dsh-workbuddy-xdpool 1.8.0 → 1.8.1

package/CHANGELOG.md

@@ -4,6 +4,44 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 1.8.1 — 一个过期的登录状态，不再拖着整个池子陪跑
+
+> 有人的卡片上，好几个账号下面顶着一大段红色英文，大意是「上游不认这个登录了，去桌面端重新登录」。话说得没错，可问题是：它只说了结论，没解决过程——那几个账号明明已经废了，每次请求还是要挨个撞一遍，撞得头破血流，旁边几个好端端的账号一次都轮不上。
+
+### 事情是怎么变成这样的
+
+上游吊销一个登录状态时，**不会顺手把凭据文件里的过期时间改掉**。于是本机留着一份「看起来还有效」的凭据：过期时间写着 11 月 4 日，今天才 10 月，一切正常。
+
+插件就信了。它把这三个账号当成健康账号，按顺序一个一个试：
+
+1. 拿账号 A 去请求，上游回 401；
+2. 插件想「可能是 token 过期了」，于是刷新 token；
+3. 上游回答「这个 refresh token 早就没了」（`invalid_grant: Offline user session not found`）；
+4. 插件刷新失败，但**没有记仇**，转头又拿 A 去试；
+5. 八次重试名额（`maxAttempts`）就这么全喂给了同一个死账号，健康账号一次都没被碰过。
+
+所以现象是「明明还有能用的账号，请求却一直失败」，外加卡片上一片红。
+
+### 现在怎么处理
+
+给账号加了第三种状态：**判死**（前两种是「正常」和「限流冷却」）。
+
+- **只有上游亲口说死才算死。** 判据是 `invalid_grant` / `Offline user session not found` 这类明确答复。网络超时、DNS 抽风、5xx 一律不算——否则一次网络抖动就会把好账号关进小黑屋半小时，那比原来的 bug 还难查。
+- **判死的账号立刻退出轮换**，不再参与 `acquire` 的选择，请求当场换健康账号继续，不用等到八次重试耗尽。
+- **想复活有两条路**：在 WorkBuddy 桌面端重新登录该账号（插件发现 refresh token 变了，自动放行），或者点卡片上的「清除所有冷却」手动再给它一次机会。
+- **全池都死了的时候**，返回的不再是含含糊糊的「你还没登录」，而是 401 `session_dead`：`N/M WorkBuddy account(s) for this gateway were rejected by the upstream (their sign-in was revoked); sign in again in the WorkBuddy desktop app to restore them`。「等待」和「重新登录」是两种完全不同的处置方式，不能混着报。
+
+### 卡片上的红字也收拾了一下
+
+- 原来那段整段英文报错**直接铺在「积分包」面板里**，把面板撑得老长，右边的「合计」都被挤出屏幕。现在折叠成一个红色小标「**登录已被拒绝**」，鼠标悬停才显示原文。
+- 账号行上加了红色的「登录已被拒绝」标签，下面补一句「请在 WorkBuddy 桌面端重新登录该账号以恢复」——红色是故意的，用琥珀色会让人以为「等一会儿就好」，而这个状态等多久都不会好。
+- 判死的账号**不再参与卡片刷新时的积分 / 签到探测**。以前每刷新一次卡片，就对每个死账号白打两个必定 401 的请求，刷新越勤越热闹。
+
+### 已知边界
+
+- 判死状态记在内存里，重启后重新判定。也就是说重启后的第一次请求还会再试一次那个账号，然后才把它请出去——这一次的代价是必要的，否则「重启一下就好了」的临时故障会被误判成永久失效。
+- 国际版每日签到活动（`checkin-activity-status`）实测当前是 `active: false`，所以「多账号自动领 30 积分」目前没有可领的东西；国内版的活动是正常的，逐账号领取的链路本来就有。
+
 ## 1.8.0 — 四种模式，终于排得像个样子了
 
 > 上一版加了第四种模式「每对话固定」，功能是好的，排版是坏的。坏得很实在：格子还是按三个排的，第四个只好委屈地掉到下一行，占着半个身位，像个插班生。

package/lib/bin.js

@@ -2644,6 +2644,28 @@ function idleWeight(lastUsedAt, now) {
 }
 /** Default rest for an account whose credits ran out (packs reset on their own schedule). */
 const EXHAUST_COOLDOWN_MS = 18e5;
+/**
+* Default rest for an account the upstream rejected the sign-in of (401/403).
