
+* A cross-provider thinking block is different from a same-route model switch:
+* it carries no `thinkingSignature` (the host builds `foreignAssistant()`
+* without one), so it could never be replayed as reasoning. Its only possible
+* contribution to the wire is the prose pi-ai manufactures from it. Dropping it
+* is therefore a correctness repair, not a preference — and it must happen
+* even when the user never opted into {@link dropForeignThinking}.
+*
+* Same-route model switches (`hy3` → `deepseek-v4.1-flash`) stay behind the
+* explicit switch, because those turns WERE produced by this bundle and their
+* reasoning may be worth keeping in the transcript for the user to read.
+*/
+function isCrossProviderAssistant(message, identity, ownedRoutes) {
+	if (typeof message !== "object" || message === null) return false;
+	const record = message;
+	if (record["role"] !== "assistant") return false;
+	if (record["api"] === "dsh-foreign") return true;
+	const provider = record["provider"];
+	if (typeof provider !== "string") return true;
+	return provider !== identity && !ownedRoutes.includes(provider);
+}
+/**
 * Every foreign thinking block pi-ai would turn into visible prose (issue #147).
 *
 * THE DEFECT. pi-ai keeps a historical `thinking` block only while
@@ -1801,38 +1834,26 @@ function foreignThinkingOf(context, identity = WORKBUDDY_MODEL_IDENTITY, request
 	return found;
 }
 /**
-* Remove the foreign thinking blocks {@link foreignThinkingOf} finds.
-*
-* WHY REMOVAL IS THE HONEST REPAIR. The alternatives are both worse:
-*
-*   - LEAVE IT: pi-ai publishes the other provider's private working notes as
-*     this turn's answer (the #147 defect), so the user reads reasoning instead
-*     of a reply and the model imitates that shape forever after.
-*   - KEEP IT AS THINKING: impossible from here. `isSameModel` is pi-ai's own
-*     predicate over fields this plugin does not control (`model.provider` /
-*     `model.api` / `model.id` are compared against the MESSAGE's), and the
-*     only way to satisfy it is to claim the foreign turn as this model's own
-*     output — which is exactly the provenance lie issue #111 removed. These
-*     blocks carry no `thinkingSignature` (the host builds them that way), so
-*     they could not be replayed as signed reasoning even if claimed.
-*
-* Dropping is what the request builder already does with them in every other
-* branch: an unsigned foreign thinking block is never sent as
-* `reasoning_content`, so its only possible contribution to the wire was the
-* flattened prose this function removes. Every other block — text, tool calls —
-* is left exactly where it is, and so is every message's identity.
+* The subset of {@link foreignThinkingOf} that is safe to repair without asking.
 *
-* Idempotent: a second pass finds nothing to remove. Returns the SAME context
-* object when nothing changed, so the common case allocates nothing.
+* This is the predicate the adapter uses when `dropForeignThinking` is OFF: a
+* turn from another provider/route is dropped unconditionally, because its
+* unsigned thinking block can never be replayed and its flattened prose is what
+* the WorkBuddy gateway refuses (issue #163's provider-switch scene). A turn
+* from this bundle under a different model id is NOT included — that one is
+* still the explicit switch's business.
 *
-* @param context - a pi-ai context.
-* @param identity - the identity this adapter stamps on its own models.
-* @param requestModelId - model id the request is addressed to (see
-*   {@link isForeignAssistant}); omitted, only the provider/api legs are judged.
-* @returns the repaired context, or the input when no block qualified.
+* Runs after `alignAssistantIdentities`, so a global-region turn this bundle
+* owns has already had its `dsh-foreign` marker repaired away and is not
+* misclassified.
