dsh-retry-boost 1.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-retry-boost contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.en.md

@@ -0,0 +1,196 @@
+# dsh-retry-boost
+
+Auto-retry transient gateway failures until the task completes — a DSH plugin
+that hot-applies a resilience `retryPolicy` to every `llm-pi-ai` provider
+(also re-applied automatically when providers are added at runtime).
+No more manual **"continue"** after rate-limit disconnects.
+
+[中文说明](./README.md)
+
+---
+
+## The problem
+
+When a gateway answers with **`429 insufficient_quota`** — the exact wording
+SenseNova (and many other LLM gateways) uses — DSH's error classifier maps it
+to the **`QUOTA`** failure code ([`isQuotaExceededError`](https://github.com/deepseek-ai/deepseek-harness))
+*before* the generic 429 → `RATE_LIMIT` mapping.
+
+DSH's built-in request retry (`dsh-llm-retry`) only retries failures whose
+code is listed in the provider's `retryableCodes`. The **default** policy is:
+
+```text
+retryableCodes: [EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT]   // ← no QUOTA
+maxRetries: 5
+backoff: 500ms → 10s
+```
+
+`QUOTA` is **not** in that list, so a transient `429 insufficient_quota` fails
+fast: no retry at all, the turn dies instantly, and every manual "continue"
+hits the same wall. Relevant upstream report:
+[deepseek-ai/deepseek-harness discussion #892](https://github.com/deepseek-ai/deepseek-harness/discussions/892)
+(0 replies so far — the fix is not upstream yet).
+
+## The fix
+
+This plugin writes a widened `retryPolicy` into the `llm-pi-ai` settings
+namespace on startup. llm-pi-ai's settings `onChange` hot-applies it —
+**no restart needed**. The injected policy:
+
+```text
+retryableCodes: [EMPTY_RESPONSE, RATE_LIMIT, QUOTA, SERVER, TIMEOUT, TRANSPORT, PI_AI_ERROR, UNKNOWN]
+maxRetries: 50
+backoff: 1s → 60s, jitter 0.2 (exponential)
+```
+
+Result: a transient 429 / stream drop / timeout is retried with a widening
+backoff **until the task completes** — same as the settings.yaml workaround
+used in production against SenseNova, but packaged so anyone can install it.
+
+## Coverage and known limits
+
+This plugin injects into providers of the `llm-pi-ai` settings namespace —
+**all direct primary routes are covered**. The following are **out of reach**
+(the plugin has no configuration surface to influence them):
+
+- **Image-input variant routes** (e.g. `vision-toolkit-<provider>`): separate
+  adapters registered by vision plugins (e.g. dsh-vision-toolkit) via
+  `registerAdapter`. Their `retryPolicy` is captured once at registration and
+  never reads settings. DSH falls back to the built-in default for such routes
+  — whose `retryableCodes` do **not** include `QUOTA` — so a SenseNova 429
+  still fails fast on that route.
+  - The plugin auto-**detects and logs a warning** for such routes
+    (`warnUnprotectedVariants`, on by default, re-checked on adapter
+    updates). If you see `variant route "..." retries WITHOUT QUOTA`,
+    that is this detector.
+  - Way out: patch the variant adapter upstream (delegate
+    `providerRetryPolicy` to the upstream route), switch to a natively
+    image-capable model, or disable paste auto-switching to variants.
+- **Self-registered routes of other third-party LLM adapter plugins**: same
+  story — they bypass the llm-pi-ai namespace, so injection cannot reach them.
+
+## Why a plugin and not just settings.yaml?
+
+- **One command install** — works for every provider, not just the one you
+  hand-edited.
+- **Follows new providers** — add a provider tomorrow; the policy is applied
+  on the next start.
+- **Configurable** — `fill` / `boost` / `force` strategies, adjustable budget.
+- **Transparent** — the injected policy shows up in `settings.yaml`, fully
+  editable and visible; the plugin is idempotent and never fights your edits.
+
+## How it differs from `dsh-chat-continue`
+
+| | dsh-retry-boost (this) | [dsh-chat-continue](https://github.com/Chu-m/dsh-chat-continue) |
+| --- | --- | --- |
+| Layer | **First line of defense** — makes DSH's own retry actually work | **Second line** — retries *after* the built-in retry is exhausted |
+| Mechanism | Injects `retryPolicy` into every `llm-pi-ai` provider (official retry chain) | Intercepts `agent/request-error` and re-issues the failed request itself |
+| Backoff | Exponential, 1s → 60s, jittered | Fixed interval |
+| Manual confirm | — | Optional notification popup |
+| Install | `github:hhb1028/dsh-retry-boost#main` | `@wuxjs/dsh-chat-continue` |
+
+They are **complementary**: run this one alone, or stack it with
+dsh-chat-continue as a last-resort net.
+
+## Requirements
+
+- DSH `>= 0.1.1-rc.1` (host plugins via `dsh.bundle.patch`)
+- Node.js `>= 20`
+
+## Install
+
+```bash
+dsh plugin --profile <your-profile> add "github:hhb1028/dsh-retry-boost#main"
+```
+
+or from npm once published (see [Roadmap](#roadmap)):
+
+```bash
+dsh plugin --profile <your-profile> add dsh-retry-boost
+```
+
+Then restart DSH. Check the log for lines like:
+
+```
+dsh-retry-boost: injected retry policy for "sensenova" (mode=normal retries=50 backoff=1000ms->60000ms codes=8)
+```
+
+The injected policies are then visible in your profile's `settings.yaml`
+under `llm-pi-ai.providers.*.retryPolicy` — edit them freely.