+*
+* Unlike a rate limit there is no reset time to read: only signing in again in
+* the desktop app revives the account. The rest is therefore long enough that a
+* single request never burns its whole retry budget on the same dead credential,
+* but short enough that a user who just signed in is not locked out of their own
+* account for long — and a newer credential file clears the mark outright.
+*/
+const CREDENTIAL_DEAD_COOLDOWN_MS = 18e5;
+/**
+* Does this refresh failure prove the credential itself is dead?
+*
+* The upstream answers a revoked refresh token with `invalid_grant: Offline user
+* session not found` (HTTP 400/401). Network failures, DNS errors and 5xx do NOT
+* prove anything about the credential and must not mark it dead — that would
+* take a working account out of rotation for half an hour over a hiccup.
+*/
+function isCredentialDeadError(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	return message.includes("invalid_grant") || message.includes("Offline user session not found") || message.includes("session_dead");
+}
 var WorkBuddyAccountPool = class {
 	logger;
 	authDirs;
@@ -2654,6 +2676,11 @@ var WorkBuddyAccountPool = class {
 	* rate-limit window, so this is much longer than `cooldownMs`.
 	*/
 	exhaustCooldownMs;
+	/**
+	* How long an account stays out of rotation after the upstream rejected its
+	* sign-in. Cleared by a newer credential file or an explicit sign-in.
+	*/
+	credentialDeadCooldownMs;
 	client;
 	refreshMarginMs;
 	accounts = [];
@@ -2736,6 +2763,7 @@ var WorkBuddyAccountPool = class {
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
 		this.cooldownMs = options.cooldownMs ?? 6e4;
 		this.exhaustCooldownMs = options.exhaustCooldownMs ?? EXHAUST_COOLDOWN_MS;
+		this.credentialDeadCooldownMs = options.credentialDeadCooldownMs ?? CREDENTIAL_DEAD_COOLDOWN_MS;
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.distribution = options.distribution ?? "priority";
@@ -2822,11 +2850,15 @@ var WorkBuddyAccountPool = class {
 				});
 				continue;
 			}
-			if (isFresher(credential, existing.credential)) byId.set(id, {
-				...existing,
-				credential,
-				label: accountLabel(credential)
-			});
+			if (isFresher(credential, existing.credential)) {
+				const signedInAgain = credential.refreshToken !== existing.credential.refreshToken || credential.accessToken !== existing.credential.accessToken;
+				byId.set(id, {
+					...existing,
+					credential,
+					label: accountLabel(credential),
+					...signedInAgain ? { credentialDeadUntilMs: 0 } : {}
+				});
+			}
 		}
 		const ordered = [...byId.values()];
 		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
@@ -2857,6 +2889,7 @@ var WorkBuddyAccountPool = class {
 				if (balance !== void 0 && balance <= reserve) return false;
 			}
 			if (account.cooldownUntilMs > now) return false;
+			if ((account.credentialDeadUntilMs ?? 0) > now) return false;
 			if (modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now) return false;
 			if (region !== void 0 && regionOf(account.credential.domain) !== region) return false;
 			return true;
@@ -2882,15 +2915,21 @@ var WorkBuddyAccountPool = class {
 			total: 0,
 			cooling: 0,
 			disabled: 0,
+			dead: 0,
 			reason: "empty"
 		};
 		let cooling = 0;
 		let disabled = 0;
+		let dead = 0;
 		for (const account of inRegion) {
 			if (this.disabledIds.has(account.id)) {
 				disabled += 1;
 				continue;
 			}
+			if ((account.credentialDeadUntilMs ?? 0) > now) {
+				dead += 1;
+				continue;
+			}
 			const modelCooling = modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now;
 			if (account.cooldownUntilMs > now || modelCooling) {
 				cooling += 1;
@@ -2903,26 +2942,37 @@ var WorkBuddyAccountPool = class {
 					total: inRegion.length,
 					cooling,
 					disabled,
