dsh-workbuddy-xdpool 1.7.5 → 1.7.7

package/CHANGELOG.md

@@ -4,6 +4,127 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 1.7.7 — 别再让你为了一个「等一会儿」去重新登录
+
+> 报错说「API 密钥无效」，于是你跑去重新登录 —— 但密钥根本没问题，只是那个模型暂时限流了。
+
+### 问题一：限流被说成了「密钥无效」
+
+**你会看到**：国际版用 hy4 时，偶尔弹出「API 密钥无效」。你重新登录、换账号，都不一定管用。
+
+**为什么**：看日志就清楚了（时间连着三行）：
+
+```
+14:50:22  qingche526  rate-limited on hy4-preview-f  → cooling + rotating
+14:50:23  aosi526     rate-limited on hy4-preview-f  → cooling + rotating
+14:50:25  401: "no WorkBuddy credential found; sign in on the desktop app"
+```
+
+两个账号的 hy4-preview-f 都被限流**冷却**了（一小时），于是池子里暂时没有可用账号。可插件判断「有没有被限流」用的是**本次请求内**的临时记录 —— 上次请求造成的冷却，它看不见。于是它以为「一个账号都没有 → 你没登录」→ 报 **401**。
+
+DSH 把 401 显示成「API 密钥无效」。**你被派去修一个根本没坏的东西。**
+
+**怎么修的**：不再靠本次请求的临时记录猜，而是**直接问账号池「为什么现在没有可用账号」**，然后按真实原因报对应的错：
+
+| 真实情况 | 以前 | 现在 |
+|---|---|---|
+| 模型限流中 | 401 密钥无效 | **429 该模型限流中**（等一会儿即可）|
+| 账号全被关/移出 | 401 密钥无效 | **403 账号全部已关闭**（去卡片打开）|
+| 积分低于保留线 | 401 密钥无效 | **402 积分不足** |
+| 确实没登录 | 401 | 401（这个才是对的）|
+
+四种情况**需要完全相反的处理**，以前却都推给你「重新登录」。现在只有真的该重新登录时才这么说。
+
+### 问题二：上下文「压缩」把目标设得比原文还大
+
+日志里抓到的：
+
+```
+context overrun on deepseek-v4.1-flash (~791793 tokens); compacting to ~797952
+                                  ↑ 原文 79.1 万                    ↑ 目标 79.7 万
+```
+
+**压缩目标比要压缩的东西还大** —— 等于什么都没压，重试当然又超限。而日志看起来还挺像"我处理过了"。
+
+**为什么**：目标值是按**目录里写的窗口**算的（`deepseek-v4.1-flash` 标称 1M），取 80% → `797952`。但**标称 1M 是宣传值，不是真实生效上限** —— 否则它就不会被拒了。
+
+**怎么修的**：**正在超限的那个请求本身就是证据**。既然它太大了，目标就必须明显小于它。现在取「按窗口算」和「按原文一半」的较小值：
+
+```
+原文 791793 → 目标 395896      （真正压掉一半）
+```
+
+### 顺便：这类报错终于有线索了
+
+上游的 `model_param_invalid` 里 **`param` 字段是空的** —— 它只说「参数不符合要求」，不说是哪个参数。你之前贴的那条 11133 就是这样，等于没有线索。
+
+现在遇到 400 时，日志会记下**请求的形状**（顶层参数名、各角色的消息条数、工具数量、内容字符数）：
+
+```
+rejected the request as invalid (model deepseek-v4.1-flash) —
+keys=[max_tokens messages model reasoning_effort stream temperature tool_choice tools top_k top_p]
+messages=122 (system:1 user:61 assistant:30 tool:30) tools=77 contentChars=481233
+```
+
+**只有形状，没有内容**（对话是你的，不该进日志）。下次再遇到，日志里就能看出是哪个参数/哪个维度不对。
+
+### 我排查时的事
+
+我一开始想直接复现 11133，试了：采样参数（`top_k`/`repetition_penalty`/`temperature`/`top_p`）、推理档位（`minimal` 到 `max`，还试了无效档位）、各种消息形状（回放 `reasoning_content`、工具调用链）、消息数量（最多 362 条）、77 个工具 + 长会话、超长 prompt ——**国内版和国际版全部返回 200**。
+
+**我没能复现它**，所以没有针对 11133 写"修复"（那会是猜测）。改的都是**从日志里坐实的**问题：那两个是确凿的。这个 11133 加上刚加的形状日志，下次出现时就能定位了。
+
+### 验证
+
+- 类型检查全绿，测试 **325 项全绿**（+12）。
+- 新增 `tests/pool-availability.test.ts`（7 项）：池能正确区分「无人登录 / 模型限流 / 账号全关 / 积分保留 / 可用」、**限流时返回 429 且文案不含「sign in」**、真没登录时仍是 401、**不把另一个 region 的账号算进来**、过期冷却自动视为可用。
+- 新增 `tests/context-budget-budget.test.ts`（5 项）：**目录窗口远大于原文时目标必须更小**（用日志里那组真实数字）、窗口未知时减半、窗口小于原文时也不放大、目标不为零。
+- **反向验证**：把 429 分支禁用、退回原来的 401 → 测试变红。
+
+## 1.7.6 — 一个读不出来的凭据文件，不再带走整个账号池
+
+> 你切了 4 个账号登录，界面显示 4 个；重启之后只剩 2 个 —— 不是账号没了，是它们被一个文件拖累了。
+
+**你会看到**：用 WorkBuddy Switch 切换登录几个国内版账号后，卡片上账号数对不上——重启少了两个。
+
+**为什么**：认证目录里**同时存在好几种文件**：明文的老格式、5.6.0+ 起的加密格式、写到一半的、还有插件不认识的版本。这些**混在一起是常态**，不是错误。
+
+但旧代码里，只要**碰到一个加密又打不开的文件**（WorkBuddy 没运行、或者取不到它的密钥），就会**抛异常终止整个扫描** —— 于是那些**明明读得好好的账号也被一起丢掉**。一个坏文件，带走整个池。
+
+我复现了这个行为：3 个正常文件 + 1 个打不开的，结果**不是返回 3 个，而是整个扫描抛错、0 个账号**。
+
+**怎么修的**：
+
+- **单个文件失败只跳过它自己**，不会连累其他账号。这是核心修复；
+- **跳过的文件会被记录并显示在卡片上**：现在账号区会明确写「有 N 个凭据文件读不出来」，并**列出文件名和原因**。其中「已加密 — 启动一次 WorkBuddy 才能取到密钥」是可操作的；而"不是凭据文件"就只是个无关文件。区分开很重要，不然你会去修一个压根修不好的东西。
+
+这样账号数就**可信了**：不会再出现「磁盘上 4 个文件，界面显示 2 个账号」这种说不清的落差。
+
+### 顺带修的第二个问题：pi-ai 跨代误用
+