+
+## Configuration
+
+Tune the plugin in the roster row (`cordis.patch.yml`) merged into your
+profile, or through your DSH plugin-config surface:
+
+| Key | Default | Meaning |
+| --- | --- | --- |
+| `strategy` | `fill` | `fill` = only providers **without** an explicit `retryPolicy`; `boost` = also merge missing codes and raise caps on explicit ones; `force` = replace every provider's policy |
+| `mode` | `normal` | `normal` = bounded retries; `always` = unbounded (DANGER: retries forever) |
+| `maxRetries` | `50` | retry budget in `normal` mode |
+| `initialDelayMs` | `1000` | first backoff delay |
+| `maxDelayMs` | `60000` | backoff ceiling |
+| `jitterRatio` | `0.2` | jitter ratio (0–1) |
+| `retryableCodes` | the 8 codes above | failure codes to retry |
+| `warnUnprotectedVariants` | `true` | log a warning when an unprotected variant route is detected (see "Coverage and known limits") |
+
+## Uninstall
+
+```bash
+dsh plugin --profile <your-profile> remove <name>
+```
+
+The injected `retryPolicy` sections stay in `settings.yaml` after removal —
+delete them by hand (or tell the plugin to `force` before uninstalling, then
+restore your own values) to return to DSH defaults.
+
+## How it works
+
+1. On startup the plugin reads the `llm-pi-ai` settings namespace.
+2. For each provider it plans a `retryPolicy` per `strategy` (pure functions
+   in `lib/policy.js`, fully unit-tested).
+3. It merges the patch through DSH's settings provider: schema-validated by
+   llm-pi-ai (the same `RetryPolicySchema` from `dsh-llm`), persisted to
+   `settings.yaml`, hot-applied by `installSettingsSection`'s `onChange`.
+4. Writes are idempotent: re-running with an already-boosted config produces
+   an empty patch.
+5. Variant-route watch: listens for `llm/adapters-updated` and re-checks the
+   captured `retryPolicy` of `vision-toolkit-*` style variant routes; warns
+   once per route while QUOTA is missing (re-armed after a fix). Warn-only —
+   an honest statement of the reach boundary.
+
+## Development
+
+```bash
+npm test        # unit + schema-integration + apply-flow tests (node --test)
+npm run check   # syntax check
+```
+
+No build step — the plugin is plain ESM. The schema-integration test passes
+generated policies through the *real* `RetryPolicySchema` /
+`resolveRetryPolicy` from your framework checkout, so an injected patch can
+never be rejected by the settings validator.
+
+## Roadmap
+
+- [ ] Publish to npm (`dsh-retry-boost`)
+- [x] Friendlier reload: re-run the plan when `llm-pi-ai` settings change
+      (v1.2.0: listens on `llm/adapters-updated`, debounced 300ms, idempotent —
+      providers added at runtime are protected without a restart)
+- [ ] Optional settings page (Settings → Retry Boost) reusing a generic form
+
+## Changelog
+
+### 1.2.0
+
+- Providers added at runtime are now protected automatically: the plugin
+  re-sweeps on `llm/adapters-updated` (shared with the variant-route warning),
+  debounced 300ms. The plan is idempotent — sweeps triggered by this plugin's
+  own writes never write again, so there is no update loop. Startup behavior
+  is unchanged from v1.1.0.
+- Useful when you add a new provider to settings.yaml (e.g. a second key as a
+  backup channel) or via the settings UI while DSH is running.
+
+## License
+
+MIT

package/README.md

@@ -0,0 +1,175 @@
+# dsh-retry-boost
+
+遇到网关瞬时故障（429 限流/断流/超时）时自动退避重试、直到任务完成——一个 DSH
+插件，启动时把防断流 `retryPolicy` 热注入到所有 `llm-pi-ai` provider；
+之后在运行中新增/修改的 provider 也会自动补上（监听 `llm/adapters-updated`）。
+再也不用手动发「继续」了。
+
+[English README](./README.en.md)
+
+---
+
+## 问题背景
+
+网关返回 **`429 insufficient_quota`**（商汤 SenseNova 和很多 LLM 网关都这么措辞）时，
+DSH 的错误分类器会先命中 `isQuotaExceededError` 把它归为 **`QUOTA`** 码，
+而不是通用的 429 → `RATE_LIMIT`。
+
+DSH 内置重试（`dsh-llm-retry`）只重试 `retryableCodes` 列表里的错误码。而**默认**策略是：
+
+```text
