dsh-qoder-connect 0.2.7 → 0.2.8

package/README.en.md

@@ -22,6 +22,7 @@ Configure only what you use: a variant with no saved PAT shows no model group an
 - **Daily auto check-in & logs** — claims the daily 100 Credits automatically, **at a time you can set per variant on the card** (10:00 UTC+8 by default, the upstream's reset moment), with independent toggles and startup catch-up protection. The card features a dedicated *Check-in log* panel with audit trails, *Check in now*, *Refresh*, and *Clear logs* quick actions.
 - **Sidebar quota card + credit details** — the *“Qoder sidebar display”* card toggles a per-variant sidebar quota widget (off by default; each toggle needs its variant's PAT saved) with one shared refresh interval (default 5 min, minimum 1 min). Clicking the sidebar widget opens the *Qoder quota* panel: one row per credit package — *“Remaining / Total + bar | Expires”* — where a campaign grant (the international edition’s *SOTA Exclusive Credits*, for one) keeps its own upstream-given title and **its own expiry**. When the account reports no overall deadline (the upstream’s year-9999 sentinel), the panel states when the PAT was authorized rather than a fabricated date. Click the same widget again to close; click the other to switch variants.
 - **Rate display `x<priceFactor>`** — each model name is suffixed with the upstream-reported price multiplier (e.g. `Some Model · x0.79`, free is `x0`), spelled `x<n>` from the catalog's `price_factor`. Display only — it never changes the request; models whose rate the upstream did not report simply show no suffix.
+- **Upstream queue hints are honored** — when Qoder answers a queued or throttled request (401/403/429 body) with `retryAfterSeconds`, the plugin turns it into a local `Retry-After` header and hands it to DSH as `failure.providerRetryAfterMs`; the host retry engine can then wait until the moment the upstream asked for, instead of hammering the same still-closed window with its local backoff.
 
 ## Screenshots
 
@@ -81,7 +82,7 @@ Enable daily automatic check-in in the settings card and set each variant's own
 
 Prerequisites:
 
-- DSH core `0.1.7-rc.1` or newer (this plugin peers on the `@deepseek-ai/*` `>=0.1.7-rc.1` line);
+- DSH core `0.2.1-rc.1` or newer (this plugin peers on the `@deepseek-ai/*` `>=0.2.1-rc.1` line);
 - Node.js `^22.19.0 || >=24.0.0` (per `package.json` engines);
 - your own Qoder account and at least one Personal Access Token.
 
@@ -94,6 +95,15 @@ dsh plugin --profile web add dsh-qoder-connect
 
 Swap the `--profile` value for the profile you use (`web` / `desktop` / `tui`, e.g. `dsh plugin --profile desktop add dsh-qoder-connect`) — data stays inside that profile, so web / desktop / tui never collide. On a terminal-only profile (TUI) there is no browser card: manage the PAT and check status through the bundled CLI instead; the settings card and sidebar widgets require Web or Desktop.
 
+> **DSH older than `0.2.1-rc.1`?** Use **[v0.2.5](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.2.5)** instead — the last release on the 0.1.7 line (DSH ≥ `0.1.7-rc.1`):
+>
+> ```sh
+> # From GitHub (recommended, pin the tag)
+> dsh plugin --profile web add github:masknull/dsh-qoder-connect#v0.2.5
+> # Or from npm
+> dsh plugin --profile web add dsh-qoder-connect@0.2.5
+> ```
+>
 > **DSH older than `0.1.7-rc.1`?** Use **[v0.2.0](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.2.0)** instead — the last release supporting the 0.1.5 line (DSH ≥ `0.1.5-rc.2`):
 >
 > ```sh
@@ -103,7 +113,7 @@ Swap the `--profile` value for the profile you use (`web` / `desktop` / `tui`, e
 > dsh plugin --profile web add dsh-qoder-connect@0.2.0
 > ```
 >
-> Upgrading from 0.1.5? This release removed the automatic migration of the old host's `settings.yaml`. To carry your old configuration over, migrate through **[v0.1.9](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.1.9)** (the first release with the data migration) first, then upgrade to this release.
+> Upgrading from 0.1.5? Newer releases removed the automatic migration of the old host's `settings.yaml`. To carry your old configuration over, migrate through **[v0.1.9](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.1.9)** (the first release with the data migration) first, then upgrade.
 