+另一份反馈报的是「每轮对话必崩，报 `Cannot read properties of undefined` 且不可重试」。根因是**同一条调用链上混用了两代 pi-ai** —— 插件用 0.85.x 组装 provider，宿主适配器用 0.87.x 消费事件流，两代对终态消息的形状约定不同，接缝处直接抛异常。而宿主把它归为不可重试的 `PI_AI_ERROR`，栈还被丢弃，所以极难排查。
+
+**为什么 `package.json` 的范围拦不住**：旧的 peer 声明是 `>=0.82.1 <0.85.0`，**上界把宿主的 0.87 代际整个排除在外** —— 等于把「跨代混用」变成了一种**合法的安装组合**。版本范围只能描述"我能接受什么"，描述不了"机器上实际装的是哪一份"。
+
+**所以改成两条**：
+
+- **放开上界**（`>=0.82.1`），不再把宿主代际排除成非法组合；
+- **加载时实测并告警**：比对插件这份与宿主那份 pi-ai 的代际，**不一致就在日志里点名两个版本并给出修法**（用 pnpm `overrides` 把代际对齐宿主）。
+
+只告警、**不阻止启动** —— 版本不一致也可能是无害的，因为一个猜测就让插件拒绝加载会更糟。
+
+### 验证
+
+- 类型检查全绿，测试 **313 项全绿**（+9），**连续两次全量运行稳定**。
+- 新增 `tests/account-discovery.test.ts`（7 项）：单个坏文件不拖垮扫描、**全部文件都坏时也不抛错**、跳过的文件带原因上报、坏文件不会被算成账号、非 JSON / 结构不对的文件同样只跳过。
+- 新增 `tests/pi-ai-generation.test.ts`（9 项）：代际归约（补丁差异不算跨代）、**0.85 / 0.87 分裂能被识别**、任一侧解析不到时判为未知、告警文案包含两个版本与修法。
+- **反向验证**：把「加密错误重新抛出」放回 → 4 项变红，确认测试确实能抓住这个缺陷。
+- 构建后校验产物**已内联**代际检测模块（无外部 `.ts` 引用），并直接加载 `lib/index.js` 确认可运行。
+
+### 已知未覆盖
+
+「每轮必崩」的那份报告里，还建议了**宿主侧**两处加固（`mapStopReason` 对空 `content` 加守卫、`classifyPiAiError` 保留原始 `error.stack`）。那是 DSH 宿主的代码，不在这个插件仓库内，需要另开 issue 到 DSH。
+
 ## 1.7.5 — 模型列表会告诉你「现在用哪个不花钱」
 
 > Hy4 preview 晚上 23 点到早上 8 点免费，Hy3 一直在免费期 —— 现在卡片上直接看得出来。

package/lib/bin.js

@@ -9,6 +9,7 @@ import "@earendil-works/pi-ai";
 import "@earendil-works/pi-ai/api/openai-completions.lazy";
 import "@deepseek-ai/dsh-llm";
 import "@deepseek-ai/dsh-llm-pi-ai";
+import { fileURLToPath } from "node:url";
 //#region src/upstream.ts
 /**
 * Backoff between catalog-fetch attempts.
@@ -2347,10 +2348,6 @@ var WorkBuddyEncryptedCredentialError = class extends Error {
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
-/** True when a thrown value is the encrypted-credential marker (cross-bundle safe). */
-function isEncryptedCredentialError(value) {
-	return typeof value === "object" && value !== null && value.code === "ENCRYPTED_CREDENTIAL";
-}
 function decryptableString(value, decrypt) {
 	if (typeof value === "string") return {
 		value,
@@ -2504,6 +2501,18 @@ async function authFilesIn(dir) {
 	files.sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
 	return files.map((name) => join(dir, name));
 }
+/**
+* One credential file, or undefined when it cannot be used.
+*
+* Returns undefined — rather than throwing — for every failure mode, so ONE bad
+* file cannot empty the pool. That is the whole point: an auth directory blends
+* plain files, encrypted files, half-written files and files from an app version
+* this plugin cannot read, and a scan that aborts on the first unusable one
+* reports "you have 2 accounts" when it means "I could not open the other two".
+*
+* The caller surfaces the ones it skipped, so the count never silently
+* disagrees with what is on disk.
+*/
 async function readCredential(path) {
 	let text;
 	try {
@@ -2514,8 +2523,7 @@ async function readCredential(path) {
 	const decrypt = text.includes("\"$wbEncrypted\"") ? await encryptedFieldOpener() : void 0;
 	try {
 		return parseWorkBuddyAuth(text, path, decrypt);
-	} catch (error) {
-		if (isEncryptedCredentialError(error)) throw error;
+	} catch {
 		return;
 	}
 }
@@ -2555,6 +2563,29 @@ async function cheapIdentityIdFromFile(path) {
 	}
 }
 /**
+* Why a file could not become an account.
+*
+* Distinguishing "encrypted" matters most: it is actionable (start the desktop
+* app, or set the executable override), whereas "malformed" means the file is
+* simply not a credential. Reporting them alike would send the user looking for
+* a fix that cannot work.