+retryableCodes: [EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT]   // ← 没有 QUOTA
+maxRetries: 5
+backoff: 500ms → 10s
+```
+
+`QUOTA` 不在列表里 → 瞬时 `429 insufficient_quota` 直接 **fail-fast**：
+一次都不重试、turn 立刻死掉，手动「继续」也会再撞同一堵墙。上游同源问题：
+[deepseek-ai/deepseek-harness discussion #892](https://github.com/deepseek-ai/deepseek-harness/discussions/892)
+（目前 0 回复，官方尚未修复）。
+
+## 解决方案
+
+插件启动时把一份加宽的 `retryPolicy` 写入 `llm-pi-ai` 设置命名空间，
+llm-pi-ai 的 settings `onChange` 会**热生效，无需重启**。注入的策略：
+
+```text
+retryableCodes: [EMPTY_RESPONSE, RATE_LIMIT, QUOTA, SERVER, TIMEOUT, TRANSPORT, PI_AI_ERROR, UNKNOWN]
+maxRetries: 50
+backoff: 1s → 60s，抖动 0.2（指数退避）
+```
+
+效果：瞬时 429 / 断流 / 超时会被指数退避**重试直到任务完成**——就是把商汤生产
+环境里用的那个 settings.yaml 补丁产品化，让任何人都能一键装上。
+
+## 覆盖范围与已知限制
+
+本插件注入的是 `llm-pi-ai` 设置命名空间里的 provider——**直连主路由全覆盖**。
+以下路径**不在射程内**（本插件没有任何配置面能影响它们）：
+
+- **图片输入变体路由**（如 `vision-toolkit-<provider>`）：由视觉类插件
+  （如 dsh-vision-toolkit）通过 `registerAdapter` 注册的独立 adapter，
+  其 `retryPolicy` 在注册时一次性捕获、不读 settings。DSH 对这类路由
+  会落到内置默认值——`retryableCodes` 里**没有 QUOTA**，商汤 429 会在
+  这条路线上照样秒断。
+  - 插件会自动**检测并在日志里警告**这类路由（`warnUnprotectedVariants`，
+    默认开启，路由注册/更新时复检）。看到
+    `variant route "..." retries WITHOUT QUOTA` 就是它。
+  - 出路：给变体 adapter 的上游提补丁（让 `providerRetryPolicy` 委托
+    upstream 主路由）、换原生支持图片输入的模型、或临时关闭粘贴自动切变体。
+- **其他第三方 LLM adapter 插件注册的自有路由**：同样不经过 llm-pi-ai
+  命名空间，本插件无法注入。
+
+## 为什么做成插件而不是只改 settings.yaml？
+
+- **一条命令安装**——对*所有* provider 生效，不只是你手改的那一个。
+- **跟着新 provider 走**——以后新增 provider，下次启动自动套用。
+- **可配置**——`fill` / `boost` / `force` 三种策略，重试预算可调。
+- **透明**——注入的策略会出现在 `settings.yaml` 里，看得见、改得动；
+  插件幂等，绝不和你手改的配置打架。
+
+## 与 dsh-chat-continue 的区别
+
+| | dsh-retry-boost（本项目） | [dsh-chat-continue](https://github.com/Chu-m/dsh-chat-continue) |
+| --- | --- | --- |
+| 定位 | **第一道防线**——让 DSH 内置重试真正生效 | **第二道防线**——内置重试耗尽后兜底重试 |
+| 机制 | 给所有 `llm-pi-ai` provider 注入 `retryPolicy`（走官方重试链路） | 拦截 `agent/request-error` 自己重发失败的请求 |
+| 退避 | 指数退避 1s → 60s + 抖动 | 固定间隔 |
+| 手动确认 | —— | 可选弹窗通知 |
+| 安装 | `github:hhb1028/dsh-retry-boost#main` | `@wuxjs/dsh-chat-continue` |
+
+两者**互补**：单独用本项目即可；也可以叠上 chat-continue 作为最后的兜底网。
+
+## 环境要求
+
+- DSH `>= 0.1.1-rc.1`（支持 `dsh.bundle.patch` 宿主插件）
+- Node.js `>= 20`
+
+## 安装
+
+```bash
+dsh plugin --profile <你的profile名> add "github:hhb1028/dsh-retry-boost#main"
+```
+
+发布到 npm 后（见 [Roadmap](#roadmap)）：
+
+```bash
+dsh plugin --profile <你的profile名> add dsh-retry-boost
+```
+
+然后重启 DSH。日志里会出现类似：
+
+```
+dsh-retry-boost: injected retry policy for "sensenova" (mode=normal retries=50 backoff=1000ms->60000ms codes=8)
+```
+
+注入后的策略会出现在 profile 的 `settings.yaml` 中
+`llm-pi-ai.providers.*.retryPolicy` 下——可以随意手动修改。
+
+## 配置项
+
+在合并进 profile 的 `cordis.patch.yml` roster 行（或 DSH 的插件配置界面）里调整：
+
+| 键 | 默认值 | 含义 |
+| --- | --- | --- |
+| `strategy` | `fill` | `fill` = 只处理**没有**显式 `retryPolicy` 的 provider；`boost` = 对显式配置的也合并缺失错误码并抬高上限；`force` = 全部替换为插件策略 |
+| `mode` | `normal` | `normal` = 有界重试；`always` = 无限重试（⚠️ 慎用，永远重试下去） |
+| `maxRetries` | `50` | `normal` 模式下的重试次数上限 |
+| `initialDelayMs` | `1000` | 首次退避延迟 |
+| `maxDelayMs` | `60000` | 退避上限 |
+| `jitterRatio` | `0.2` | 抖动比例（0–1） |
+| `retryableCodes` | 上面 8 个码 | 需要重试的失败码 |
+| `warnUnprotectedVariants` | `true` | 检测到不受保护的变体路由（见「覆盖范围与已知限制」）时打日志警告 |
+
+## 卸载
+
+```bash
+dsh plugin --profile <你的profile名> remove <名字>
+```
+
+卸载后注入到 `settings.yaml` 里的 `retryPolicy` 段**不会自动删除**——手动清掉
+（或卸载前先用 `force` 策略并恢复你自己的值），即可回到 DSH 默认行为。
+
+## 工作原理
+
+1. 启动时读取 `llm-pi-ai` 设置命名空间。
+2. 按 `strategy` 为每个 provider 规划目标 `retryPolicy`（`lib/policy.js` 纯函数，
+   全量单元测试）。
+3. 通过 DSH 的 settings provider 合并写入：经 llm-pi-ai 校验（与 `dsh-llm`
+   的 `RetryPolicySchema` 完全一致）→ 持久化到 `settings.yaml` →
+   `installSettingsSection` 的 `onChange` 热生效。
+4. 写入幂等：已达标时再次运行产生空 patch，绝不反复改写。
+5. 变体路由巡检：监听 `llm/adapters-updated`，对 `vision-toolkit-*` 等变体
+   路由的已捕获 `retryPolicy` 复检；缺 QUOTA 时打警告（每条路由一次，
+   修复后重新武装），只警告不改动——诚实告知射程边界。