 ## Configuration
 

package/README.md

@@ -22,6 +22,7 @@
 - **每日自动签到与日志明细**：支持每天自动签到领取 100 Credits 算力额度，**签到时刻可在卡片上自定义**（默认 10:00，即上游刷新时间，按 UTC+8），配备双端开关与开机防漏补签机制；卡片常驻「签到日志」面板，提供执行流水记录与「立即签到」、「刷新」、「清空日志」快捷操作。
 - **侧栏额度展示 + 额度明细**：「Qoder 侧栏展示」卡片可分别为两版开启侧栏底部的额度小卡（默认关，开启前需为该变体保存 PAT），共享一个刷新间隔（默认 5 分钟，最小 1 分钟）。点侧栏小卡在中间面板打开「Qoder 额度」明细：按资源包逐行给出「剩余 / 总量 + 进度条｜到期时间」，活动赠送包（如国际版「SOTA 专属积分」）按上游给定的名称与**各自的到期日**单独成行；账号整体无到期（上游回 9999 占位值）时展示 PAT 的授权时间而非假日期；再点同一张卡关闭，点另一张切换到对应版本。
 - **倍率显示 `x<priceFactor>`**：模型名后直接拼上游报价的价格倍率（如 `某模型 · x0.79`，免费为 `x0`），来自目录接口的 `price_factor` 字段，仅作展示、不影响请求；上游未报倍率的模型不显示后缀，不会凭空补一个数。
+- **尊重上游的排队建议**：Qoder 在排队/限流答复里给出 `retryAfterSeconds` 时（401/403/429 的 body），插件把它转成本机 `Retry-After` 响应头，并作为 `failure.providerRetryAfterMs` 交给 DSH 的重试策略；宿主重试引擎因此会等到上游要求的时刻再发起下一次请求，而不是用本地退避提前撞回同一个未打开的窗口。
 
 ## 界面一览
 
@@ -81,7 +82,7 @@
 
 前置条件：
 
-- DSH 核心 `0.1.7-rc.1` 及以上（本插件 peer 依赖 `@deepseek-ai/*` `>=0.1.7-rc.1` 线）；
+- DSH 核心 `0.2.1-rc.1` 及以上（本插件 peer 依赖 `@deepseek-ai/*` `>=0.2.1-rc.1` 线）；
 - Node.js `^22.19.0 || >=24.0.0`（`package.json` engines）；
 - 你自己的 Qoder 账号，以及至少一枚个人访问令牌。
 
@@ -94,6 +95,15 @@ dsh plugin --profile web add dsh-qoder-connect
 
 按你使用的 profile 换 `--profile` 的值（`web` / `desktop` / `tui`，如 `dsh plugin --profile desktop add dsh-qoder-connect`）。装到哪个 profile，数据就落在哪个 profile 目录里，web / desktop / tui 各自独立。没有浏览器卡片的终端环境（TUI）下依旧可用 CLI 保存 PAT 并驱动模型；设置卡片与侧栏额度卡需要 Web/Desktop 界面。
 
+> **DSH 低于 `0.2.1-rc.1`？** 请改用最后一个支持 0.1.7 线的版本 **[v0.2.5](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.2.5)**（要求 DSH ≥ `0.1.7-rc.1`）：
+>
+> ```sh
+> # GitHub（推荐，指定 tag）
+> dsh plugin --profile web add github:masknull/dsh-qoder-connect#v0.2.5
+> # 或从 npm 安装
+> dsh plugin --profile web add dsh-qoder-connect@0.2.5
+> ```
+>
 > **DSH 低于 `0.1.7-rc.1`？** 请改用最后一个支持 0.1.5 线的版本 **[v0.2.0](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.2.0)**（要求 DSH ≥ `0.1.5-rc.2`）：
 >
 > ```sh
@@ -103,7 +113,7 @@ dsh plugin --profile web add dsh-qoder-connect
 > dsh plugin --profile web add dsh-qoder-connect@0.2.0
 > ```
 >
-> 从 0.1.5 升级上来的老用户：本版本已移除旧宿主 `settings.yaml` 的自动迁移；如需保留旧配置，请先经 **[v0.1.9](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.1.9)**（首个带数据迁移的版本）完成迁移后，再升级本版本。
+> 从 0.1.5 升级上来的老用户：新版本已移除旧宿主 `settings.yaml` 的自动迁移；如需保留旧配置，请先经 **[v0.1.9](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.1.9)**（首个带数据迁移的版本）完成迁移后，再升级。
 