+*/
+async function skipReasonFor(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return "unreadable";
+	}
+	if (text.includes("\"$wbEncrypted\"")) return "encrypted";
+	try {
+		JSON.parse(text);
+		return "malformed";
+	} catch {
+		return "malformed";
+	}
+}
+/**
 * Build the field opener, or undefined when the app cannot supply its key.
 *
 * Split out so the key lookup is testable without a real desktop install, and so
@@ -2619,6 +2650,13 @@ var WorkBuddyAccountPool = class {
 	client;
 	refreshMarginMs;
 	accounts = [];
+	/**
+	* Files the last scan could not read, with the reason.
+	*
+	* Surfaced so "2 accounts" can be told apart from "4 files, 2 unreadable" —
+	* the difference between accounts being gone and files being unopenable.
+	*/
+	skippedFiles = [];
 	distribution;
 	/** Cursor for round-robin mode; unused under priority distribution. */
 	cursor = 0;
@@ -2720,19 +2758,38 @@ var WorkBuddyAccountPool = class {
 	ignoredIdsInOrder() {
 		return [...this.ignoredIds];
 	}
+	/**
+	* Credential files the last scan could not read, with the reason.
+	*
+	* Exposed because a short account list is otherwise indistinguishable from a
+	* broken one: with this, the card can say "2 accounts, 2 files unreadable"
+	* instead of silently showing half a pool.
+	*/
+	skippedFilesInOrder() {
+		return this.skippedFiles;
+	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
 		const found = [];
+		const skipped = [];
 		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
 			if (this.ignoredIds.size > 0) {
 				const cheapId = await cheapIdentityIdFromFile(file);
 				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
 			}
 			const credential = await readCredential(file);
-			if (credential === void 0) continue;
+			if (credential === void 0) {
+				skipped.push({
+					path: file,
+					reason: await skipReasonFor(file)
+				});
+				continue;
+			}
 			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
 			found.push(credential);
 		}
+		this.skippedFiles = skipped;
+		if (skipped.length > 0) this.logger?.warn?.(`dsh-workbuddy-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
 		for (const credential of found) {
@@ -2789,6 +2846,70 @@ var WorkBuddyAccountPool = class {
 			return true;
 		});
 	}
+	/**
+	* Why no account is available right now, for an accurate error.
+	*
+	* The pool can be empty for reasons that need OPPOSITE remedies: nobody is
+	* signed in (the user must sign in), every account is rate-limited (the user
+	* must wait, and retrying later works), or every account was switched off /
+	* ignored (the user must re-enable one). Reporting all of them as "no
+	* credential, sign in" sent users to re-authenticate over a temporary 429 —
+	* observed as an "API key invalid" panel for a model that was merely cooling.
+	*
+	* Counts are over the region's accounts, since a provider only ever sees its
+	* own gateway.
+	*/
+	unavailableReason(modelId, region) {
+		const now = Date.now();
+		const inRegion = this.accounts.filter((account) => region === void 0 || regionOf(account.credential.domain) === region);
+		if (inRegion.length === 0) return {
+			total: 0,
+			cooling: 0,
+			disabled: 0,
+			reason: "empty"
+		};
+		let cooling = 0;
+		let disabled = 0;
+		for (const account of inRegion) {
+			if (this.disabledIds.has(account.id)) {
+				disabled += 1;
+				continue;
+			}
+			const modelCooling = modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now;
+			if (account.cooldownUntilMs > now || modelCooling) {
+				cooling += 1;
+				continue;
+			}
+			const reserve = this.creditReserves.get(account.id);
+			if (reserve !== void 0 && reserve > 0) {
+				const balance = this.creditBalances.get(account.id);
+				if (balance !== void 0 && balance <= reserve) return {
+					total: inRegion.length,
+					cooling,
+					disabled,
+					reason: "reserve"
+				};
+			}
+		}
+		if (cooling > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			reason: "cooling"
+		};
+		if (disabled > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			reason: "disabled"
+		};
+		return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			reason: "none"
+		};
+	}
 	/** Round-robin: the legacy cursor walk, kept for the distribution that asks for it. */
 	pickRoundRobin(pool) {
 		const index = this.cursor % pool.length;
@@ -4899,8 +5020,14 @@ async function unignoreAccount(accountId, path = ignoredIdsPath()) {
 	if (next.length !== current.length) await writeIgnoredAccounts(next, path);
 	return next;
 }
-//#endregion
-//#region src/index.ts
+fileURLToPath(new URL("..", import.meta.url));
+(() => {
+	try {
+		return fileURLToPath(new URL("../../node_modules/@deepseek-ai/dsh-llm-pi-ai/", import.meta.url));
+	} catch {
+		return "";
+	}
+})();
 /**
 * One region's model-selection schema.