+
+## 开发
+
+```bash
+npm test        # 单元 + 真实 schema 集成 + apply 流程测试（node --test）
+npm run check   # 语法检查
+```
+
+无构建步骤——纯 ESM。schema 集成测试会把生成的策略跑过框架**真实**的
+`RetryPolicySchema` / `resolveRetryPolicy`，保证注入的 patch 永远不会被设置校验拒绝。
+
+## Roadmap
+
+- [ ] 发布到 npm（`dsh-retry-boost`）
+- [x] llm-pi-ai 配置变化时自动重跑策略（v1.2.0：监听 `llm/adapters-updated`，
+      防抖 300ms，幂等防自触发——运行中新增的 provider 无需重启即受保护）
+- [ ] 可选的设置页面（Settings → Retry Boost）
+
+## 更新记录
+
+### 1.2.0
+
+- 运行中新增的 provider 自动受保护：监听 `llm/adapters-updated`（与变体路由
+  警告共用事件），防抖 300ms 后重跑注入计划。计划幂等——本插件自己写入引发
+  的扫描不会造成二次写入，更不会死循环；启动行为与 v1.1.0 完全一致。
+- 适用于：先启动 DSH、之后往 settings.yaml 加新 provider（比如第二把 key 的
+  备用通道）、或在设置界面新增供应商的场景，全程无需重启。
+
+## 许可证
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,30 @@
+# dsh-retry-boost bundle patch: inserts the host plugin row into the profile
+# roster. Applied as a profile bundle layer (the `dsh.bundle.patch` manifest
+# field). The node half (exports ".") runs in the host process and hot-applies
+# a resilience retryPolicy to every llm-pi-ai provider on startup. No browser
+# half.
+#
+# Defaults mirror the SenseNova 429 fix: bounded 50-attempt retries with an
+# exponential backoff of 1s -> 60s (jitter 0.2) across the FULL failure-code
+# set (QUOTA included). Tune `strategy`: "fill" (only providers without an
+# explicit retryPolicy), "boost" (also merge codes/raise caps on explicit
+# ones), "force" (replace everything).
+- insert:
+    - id: retry-boost
+      name: dsh-retry-boost
+      config:
+        strategy: fill
+        mode: normal
+        maxRetries: 50
+        initialDelayMs: 1000
+        maxDelayMs: 60000
+        jitterRatio: 0.2
+        retryableCodes:
+          - EMPTY_RESPONSE
+          - RATE_LIMIT
+          - QUOTA
+          - SERVER
+          - TIMEOUT
+          - TRANSPORT
+          - PI_AI_ERROR
+          - UNKNOWN

package/lib/index.js

@@ -0,0 +1,209 @@
+/**
+ * dsh-retry-boost — DSH plugin entry.
+ *
+ * On startup it plans and hot-applies a resilience `retryPolicy` for every
+ * provider registered under the built-in `llm-pi-ai` settings namespace, so
+ * transient gateway failures — most importantly `429 insufficient_quota`
+ * (code `QUOTA`, which DSH's default retry list does NOT contain) — are
+ * automatically retried with a widened exponential backoff until the task
+ * completes, with no manual "continue" needed.
+ *
+ * Providers added after boot (or whose explicit policy was removed) are picked
+ * up automatically: the plugin re-sweeps on `llm/adapters-updated`, so a newly
+ * registered provider gets protected without a restart.
+ *
+ * The write goes through the settings provider (`llm-pi-ai` namespace, merge
+ * patch), which is validated by llm-pi-ai and hot-applied by its
+ * `installSettingsSection` onChange → no restart, and it is visible and
+ * user-editable in settings.yaml afterwards. Writes are idempotent.
+ */
+
+import {
+  findUnprotectedVariants,
+  isPolicyProtected,
+  normalizeConfig,
+  planInjection,
+} from "./policy.js";
+
+/** Plugin identity, matched by the cordis.patch.yml roster row. */
+export const name = "retry-boost";
+/** Wait for the settings service before touching the `llm-pi-ai` namespace. */
+export const inject = ["settings"];
+
+/** The settings namespace owned by the built-in llm-pi-ai plugin. */
+export const LLM_PI_AI_NS = "llm-pi-ai";
+
+/** Defensive wait upper bound for the namespace to appear (boot ordering). */
+const WAIT_TRIES = 50;
+const WAIT_STEP_MS = 50;
+
+/** Coalesce bursts of `llm/adapters-updated` events before a runtime re-sweep. */
+const RESWEEP_DEBOUNCE_MS = 300;
+
+/** @param {number} ms */
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * llm-pi-ai is a built-in plugin and registers its namespace before profile
+ * plugins apply, but we guard boot-order races with a short bounded wait.