 ## 配置与使用
 

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { K as QoderCredentialStore, M as QoderCatalogStore, N as qoderCatalogPath, P as FALLBACK_QODER_MODELS, T as createQoderTransport, Y as qoderCredentialIdentity, _ as qoderProbePath, f as QODER_CONNECT_VERSION, i as variantFor, l as qoderHostHeartbeatPath, m as QoderProbeStore, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, w as validateApiKey, y as QoderUpstreamClient } from "./variants-B_ZzENbC.js";
+import { K as QoderCredentialStore, M as QoderCatalogStore, N as qoderCatalogPath, P as FALLBACK_QODER_MODELS, T as createQoderTransport, Y as qoderCredentialIdentity, _ as qoderProbePath, f as QODER_CONNECT_VERSION, i as variantFor, l as qoderHostHeartbeatPath, m as QoderProbeStore, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, w as validateApiKey, y as QoderUpstreamClient } from "./variants-Dl1AbWre.js";
 import { readFile } from "node:fs/promises";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/lib/index.d.ts

@@ -954,6 +954,18 @@ type QoderChatResult = {
   status: number;
   kind: UpstreamErrorKind;
   message: string;
+  /**
+   * The upstream's own "try again in N ms" answer (Qoder's queue body carries
+   * `retryAfterSeconds`, and a plain 429 may carry `Retry-After`).
+   *
+   * It has to survive this layer to be usable: the shim turns it into the
+   * `Retry-After` header and the `[retry-after=<n>s]` message tag, and the
+   * adapter reads that tag back into `failure.providerRetryAfterMs` — the
+   * only field the harness retry policy honors. Dropped here, the host can
+   * only fall back to its own backoff (observed: 19134ms against an upstream
+   * that asked for 30s, so every retry hit the still-closed window).
+   */
+  retryAfterMs?: number;
 };
 /** Provenance of the last successful catalog fetch. */
 interface QoderCatalogFetch {

