dsh-model-rotator 0.2.5 → 0.2.7

package/CHANGELOG.md

@@ -4,11 +4,21 @@
 
 User-visible changes, newest first. Commit hashes in brackets.
 
+## 0.2.7
+- **Fixed: a compaction that ran out of quota ended the whole turn.** The compaction summary is the first call a long conversation makes, so when the current model's balance was gone it was the first thing to fail — and it was on the do-not-fail-over list, which meant the refusal was passed straight through and the turn died before the answer existed. Compaction now walks the candidate list like any other dead route: the summary is written by the next model and the turn continues. A session title still stays on the model that was asked, because a caption nobody waits on is not worth a second provider.
+- **Fixed: the switch question no longer parks a summary.** Asking "switch model?" before a compaction would have shown a modal about plumbing the reader is not watching, and on timeout it switched anyway. Compaction switches proceed unconfirmed; the reader still learns about it from the ordinary switch notice at the turn boundary.
+- **Unchanged on purpose: compaction never adopts the switched model.** A summary that fails because the context is too large for this model says nothing about the model's fitness for the conversation. Adoption is left to the conversation attempt, which makes the same call on the right evidence.
+- 168 offline assertions, with three negative controls proving each new exclusion is what makes its assertion pass. [`c5590ef`]
+
+## 0.2.6
+- **Fixed: other channels of the same model were deduplicated out of the walk.** This is the real problem 0.2.5 uncovered once the classification was right: when WorkBuddy met its quota wall, **buddy and trae — the same model on other channels — were healthy**, but "one channel per model family" kept them out of the candidate list entirely, so the turn ended on the quota error with a working route sitting one slot away. A family now keeps up to **two channels**: the ranked winner plus one proven-usable backup. A cooling backup is dropped, since dispatching it would walk into the same wall. The switch notice is already deduplicated by model id, so arriving at a second channel of the same model is not announced as "switched to the same model again".
+- Measured: before the fix the walk held one channel of `deepseek-v4.1-flash` and `buddy` (ok=1538, healthy) was absent; after it holds three and `buddy` is back. [`fed9508`]
+
 ## 0.2.5
 - **Fixed: an exhausted quota read as a rate limit, so the switch never happened.** WorkBuddy answers "可用账号均在限流中，最近一个将于 … 解禁" — every account exhausted. Classified as `rate-limit` it cooled for 60 seconds and retried the same wall; one evening accumulated 702 failures. An account pool that is entirely unavailable is now recognised as `quota` and rests like any other balance wall.
 - **New: the release time is parsed out of the message.** When the provider states when it comes back, that beats any calendar policy. `parseReleaseTime()` accepts `2026/10/18 00:29:52`, `2026-10-18 00:29:52` and ISO forms; a parsed time becomes the exact cooldown (measured here: 60 seconds became 1.7 hours), and only an unparseable message falls back to the next-day rule.
 - **Fixed: a switch was not persisted.** The switch notice was queued and then returned, so `scheduleStatsSave()` never ran — a restart showed the old model still in use. The save happens with the enqueue now.
-- **Improved: a pin defers while it cools.** A model pinned with `model_rotator_select` took the head on every turn even while cooling, so every turn opened by walking into the same wall. The pin now applies only while the model is healthy; the ranking decides during cooldown and the pin returns by itself afterwards. [`TBD`]
+- **Improved: a pin defers while it cools.** A model pinned with `model_rotator_select` took the head on every turn even while cooling, so every turn opened by walking into the same wall. The pin now applies only while the model is healthy; the ranking decides during cooldown and the pin returns by itself afterwards. [`a2d5a0c`]
 