+ * @param {import("@deepseek-ai/dsh-settings").SettingsProvider} settings
+ */
+async function waitForNamespace(settings) {
+  for (let attempt = 0; attempt < WAIT_TRIES; attempt += 1) {
+    if (settings.get?.(LLM_PI_AI_NS) !== undefined) return;
+    await sleep(WAIT_STEP_MS);
+  }
+  throw new Error(
+    `dsh-retry-boost: settings namespace "${LLM_PI_AI_NS}" never appeared — ` +
+    "is the built-in llm-pi-ai plugin enabled?",
+  );
+}
+
+/**
+ * @param {import("@deepseek-ai/cordis").Context} ctx - cordis plugin context.
+ * @param {object} [config] - plugin config from the roster row (see cordis.patch.yml).
+ */
+export function apply(ctx, config = {}) {
+  let cfg;
+  try {
+    cfg = normalizeConfig(config);
+  } catch (error) {
+    ctx.logger.error("dsh-retry-boost: %s", error.message);
+    return;
+  }
+  ctx.logger.info(
+    "dsh-retry-boost: strategy=%s mode=%s maxRetries=%d backoff=%dms->%dms codes=%s",
+    cfg.strategy, cfg.mode, cfg.maxRetries, cfg.initialDelayMs, cfg.maxDelayMs,
+    cfg.retryableCodes.join(","),
+  );
+  ctx.inject(["settings"], async (sctx) => {
+    try {
+      await waitForNamespace(sctx.settings);
+      await sweepProviders(ctx, sctx.settings, cfg, "startup");
+    } catch (error) {
+      ctx.logger.error("dsh-retry-boost: failed to apply retry policies: %o", error);
+    }
+  });
+  watchRuntimeProviders(ctx, cfg);
+  if (cfg.warnUnprotectedVariants) {
+    watchVariantRoutes(ctx, cfg);
+  }
+}
+
+/**
+ * Re-plan and hot-apply policies for providers that appear AFTER boot (user
+ * registers a new provider in settings.yaml or via the UI). Driven by the same
+ * `llm/adapters-updated` event the variant watcher listens on, debounced to
+ * coalesce bursts. Loop-safe: the plan is idempotent (resolveTargetPolicy
+ * returns null for unchanged providers), so the sweep triggered by this
+ * plugin's own write ends after one extra no-op pass. If the namespace has not
+ * appeared yet the sweep is a no-op; the startup path still covers boot.
+ * @param {import("@deepseek-ai/cordis").Context} ctx - cordis plugin context.
+ * @param {object} cfg - normalized plugin config.
+ */
+function watchRuntimeProviders(ctx, cfg) {
+  if (typeof ctx.on !== "function") return;
+  ctx.inject(["settings"], (sctx) => {
+    const settings = sctx.settings;
+    let timer = null;
+    const resweep = () => {
+      timer = null;
+      Promise.resolve()
+        .then(() => sweepProviders(ctx, settings, cfg, "runtime"))
+        .catch((error) => ctx.logger.error("dsh-retry-boost: runtime re-sweep failed: %o", error));
+    };
+    ctx.on("llm/adapters-updated", () => {
+      if (timer !== null) clearTimeout(timer);
+      timer = setTimeout(resweep, RESWEEP_DEBOUNCE_MS);
+    });
+  });
+}
+
+/**
+ * Plan the injection for the currently registered providers and write it when
+ * non-empty. Idempotent: writes nothing when every provider is already at its
+ * target policy.
+ * @param {import("@deepseek-ai/cordis").Context} ctx - cordis plugin context.
+ * @param {import("@deepseek-ai/dsh-settings").SettingsProvider} settings
+ * @param {object} cfg - normalized plugin config.
+ * @param {"startup"|"runtime"} source - sweep origin, for log context.
+ * @returns {Promise<boolean>} whether a settings update was issued.
+ */
+async function sweepProviders(ctx, settings, cfg, source) {
+  const current = settings.get(LLM_PI_AI_NS);
+  const providers = current?.providers ?? {};
+  const { patch, report } = planInjection(providers, cfg);
+  const touched = Object.keys(patch.providers);
+  if (touched.length === 0) {
+    if (source === "startup") {
+      ctx.logger.info("dsh-retry-boost: nothing to adjust (strategy=%s)", cfg.strategy);
+    }
+    return false;
+  }
+  await settings.update(LLM_PI_AI_NS, patch);
+  for (const row of report) {
+    if (row.action === "skipped") continue;
+    ctx.logger.info(
+      "dsh-retry-boost: (%s) %s provider \"%s\" (%s)",
+      source,
+      row.action === "injected" ? "injected retry policy for" : "boosted retry policy for",
+      row.provider,
+      row.detail,
+    );
+  }
+  return true;
+}
+
+/**
+ * Warn about registered variant routes (vision-toolkit image-input twins etc.)