package/lib/index.js

@@ -1,4 +1,4 @@
-import { $ as configurePluginPaths, A as probeModel, B as QODER_PROBE_PATH, C as normalizeCredits, D as utc8WallClock, E as formatUtc8Date, F as QoderCatalog, G as QODER_PAT_ENV_GLOBAL, H as QODER_STATUS_PATH, I as QODER_AUTH_PATH, J as qoderCredentialId, K as QoderCredentialStore, L as QODER_GLOBAL_AUTH_PATH, M as QoderCatalogStore, N as qoderCatalogPath, O as getMachineId, P as FALLBACK_QODER_MODELS, Q as QODER_DATA_DIR_NAME, R as QODER_GLOBAL_PROBE_PATH, S as modelInfoOf, T as createQoderTransport, U as QODER_AUTH_FILENAME, V as QODER_SETTINGS_FACE_PATH, W as QODER_PAT_ENV_CN, X as qoderOwnAuthPath, Y as qoderCredentialIdentity, Z as QODER_DATA_DIR_ENV, _ as qoderProbePath, a as QODER_HOST_HEARTBEAT_FILENAME, b as classifyUpstreamError, c as processStartTimeMs, d as writeHostHeartbeat, et as qoderMachineIdPath, f as QODER_CONNECT_VERSION, g as newestFirst, h as fingerprintModel, i as variantFor, j as randomSentinel, k as PROBE_EFFORT_CANDIDATES, l as qoderHostHeartbeatPath, m as QoderProbeStore, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as QODER_PROBE_FILENAME, q as patTail, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, tt as qoderPluginDataDir, u as readHostHeartbeat, v as KIND_STATUS, w as validateApiKey, x as kindFromQoderFailure, y as QoderUpstreamClient, z as QODER_GLOBAL_STATUS_PATH } from "./variants-B_ZzENbC.js";
+import { $ as configurePluginPaths, A as probeModel, B as QODER_PROBE_PATH, C as normalizeCredits, D as utc8WallClock, E as formatUtc8Date, F as QoderCatalog, G as QODER_PAT_ENV_GLOBAL, H as QODER_STATUS_PATH, I as QODER_AUTH_PATH, J as qoderCredentialId, K as QoderCredentialStore, L as QODER_GLOBAL_AUTH_PATH, M as QoderCatalogStore, N as qoderCatalogPath, O as getMachineId, P as FALLBACK_QODER_MODELS, Q as QODER_DATA_DIR_NAME, R as QODER_GLOBAL_PROBE_PATH, S as modelInfoOf, T as createQoderTransport, U as QODER_AUTH_FILENAME, V as QODER_SETTINGS_FACE_PATH, W as QODER_PAT_ENV_CN, X as qoderOwnAuthPath, Y as qoderCredentialIdentity, Z as QODER_DATA_DIR_ENV, _ as qoderProbePath, a as QODER_HOST_HEARTBEAT_FILENAME, b as classifyUpstreamError, c as processStartTimeMs, d as writeHostHeartbeat, et as qoderMachineIdPath, f as QODER_CONNECT_VERSION, g as newestFirst, h as fingerprintModel, i as variantFor, j as randomSentinel, k as PROBE_EFFORT_CANDIDATES, l as qoderHostHeartbeatPath, m as QoderProbeStore, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as QODER_PROBE_FILENAME, q as patTail, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, tt as qoderPluginDataDir, u as readHostHeartbeat, v as KIND_STATUS, w as validateApiKey, x as kindFromQoderFailure, y as QoderUpstreamClient, z as QODER_GLOBAL_STATUS_PATH } from "./variants-Dl1AbWre.js";
 import z from "@deepseek-ai/schemastery";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { dirname, join } from "node:path";
@@ -221,6 +221,245 @@ function registerQoderAuthRoute(ctx, deps, key) {
 	}, "dsh-qoder-connect: PAT route");
 }
 //#endregion
+//#region src/shim.ts
+/**
+* Loopback OpenAI-compatible endpoint. The pi-ai provider points here; the
+* shim guards the local boundary and hands the raw JSON body to the upstream
+* client, which translates it onto the Qoder transport. It binds 127.0.0.1
+* only and never serves another interface.
+*
+* Inbound hardening: the loopback bind alone is not a trust boundary (any
+* local process or a DNS-rebinding page can reach 127.0.0.1), so every
+* request must carry a loopback Host header, browser-sent Origins must be
+* loopback, chat POSTs must be application/json, and the Authorization
+* header must carry the shim's per-process shared secret. The plugin's
+* own client satisfies all four by construction; local attackers cannot
+* read the secret out of the plugin process's memory.
+*
+* @module dsh-qoder-connect/shim
+*/
+const REQUEST_BODY_LIMIT = 67108864;
+/** Chat-completion POSTs must carry a JSON body type (simple-request CSRF drops here). */
+function isJsonContentType(req) {
+	const type = req.headers["content-type"];
+	return typeof type === "string" && type.trim().toLowerCase().startsWith("application/json");
+}
+function writeJson(res, status, body, headers = {}) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"Content-Type": "application/json",
+		"Content-Length": Buffer.byteLength(payload),
+		...headers
+	});
+	res.end(payload);
+}
+/**
+* The prefix the shim stamps onto a failure message carrying an upstream retry
+* hint.
+*
+* The hint has to cross two text-only boundaries to reach the harness retry
+* policy: pi-ai flattens an HTTP failure to its message and the adapter may only
+* rewrite that message. So the marker is written here, in front of the 400-byte
+* excerpt (never inside it, where truncation could cut it off), and read back by
+* {@link retryAfterFromMessage}.
+*/
+const RETRY_AFTER_TAG = /\[retry-after=(\d+)s\]/u;
+/**
+* The upstream's retry hint, in milliseconds, recovered from a shim failure
+* message.
+*
+* The tagged form is the contract this plugin writes itself. The untagged
+* `retryAfterSeconds` form is the fallback for a message the transport built
+* before the tag existed (an installed older shim, or a caller that composed the