 */
-function dropForeignThinking(context, identity = WORKBUDDY_MODEL_IDENTITY, requestModelId) {
-	const affected = foreignThinkingOf(context, identity, requestModelId);
+function crossProviderThinkingOf(context, identity = WORKBUDDY_MODEL_IDENTITY, ownedRoutes = [WORKBUDDY_PROVIDER, WORKBUDDY_GLOBAL_PROVIDER]) {
+	const messages = context.messages;
+	if (!Array.isArray(messages)) return [];
+	return foreignThinkingOf(context, identity).filter((block) => isCrossProviderAssistant(messages[block.messageIndex], identity, ownedRoutes));
+}
+/** Remove exactly the listed blocks; the one place that edits a transcript. */
+function dropThinkingBlocks(context, affected) {
 	if (affected.length === 0) return context;
 	const messages = context.messages;
 	const byMessage = /* @__PURE__ */ new Map();
@@ -1860,13 +1881,12 @@ function withLegacyContext(api, generation, identity = WORKBUDDY_MODEL_IDENTITY,
 	/** One place so both branches and both entry points agree on the order. */
 	const prepare = (context, requestModelId) => {
 		const aligned = alignAssistantIdentities(generation === "modern" ? foldModernContext(context) : adaptLegacyPiAiContext(context), identity, ownedRoutes);
-		if (repair?.dropForeignThinking !== true) return aligned;
-		const affected = foreignThinkingOf(aligned, identity, requestModelId);
+		const affected = repair?.dropForeignThinking === true ? foreignThinkingOf(aligned, identity, requestModelId) : crossProviderThinkingOf(aligned, identity, ownedRoutes);
 		if (affected.length === 0) return aligned;
 		try {
-			repair.onForeignThinking?.(affected);
+			repair?.onForeignThinking?.(affected);
 		} catch {}
-		return dropForeignThinking(aligned, identity, requestModelId);
+		return dropThinkingBlocks(aligned, affected);
 	};
 	if (generation === "modern") return {
 		...api,
@@ -2212,6 +2232,368 @@ async function foldOnce(deps, agent, measurement, window, target) {
 	return false;
 }
 //#endregion
+//#region src/channel-continue.ts
+/**
+* 「被网关渠道校验拦截」时自动再发一次「继续」——可选、有上限。
+*
+* ## 这条功能要解决的那一次失败
+*
+* 用户粘贴的原文：
+*
+*   本轮运行失败400: {"message":"workbuddy 上游失败：被网关的渠道校验拦截（不是账号、
+*   额度或网络问题）（http 400）（code 11128，requestId …）。…",
+*   "type":"channel_reject","code":"channel_reject"}
+*
+* 它被 `classifyUpstreamError` 判成 `channel_reject`（`src/upstream.ts`），而这个类
+* **刻意不换号**（`isFailoverWorthy`，`src/shim.ts`）：网关匹配的是请求里消息的开头，
+* 换账号只会每个账号白烧一次真实请求。所以插件在同一请求内跑完三级救援阶梯
+* （`forceNeutralHead` → 一次零宽扰动 → 密集零宽扰动）之后，就把 400 原样交给宿主。
+*
+* 宿主也不会替我们重发：`channel_reject` 走的是 400，`code` 又是它不认识的字符串，
+* 不在 `DEFAULT_RETRYABLE_CODES` 里，于是这一轮直接结束，用户看到的正是上面那句。
+*
+* ## 为什么它过去看起来可能成功（只对随轮次变化的窄情况）
+*
+* `docs/PINNED-11128-RETRY.md` §2 记录了两条互相矛盾的事实：插件自己在
+* `perturbChannelFingerprints` 旁的注释说「给定提示词被拒是确定性的」，而现场报告