 ## 0.2.4
 - **Docs**: adds this bilingual changelog, listed in the manifest and gated by release-check; the README and repository description were refreshed too. The npm package now carries the changelog with each release. Also fixes a crash in this gate: the SHA check fed a comment line to readFileSync, so the gate died with ENOENT and hid every other check behind it. [`fc14e99`]

package/CHANGELOG.zh.md

@@ -4,11 +4,21 @@
 
 本文件按版本记录用户可感知的变化。方括号内为对应提交。
 
+## 0.2.7
+- **修复：压缩阶段额度耗尽导致整轮失败**。压缩摘要是长会话发出的第一个请求，所以当前模型余额耗尽时最先失败的就是它 —— 而它被列在「不参与故障转移」的名单里，拒绝被原样抛出，回答还没开始整轮就结束了。现在压缩与其它死线路一样走候选列表：摘要有下一个模型来写，这一轮继续。会话标题仍然留在被请求的模型上 —— 一个没人等的标题不值得再找一个提供方。
+- **修复：切换确认不再卡住摘要**。在压缩前弹出「是否切换模型」等于拿读者没在看的管道工作去打断他，而且超时后照样会切。压缩的切换不再询问；读者仍会在回合边界收到常规的切换通知。
+- **有意不改：压缩不采纳切换后的模型**。摘要失败如果是因为上下文对这个模型太大，那与模型是否适合这段对话无关。采纳留给随后的对话请求，那里才有正确依据。
+- 离线断言 168 项；三条负向对照分别证明每一处新排除条件正是对应断言通过的原因。 [`c5590ef`]
+
+## 0.2.6
+- **修复：同一模型的其它渠道被去重挡在候选之外**。这是 0.2.5 修好分类之后暴露出来的真问题：WorkBuddy 撞上额度墙时，**buddy 与 trae 这两个同模型的渠道是健康的**，但「每个模型家族只保留一个渠道」的规则让它们根本不在候选里，于是整轮以额度错误结束 —— 而可用线路就在旁边。现每个家族保留最多 **2 个渠道**（排名靠前的一个 + 一个经证实用可用的备份）；备份若正在冷却则不保留，因为那等于再撞一次同一堵墙。切换通知本就按模型 id 去重，所以落到同模型的第二个渠道不会被播报成「又切到同一模型」。
+- 实测：修复前候选列表里 `deepseek-v4.1-flash` 只占 1 个渠道，`buddy`（ok=1538，健康）缺失；修复后占 3 个，`buddy` 回到列表中。[`fed9508`]
+
 ## 0.2.5
 - **修复：额度耗尽被误判为限流，导致不切换**。WorkBuddy 的报错是「可用账号均在限流中，最近一个将于 … 解禁」，判成 `rate-limit` 就按 60 秒冷却反复重试同一堵墙（实测一晚累计 702 次失败）。现新增「账号池耗尽」识别归入 `quota`，与「余额不足」同一处置。
 - **新增：解析报错里的解禁时间**。提供方既然写明了何时恢复，就比任何日历策略都准。`parseReleaseTime()` 支持 `2026/10/18 00:29:52`、`2026-10-18 00:29:52` 与 ISO 形式；解析到就用作精确冷却（本次实测把 60 秒变成 1.7 小时），解析不到才回落到次日策略。
 - **修复：切换后未落盘**。切换通知入队后直接 `return`，`scheduleStatsSave()` 没有被调用，所以重启后看不到这次切换发生过。现在入队时一并保存。
-- **改进：pin 在冷却时让位**。此前被 `model_rotator_select` 置顶的模型即使正在冷却也每轮抢在第一位，于是每轮都先撞一次墙再切换。现只在模型健康时置顶，冷却期间交给排序，冷却结束后自动回到首位。[`TBD`]
+- **改进：pin 在冷却时让位**。此前被 `model_rotator_select` 置顶的模型即使正在冷却也每轮抢在第一位，于是每轮都先撞一次墙再切换。现只在模型健康时置顶，冷却期间交给排序，冷却结束后自动回到首位。[`a2d5a0c`]
 
 ## 0.2.4
 - **文档**：新增中英双语更新说明（本文件），并纳入发布清单与发布门；README 与仓库首页说明同步更新。npm 包开始随版本携带 CHANGELOG。同时修复发布门自身的一处崩溃：SHA 校验把清单注释行当成文件名读，导致整门以 ENOENT 中止、掩盖其余全部检查。[`fc14e99`]

package/index.js

@@ -392,6 +392,16 @@ export function isNonChatModelId(provider, id) {
 /** Hard ceiling on candidates considered per turn, regardless of config. */
 const HARD_MAX_CANDIDATES = 8
 