+					dead,
 					reason: "reserve"
 				};
 			}
 		}
+		if (dead > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			dead,
+			reason: "session_dead"
+		};
 		if (cooling > 0) return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "cooling"
 		};
 		if (disabled > 0) return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "disabled"
 		};
 		return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "none"
 		};
 	}
@@ -3026,31 +3076,28 @@ var WorkBuddyAccountPool = class {
 	*/
 	async acquire(modelId, region, conversationKey) {
 		if (this.accounts.length === 0) await this.scan();
-		let pool = this.available(Date.now(), modelId, region);
-		if (pool.length === 0) {
-			await this.scan();
-			pool = this.available(Date.now(), modelId, region);
-		}
-		if (pool.length === 0) return void 0;
-		if (this.preferredId !== void 0) {
-			const preferred = pool.find((account) => account.id === this.preferredId);
-			if (preferred !== void 0) {
-				await this.ensureFresh(preferred);
-				return preferred;
+		const maxTries = this.accounts.length + 1;
+		for (let attempt = 0; attempt < maxTries; attempt += 1) {
+			let pool = this.available(Date.now(), modelId, region);
+			if (pool.length === 0 && attempt === 0) {
+				await this.scan();
+				pool = this.available(Date.now(), modelId, region);
 			}
-		}
-		if (this.distribution === "sticky") {
-			const bound = this.affinityAccount(pool, conversationKey);
-			if (bound !== void 0) {
-				await this.ensureFresh(bound);
-				return bound;
+			if (pool.length === 0) return void 0;
+			if (this.preferredId !== void 0) {
+				const preferred = pool.find((account) => account.id === this.preferredId);
+				if (preferred !== void 0 && await this.ensureFresh(preferred)) return preferred;
+			}
+			if (this.distribution === "sticky") {
+				const bound = this.affinityAccount(pool, conversationKey);
+				if (bound !== void 0 && await this.ensureFresh(bound)) return bound;
 			}
+			const account = this.distribution === "round-robin" || this.distribution === "sticky" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : pool[0];
+			if (account === void 0) return void 0;
+			if (!await this.ensureFresh(account)) continue;
+			if (this.distribution === "sticky" && conversationKey !== void 0 && conversationKey !== "") this.bindAffinity(conversationKey, account.id);
+			return account;
 		}
-		const account = this.distribution === "round-robin" || this.distribution === "sticky" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : pool[0];
-		if (account === void 0) return void 0;
-		if (this.distribution === "sticky" && conversationKey !== void 0 && conversationKey !== "") this.bindAffinity(conversationKey, account.id);
-		await this.ensureFresh(account);
-		return account;
 	}
 	/** Pin the account the plugin card should prefer; tokens stay out of settings. */
 	/** How the pool currently spreads requests. Shown on the card. */
@@ -3154,31 +3201,68 @@ var WorkBuddyAccountPool = class {
 		return newest?.id;
 	}
 	/** Best-effort refresh of one account after a session-dead upstream answer. */
-	async refreshAccount(accountId) {
+	async refreshAccount(accountId, options) {
+		const account = this.accounts.find((item) => item.id === accountId);
+		if (account === void 0) return false;
+		return await this.ensureFresh(account, options?.force === true);
+	}
+	/**
+	* Cool a whole account because the upstream REJECTED its sign-in (401/403).
+	*
+	* Called with direct evidence (the request just came back `session_dead`), so
+	* it does not need to guess: without this, the next retry of the SAME request
+	* picks the same account again — its credential file still claims to be valid
+	* — and a request with 8 attempts spends all 8 on one dead account while
+	* healthy accounts are never tried.