+* （#87–#98、#113）反复出现「把这条消息再发一次就过了」。二者都能成立，原因是**每
+* 一次新回合都是一份新的请求**：宿主会把当前 surface 重新组装、注入块的位置与内容
+* 可能变化、插件也可能因为学到偏好而从第一发就带扰动。所以「重发一次」不是把被拒
+* 的字节原样再塞一遍（那才是真正的浪费），而是**开一个新回合**。
+*
+* #163 的 2026-10-29 实测把这条解释收窄了：固定 system 指纹每轮逐字节相同，新回合
+* 换不掉它；只有被拒内容恰好落在随轮次变化的段上时才可能碰过。不要把它当成
+* 「11128 只要重发就能过」的承诺。
+*
+* 本模块就是把这个「手动再发一次」自动化，并且**只做这件事**：
+*
+* - 只认 `channel_reject` 这一种失败。配额、限流、网络、内容审核都有各自的处置，
+*   那些失败再发「继续」只会多烧一次请求（`NO_CONTINUE_CODES` 的同一判断）。
+* - 上限默认 **1** 次，**连续**计数：一次成功回合或一条真实用户消息立即清零。
+*   旧默认是 3；#163 的实测把「新回合会换掉被拒内容」证伪了（固定 system 指纹每轮
+*   相同，3 次只是把同一个 400 付三遍），所以一次足够：1 次救不了，3 次也救不了。
+* - 不做换号、不换区域、不改请求内容、不重试同一份字节：换号对这类拒绝无效，而
+*   篡改请求才是这条功能不该碰的东西。
+* - 子代理会话一律不碰：子代理由父代理驱动，抢跑会打乱执行树。
+*
+* 它是**最后兜底**，不是 11128 的修复：固定指纹由 `prepareChatBody` 的按句改词处理；
+* 改词后仍 11128，多半是新的固定指纹，重发同样无效。只有「被拒内容刚好随轮次变化」
+* 的窄情况才可能靠它碰过去，所以默认关闭、默认只发 1 次。
+*
+* 参考：`dsh-client-auto-continue`（MIT，HsiangNianian/dsh-auto-continue）—
+*   「连续失败上限」这套**语义**取自它：`state.consecutive` 在每次发出时自增、
+*   `consecutive >= maxConsecutive` 就停、只在真正成功的回合清零、子代理会话按
+*   `session.header.origin === 'subagent'` 跳过、发消息用
+*   `agent.followup(createUserMessage(...))`。本模块**没有**照搬它的引擎：那个实现
+*   有 1590 行，覆盖收尾原因矩阵、自适应退避、自主循环、循环守卫与浏览器通知，而
+*   这里只需要「一种失败、一条消息、一个上限」。
+* 参考：`dsh-purge`（MIT，YuJunZhiXue/dsh-purge）的 `lib/continue-retry.js` —
+*   三处具体做法：**被排除的失败码清单**（`NO_CONTINUE_CODES`：配额、限流、传输
+*   这些「重发也拿同一句回答」的失败不该续）、**收件箱忙就不插队**（`inboxBusy`），
+*   以及用 `user/message` 的 `source.kind` 区分「真人介入」与「插件自己发的」，以免
+*   自己的回显把上限清零。
+* 改动：本项目相对两者都是**收窄**，不是扩展——（a）只认 `channel_reject` 这一种
+*   失败，两套参考实现都是「除永久码外一律续」；（b）不做原地重试、不做换号、不做
+*   退避，因为这一类失败换谁、隔多久都是同一份请求；（c）计数状态只活在进程里、不
+*   落盘（参考实现有持久化文件），因为「刚刚这一串失败」本来就是即时的事实；（d）把
+*   订阅交给调用方注入（`onSessionEvent`），因为本插件没有 `@deepseek-ai/dsh-session`
+*   这条 peer 依赖，也不该为一条监听引入它。
+*
+* @module dsh-connect-workbuddy/channel-continue
+*/
+/**
+* 自动续发消息的 `source.kind`。
+*
+* 不用 `'user'`：那等于声称这条消息是用户敲的，转录里会渲染成右对齐的用户气泡，
+* 用户既没说过这句话、也就无从判断它是谁发的。`MessageSourceMap` 是**可合并扩展**
+* 的（其自带注释：「each producer declares its own kind in its own module」），
+* 声明在 `src/dsh-llm-augment.d.ts`。`dsh-connect-atomcode` / `dsh-purge` 同样做法。
+*/
+const CONTINUE_SOURCE_KIND = "workbuddy-continue";
+/** 默认续发的文本。用户要的就是「继续」两个字。 */
+const DEFAULT_CONTINUE_TEXT = "继续";
+/** 上限的硬边界：0 等于关闭，超过 10 次已经不属于「再试一次」的语义。 */
+const MAX_CONSECUTIVE_CEILING = 10;
+/**
+* 发出前的等待。
+*
+* `turn/end` 是在回合**已经收尾**之后追加的，但宿主紧接着还要把这一步的状态落定；
+* 立刻 `followup` 有机会撞上宿主自己的收尾动作。300ms 是 `dsh-purge` 的
+* `continue-retry` 在同一位置实测可用的量级，这里取同一个值，不另挑一个没有依据的数。
+*/
+const SEND_DELAY_MS = 300;
+/** 每个进程最多记多少个会话的计数（长开进程的 FIFO 兜底，`dsh-purge` 同一做法）。 */
+const SESSION_CAP = 200;
+/** 超过时一次丢多少个。 */
+const SESSION_EVICT = 50;
+/**
+* 把配置里的两个标量归一化成一个可用的设置对象。
+*
+* 两处「防御」都是有意为之：`enabled` 只认显式 `true`（这条功能会花真实请求，