+/**
+ * How many channels of one model family may share the candidate walk.
+ *
+ * One per family was too few - a channel failing while its healthy siblings were
+ * unreachable is exactly the report this constant answers - and all of them is
+ * too many, because five channels of one model would spend the entire budget on
+ * a single model. Two keeps the representative and one proven-healthy backup.
+ */
+const FAMILY_CHANNELS_MAX = 2
+
 /**
  * Hard ceiling on same-model retries per candidate, regardless of config.
  *
@@ -956,19 +966,41 @@ export function apply(ctx, config = {}, runtime = {}) {
   // ---- automatic calls ---------------------------------------------------------
 
   /**
-   * Purposes that are not the conversation.
+   * Purposes that are *not* worth a second provider.
+   *
+   * A session title rides the same llm/stream seam as a user turn but is not a
+   * user turn: nobody is waiting on it, and failing it over asks a second
+   * provider to do a caption the first one refused. A refusal there is also
+   * frequently a policy answer - "this lane owns titles" - which another model
+   * would happily ignore. So a title stays on the model that was asked.
+   *
+   * Compaction is deliberately *not* in this set, even though it is plumbing
+   * too. It is plumbing the turn cannot proceed without: when the current
+   * model's quota is exhausted, the summary call is the first thing to fail,
+   * and passing that failure through ends the whole turn before a single token
+   * of the user's answer exists. A compaction that cannot run is therefore a
+   * dead route, exactly like a failed conversation attempt, and it walks the
+   * same candidate list - see AUTOMATIC_SWITCH_PURPOSES for what it skips.
    *
-   * A compaction summary and a session title ride the same llm/stream seam as a
-   * user turn but are *not* a user turn: nothing about them is answered to a
-   * human, and failing one over asks a second provider to do plumbing work the
-   * first provider refused. That refusal is also frequently a policy answer -
-   * "this lane owns compression" - which another model would happily ignore.
    * The names come from the host itself (dsh-compaction-basic passes
    * purpose: "compaction", dsh-session-title-llm passes "session-title"), and an
    * unnamed call stays in scope, so the ordinary turns - which carry no purpose
    * at all - keep failing over exactly as before.
    */
-  const AUTOMATIC_PURPOSES = new Set(['compaction', 'session-title'])
+  const AUTOMATIC_PURPOSES = new Set(['session-title'])
+
+  /**
+   * Purposes that fail over without asking.
+   *
+   * The switch question exists to keep the reader in charge of *their*
+   * conversation: a model they did not pick answering their words is worth a
+   * confirmation. A compaction summary is not their words, and the question
+   * would land while the turn is still being assembled - a 20 second stall on
+   * plumbing nobody is reading, which on timeout switches anyway. The walk
+   * therefore proceeds unconfirmed and the reader learns about it from the
+   * ordinary switch notice once the turn boundary arrives.
+   */
+  const UNCONFIRMED_PURPOSES = new Set(['compaction'])
 
   // ---- configuration ----------------------------------------------------------
 
@@ -1509,19 +1541,35 @@ export function apply(ctx, config = {}, runtime = {}) {
     }
     ranked.sort((a, b) => (b.score !== a.score ? b.score - a.score : a.key < b.key ? -1 : a.key > b.key ? 1 : 0))
 