 *

package/lib/client.js

@@ -279,6 +279,13 @@ window.__ModuleLoader__.load({
 /* "活动至 10-31": the campaign's end date. Muted — it is context for planning,
    not a claim about the current price. */
 .dsm-workbuddy-xdpool-model-meta-promo{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:11px;line-height:16px;opacity:.85}
+/* Unreadable credential files: a warning tint, since it explains a smaller pool
+   and "encrypted" is actionable (start the app once). */
+.dsm-workbuddy-xdpool-skipped{margin:6px 0 0;padding:7px 10px;border-radius:8px;background:var(--dsw-alias-state-warning-subtle,rgba(217,119,6,.12));display:flex;flex-direction:column;gap:3px}
+.dsm-workbuddy-xdpool-skipped-summary{margin:0;font-size:12px;line-height:18px;font-weight:600;color:var(--dsw-alias-state-warning-primary,#d97706)}
+.dsm-workbuddy-xdpool-skipped-row{margin:0;display:flex;gap:8px;align-items:baseline;font-size:11px;line-height:16px;flex-wrap:wrap}
+.dsm-workbuddy-xdpool-skipped-file{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;color:var(--dsw-alias-label-secondary,#c6c9d0);max-width:100%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+.dsm-workbuddy-xdpool-skipped-reason{color:var(--dsw-alias-label-tertiary,#9aa0a8)}
 .dsm-workbuddy-xdpool-model-cap{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px;font-variant-numeric:tabular-nums}
 /* Model row: checkbox + image toggle + context-budget radios. */
 .dsm-workbuddy-xdpool-model-off{opacity:.55}
@@ -1504,6 +1511,22 @@ window.__ModuleLoader__.load({
 									}) ?? `${accountCount} account(s) · ${cooling} cooling`
 								})]
 							}),
+							status?.skippedFiles === void 0 || status.skippedFiles.length === 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: "dsm-workbuddy-xdpool-skipped",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+									className: "dsm-workbuddy-xdpool-skipped-summary",
+									children: t?.("row.skippedFiles", { count: status.skippedFiles.length }) ?? `${status.skippedFiles.length} credential file(s) could not be read`
+								}), status.skippedFiles.slice(0, 4).map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+									className: "dsm-workbuddy-xdpool-skipped-row",
+									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-xdpool-skipped-file",
+										children: entry.file
+									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+										className: "dsm-workbuddy-xdpool-skipped-reason",
+										children: entry.reason === "encrypted" ? t?.("row.skippedEncrypted") ?? "encrypted — start WorkBuddy once" : entry.reason === "unreadable" ? t?.("row.skippedUnreadable") ?? "file could not be read" : t?.("row.skippedMalformed") ?? "not a credential file"
+									})]
+								}, entry.file))]
+							}),
 							(() => {
 								const active = status?.activeAccountId === void 0 ? void 0 : status.accounts.find((account) => account.id === status.activeAccountId);
 								if (active === void 0) return null;
@@ -2244,6 +2267,10 @@ window.__ModuleLoader__.load({
 			"row.nightFreeNow": "free until {time}",
 			"row.nightFreeLater": "free from {time}",
 			"row.promoUntil": "promo to {date}",
+			"row.skippedFiles": "{count} credential file(s) could not be read",
+			"row.skippedEncrypted": "encrypted — start WorkBuddy once so its key can be read",
+			"row.skippedUnreadable": "file could not be read",
+			"row.skippedMalformed": "not a credential file",
 			"row.imageCapable": "image input",
 			"row.rate": "{rate}x credits",
 			"row.accountsRescan": "Detect accounts again",
@@ -2392,6 +2419,10 @@ window.__ModuleLoader__.load({
 			"row.nightFreeNow": "免费至 {time}",
 			"row.nightFreeLater": "{time} 起免费",
 			"row.promoUntil": "活动至 {date}",
+			"row.skippedFiles": "有 {count} 个凭据文件读不出来",
+			"row.skippedEncrypted": "已加密 —— 启动一次 WorkBuddy 才能取到密钥",
+			"row.skippedUnreadable": "文件读不出来",
+			"row.skippedMalformed": "不是凭据文件",
 			"row.imageCapable": "图片输入",
 			"row.rate": "{rate}x 积分",
 			"row.accountsRescan": "重新检测账号",

package/lib/index.d.ts

@@ -752,6 +752,18 @@ export declare const WORKBUDDY_LIVE_FILENAME = "workbuddy-desktop.info";
 /** Env override for the auth file or its directory. */
 export declare const WORKBUDDY_AUTH_FILE_ENV = "WORKBUDDY_AUTH_FILE";
 /** One parsed WorkBuddy credential. */
+/**
+ * A credential file the pool could not turn into an account.
+ *
+ * Reported (not swallowed) because the count is otherwise a lie: a directory
+ * holding four files that yields two accounts looks like two accounts were
+ * deleted, when in fact two files were unreadable. Naming the file and the
+ * reason is what makes the difference visible.
+ */
+interface WorkBuddySkippedFile {
+  path: string;
+  reason: 'encrypted' | 'unreadable' | 'malformed';
+}
 interface WorkBuddyCredential {
   accessToken: string;
   refreshToken: string;
@@ -862,6 +874,13 @@ export declare class WorkBuddyAccountPool {
   private readonly client;
   private readonly refreshMarginMs;
   private accounts;
+  /**
+   * Files the last scan could not read, with the reason.
+   *
+   * Surfaced so "2 accounts" can be told apart from "4 files, 2 unreadable" —
+   * the difference between accounts being gone and files being unopenable.
+   */
+  private skippedFiles;
   private distribution;
   /** Cursor for round-robin mode; unused under priority distribution. */
   private cursor;
@@ -948,6 +967,14 @@ export declare class WorkBuddyAccountPool {
   isIgnored(accountId: string): boolean;
   /** Every ignored id currently in force, in insertion order. */
   ignoredIdsInOrder(): string[];
+  /**
+   * Credential files the last scan could not read, with the reason.
+   *
+   * Exposed because a short account list is otherwise indistinguishable from a
+   * broken one: with this, the card can say "2 accounts, 2 files unreadable"
+   * instead of silently showing half a pool.
+   */
+  skippedFilesInOrder(): readonly WorkBuddySkippedFile[];
   /** Rescan the auth directories and merge newly discovered accounts. */
   scan(): Promise<WorkBuddyAccount[]>;
   /** All accounts, cooldown state included. */
@@ -962,6 +989,25 @@ export declare class WorkBuddyAccountPool {
    * model, e.g. CLI diagnostics).
    */
   private available;
+  /**
+   * Why no account is available right now, for an accurate error.
+   *
+   * The pool can be empty for reasons that need OPPOSITE remedies: nobody is
+   * signed in (the user must sign in), every account is rate-limited (the user
+   * must wait, and retrying later works), or every account was switched off /
+   * ignored (the user must re-enable one). Reporting all of them as "no
+   * credential, sign in" sent users to re-authenticate over a temporary 429 —
+   * observed as an "API key invalid" panel for a model that was merely cooling.