+* 缺失或畸形必须读成「关」），`maxConsecutive` 与 `text` 越界时退回默认值，
+* 因为一个 `0`/`NaN`/空白文本会让功能变成静默空转——那比关着更难查。
+*
+* @param enabled - 配置里的开关标量。
+* @param max - 配置里的上限标量。
+* @param text - 配置里的文本。
+* @returns 归一化后的设置。
+*/
+function channelContinueSettingsOf(enabled, max, text) {
+	const capped = Math.min(MAX_CONSECUTIVE_CEILING, Math.max(1, typeof max === "number" && Number.isFinite(max) ? Math.trunc(max) : 1));
+	const body = typeof text === "string" && text.trim() !== "" ? text.trim() : DEFAULT_CONTINUE_TEXT;
+	return {
+		enabled: enabled === true,
+		maxConsecutive: capped,
+		text: body
+	};
+}
+/**
+* 这段失败是不是「被网关渠道校验拦截」。
+*
+* 不能只看 `code`。插件在 shim 里写的是 `type: "channel_reject"` 与
+* `code: "channel_reject"`（`KIND_STATUS` / 未翻译的 kind），但宿主拿到的
+* `LlmFailure.code` 由 pi-ai 从**消息文本**重新分类（`classifyPiAiError`，
+* `@deepseek-ai/dsh-llm-pi-ai`）：`/\b400\b/` 命中就归成 `INVALID_REQUEST`。
+* 也就是说 host 侧这一份 `code` 极可能不是 `channel_reject`，而那句插件自
+* 己的话（连同 JSON 里的 `channel_reject`）一定在 `message` 里。
+*
+* 于是判断刻意「够宽但锚得准」：命中插件自己的 kind 字面量或它自己的那句中文说明，
+* 就算这一类；其余一切（配额、限流、审核、网络、模型不可用）都不算——它们各有
+* 自己的处置，重发「继续」只会多花一次真实请求。
+*
+* @param failure - `turn/end` 的 `reason.error`，形状按 `LlmFailure` 读。
+* @returns 是否属于渠道门拒绝。
+*/
+function isChannelRejectFailure(failure) {
+	if (typeof failure !== "object" || failure === null) return false;
+	const record = failure;
+	if (typeof record.code === "string" && record.code === "channel_reject") return true;
+	const message = record.message;
+	if (typeof message !== "string" || message === "") return false;
+	if (message.includes("channel_reject")) return true;
+	return message.includes("渠道校验拦截");
+}
+/** 结构化的会话切片。 */
+function sessionIdOf(session) {
+	const id = session?.id;
+	return typeof id === "string" ? id : "";
+}
+/** 子代理会话：它的回合由父代理驱动，插件不该插手。 */
+function isSubagentSession(session, agent) {
+	if (session?.header?.origin === "subagent") return true;
+	return agent?.session?.header?.origin === "subagent";
+}
+/**
+* agent 的收件箱里是否已经有人排队。
+*
+* 只做「看起来非空」的结构探测，覆盖宿主不同版本的三种表示（`hasPending()` /
+* `size` / `length`）。有排队就放弃这一次续发：用户很可能刚敲了一条消息，此时插一条
+* 「继续」会让他的提问排到自动消息后面。
+*/
+function inboxBusy(agent) {
+	const inbox = agent.inbox;
+	if (typeof inbox !== "object" || inbox === null) return false;
+	const probe = inbox;
+	try {
+		if (typeof probe.hasPending === "function" && probe.hasPending() === true) return true;
+		if (typeof probe.size === "number" && probe.size > 0) return true;
+		if (typeof probe.length === "number" && probe.length > 0) return true;
+	} catch {}
+	return false;
+}
+/**
+* 建一台自动续发引擎。
+*
+* 只认 `session/event` 上的三件事：`turn/end`（判失败/清计数）、`turn/start`
+* （取消待发）、`user/message`（真人插话就把计数清零）。没有轮询、没有扫描、
+* 没有持久化：计数失效于进程即可，它描述的本来就是「刚刚这一串失败」。
+*
+* @param host - 注入的宿主依赖。
+* @returns 引擎句柄。