-    // One candidate per model *family*, not one per channel. The same model on
-    // five channels shares its fate - one quota wall, one dead endpoint - so
-    // keeping all five in the walk spends the whole candidate budget retrying
-    // what is effectively one model, and the switch notice then reads as
-    // "switched to the same model again". The best-scoring channel of each
-    // family survives; its siblings wait for another turn (no cooldown is
-    // written for them, so a later walk can still pick them).
-    const familySeen = new Set()
+    // A model family contributes more than one channel - but not all of them.
+    //
+    // The same model on five channels used to occupy five candidate slots, which
+    // spent the whole budget retrying what is effectively one model. Collapsing it
+    // to exactly one channel fixed that and introduced a worse failure: a channel is
+    // not the whole family. WorkBuddy met its quota wall while buddy and trae, the
+    // same model on other channels, were healthy and serving - and the walk could
+    // not reach them, because the family had already been represented by the channel
+    // that failed. The turn ended on the wall with a working route sitting one slot
+    // away.
+    //
+    // So a family keeps up to FAMILY_CHANNELS_MAX channels, ranked, and a sibling is
+    // only kept while it is actually usable. Cooling siblings are dropped: they would
+    // be dispatched into the same wall the representative just hit, and the walk
+    // already knows better. The switch-notice dedup keys on the model id, so arriving
+    // at a second channel of the same model does not announce "switched to the same
+    // model again" - the reason that motivated one-per-family in the first place is
+    // handled where it belongs.
+    const familyCount = new Map()
     const byFamily = []
     for (const row of ranked) {
       const family = String(row.pair.model).toLowerCase()
-      if (familySeen.has(family)) continue
-      familySeen.add(family)
+      const used = familyCount.get(family) ?? 0
+      if (used >= FAMILY_CHANNELS_MAX) continue
+      const stat = statFor(row.key)
+      // The family's first channel is always kept - it is the ranked winner and the
+      // representation of that model. Only the siblings have to prove they are usable.
+      if (used > 0 && stat.cooldownUntil > nowMs) continue
+      familyCount.set(family, used + 1)
       byFamily.push(row)
     }
     const ordered = [current, ...byFamily.map(row => row.pair)]
@@ -1872,7 +1920,14 @@ export function apply(ctx, config = {}, runtime = {}) {
           // dispatch never reached a provider, so an answer here does not mean the
           // user's model is unreachable, and adopting would change their model
           // behind a fault rather than behind a failure.
-          if (index > 0 && flowed && cfg.adoptSwitchedModel && !hostRefusalSeen) adoptServedModel(pair)
+          // Plumbing purposes are excluded from adoption on purpose: a compaction
+          // that fails because the *context* is too large for this model says
+          // nothing about the model's fitness for the conversation, and adopting
+          // there would change the reader's model behind a size limit rather than
+          // behind a dead route. The conversation attempt that follows makes the
+          // same decision with the right evidence.
+          const adoptHere = cfg.adoptSwitchedModel && !hostRefusalSeen && !UNCONFIRMED_PURPOSES.has(String(options.purpose ?? ''))
+          if (index > 0 && flowed && adoptHere) adoptServedModel(pair)
           // Tell the reader which model answered instead of theirs. Recorded here
           // and delivered at the turn boundary (see the notice listener), because
           // this is the moment the walk actually left the model the user picked.
@@ -2015,8 +2070,11 @@ export function apply(ctx, config = {}, runtime = {}) {
 
         // Consent gate. Asked once per turn: approving the first switch covers
         // the rest of the walk, so a cascade of dead models does not become a
-        // cascade of identical questions.
-        if (!isLast && cfg.confirmSwitch && switchVerdict === '') {
+        // cascade of identical questions. Plumbing purposes skip it: nobody is
+        // reading the summary, and the question would park the turn on a modal
+        // that only times out (see UNCONFIRMED_PURPOSES).
+        const asksBeforeSwitching = cfg.confirmSwitch && !UNCONFIRMED_PURPOSES.has(String(options.purpose ?? ''))
+        if (!isLast && asksBeforeSwitching && switchVerdict === '') {
           switchVerdict = await confirmSwitch(options, cfg, key, candidates[index + 1], failedBecause)
           if (switchVerdict === 'deny') {
             yield {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-rotator",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Model auto-ranking and transparent failover for DeepSeek Harness: ranks discovered models by measured connectivity and speed, switches to the next candidate inside the same turn when the current one is unusable, and ships a grouped model list with per-channel switches. Never modifies model or provider configuration.",
   "type": "module",
   "main": "index.js",