+ * whose captured retryPolicy still fails QUOTA fast. These routes are registered
+ * by OTHER adapters outside the llm-pi-ai settings namespace, so this plugin
+ * cannot inject a fix — warning is the honest maximum. Re-checks on every
+ * llm/adapters-updated (variant registration is async), warns once per route
+ * until its policy is fixed or the route disappears, then re-arms.
+ * @param {import("@deepseek-ai/cordis").Context} ctx - cordis plugin context.
+ * @param {object} cfg - normalized plugin config.
+ */
+function watchVariantRoutes(ctx, cfg) {
+  ctx.inject(["llm"], (lctx) => {
+    const llm = lctx.llm;
+    /** Routes already warned about; removed when fixed or gone, so a later
+     *  regression warns again instead of being silenced forever. */
+    const warned = new Set();
+    const sweep = () => {
+      let providers;
+      try {
+        providers = llm.listProviders();
+      } catch {
+        return;
+      }
+      for (const finding of findUnprotectedVariants(providers, (id) => llm.providerRetryPolicy(id))) {
+        if (warned.has(finding.provider)) continue;
+        warned.add(finding.provider);
+        ctx.logger.warn(
+          "dsh-retry-boost: variant route \"%s\" (%s) retries WITHOUT QUOTA — 429 insufficient_quota fails fast there. " +
+          "Variant routes live outside the llm-pi-ai settings namespace, so this plugin cannot protect them; " +
+          "patch the variant adapter upstream or pick a natively image-capable model.",
+          finding.provider,
+          finding.name ?? finding.provider,
+        );
+      }
+      for (const id of [...warned]) {
+        let policy;
+        try {
+          policy = llm.providerRetryPolicy(id);
+        } catch {
+          warned.delete(id); // route gone — re-arm
+          continue;
+        }
+        if (isPolicyProtected(policy)) warned.delete(id); // fixed — re-arm for future regressions
+      }
+    };
+    sweep();
+    if (typeof ctx.on === "function") {
+      ctx.on("llm/adapters-updated", () => sweep());
+    }
+  });
+}

package/lib/policy.js

@@ -0,0 +1,258 @@
+/**
+ * dsh-retry-boost — pure retry-policy planning.
+ *
+ * DSH's built-in request retry (`dsh-llm-retry`) only retries a failure when
+ * the failure code is present in the provider's `retryableCodes`. The default
+ * policy shipped by `dsh-llm` is:
+ *
+ *   maxRetries 5 · initialDelayMs 500 · maxDelayMs 10_000
+ *   retryableCodes [EMPTY_RESPONSE, RATE_LIMIT, SERVER, TIMEOUT, TRANSPORT]
+ *
+ * `QUOTA` is missing, so a gateway answering `429 insufficient_quota` (the
+ * wording SenseNova — and many other gateways — actually use) is classified
+ * as QUOTA by `classifyPiAiError` and **fails fast**: no retry, the turn dies,
+ * the user has to click "continue" and often hits the same 429 again.
+ *
+ * This module plans a per-provider `retryPolicy` that fixes exactly that:
+ *   - adds QUOTA (+ PI_AI_ERROR, UNKNOWN) to the retryable set,
+ *   - raises the retry budget (50 attempts),
+ *   - widens the exponential backoff window (1s → 60s, jittered).
+ *
+ * The plugin writes the planned patch into the `llm-pi-ai` settings namespace
+ * (hot-applied by llm-pi-ai's settings.onChange — no restart needed).
+ */
+
+/** Every failure code the built-in classifier can produce. */
+export const DEFAULT_RETRYABLE_CODES = Object.freeze([
+  "EMPTY_RESPONSE",
+  "RATE_LIMIT",
+  "QUOTA",
+  "SERVER",
+  "TIMEOUT",
+  "TRANSPORT",
+  "PI_AI_ERROR",
+  "UNKNOWN",
+]);
+
+export const STRATEGIES = Object.freeze(["fill", "boost", "force"]);
+export const MODES = Object.freeze(["normal", "always"]);
+
+export const DEFAULT_CONFIG = Object.freeze({
+  /** fill = only touch providers that have no explicit retryPolicy (default).
+   *  boost = additionally strengthen providers that do (merge codes, raise caps).