+*/
+function createChannelContinue(host) {
+	const states = /* @__PURE__ */ new Map();
+	let disposed = false;
+	const stateOf = (sessionId) => {
+		let state = states.get(sessionId);
+		if (state === void 0) {
+			if (states.size >= SESSION_CAP) {
+				let dropped = 0;
+				for (const key of states.keys()) {
+					if (dropped >= SESSION_EVICT) break;
+					const victim = states.get(key);
+					if (victim?.pending !== null && victim?.pending !== void 0) clearTimeout(victim.pending);
+					states.delete(key);
+					dropped += 1;
+				}
+			}
+			state = {
+				consecutive: 0,
+				lastHandledSeq: 0,
+				pending: null,
+				capped: false
+			};
+			states.set(sessionId, state);
+		}
+		return state;
+	};
+	const cancelPending = (state) => {
+		if (state.pending === null) return;
+		clearTimeout(state.pending);
+		state.pending = null;
+	};
+	/** 真的把「继续」发出去。所有放弃的分支都留一行日志，不静默。 */
+	const fire = (sessionId, state, session) => {
+		state.pending = null;
+		if (disposed) return;
+		const config = host.getConfig();
+		if (!config.enabled) return;
+		const agent = host.getAgent(sessionId);
+		if (agent === void 0) {
+			host.log(`跳过自动续发 ${sessionId}：会话已没有 live agent`);
+			return;
+		}
+		if (isSubagentSession(session, agent)) return;
+		if (agent.status === "running") {
+			host.log(`跳过自动续发 ${sessionId}：回合已经在跑`);
+			return;
+		}
+		if (inboxBusy(agent)) {
+			host.log(`跳过自动续发 ${sessionId}：收件箱里已有排队内容`);
+			return;
+		}
+		try {
+			const message = createUserMessage({
+				content: [{
+					type: "text",
+					text: config.text
+				}],
+				source: {
+					kind: CONTINUE_SOURCE_KIND,
+					form: "notice",
+					summary: "channel-reject-continue"
+				}
+			});
+			agent.followup(message);
+			state.consecutive += 1;
+			host.log(`已自动发送「${config.text}」到 ${sessionId}（被渠道校验拦截），第 ${String(state.consecutive)}/${String(config.maxConsecutive)} 次连续`);
+			if (state.consecutive >= config.maxConsecutive) host.log(`已达连续上限 ${String(config.maxConsecutive)} 次，${sessionId} 不再自动续发，等用户介入`);
+		} catch (error) {
+			host.log(`自动续发失败 ${sessionId}：${error instanceof Error ? error.message : String(error)}`);
+		}
+	};
+	return {
+		onSessionEvent(session, event) {
+			if (disposed) return;
+			const sessionId = sessionIdOf(session);
+			if (sessionId === "") return;
+			const record = event;
+			const type = record?.type;
+			if (typeof type !== "string") return;
+			const state = stateOf(sessionId);
+			if (type === "turn/start") {
+				cancelPending(state);
+				return;
+			}
+			if (type === "user/message") {
+				if (record?.data?.source?.kind === "user") {
+					cancelPending(state);
+					state.consecutive = 0;
+					state.capped = false;
+				}
+				return;
+			}
+			if (type !== "turn/end") return;