+	*/
+	penalizeCredentialDead(accountId) {
 		const account = this.accounts.find((item) => item.id === accountId);
 		if (account === void 0) return;
-		await this.ensureFresh(account);
+		const until = Date.now() + this.credentialDeadCooldownMs;
+		account.credentialDeadUntilMs = Math.max(account.credentialDeadUntilMs ?? 0, until);
+		this.logger?.warn(`dsh-workbuddy-xdpool: ${account.label} sign-in was rejected by the upstream; keeping it out of rotation until ${new Date(until).toISOString()} (sign in again to restore it)`);
+	}
+	/** Put an account back in rotation after its sign-in was proven good again. */
+	clearCredentialDead(accountId) {
+		const account = this.accounts.find((item) => item.id === accountId);
+		if (account === void 0) return;
+		account.credentialDeadUntilMs = 0;
+	}
+	/** Accounts currently kept out of rotation because their sign-in was rejected. */
+	deadCredentials() {
+		const now = Date.now();
+		return this.accounts.filter((account) => (account.credentialDeadUntilMs ?? 0) > now);
 	}
 	/**
 	* Refresh the account's access token when it is within the margin (or already
 	* expired), in-flight de-duped per account. A failed refresh keeps the
 	* existing token when it has not yet expired, so an unreachable refresh
 	* endpoint never takes down a working session.
+	*
+	* `force` skips the "is it expiring?" gate. That gate is a cost optimisation,
+	* not a correctness rule: it exists so a healthy token is not re-fetched on
+	* every acquire. After the upstream has ALREADY rejected the token, the gate
+	* is actively wrong — a revoked token keeps its future `expiresAtMs` — and the
+	* caller needs the refresh attempted so the credential can be proven dead.
+	*
+	* Returns true when the token is known good afterwards (refreshed, or still
+	* valid), false when the credential was proven dead.
 	*/
-	async ensureFresh(account) {
-		if (this.client === void 0) return;
+	async ensureFresh(account, force = false) {
+		if (this.client === void 0) return true;
 		const credential = account.credential;
-		if (!(credential.expiresAtMs <= 0 || credential.expiresAtMs <= Date.now() + this.refreshMarginMs)) return;
+		if (!(credential.expiresAtMs <= 0 || credential.expiresAtMs <= Date.now() + this.refreshMarginMs) && !force) return true;
 		const existing = this.refreshInflight.get(account.id);
 		if (existing !== void 0) {
 			await existing;
-			return;
+			return (account.credentialDeadUntilMs ?? 0) <= Date.now();
 		}
 		const run = (async () => {
 			if (credential.refreshToken === "") {
-				if (credential.expiresAtMs > Date.now() + 3e4) return;
+				if (credential.expiresAtMs > Date.now() + 3e4) return true;
 				this.logger?.warn(`dsh-workbuddy-xdpool: ${account.label} token expired with no refresh token; sign in again`);
-				return;
+				this.penalizeCredentialDead(account.id);
+				return false;
 			}
 			try {
 				const outcome = await this.client.refreshToken(credential);
@@ -3189,15 +3273,23 @@ var WorkBuddyAccountPool = class {
 					expiresAtMs: outcome.expiresInSec !== void 0 ? Date.now() + outcome.expiresInSec * 1e3 : credential.expiresAtMs,
 					...outcome.domain === void 0 || outcome.domain === "" ? {} : { domain: outcome.domain }
 				};
+				this.clearCredentialDead(account.id);
 				this.logger?.info?.(`dsh-workbuddy-xdpool: refreshed token for ${account.label}`);
+				return true;
 			} catch (error) {
+				if (isCredentialDeadError(error)) {
+					this.penalizeCredentialDead(account.id);
+					this.logger?.warn?.(`dsh-workbuddy-xdpool: ${account.label} refresh token was revoked upstream; sign in again to restore it`, error);
+					return false;
+				}
 				if (credential.expiresAtMs > Date.now() + 3e4) this.logger?.warn?.(`dsh-workbuddy-xdpool: token refresh failed but token still valid for ${account.label}`, error);