+   *
+   * Counts are over the region's accounts, since a provider only ever sees its
+   * own gateway.
+   */
+  unavailableReason(modelId?: string, region?: WorkBuddyRegion): {
+    total: number;
+    cooling: number;
+    disabled: number;
+    reason: 'empty' | 'cooling' | 'disabled' | 'reserve' | 'none';
+  };
   /** Round-robin: the legacy cursor walk, kept for the distribution that asks for it. */
   private pickRoundRobin;
   /**
@@ -1345,6 +1391,21 @@ interface PoolWebStatus {
   catalogUpdatedAt?: string;
   /** Why the last fetch failed, when it did. Redacted and length-capped. */
   catalogError?: string;
+  /**
+   * Credential files on disk that did NOT become accounts.
+   *
+   * Reported so the account count can be trusted: without this, a directory
+   * holding four files that yields two accounts looks like two accounts were
+   * deleted, when really two files could not be opened (most often an encrypted
+   * credential the desktop app was not running to unlock).
+   */
+  skippedFiles?: readonly PoolWebSkippedFile[];
+}
+/** A credential file the pool could not read. */
+interface PoolWebSkippedFile {
+  /** Basename only; the full path lives in the desktop app's auth directory. */
+  file: string;
+  reason: 'encrypted' | 'unreadable' | 'malformed';
 }
 /** How a region's model list was obtained. */
 type PoolWebCatalogSource = 'live' | 'fallback';

package/lib/index.js

@@ -1,3 +1,4 @@
+import { createRequire } from "node:module";
 import { basename, dirname, join, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
 import { createDecipheriv, createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
@@ -11,6 +12,7 @@ import { resolveImageAttachmentAccess, resolveRetryPolicy } from "@deepseek-ai/d
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
+import { fileURLToPath } from "node:url";
 //#region src/upstream.ts
 /**
 * Backoff between catalog-fetch attempts.
@@ -2454,10 +2456,6 @@ var WorkBuddyEncryptedCredentialError = class extends Error {
 		this.name = "WorkBuddyEncryptedCredentialError";
 	}
 };
-/** True when a thrown value is the encrypted-credential marker (cross-bundle safe). */
-function isEncryptedCredentialError(value) {
-	return typeof value === "object" && value !== null && value.code === "ENCRYPTED_CREDENTIAL";
-}
 function decryptableString(value, decrypt) {
 	if (typeof value === "string") return {
 		value,
@@ -2611,6 +2609,18 @@ async function authFilesIn(dir) {
 	files.sort((a, b) => a < b ? 1 : a > b ? -1 : 0);
 	return files.map((name) => join(dir, name));
 }
+/**
+* One credential file, or undefined when it cannot be used.
+*
+* Returns undefined — rather than throwing — for every failure mode, so ONE bad
+* file cannot empty the pool. That is the whole point: an auth directory blends
+* plain files, encrypted files, half-written files and files from an app version
+* this plugin cannot read, and a scan that aborts on the first unusable one
+* reports "you have 2 accounts" when it means "I could not open the other two".
+*
+* The caller surfaces the ones it skipped, so the count never silently
+* disagrees with what is on disk.
+*/
 async function readCredential(path) {
 	let text;
 	try {
@@ -2621,8 +2631,7 @@ async function readCredential(path) {
 	const decrypt = text.includes("\"$wbEncrypted\"") ? await encryptedFieldOpener() : void 0;
 	try {
 		return parseWorkBuddyAuth(text, path, decrypt);
-	} catch (error) {
-		if (isEncryptedCredentialError(error)) throw error;
+	} catch {
 		return;
 	}
 }
@@ -2662,6 +2671,29 @@ async function cheapIdentityIdFromFile(path) {
 	}
 }
 /**
+* Why a file could not become an account.
+*
+* Distinguishing "encrypted" matters most: it is actionable (start the desktop
+* app, or set the executable override), whereas "malformed" means the file is
+* simply not a credential. Reporting them alike would send the user looking for
+* a fix that cannot work.
+*/
+async function skipReasonFor(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch {
+		return "unreadable";
+	}
+	if (text.includes("\"$wbEncrypted\"")) return "encrypted";
+	try {
+		JSON.parse(text);
+		return "malformed";
+	} catch {
+		return "malformed";
+	}
+}
+/**
 * Build the field opener, or undefined when the app cannot supply its key.
 *
 * Split out so the key lookup is testable without a real desktop install, and so
@@ -2726,6 +2758,13 @@ var WorkBuddyAccountPool = class {
 	client;
 	refreshMarginMs;
 	accounts = [];
+	/**
+	* Files the last scan could not read, with the reason.
+	*
+	* Surfaced so "2 accounts" can be told apart from "4 files, 2 unreadable" —
+	* the difference between accounts being gone and files being unopenable.
+	*/
+	skippedFiles = [];
 	distribution;
 	/** Cursor for round-robin mode; unused under priority distribution. */
 	cursor = 0;
@@ -2827,19 +2866,38 @@ var WorkBuddyAccountPool = class {
 	ignoredIdsInOrder() {
 		return [...this.ignoredIds];
 	}
+	/**
+	* Credential files the last scan could not read, with the reason.
+	*
+	* Exposed because a short account list is otherwise indistinguishable from a
+	* broken one: with this, the card can say "2 accounts, 2 files unreadable"
+	* instead of silently showing half a pool.