+			const seq = typeof record?.seq === "number" ? record.seq : 0;
+			if (seq !== 0 && state.lastHandledSeq === seq) return;
+			state.lastHandledSeq = seq;
+			const reason = record?.data?.reason;
+			const kind = typeof reason === "object" && reason !== null ? reason.kind : void 0;
+			if (kind === "completed") {
+				cancelPending(state);
+				state.consecutive = 0;
+				state.capped = false;
+				return;
+			}
+			if (kind === "aborted") {
+				if ((reason?.reason)?.kind === "user") {
+					cancelPending(state);
+					state.consecutive = 0;
+					state.capped = false;
+				}
+				return;
+			}
+			if (kind !== "error") return;
+			const failure = reason.error;
+			if (!isChannelRejectFailure(failure)) return;
+			const config = host.getConfig();
+			if (!config.enabled) return;
+			if (state.pending !== null) return;
+			if (state.consecutive >= config.maxConsecutive) {
+				if (!state.capped) {
+					state.capped = true;
+					host.log(`已达连续上限 ${String(config.maxConsecutive)} 次，${sessionId} 停止自动续发`);
+				}
+				return;
+			}
+			host.log(`检测到渠道门拒绝 ${sessionId}，${String(SEND_DELAY_MS)}ms 后自动发送「${config.text}」（第 ${String(state.consecutive + 1)}/${String(config.maxConsecutive)} 次）`);
+			state.pending = setTimeout(() => {
+				try {
+					fire(sessionId, state, session);
+				} catch (error) {
+					host.log(`自动续发回调异常 ${sessionId}：${error instanceof Error ? error.message : String(error)}`);
+				}
+			}, SEND_DELAY_MS);
+			state.pending.unref?.();
+		},
+		dispose() {
+			disposed = true;
+			for (const state of states.values()) {
+				if (state.pending !== null) clearTimeout(state.pending);
+				state.pending = null;
+			}
+			states.clear();
+		},
+		stateOf(sessionId) {
+			const state = states.get(sessionId);
+			if (state === void 0) return void 0;
+			return {
+				consecutive: state.consecutive,
+				pending: state.pending !== null
+			};
+		}
+	};
+}
+/**
+* 把引擎挂到宿主的事件总线上。
+*
+* 订阅走注入的 `onSessionEvent`，而不是在这里 `ctx.on`：宿主把 `session/event`
+* 声明在 `@deepseek-ai/dsh-session` 的类型里，本插件没有也不该有那条 peer 依赖，
+* 由调用方用一行鸭子类型的 cast 提供，才能让这个模块在没装宿主包的测试里也能跑。
+*
+* @param mount - 宿主切片。
+* @returns 卸载函数（取消订阅并清空计数）。
+*/
+function installChannelContinue(mount) {
+	const engine = createChannelContinue(mount);
+	let off;
+	try {
+		off = mount.onSessionEvent((session, event) => {
+			engine.onSessionEvent(session, event);
+		});
+	} catch (error) {
+		mount.log(`未能订阅 session/event，自动续发不可用（插件其余部分不受影响）：${error instanceof Error ? error.message : String(error)}`);
+		engine.dispose();
+		return () => {};
+	}
+	return () => {
+		try {
+			off?.();
+		} catch {}
+		engine.dispose();
+	};
+}
+//#endregion
 //#region src/body-report.ts
 /**
 * Body-composition report: WHAT was sent upstream, in counts (issue #59).