+* message itself), and is the same field {@link qoderQueueSignal} reads.
+*/
+function retryAfterFromMessage(message) {
+	const tagged = RETRY_AFTER_TAG.exec(message);
+	if (tagged !== null) {
+		const seconds = Number(tagged[1]);
+		return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : void 0;
+	}
+	const body = /"retryAfterSeconds"\s*:\s*(\d+)/u.exec(message);
+	if (body !== null) {
+		const seconds = Number(body[1]);
+		return Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : void 0;
+	}
+}
+/**
+* Seconds an OpenAI `Retry-After` header carries: the ceiling of the hint, so a
+* client that honors it never returns before the upstream's window closed.
+*/
+function retryAfterSeconds(retryAfterMs) {
+	return Math.max(1, Math.ceil(retryAfterMs / 1e3));
+}
+function writeOpenAIError(res, status, kind, message, retryAfterMs) {
+	const hint = typeof retryAfterMs === "number" && Number.isFinite(retryAfterMs) && retryAfterMs > 0 ? Math.floor(retryAfterMs) : void 0;
+	if (hint === void 0) {
+		writeJson(res, status, { error: {
+			message,
+			type: kind,
+			code: kind
+		} });
+		return;
+	}
+	const seconds = retryAfterSeconds(hint);
+	writeJson(res, status, { error: {
+		message: `[retry-after=${seconds}s] ${message}`,
+		type: kind,
+		code: kind
+	} }, {
+		"Retry-After": String(seconds),
+		"retry-after-ms": String(hint)
+	});
+}
+/** Read a request body with a size cap; over-limit bodies fail the request. */
+function readBody$1(req) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let size = 0;
+		req.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > REQUEST_BODY_LIMIT) {
+				reject(/* @__PURE__ */ new Error("request body too large"));
+				req.destroy();
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => resolve(Buffer.concat(chunks)));
+		req.on("error", reject);
+	});
+}
+/**
+* Start the loopback endpoint. Requests carry any bearer; the loopback bind
+* is the boundary, and the upstream credential comes from the store alone.
+*/
+function createQoderShim(options) {
+	const { store, client, catalog } = options;
+	const logger = options.logger;
+	const providerId = options.providerId;
+	const SHARED_SECRET = randomBytes(32).toString("base64url");
+	/** Constant-time bearer check; absent or mismatched bearers are rejected. */
+	function bearerOk(req) {
+		const header = req.headers.authorization;
+		if (typeof header !== "string") return false;
+		const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+		if (match === null) return false;
+		const presented = match[1];
+		const expected = SHARED_SECRET;
+		const a = Buffer.from(presented);
+		const b = Buffer.from(expected);
+		if (a.length !== b.length) return false;
+		return timingSafeEqual(a, b);
+	}
+	const server = createServer((req, res) => {
+		handle(req, res).catch((error) => {
+			logger?.warn("dsh-qoder-connect: loopback request failed", error);
+			try {
+				if (!res.headersSent) writeOpenAIError(res, 500, "internal", "loopback request failed");
+				else res.end();
+			} catch {}
+		});
+	});
+	const ready = new Promise((resolve, reject) => {
+		server.once("listening", () => resolve());
+		server.once("error", reject);
+	});
+	server.listen(0, "127.0.0.1");
+	const baseUrl = () => {
+		const address = server.address();
+		if (address === null || typeof address === "string") throw new Error(`${providerId} shim has no listening address`);
+		return `http://127.0.0.1:${address.port}`;
+	};
+	async function handle(req, res) {
+		try {
+			if (!hostIsLoopback(req.headers.host)) {
+				writeOpenAIError(res, 403, "host_not_allowed", "Host header must name the loopback interface");
+				return;
+			}
+			if (!originIsLoopback(req.headers.origin)) {
+				writeOpenAIError(res, 403, "origin_not_allowed", "Origin must be a loopback origin");
+				return;
+			}
+			if (!bearerOk(req)) {
+				writeOpenAIError(res, 401, "unauthorized", "missing or invalid Authorization bearer");
+				return;
+			}
+			const url = req.url ?? "/";
+			if (req.method === "GET" && (url === "/healthz" || url === "/healthz/")) {
+				writeJson(res, 200, { ok: true });
+				return;
+			}
+			if (req.method === "GET" && (url === "/v1/models" || url === "/v1/models/")) {
+				writeJson(res, 200, {
+					object: "list",
+					data: catalog.current().map((model) => ({
+						id: model.id,
+						object: "model",
+						created: 0,
+						owned_by: providerId
+					}))
+				});
+				return;
+			}
+			if (req.method === "POST" && (url === "/v1/chat/completions" || url === "/v1/chat/completions/")) {
+				await chatCompletions(req, res);
+				return;
+			}
+			writeOpenAIError(res, 404, "not_found", `no such route: ${req.method} ${url}`);
+		} catch (error) {
+			if (!res.headersSent) writeOpenAIError(res, 500, "internal", String(error));
+			else res.end();
+		}
+	}
+	async function chatCompletions(req, res) {
+		if (!isJsonContentType(req)) {
+			writeOpenAIError(res, 415, "unsupported_media_type", "Content-Type must be application/json");
+			return;
+		}
+		try {
+			await store.resolve();
+		} catch (error) {
+			writeOpenAIError(res, KIND_STATUS.missing_credential, "not_signed_in", String(error));
+			return;
+		}
+		const raw = (await readBody$1(req)).toString("utf8");
+		const controller = new AbortController();
+		req.on("close", () => controller.abort());