+	*/
+	skippedFilesInOrder() {
+		return this.skippedFiles;
+	}
 	/** Rescan the auth directories and merge newly discovered accounts. */
 	async scan() {
 		const found = [];
+		const skipped = [];
 		for (const dir of this.authDirs) for (const file of await authFilesIn(dir)) {
 			if (this.ignoredIds.size > 0) {
 				const cheapId = await cheapIdentityIdFromFile(file);
 				if (cheapId !== void 0 && this.ignoredIds.has(cheapId)) continue;
 			}
 			const credential = await readCredential(file);
-			if (credential === void 0) continue;
+			if (credential === void 0) {
+				skipped.push({
+					path: file,
+					reason: await skipReasonFor(file)
+				});
+				continue;
+			}
 			if (this.ignoredIds.size > 0 && this.ignoredIds.has(workbuddyAccountId(credential))) continue;
 			found.push(credential);
 		}
+		this.skippedFiles = skipped;
+		if (skipped.length > 0) this.logger?.warn?.(`dsh-workbuddy-xdpool: ${skipped.length} credential file(s) could not be read; ${found.length} account(s) still loaded. Reasons: ` + [...new Set(skipped.map((s) => s.reason))].join("; "));
 		const byId = /* @__PURE__ */ new Map();
 		for (const account of this.accounts) byId.set(account.id, account);
 		for (const credential of found) {
@@ -2896,6 +2954,70 @@ var WorkBuddyAccountPool = class {
 			return true;
 		});
 	}
+	/**
+	* Why no account is available right now, for an accurate error.
+	*
+	* The pool can be empty for reasons that need OPPOSITE remedies: nobody is
+	* signed in (the user must sign in), every account is rate-limited (the user
+	* must wait, and retrying later works), or every account was switched off /
+	* ignored (the user must re-enable one). Reporting all of them as "no
+	* credential, sign in" sent users to re-authenticate over a temporary 429 —
+	* observed as an "API key invalid" panel for a model that was merely cooling.
+	*
+	* Counts are over the region's accounts, since a provider only ever sees its
+	* own gateway.
+	*/
+	unavailableReason(modelId, region) {
+		const now = Date.now();
+		const inRegion = this.accounts.filter((account) => region === void 0 || regionOf(account.credential.domain) === region);
+		if (inRegion.length === 0) return {
+			total: 0,
+			cooling: 0,
+			disabled: 0,
+			reason: "empty"
+		};
+		let cooling = 0;
+		let disabled = 0;
+		for (const account of inRegion) {
+			if (this.disabledIds.has(account.id)) {
+				disabled += 1;
+				continue;
+			}
+			const modelCooling = modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now;
+			if (account.cooldownUntilMs > now || modelCooling) {
+				cooling += 1;
+				continue;
+			}
+			const reserve = this.creditReserves.get(account.id);
+			if (reserve !== void 0 && reserve > 0) {
+				const balance = this.creditBalances.get(account.id);
+				if (balance !== void 0 && balance <= reserve) return {
+					total: inRegion.length,
+					cooling,
+					disabled,
+					reason: "reserve"
+				};
+			}
+		}
+		if (cooling > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			reason: "cooling"
+		};
+		if (disabled > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			reason: "disabled"
+		};
+		return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			reason: "none"
+		};
+	}
 	/** Round-robin: the legacy cursor walk, kept for the distribution that asks for it. */
 	pickRoundRobin(pool) {
 		const index = this.cursor % pool.length;
@@ -5490,6 +5612,40 @@ function isContextTooLong(body) {
 	if (/exceeds?\s+(the\s+)?(model\s+)?context\s+(window|limit)/iu.test(body)) return true;
 	return false;
 }
+/**
+* A content-free description of a request, for the log when the upstream
+* rejects it.
+*
+* `model_param_invalid` arrives with an EMPTY `param` field, so the error alone
+* says nothing about which parameter was rejected — the user is left with "the
+* request parameters do not meet the current model requirements" and no way to
+* act. Recording the shape (top-level keys, message count by role, tool count,
+* approximate prompt size) makes such a rejection diagnosable from the log.
+*
+* Deliberately SHAPE ONLY: no message content, no tool schemas, no tokens. It
+* ends up in a log file, and the conversation it describes is the user's.
+*/
+function requestShape(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		const keys = Object.keys(parsed).sort();
+		const messages = Array.isArray(parsed["messages"]) ? parsed["messages"] : [];
+		const byRole = /* @__PURE__ */ new Map();
+		let chars = 0;
+		for (const entry of messages) {
+			if (typeof entry !== "object" || entry === null) continue;
+			const message = entry;
+			const role = typeof message["role"] === "string" ? message["role"] : "?";
+			byRole.set(role, (byRole.get(role) ?? 0) + 1);
+			chars += JSON.stringify(message["content"] ?? "").length;
+		}
+		const roles = [...byRole.entries()].map(([role, n]) => `${role}:${n}`).join(" ");
+		const tools = Array.isArray(parsed["tools"]) ? parsed["tools"].length : 0;
+		return `keys=[${keys.join(" ")}] messages=${messages.length}${roles === "" ? "" : ` (${roles})`} tools=${tools} contentChars=${chars}`;
+	} catch {
+		return "body was not parseable JSON";
+	}
+}
 function readBody(req) {
 	return new Promise((resolve, reject) => {
 		const chunks = [];
@@ -5628,17 +5784,26 @@ function createWorkBuddyShim(options) {
 		}
 		const tried = [];
 		let last;
-		let exhaustedByRateLimit = false;
 		for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
 			if (controller.signal.aborted) return;
 			const account = await pool.acquire(modelId, region);
 			if (account === void 0) {
-				if (exhaustedByRateLimit && last !== void 0) {
+				const why = pool.unavailableReason(modelId, region);
+				if (why.reason === "cooling") {
 					const subject = modelId === void 0 ? "every WorkBuddy account is rate-limited" : `every account is rate-limited for model ${modelId}`;