+   *  force = replace every provider's retryPolicy with the boost policy. */
+  strategy: "fill",
+  /** "normal" = bounded retries, "always" = unbounded (mode: always, careful). */
+  mode: "normal",
+  maxRetries: 50,
+  initialDelayMs: 1000,
+  maxDelayMs: 60000,
+  jitterRatio: 0.2,
+  retryableCodes: [...DEFAULT_RETRYABLE_CODES],
+  /** Warn (log only) when a registered variant route (e.g. vision-toolkit
+   *  image-input twins) would still fail QUOTA fast — such routes live outside
+   *  the llm-pi-ai settings namespace, so injection cannot reach them. */
+  warnUnprotectedVariants: true,
+});
+
+/** Keep only the keys this plugin owns, so it never drags foreign keys into settings. */
+const KNOWN_KEYS = new Set(Object.keys(DEFAULT_CONFIG));
+
+/** @returns a copy of `input` restricted to known config keys (undefined-safe). */
+export function pickKnown(input = {}) {
+  if (typeof input !== "object" || input === null) return {};
+  const out = {};
+  for (const key of KNOWN_KEYS) {
+    if (key in input && input[key] !== undefined) out[key] = input[key];
+  }
+  return out;
+}
+
+function fail(message) {
+  throw new TypeError(`dsh-retry-boost config: ${message}`);
+}
+
+/** Validate and normalize a plugin config object. */
+export function normalizeConfig(input = {}) {
+  const base = { ...DEFAULT_CONFIG, ...pickKnown(input) };
+  if (!STRATEGIES.includes(base.strategy)) fail(`strategy must be one of ${STRATEGIES.join("/")}`);
+  if (!MODES.includes(base.mode)) fail(`mode must be one of ${MODES.join("/")}`);
+  if (base.warnUnprotectedVariants !== undefined && typeof base.warnUnprotectedVariants !== "boolean") {
+    fail("warnUnprotectedVariants must be a boolean");
+  }
+  const maxRetries = Number(base.maxRetries);
+  if (!Number.isSafeInteger(maxRetries) || maxRetries < 0) fail("maxRetries must be a non-negative safe integer");
+  const initialDelayMs = Number(base.initialDelayMs);
+  const maxDelayMs = Number(base.maxDelayMs);
+  const jitterRatio = Number(base.jitterRatio);
+  if (!Number.isFinite(initialDelayMs) || initialDelayMs <= 0) fail("initialDelayMs must be a positive number");
+  if (!Number.isFinite(maxDelayMs) || maxDelayMs <= 0) fail("maxDelayMs must be a positive number");
+  if (initialDelayMs > maxDelayMs) fail("initialDelayMs must be <= maxDelayMs");
+  if (!Number.isFinite(jitterRatio) || jitterRatio < 0 || jitterRatio > 1) fail("jitterRatio must be between 0 and 1");
+  const codes = Array.isArray(base.retryableCodes)
+    ? base.retryableCodes
+    : [...DEFAULT_RETRYABLE_CODES];
+  if (codes.length === 0) fail("retryableCodes must not be empty");
+  for (const code of codes) {
+    if (typeof code !== "string" || code.length === 0) fail("retryableCodes must contain only non-empty strings");
+  }
+  if (new Set(codes).size !== codes.length) fail("retryableCodes must not contain duplicates");
+  return Object.freeze({
+    strategy: base.strategy,
+    mode: base.mode,
+    maxRetries,
+    initialDelayMs,
+    maxDelayMs,
+    jitterRatio,
+    retryableCodes: Object.freeze([...codes]),
+    warnUnprotectedVariants: base.warnUnprotectedVariants ?? true,
+  });
+}
+
+/** Union-preserving code merge: keep `existing` order, append missing `want` codes. */
+export function mergeCodes(existing, want) {
+  const seen = new Set(existing);
+  return [...existing, ...want.filter((code) => !seen.has(code))];
+}
+
+/**
+ * Build the policy the plugin would write for one provider.
+ * @param {string} strategy - fill | boost | force
+ * @param {object|undefined} existing - the provider's current retryPolicy, if any.
+ * @param {object} cfg - normalized plugin config.
+ * @returns {object|null} the target retryPolicy, or null when nothing should change.
+ */
+export function resolveTargetPolicy(strategy, existing, cfg) {
+  const boost = makePolicy(cfg);
+  // No explicit policy (or forced): write the boost policy.
+  if (strategy === "force" || existing === undefined) return boost;
+  if (strategy === "fill") return null; // explicit user policy wins
+  // boost: keep the user's mode, raise the caps, complete the codes.
+  const merged = { ...existing };
+  merged.retryableCodes = mergeCodes(existing.retryableCodes ?? [], cfg.retryableCodes);
+  if (existing.mode === "normal") {
+    merged.maxRetries = Math.max(existing.maxRetries ?? 0, cfg.maxRetries);
+  }
+  const backoff = { ...(existing.backoff ?? {}) };
+  backoff.initialDelayMs = Math.min(existing.backoff?.initialDelayMs ?? cfg.initialDelayMs, cfg.initialDelayMs);
+  backoff.maxDelayMs = Math.max(existing.backoff?.maxDelayMs ?? 0, cfg.maxDelayMs);
+  backoff.jitterRatio = existing.backoff?.jitterRatio ?? cfg.jitterRatio;
+  merged.backoff = backoff;
+  return equalPolicy(merged, existing) ? null : merged;
+}
+
+/** The policy this plugin writes for a provider (bounded or unbounded). */
+export function makePolicy(cfg) {
+  const backoff = {
+    initialDelayMs: cfg.initialDelayMs,
+    maxDelayMs: cfg.maxDelayMs,
+    jitterRatio: cfg.jitterRatio,
+  };
+  if (cfg.mode === "always") return { mode: "always", backoff };
+  return {
+    mode: "normal",
+    maxRetries: cfg.maxRetries,
+    retryableCodes: [...cfg.retryableCodes],
+    backoff,
+  };
+}
+
+function equalPolicy(a, b) {
+  if (a === undefined || b === undefined) return a === b;
+  return JSON.stringify(sortPolicy(a)) === JSON.stringify(sortPolicy(b));
+}
+
+/** Canonical, order-independent serialization for change detection. */
+function sortPolicy(policy) {
+  return {
+    mode: policy.mode,
+    ...(policy.mode === "normal"
+      ? { maxRetries: policy.maxRetries, retryableCodes: [...policy.retryableCodes].sort() }
+      : {}),
+    backoff: {
+      initialDelayMs: policy.backoff?.initialDelayMs,
+      maxDelayMs: policy.backoff?.maxDelayMs,
+      jitterRatio: policy.backoff?.jitterRatio,
+    },
+  };
+}
+
+/**
+ * Plan the settings patch for `llm-pi-ai`.