+		const result = await client.chatStream(raw, controller.signal);
+		if (!result.ok) {
+			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `${providerId} upstream ${result.kind} (http ${KIND_STATUS[result.kind]}): ${result.message.slice(0, 400)}`, result.retryAfterMs);
+			return;
+		}
+		res.writeHead(200, {
+			"Content-Type": "text/event-stream",
+			"Cache-Control": "no-cache",
+			"Connection": "keep-alive",
+			"X-Accel-Buffering": "no"
+		});
+		let sawDone = false;
+		const body = Readable.fromWeb(result.response.body);
+		body.on("data", (chunk) => {
+			if (chunk.includes("[DONE]")) sawDone = true;
+		});
+		body.on("error", (error) => {
+			logger?.warn("dsh-qoder-connect: upstream stream failed mid-flight", error);
+			if (!sawDone && res.writable) res.end("data: [DONE]\n\n");
+		});
+		body.pipe(res);
+	}
+	return {
+		ready,
+		baseUrl,
+		token: () => SHARED_SECRET,
+		close: () => new Promise((resolve, reject) => {
+			server.close(() => resolve());
+			server.closeAllConnections();
+			server.once("error", reject);
+		})
+	};
+}
+//#endregion
 //#region src/adapter.ts
 /**
 * The Qoder pi-ai provider: one loopback-backed adapter per variant route,
@@ -492,6 +731,64 @@ var QoderPiAiAdapter = class QoderPiAiAdapter extends PiAiAdapter {
 		};
 	}
 	/**
+	* Carry the upstream's retry hint onto the finish failure.
+	*
+	* `dsh-llm-pi-ai` maps a failed pi-ai turn onto `{ message, code }` before the
+	* chunk reaches the loop: the HTTP status and headers pi-ai's own error object
+	* still holds are flattened away, so `failure.providerRetryAfterMs` — the one
+	* field the harness retry policy honors — never arrives. The policy then falls
+	* back to its local backoff, which is capped (20s in the report that prompted
+	* this) below Qoder's 30-second queue answer, so every retry hits the same
+	* closed window.
+	*
+	* The shim stamps `[retry-after=<n>s]` in front of its error message for this
+	* layer to recover; see `retryAfterFromMessage`. Rewriting only the field,
+	* never the message, keeps the text a human reads unchanged.
+	*
+	* Both entry points are wrapped because `PiAiAdapter` has two of them and the
+	* harness uses the other one: `prepareCall()` returns
+	* `stream: (options) => this.streamWithSnapshot(options, snapshot)`, which
+	* never calls `this.stream`. Overriding `stream` alone is dead code on every
+	* harness request (verified against a live session log: the finish failure
+	* arrived as bare `{ message, code }` while a direct `adapter.stream()` call
+	* carried the hint).
+	*/
+	async *stream(options) {
+		yield* this.withRetryHint(super.stream(options));
+	}
+	async prepareCall(provider, model, signal) {
+		const prepared = await super.prepareCall(provider, model, signal);
+		return {
+			...prepared,
+			stream: (options) => this.withRetryHint(prepared.stream(options))
+		};
+	}
+	/** Re-stamp `failure.providerRetryAfterMs` on every terminal failure chunk. */
+	async *withRetryHint(inner) {
+		for await (const chunk of inner) {
+			if (chunk.type === "finish") {
+				const { reason } = chunk;
+				if ((reason.kind === "error" || reason.kind === "aborted") && reason.failure.providerRetryAfterMs === void 0) {
+					const retryAfterMs = retryAfterFromMessage(reason.failure.message);
+					if (retryAfterMs !== void 0) {
+						yield {
+							...chunk,
+							reason: {
+								...reason,
+								failure: {
+									...reason.failure,
+									providerRetryAfterMs: retryAfterMs
+								}
+							}
+						};
+						continue;
+					}
+				}
+			}
+			yield chunk;
+		}
+	}
+	/**
 	* Resolve the request-image projection target for one route.
 	*
 	* `dsh-llm` 0.2.1 added `LlmAdapter.imageRequestTarget()` and its runtime calls
@@ -517,192 +814,6 @@ var QoderPiAiAdapter = class QoderPiAiAdapter extends PiAiAdapter {
 	}
 };
 //#endregion
-//#region src/shim.ts
-/**
-* Loopback OpenAI-compatible endpoint. The pi-ai provider points here; the
-* shim guards the local boundary and hands the raw JSON body to the upstream
-* client, which translates it onto the Qoder transport. It binds 127.0.0.1
-* only and never serves another interface.
-*
-* Inbound hardening: the loopback bind alone is not a trust boundary (any
-* local process or a DNS-rebinding page can reach 127.0.0.1), so every
-* request must carry a loopback Host header, browser-sent Origins must be
-* loopback, chat POSTs must be application/json, and the Authorization
-* header must carry the shim's per-process shared secret. The plugin's
-* own client satisfies all four by construction; local attackers cannot
-* read the secret out of the plugin process's memory.
-*
-* @module dsh-qoder-connect/shim
-*/
-const REQUEST_BODY_LIMIT = 67108864;
-/** Chat-completion POSTs must carry a JSON body type (simple-request CSRF drops here). */
-function isJsonContentType(req) {
-	const type = req.headers["content-type"];
-	return typeof type === "string" && type.trim().toLowerCase().startsWith("application/json");
-}
-function writeJson(res, status, body) {
-	const payload = JSON.stringify(body);
-	res.writeHead(status, {
-		"Content-Type": "application/json",
-		"Content-Length": Buffer.byteLength(payload)
-	});
-	res.end(payload);
-}
-function writeOpenAIError(res, status, kind, message) {