-					writeOpenAIError(res, KIND_STATUS[last.kind], last.kind, `${subject} (tried ${tried.length}: ${tried.join(", ")}); resets at the upstream window — ${last.message.slice(0, 200)}`);
+					const upstream = last === void 0 ? "" : ` — ${last.message.slice(0, 200)}`;
+					writeOpenAIError(res, 429, "soft_rate", `${subject} (${why.cooling}/${why.total} cooling, tried ${tried.length})${tried.length === 0 ? "" : `: ${tried.join(" → ")}`}${upstream}`);
 					return;
 				}
-				writeOpenAIError(res, 401, "not_signed_in", "no WorkBuddy credential found; sign in on the desktop app (or set WORKBUDDY_AUTH_FILE)");
+				if (why.reason === "disabled") {
+					writeOpenAIError(res, 403, "no_enabled_account", `all ${why.total} WorkBuddy account(s) for this gateway are switched off or ignored; re-enable one on the pool card`);
+					return;
+				}
+				if (why.reason === "reserve") {
+					writeOpenAIError(res, 402, "reserve_floor", `every WorkBuddy account is at or below its credit reserve (${why.total} account(s)); lower the reserve on the pool card or top up credits`);
+					return;
+				}
+				writeOpenAIError(res, 401, "not_signed_in", why.total === 0 ? "no WorkBuddy credential found for this gateway; sign in on the desktop app (or set WORKBUDDY_AUTH_FILE)" : `no usable WorkBuddy credential among ${why.total} account(s) for this gateway; sign in again on the desktop app`);
 				return;
 			}
 			tried.push(account.label);
@@ -5662,8 +5827,8 @@ function createWorkBuddyShim(options) {
 				logger?.warn(`dsh-workbuddy-xdpool: ${account.label} has no credits left (attempt ${attempt + 1}/${maxAttempts}); rotating`);
 				continue;
 			}
+			if (result.kind === "client") logger?.warn(`dsh-workbuddy-xdpool: ${account.label} rejected the request as invalid (model ${modelId ?? "(none)"}) — ${requestShape(raw)}; upstream: ${result.message.slice(0, 300)}`);
 			if (result.kind !== "soft_rate") break;
-			exhaustedByRateLimit = true;
 			pool.penalize(account.id, parseRateLimitReset(result.message), modelId);
 			logger?.warn(`dsh-workbuddy-xdpool: ${account.label} rate-limited on ${modelId ?? "(no model)"} (attempt ${attempt + 1}/${maxAttempts}); rotating`);
 		}
@@ -5786,8 +5951,10 @@ async function recoverFromContextOverrun(options) {
 	};
 	const overrunTokens = estimateMessagesTokens(messages);
 	const realWindow = options.contextWindow;
-	const budget = realWindow !== void 0 && realWindow > 0 ? Math.max(512, Math.floor(realWindow * .8) - 2048) : Math.max(512, Math.floor(overrunTokens / 2));
-	logger?.warn(`dsh-workbuddy-xdpool: context overrun on ${modelId ?? "(no model)"} (~${overrunTokens} tokens); compacting to ~${budget} and retrying once`);
+	const fromWindow = realWindow !== void 0 && realWindow > 0 ? Math.max(512, Math.floor(realWindow * .8) - 2048) : Number.POSITIVE_INFINITY;
+	const fromOverrun = Math.max(512, Math.floor(overrunTokens / 2));
+	const budget = Math.min(fromWindow, fromOverrun);
+	logger?.warn(`dsh-workbuddy-xdpool: context overrun on ${modelId ?? "(no model)"} (~${overrunTokens} tokens, catalog window ${realWindow ?? "unknown"}); compacting to ~${budget} and retrying once`);
 	let summary;
 	let compacted = messages;
 	let compactionDetail = "";
@@ -6275,7 +6442,11 @@ async function poolWebStatus(deps, region = "cn") {
 		ignored: deps.ignoredAccounts?.() ?? [],
 		catalogSource: deps.catalogs[region].currentSource(),
 		...deps.catalogs[region].catalogUpdatedAt() === void 0 ? {} : { catalogUpdatedAt: deps.catalogs[region].catalogUpdatedAt() },
-		...deps.catalogs[region].lastFetchError() === void 0 ? {} : { catalogError: safeMessage(deps.catalogs[region].lastFetchError()) }
+		...deps.catalogs[region].lastFetchError() === void 0 ? {} : { catalogError: safeMessage(deps.catalogs[region].lastFetchError()) },
+		...deps.pool.skippedFilesInOrder().length === 0 ? {} : { skippedFiles: deps.pool.skippedFilesInOrder().map((entry) => ({
+			file: basename(entry.path),
+			reason: entry.reason
+		})) }
 	};
 }
 /**
@@ -6682,6 +6853,95 @@ async function unignoreAccount(accountId, path = ignoredIdsPath()) {
 	return next;
 }
 //#endregion
+//#region pi-ai-generation.ts
+/**
+* Cross-generation guard for `@earendil-works/pi-ai`.
+*
+* The failure this exists to catch: the plugin assembles its provider with ONE
+* copy of pi-ai while the host's `PiAiAdapter` consumes the event stream with
+* ANOTHER. The two generations disagree on the shape of the terminal message,
+* and the seam between them throws `Cannot read properties of undefined
+* (reading 'length')` inside the host adapter — which the host then classifies
+* as a non-retryable `PI_AI_ERROR`. From the user's side it is "every turn
+* fails, immediately, with no content and no useful error".
+*
+* A `package.json` range cannot prevent this. The old peer range was
+* `>=0.82.1 <0.85.0` while the host shipped 0.87.x: the upper bound excluded the
+* host's generation outright, which turned a cross-generation mix into a
+* legitimate install. Ranges describe what a package tolerates; they cannot
+* describe what the OTHER resolved copy on the same machine happens to be.
+*
+* So this checks the resolved reality at load time and says so, loudly, in the
+* log. It does NOT refuse to start: a version mismatch might well be benign, and
+* a plugin that hard-fails on a guess would be worse than one that warns.
+*
+* @module dsh-workbuddy-xdpool/pi-ai-generation
+*/
+/** The package whose generation must agree between plugin and host. */
+const PI_AI_PACKAGE = "@earendil-works/pi-ai";
+/**
+* The major.minor of a version string, which is what "generation" means here.
+*
+* Patch differences are expected and harmless; two copies differing in
+* minor — 0.85 vs 0.87 — is exactly the split that broke the adapter seam.