+ * @param {Record<string, any>} providers - raw providers section (may be {}).
+ * @param {object} cfg - normalized plugin config.
+ * @returns {{patch: {providers: Record<string, {retryPolicy: object}>}, report: Array<object>}}
+ *   `report` rows are {provider, action: "injected"|"boosted"|"skipped"} with a short summary.
+ */
+export function planInjection(providers = {}, cfg) {
+  const patch = { providers: {} };
+  const report = [];
+  for (const [id, profile] of Object.entries(providers ?? {})) {
+    if (typeof profile !== "object" || profile === null) continue;
+    const existing = profile.retryPolicy;
+    const target = resolveTargetPolicy(cfg.strategy, existing, cfg);
+    if (target === null) {
+      report.push({ provider: id, action: "skipped", detail: existing ? "user policy kept" : "no provider" });
+    } else if (equalPolicy(target, existing)) {
+      report.push({ provider: id, action: "skipped", detail: "already boosted" });
+    } else {
+      patch.providers[id] = { retryPolicy: target };
+      report.push({
+        provider: id,
+        action: existing === undefined ? "injected" : "boosted",
+        detail: summaryOf(target),
+      });
+    }
+  }
+  return { patch, report };
+}
+
+/** Prefix vision-toolkit-style image-input variant routes register under. */
+export const VARIANT_PROVIDER_PREFIX = "vision-toolkit-";
+
+/**
+ * Whether one resolved retryPolicy actually covers the codes this plugin
+ * exists for. `mode: "always"` retries unconditionally and always qualifies.
+ * @param {object|undefined} policy - a resolved (registration-captured) policy.
+ * @param {string[]} [requiredCodes] - codes that must be retryable.
+ * @returns {boolean}
+ */
+export function isPolicyProtected(policy, requiredCodes = ["QUOTA"]) {
+  if (policy === undefined || policy === null) return false;
+  if (policy.mode === "always") return true;
+  const codes = Array.isArray(policy.retryableCodes) ? policy.retryableCodes : [];
+  return requiredCodes.every((code) => codes.includes(code));
+}
+
+/**
+ * Find registered variant routes (vision-toolkit image-input twins and any
+ * future adapter following the same `<prefix><upstream>` naming) whose captured
+ * retryPolicy still fails QUOTA fast. These routes live OUTSIDE the llm-pi-ai
+ * settings namespace — the plugin cannot inject a fix — so the caller should
+ * warn instead. Pure: providers in, findings out.
+ * @param {Array<{id: string, name?: string}>} providers - llm.listProviders() output.
+ * @param {(providerId: string) => object|undefined} readPolicy - bound llm.providerRetryPolicy.
+ * @returns {Array<{provider: string, name?: string}>}
+ */
+export function findUnprotectedVariants(providers, readPolicy) {
+  const findings = [];
+  for (const provider of providers ?? []) {
+    if (typeof provider?.id !== "string" || !provider.id.startsWith(VARIANT_PROVIDER_PREFIX)) continue;
+    let policy;
+    try {
+      policy = readPolicy(provider.id);
+    } catch {
+      continue; // route vanished mid-scan; the next adapters-updated sweep re-checks
+    }
+    if (!isPolicyProtected(policy)) {
+      findings.push({ provider: provider.id, ...(provider.name === undefined ? {} : { name: provider.name }) });
+    }
+  }
+  return findings;
+}
+
+function summaryOf(policy) {
+  const backoff = policy.backoff;
+  if (policy.mode === "always") return `mode=always backoff=${backoff.initialDelayMs}ms->${backoff.maxDelayMs}ms`;
+  return `mode=normal retries=${policy.maxRetries} backoff=${backoff.initialDelayMs}ms->${backoff.maxDelayMs}ms codes=${policy.retryableCodes.length}`;
+}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "dsh-retry-boost",
+  "version": "1.2.0",
+  "description": "让 DeepSeek Harness 自动重试商汤 429/QUOTA 等瞬时网关故障直到任务完成——启动时给所有 llm-pi-ai provider 热注入加固版 retryPolicy，运行中新增的 provider 也会自动补上，再也不用手动发「继续」。",
+  "keywords": [
+    "deepseek-harness",
+    "deepseek-harness-plugin",
+    "dsh",
+    "dsh-plugin",
+    "cordis-plugin",
+    "llm",
+    "retry",
+    "backoff",
+    "rate-limit",
+    "429",
+    "quota",
+    "resilience",
+    "reconnect",
+    "auto-retry"
+  ],
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md",
+    "LICENSE"
+  ],
+  "dsh": {
+    "engines": {
+      "dsh": ">=0.1.1-rc.1"
+    },
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "scripts": {
+    "test": "node --test",
+    "check": "node --check lib/index.js && node --check lib/policy.js"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hhb1028/dsh-retry-boost.git"
+  },
+  "bugs": {
+    "url": "https://github.com/hhb1028/dsh-retry-boost/issues"
+  },
+  "homepage": "https://github.com/hhb1028/dsh-retry-boost#readme"
+}