-	writeJson(res, status, { error: {
-		message,
-		type: kind,
-		code: kind
-	} });
-}
-/** Read a request body with a size cap; over-limit bodies fail the request. */
-function readBody$1(req) {
-	return new Promise((resolve, reject) => {
-		const chunks = [];
-		let size = 0;
-		req.on("data", (chunk) => {
-			size += chunk.length;
-			if (size > REQUEST_BODY_LIMIT) {
-				reject(/* @__PURE__ */ new Error("request body too large"));
-				req.destroy();
-				return;
-			}
-			chunks.push(chunk);
-		});
-		req.on("end", () => resolve(Buffer.concat(chunks)));
-		req.on("error", reject);
-	});
-}
-/**
-* Start the loopback endpoint. Requests carry any bearer; the loopback bind
-* is the boundary, and the upstream credential comes from the store alone.
-*/
-function createQoderShim(options) {
-	const { store, client, catalog } = options;
-	const logger = options.logger;
-	const providerId = options.providerId;
-	const SHARED_SECRET = randomBytes(32).toString("base64url");
-	/** Constant-time bearer check; absent or mismatched bearers are rejected. */
-	function bearerOk(req) {
-		const header = req.headers.authorization;
-		if (typeof header !== "string") return false;
-		const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-		if (match === null) return false;
-		const presented = match[1];
-		const expected = SHARED_SECRET;
-		const a = Buffer.from(presented);
-		const b = Buffer.from(expected);
-		if (a.length !== b.length) return false;
-		return timingSafeEqual(a, b);
-	}
-	const server = createServer((req, res) => {
-		handle(req, res).catch((error) => {
-			logger?.warn("dsh-qoder-connect: loopback request failed", error);
-			try {
-				if (!res.headersSent) writeOpenAIError(res, 500, "internal", "loopback request failed");
-				else res.end();
-			} catch {}
-		});
-	});
-	const ready = new Promise((resolve, reject) => {
-		server.once("listening", () => resolve());
-		server.once("error", reject);
-	});
-	server.listen(0, "127.0.0.1");
-	const baseUrl = () => {
-		const address = server.address();
-		if (address === null || typeof address === "string") throw new Error(`${providerId} shim has no listening address`);
-		return `http://127.0.0.1:${address.port}`;
-	};
-	async function handle(req, res) {
-		try {
-			if (!hostIsLoopback(req.headers.host)) {
-				writeOpenAIError(res, 403, "host_not_allowed", "Host header must name the loopback interface");
-				return;
-			}
-			if (!originIsLoopback(req.headers.origin)) {
-				writeOpenAIError(res, 403, "origin_not_allowed", "Origin must be a loopback origin");
-				return;
-			}
-			if (!bearerOk(req)) {
-				writeOpenAIError(res, 401, "unauthorized", "missing or invalid Authorization bearer");
-				return;
-			}
-			const url = req.url ?? "/";
-			if (req.method === "GET" && (url === "/healthz" || url === "/healthz/")) {
-				writeJson(res, 200, { ok: true });
-				return;
-			}
-			if (req.method === "GET" && (url === "/v1/models" || url === "/v1/models/")) {
-				writeJson(res, 200, {
-					object: "list",
-					data: catalog.current().map((model) => ({
-						id: model.id,
-						object: "model",
-						created: 0,
-						owned_by: providerId
-					}))
-				});
-				return;
-			}
-			if (req.method === "POST" && (url === "/v1/chat/completions" || url === "/v1/chat/completions/")) {
-				await chatCompletions(req, res);
-				return;
-			}
-			writeOpenAIError(res, 404, "not_found", `no such route: ${req.method} ${url}`);
-		} catch (error) {
-			if (!res.headersSent) writeOpenAIError(res, 500, "internal", String(error));
-			else res.end();
-		}
-	}
-	async function chatCompletions(req, res) {
-		if (!isJsonContentType(req)) {
-			writeOpenAIError(res, 415, "unsupported_media_type", "Content-Type must be application/json");
-			return;
-		}
-		try {
-			await store.resolve();
-		} catch (error) {
-			writeOpenAIError(res, KIND_STATUS.missing_credential, "not_signed_in", String(error));
-			return;
-		}
-		const raw = (await readBody$1(req)).toString("utf8");
-		const controller = new AbortController();
-		req.on("close", () => controller.abort());
-		const result = await client.chatStream(raw, controller.signal);
-		if (!result.ok) {
-			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `${providerId} upstream ${result.kind} (http ${KIND_STATUS[result.kind]}): ${result.message.slice(0, 400)}`);
-			return;
-		}
-		res.writeHead(200, {
-			"Content-Type": "text/event-stream",
-			"Cache-Control": "no-cache",
-			"Connection": "keep-alive",
-			"X-Accel-Buffering": "no"
-		});
-		let sawDone = false;
-		const body = Readable.fromWeb(result.response.body);
-		body.on("data", (chunk) => {
-			if (chunk.includes("[DONE]")) sawDone = true;
-		});
-		body.on("error", (error) => {
-			logger?.warn("dsh-qoder-connect: upstream stream failed mid-flight", error);
-			if (!sawDone && res.writable) res.end("data: [DONE]\n\n");
-		});
-		body.pipe(res);
-	}
-	return {
-		ready,
-		baseUrl,
-		token: () => SHARED_SECRET,
-		close: () => new Promise((resolve, reject) => {
-			server.close(() => resolve());
-			server.closeAllConnections();
-			server.once("error", reject);
-		})
-	};
-}
-//#endregion
 //#region src/probe-service.ts
 /**
 * Serial probe runner. One instance is shared by the manual API and any