+*/
+function generationOf(version) {
+	const trimmed = version.trim();
+	const parts = /^(\d+)\.(\d+)/u.exec(trimmed);
+	if (parts === null || parts === void 0 || parts[1] === void 0 || parts[2] === void 0) return trimmed;
+	return `${parts[1]}.${parts[2]}`;
+}
+/**
+* Read the version of a resolved pi-ai, starting the lookup from `fromDir`.
+*
+* Using `require.resolve` with an explicit anchor is what makes the two sides
+* distinguishable: resolving plainly would return whichever copy this module
+* happens to see, the same one for both, and the comparison would always pass.
+*/
+function piAiGenerationFrom(fromDir) {
+	try {
+		const require_ = createRequire(`${fromDir.replace(/[\\/]+$/u, "")}/`);
+		const pkgPath = require_.resolve(`${PI_AI_PACKAGE}/package.json`);
+		const pkg = require_(pkgPath);
+		if (typeof pkg.version !== "string") return void 0;
+		return {
+			version: pkg.version,
+			resolvedFrom: pkgPath
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Compare the copy the plugin assembled with against the copy the host adapter
+* will use.
+*
+* `hostDir` should be a directory inside the host install (its own
+* `node_modules`), so the two resolutions walk different trees.
+*/
+function checkPiAiGeneration(pluginDir, hostDir) {
+	const plugin = piAiGenerationFrom(pluginDir);
+	const host = piAiGenerationFrom(hostDir);
+	if (plugin === void 0 || host === void 0) return { kind: "unknown" };
+	if (generationOf(plugin.version) === generationOf(host.version)) return {
+		kind: "aligned",
+		generation: generationOf(plugin.version)
+	};
+	return {
+		kind: "mismatched",
+		plugin,
+		host
+	};
+}
+/**
+* A warning message for a mismatched pair, or undefined when there is nothing
+* to say.
+*/
+function piAiMismatchMessage(check) {
+	if (check.kind !== "mismatched") return void 0;
+	return `dsh-workbuddy-xdpool: @earendil-works/pi-ai generation mismatch — this plugin assembled its provider with ${check.plugin.version} while the host adapter resolves ${check.host.version}. Two generations on one call chain produce a TypeError at the adapter seam ("Cannot read properties of undefined"), which the host reports as a non-retryable PI_AI_ERROR, so every turn fails with no content. Align the two by pinning pi-ai to the host generation (for example a pnpm \`overrides\` entry in the profile) and restart DSH.`;
+}
+//#endregion
 //#region src/index.ts
 /**
 * Host-side plugin entry. Registers the `workbuddy-xdpool` provider into the
@@ -6690,6 +6950,28 @@ async function unignoreAccount(accountId, path = ignoredIdsPath()) {
 *
 * @module dsh-workbuddy-xdpool/index
 */
+/**
+* This plugin's install root, the tree its own provider is assembled from.
+*
+* Two directories up from `lib/` — the built bundle sits in `lib/`, so the
+* package root is its parent. Used as one side of the pi-ai generation check.
+*/
+const PLUGIN_ROOT = fileURLToPath(new URL("..", import.meta.url));
+/**
+* The host's own module directory, the tree its `PiAiAdapter` resolves from.
+*
+* Reached from the host package this plugin is loaded by: walking up from a
+* `@deepseek-ai/dsh-llm-pi-ai` import lands in the host's `node_modules`, which
+* is where the HOST generation actually lives. The plugin's own tree is the
+* other side; comparing one tree with itself would always agree.
+*/
+const HOST_MODULE_ROOT = (() => {
+	try {
+		return fileURLToPath(new URL("../../node_modules/@deepseek-ai/dsh-llm-pi-ai/", import.meta.url));
+	} catch {
+		return "";
+	}
+})();
 /** Stable Cordis plugin name. */
 const name = "llm-workbuddy-xdpool";
 /** The model registry required before the provider can register. */
@@ -6878,12 +7160,30 @@ function createCore(logger) {
 	};
 }
 /**
+* Log a warning when the plugin and the host resolve different pi-ai
+* generations.
+*
+* Never throws and never blocks startup: the check is a filesystem lookup, and
+* a plugin that refused to load because of a version guess would be worse than
+* one that merely warns. The two directories are THIS plugin's install root and
+* the host's own module directory, so the two resolutions walk different trees —
+* resolving from one place only would compare a copy with itself and always
+* agree.
+*/
+function warnOnPiAiGenerationMismatch(ctx) {
+	try {
+		const message = piAiMismatchMessage(checkPiAiGeneration(PLUGIN_ROOT, HOST_MODULE_ROOT));
+		if (message !== void 0) ctx.logger.warn(message);
+	} catch {}
+}
+/**
 * Start the loopback endpoint, register the `workbuddy-xdpool` provider, and
 * discover accounts. The provider registers only after `shim.ready` resolves,
 * because its models read the shim origin at construction time.
 */
 function apply(ctx, config = {}) {
 	const core = createCore(ctx.logger);
+	warnOnPiAiGenerationMismatch(ctx);
 	const ignoredPath = ignoredIdsPath();
 	let ignoredAccounts = readIgnoredAccountsSync(ignoredPath);
 	core.pool.applyIgnored(ignoredAccounts.map((entry) => entry.id));

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-xdpool",
   "displayName": "DSH WorkBuddy XD Pool",
   "description": "Merge every locally signed-in WorkBuddy account into DeepSeek Harness as one auto-failing-over model pool (multi-account rotation, live credits, daily check-in and model catalog).",
-  "version": "1.7.5",
+  "version": "1.7.7",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-workbuddy-xdpool#readme",
@@ -103,7 +103,7 @@
     "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.1-rc.1 <0.2.0",
     "@deepseek-ai/dsh-settings": ">=0.1.1-rc.1 <0.2.0",
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@earendil-works/pi-ai": ">=0.82.1 <0.85.0"
+    "@earendil-works/pi-ai": ">=0.82.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-llm": {