 				else this.logger?.error?.(`dsh-workbuddy-xdpool: token refresh failed and token expired for ${account.label}`, error);
+				return true;
 			}
 		})();
 		this.refreshInflight.set(account.id, run);
 		try {
-			await run;
+			return await run;
 		} finally {
 			this.refreshInflight.delete(account.id);
 		}
@@ -3246,6 +3338,7 @@ ${new Date(until).toISOString()}
 			account.cooldownUntilMs = 0;
 			account.modelCooldowns = {};
 			account.rateLimitHits = 0;
+			account.credentialDeadUntilMs = 0;
 		}
 	}
 	/** Diagnostics snapshot. Account-wide cooling count (per-model cooling excluded:
@@ -3255,6 +3348,7 @@ ${new Date(until).toISOString()}
 		return {
 			count: this.accounts.length,
 			cooling: this.accounts.filter((account) => account.cooldownUntilMs > now).length,
+			dead: this.accounts.filter((account) => (account.credentialDeadUntilMs ?? 0) > now).length,
 			lastScanAtMs: this.lastScanAtMs
 		};
 	}

package/lib/client.js

@@ -249,7 +249,11 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-account-tag{padding:1px 8px;border-radius:999px;font-size:11px;line-height:18px;background:var(--dsw-alias-state-success-subtle,rgba(34,160,107,.12));color:var(--dsw-alias-state-success-primary,#22a06b)}
 .dsm-workbuddy-xdpool-account-tag-cooling{background:var(--dsw-alias-state-warning-subtle,rgba(217,119,6,.15));color:var(--dsw-alias-state-warning-primary,#d97706)}
 .dsm-workbuddy-xdpool-account-tag-error{background:var(--dsw-alias-state-error-subtle,rgba(239,68,68,.12));color:var(--dsw-alias-state-error-primary,#ef4444)}
+/* A rejected sign-in is red, not amber: unlike a cooldown it will not clear by
+   waiting, and it is the one state where the user has to go do something. */
+.dsm-workbuddy-xdpool-account-tag-dead{background:var(--dsw-alias-state-error-subtle,rgba(239,68,68,.12));color:var(--dsw-alias-state-error-primary,#ef4444)}
 .dsm-workbuddy-xdpool-account-meta{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px;display:flex;flex-wrap:wrap;gap:10px}
+.dsm-workbuddy-xdpool-account-meta-dead{color:var(--dsw-alias-state-error-primary,#ef4444)}
 .dsm-workbuddy-xdpool-account-modelcool{display:flex;flex-wrap:wrap;gap:6px;margin-top:2px}
 .dsm-workbuddy-xdpool-account-modelcool-chip{display:inline-flex;align-items:center;gap:4px;padding:1px 8px;border-radius:999px;font-size:11px;line-height:18px;background:var(--dsw-alias-state-warning-subtle,rgba(217,119,6,.12));color:var(--dsw-alias-state-warning-primary,#d97706)}
 .dsm-workbuddy-xdpool-account-error{margin:0;color:var(--dsw-alias-state-error-primary,#ef4444);font-size:13px;line-height:20px}
@@ -260,6 +264,9 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-panel-title{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px;letter-spacing:.03em;text-transform:uppercase;font-weight:600}
 .dsm-workbuddy-xdpool-panel-empty{color:var(--dsw-alias-label-tertiary,#999);font-size:14px;line-height:20px}
 .dsm-workbuddy-xdpool-panel-error{color:var(--dsw-alias-state-error-primary,#ef4444);font-size:12px;line-height:18px;word-break:break-word}
+/* A rejected sign-in gets a compact chip: the upstream paragraph is long, and
+   printed inline it pushed the neighbouring "Total" panel off screen. */
+.dsm-workbuddy-xdpool-panel-error-dead{display:inline-flex;align-items:center;align-self:flex-start;padding:1px 8px;border-radius:999px;background:var(--dsw-alias-state-error-subtle,rgba(239,68,68,.12));font-size:11px;line-height:18px;white-space:nowrap;cursor:help}
 .dsm-workbuddy-xdpool-panel-foot{display:flex;align-items:baseline;justify-content:space-between;gap:10px;margin-top:9px;padding-top:9px;border-top:1px solid var(--dsw-alias-border-l2,#36373b);color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:12px;line-height:18px}
 .dsm-workbuddy-xdpool-panel-foot strong{color:var(--dsw-alias-label-primary,#e6e6e6);font-size:15px;font-variant-numeric:tabular-nums}