package/lib/{variants-B_ZzENbC.js → variants-Dl1AbWre.js}

@@ -4625,6 +4625,17 @@ var ChunkEncoder = class {
 		} }), SSE_DONE];
 	}
 };
+/**
+* Normalize a provider retry hint for {@link QoderChatResult}.
+*
+* Only a positive finite number is a hint: the truncation keeps the shim's
+* `Retry-After` header an integer number of seconds, and `undefined` keeps the
+* optional field off the result entirely (no `retryAfterMs: undefined` noise in
+* the shim's error body).
+*/
+function retryHintOf(value) {
+	return typeof value === "number" && Number.isFinite(value) && value > 0 ? { retryAfterMs: Math.floor(value) } : {};
+}
 /** Turn any thrown failure into the shim's classified pre-stream result. */
 function failureResult(error) {
 	if (error instanceof UpstreamRequestError) return {
@@ -4639,7 +4650,8 @@ function failureResult(error) {
 			ok: false,
 			status: typeof error.failure.status === "number" && error.failure.status >= 100 && error.failure.status <= 599 ? error.failure.status : KIND_STATUS[kind],
 			kind,
-			message: error.failure.message
+			message: error.failure.message,
+			...retryHintOf(error.failure.providerRetryAfterMs)
 		};
 	}
 	return {
@@ -4819,7 +4831,8 @@ var QoderUpstreamClient = class {
 						ok: false,
 						status: earlyFailure.status ?? KIND_STATUS[kind],
 						kind,
-						message: earlyFailure.message
+						message: earlyFailure.message,
+						...retryHintOf(earlyFailure.providerRetryAfterMs)
 					};
 				}
 			}
@@ -5234,7 +5247,7 @@ function newestFirst(records) {
 }
 //#endregion
 //#region src/version.ts
-const QODER_CONNECT_VERSION = "0.2.7";
+const QODER_CONNECT_VERSION = "0.2.8";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-qoder-connect",
   "displayName": "DSH Qoder Connect",
   "description": "将 Qoder（国内版 / 国际版）的模型接入 DeepSeek Harness — bring Qoder (CN & international) models into DeepSeek Harness.",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "author": "corrinehu",
   "keywords": [
     "dsh-plugin",