@@ -9627,7 +10009,8 @@ const UPSTREAM_SWITCH_FIELDS = /* @__PURE__ */ new Set([
 	"keepPromptLast",
 	"extraInjectedPrefixes",
 	"sessionTitle",
-	"dropForeignThinking"
+	"dropForeignThinking",
+	"channelRejectContinue"
 ]);
 /** A non-null, non-array object: the only shape the slot merge applies to. */
 function isPlainRecord(value) {
@@ -10536,7 +10919,7 @@ function registerWorkBuddyStatusRoute(ctx, deps) {
 						req.on("error", reject);
 					});
 					const field = body.field;
-					if (field !== "regions" && field !== "accounts" && field !== "cliBridge" && !(typeof field === "string" && UPSTREAM_SWITCH_FIELDS.has(field))) return json(res, 400, { error: "field must be regions, accounts, cliBridge, usageIdentity, keepPromptLast, extraInjectedPrefixes, sessionTitle or dropForeignThinking" });
+					if (field !== "regions" && field !== "accounts" && field !== "cliBridge" && !(typeof field === "string" && UPSTREAM_SWITCH_FIELDS.has(field))) return json(res, 400, { error: "field must be regions, accounts, cliBridge, usageIdentity, keepPromptLast, extraInjectedPrefixes, sessionTitle, dropForeignThinking or channelRejectContinue" });
 					const row = settings.describe().find((r) => String(r.ns).includes("workbuddy"));
 					if (row === void 0) return json(res, 503, { error: "workbuddy namespace missing from describe()" });
 					const current = field === "regions" ? regionsMapOf(row.value?.[field]) : unwrapVolatileDeep(row.value?.[field] ?? {});
@@ -10947,11 +11330,16 @@ const Config = z.object({
 	usageIdentity: asVolatile(z.boolean().default(false).description("Make the upstream's usage page record these calls like the official client's: add the X-IDE-* identity headers (which fill the 使用端 column) and send the conversation ids as 32-hex UUIDv7. Off by default — it is a display alignment measured by a reporter, not by this plugin, and the chat channel identity (User-Agent) and request body never change.")),
 	keepPromptLast: asVolatile(z.boolean().default(false).description("Move the harness-injected runtime context above the real prompt, so the WorkBuddy usage page records what you actually typed instead of the injected block. Message count and text are preserved; the one edit is the recorded prompt's own leading <acp> marker. Off by default because it changes the message order the upstream counts.")),
 	extraInjectedPrefixes: asVolatile(z.array(z.string()).default([]).description("Extra literal prefixes (issue #133) treated like the harness-injected context markers when keepPromptLast is on — for blocks a companion plugin injects that the built-in list does not recognize. Each entry matches the start of a trailing user message; read only while keepPromptLast is enabled. Sampled when the plugin mounts: reload the plugin (or restart the host) after changing it.")),
-	dropForeignThinking: asVolatile(z.boolean().default(false).description("Drop foreign thinking blocks that pi-ai would publish as prose (issue #147). After a provider switch the host rebuilds the other provider's assistant turns as dsh-foreign, and pi-ai then rewrites their thinking blocks into visible text, so the model's working notes become the answer and it copies that shape on later turns. On, those unsigned blocks are removed from the request (they could never be replayed as reasoning anyway); text and tool calls are untouched. Off by default because it changes bytes the upstream counts.")),
+	dropForeignThinking: asVolatile(z.boolean().default(false).description("Drop foreign thinking blocks that pi-ai would publish as prose (issue #147). CROSS-PROVIDER turns are dropped automatically: after a provider switch the other provider's unsigned thinking blocks can never be replayed, and pi-ai would flatten them into assistant prose that the gateway refuses with 11128 (issue #163's measured scene). This switch only widens the repair to a model switch inside one of this bundle's own routes. On, those blocks are removed from the request; text and tool calls are untouched. Off by default for the same-route leg because it changes bytes the upstream counts.")),
 	sessionTitle: asVolatile(z.object({
 		enabled: z.boolean().default(false),
 		model: z.string().default("wb-lite")
-	}).default({}).description("Move the host session-title request onto a hidden lightweight model (issues #132/#133). The host fires one real upstream request per new session either way; enabled re-points it at `model` (default wb-lite, measured 0 credits by the reporter) instead of billing the main paid model. Request volume still counts, and the lightweight model is reporter-measured, not reproduced here. Sampled when the plugin mounts: reload the plugin (or restart the host) after changing it."))