 .dsm-workbuddy-xdpool-packages{display:flex;flex-direction:column;gap:5px;margin:0;padding:0;list-style:none}
@@ -1735,9 +1742,13 @@ window.__ModuleLoader__.load({
 		function AccountBlock({ account, t, checkinBusyId, onClaimCheckin, accountBusyId, onToggleDisabled, onIgnoreAccount, onSaveCreditReserve, reserveBusyId }) {
 			const isDisabled = account.disabled === true;
 			const isCooling = account.cooling === true;
+			const isDead = account.credentialDead === true;
 			const cooldownUntil = account.cooldownUntil !== void 0 ? Date.parse(account.cooldownUntil) : void 0;
 			const modelCooldowns = account.modelCooldowns ?? [];
-			const tag = isCooling ? {
+			const tag = isDead ? {
+				text: t?.("row.credentialDeadTag") ?? "Sign-in rejected",
+				cls: "dsm-workbuddy-xdpool-account-tag dsm-workbuddy-xdpool-account-tag-dead"
+			} : isCooling ? {
 				text: t?.("row.cooling") ?? "Cooling",
 				cls: "dsm-workbuddy-xdpool-account-tag dsm-workbuddy-xdpool-account-tag-cooling"
 			} : null;
@@ -1795,6 +1806,10 @@ window.__ModuleLoader__.load({
 										t?.("row.cooldownHits", { hits: account.rateLimitHits ?? 0 }) ?? `${account.rateLimitHits ?? 0} hit(s)`
 									]
 								}) : null,
+								isDead ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dsm-workbuddy-xdpool-account-meta dsm-workbuddy-xdpool-account-meta-dead",
+									children: t?.("row.credentialDeadHint") ?? "Sign in again in the WorkBuddy desktop app to restore it"
+								}) : null,
 								modelCooldowns.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 									className: "dsm-workbuddy-xdpool-account-modelcool",
 									children: modelCooldowns.map((mc) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
@@ -1976,8 +1991,9 @@ window.__ModuleLoader__.load({
 							children: t?.("row.creditsPackages") ?? "Credit packages"
 						}),
 						account.creditsError !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: "dsm-workbuddy-xdpool-panel-error",
-							children: account.creditsError
+							className: `dsm-workbuddy-xdpool-panel-error${account.credentialDead === true ? " dsm-workbuddy-xdpool-panel-error-dead" : ""}`,
+							title: account.creditsError,
+							children: account.credentialDead === true ? t?.("row.credentialDead") ?? "Sign-in rejected" : t?.("row.creditsError") ?? "credits unavailable"
 						}) : packages.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: "dsm-workbuddy-xdpool-panel-empty",
 							children: "–"
@@ -2282,6 +2298,9 @@ window.__ModuleLoader__.load({
 			"row.creditsPackages": "Credit packages",
 			"row.creditsPackage": "{remain} / {size}",
 			"row.creditsError": "credits unavailable",
+			"row.credentialDead": "Sign-in rejected",
+			"row.credentialDeadTag": "Sign-in rejected",
+			"row.credentialDeadHint": "The upstream no longer accepts this sign-in. Sign in again in the WorkBuddy desktop app to restore it.",
 			"row.creditsSoon": "Expiring in 3 days",
 			"row.creditsExpiresAt": "Expires {time}",
 			"row.creditsExpiresSoonTitle": "Expiring within 3 days",
@@ -2437,6 +2456,9 @@ window.__ModuleLoader__.load({
 			"row.creditsPackages": "积分包",
 			"row.creditsPackage": "{remain} / {size}",
 			"row.creditsError": "积分不可用",
+			"row.credentialDead": "登录已被拒绝",
+			"row.credentialDeadTag": "登录已被拒绝",
+			"row.credentialDeadHint": "上游已不再接受这个登录状态。请在 WorkBuddy 桌面端重新登录该账号以恢复。",
 			"row.creditsSoon": "3 天内到期",
 			"row.creditsExpiresAt": "到期 {time}",
 			"row.creditsExpiresSoonTitle": "3 天内到期",

package/lib/index.d.ts

@@ -810,6 +810,20 @@ interface WorkBuddyAccount {
   modelCooldowns: Record<string, number>;
   /** Consecutive rate-limit hits, for diagnostics. */
   rateLimitHits: number;
+  /**
+   * Epoch ms until which this account is skipped because the upstream REJECTED
+   * its sign-in (401/403), not because of a rate limit.