+	}).default({}).description("Move the host session-title request onto a hidden lightweight model (issues #132/#133). The host fires one real upstream request per new session either way; enabled re-points it at `model` (default wb-lite, measured 0 credits by the reporter) instead of billing the main paid model. Request volume still counts, and the lightweight model is reporter-measured, not reproduced here. Sampled when the plugin mounts: reload the plugin (or restart the host) after changing it.")),
+	channelRejectContinue: asVolatile(z.object({
+		enabled: z.boolean().default(false),
+		maxConsecutive: z.number().step(1).min(1).max(10).default(1),
+		text: z.string().default("继续")
+	}).default({}).description("LAST RESORT, not a fix for 11128. After the gateway refuses a turn with `channel_reject` (business code 11128), send 「继续」 once automatically. Off by default: it spends a real request without the user typing anything. Fixed system fingerprints are handled by prepareChatBody's sentence rewrites; they are byte-identical every turn, so resending only pays for the same 400 again. The narrow case this can help is content that changes between turns. `maxConsecutive` (default 1) counts CONSECUTIVE auto-sends: one successful turn, or one real user message, resets it. Subagent sessions are never touched. Live: the engine reads this on every failure, so no reload is needed."))
 });
 /**
 * One region's saved model state. A config written before the region split has
@@ -11259,6 +11647,34 @@ function apply(ctx, config) {
 	let current = () => config;
 	let invalidateCatalog = () => {};
 	/**
+	* 渠道门拒绝（`channel_reject` / 11128）之后的自动「继续」。
+	*
+	* 挂在这里而不是 adapter 里，理由是**它要的是一个新回合**：adapter 只看得到
+	* 一次请求，`channel_reject` 在同一个请求内已经跑完三级救援阶梯，再在那一层
+	* 重发就是把被拒的字节原样再送一遍。宿主把这一轮判死之后才追加 `turn/end`，
+	* 而新回合会让宿主重新组装 surface —— 那才是 `docs/PINNED-11128-RETRY.md`
+	* 里「把这条消息再发一次」真正做的事。
+	*
+	* 会花真实请求，所以开关默认关闭，且只在用户显式打开后才读配置（见
+	* `channelContinueSettingsOf`：只有 `=== true` 算开启）。
+	*/
+	const disposeChannelContinue = installChannelContinue({
+		getConfig: () => {
+			const block = unwrapVolatile(current().channelRejectContinue);
+			return channelContinueSettingsOf(block?.enabled, block?.maxConsecutive, block?.text);
+		},
+		getAgent: (sessionId) => {
+			return ctx.get("agents")?.get(sessionId);
+		},
+		log: (message) => {
+			ctx.logger.warn(`dsh-connect-workbuddy: ${message}`);
+		},
+		onSessionEvent: (listener) => ctx.on("session/event", listener)
+	});
+	ctx.effect(() => () => {
+		disposeChannelContinue();
+	});
+	/**
 	* REPAIR a region's saved directory against the live upstream roster.
 	*
 	* ISSUES #114 AND #115, THE PERSISTED HALF. The read side now serves the
@@ -12695,6 +13111,7 @@ function apply(ctx, config) {
 						blocks,
 						atMs: Date.now()
 					};
+					if (unwrapVolatile(current().dropForeignThinking) !== true) ctx.logger.warn(`dsh-connect-workbuddy: dropped ${blocks.length} cross-provider thinking block(s) before a WorkBuddy request (provider switch); see issue #163`);
 				}
 			});
 			invalidateCatalog = () => {

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-connect-workbuddy",
   "displayName": "DSH Connect WorkBuddy",
   "description": "把本机登录的 WorkBuddy 模型（国内版与国际版）接入 DeepSeek Harness：每次刷新按上游目录自动读取每个模型的积分倍率，支持逐模型图片输入开关、多账号切换与账号池自动换号，并提供每日签到、卡片与输入框里的胶囊积分读数等只读积分概览。",
-  "version": "5.12.4",
+  "version": "5.13.1",
   "author": "dingminhua",
   "copyright": "Copyright (c) 2026 LaoDing",
   "license": "MIT",