+   *
+   * A revoked session is invisible from the credential file: the upstream does
+   * not rewrite `expiresAtMs` when it kills a refresh token, so a dead account
+   * looks perfectly fresh and, without this field, gets picked again on the very
+   * next attempt. With `maxAttempts` retries that meant one dead account could
+   * absorb an entire request while healthy accounts were never tried.
+   *
+   * Only a fresh sign-in in the desktop app clears it, so the cooldown is long;
+   * `0`/undefined means "not known to be dead".
+   */
+  credentialDeadUntilMs?: number;
 }
 /**
  * Platform-default directories holding the desktop app's auth files.
@@ -845,6 +859,11 @@ interface AccountPoolOptions {
   cooldownMs?: number;
   /** How long an account rests after its credits run out (default 30 minutes). */
   exhaustCooldownMs?: number;
+  /**
+   * How long an account rests after the upstream rejects its sign-in
+   * (default 30 minutes). Only a fresh sign-in in the desktop app clears it.
+   */
+  credentialDeadCooldownMs?: number;
   /** Upstream client used to refresh near-expiry tokens. */
   client?: TokenRefresher;
   /** Refresh this long before actual expiry; default five minutes. */
@@ -874,6 +893,11 @@ export declare class WorkBuddyAccountPool {
    * rate-limit window, so this is much longer than `cooldownMs`.
    */
   private exhaustCooldownMs;
+  /**
+   * How long an account stays out of rotation after the upstream rejected its
+   * sign-in. Cleared by a newer credential file or an explicit sign-in.
+   */
+  private credentialDeadCooldownMs;
   private readonly client;
   private readonly refreshMarginMs;
   private accounts;
@@ -1018,7 +1042,9 @@ export declare class WorkBuddyAccountPool {
     total: number;
     cooling: number;
     disabled: number;
-    reason: 'empty' | 'cooling' | 'disabled' | 'reserve' | 'none';
+    /** Accounts skipped because the upstream rejected their sign-in. */
+    dead: number;
+    reason: 'empty' | 'cooling' | 'disabled' | 'reserve' | 'session_dead' | 'none';
   };
   /** Round-robin: the legacy cursor walk, kept for the distribution that asks for it. */
   private pickRoundRobin;
@@ -1135,12 +1161,37 @@ export declare class WorkBuddyAccountPool {
    */
   lastServedId(): string | undefined;
   /** Best-effort refresh of one account after a session-dead upstream answer. */
-  refreshAccount(accountId: string): Promise<void>;
+  refreshAccount(accountId: string, options?: {
+    force?: boolean;
+  }): Promise<boolean>;
+  /**
+   * Cool a whole account because the upstream REJECTED its sign-in (401/403).
+   *
+   * Called with direct evidence (the request just came back `session_dead`), so
+   * it does not need to guess: without this, the next retry of the SAME request
+   * picks the same account again — its credential file still claims to be valid
+   * — and a request with 8 attempts spends all 8 on one dead account while
+   * healthy accounts are never tried.
+   */
+  penalizeCredentialDead(accountId: string): void;
+  /** Put an account back in rotation after its sign-in was proven good again. */
+  clearCredentialDead(accountId: string): void;
+  /** Accounts currently kept out of rotation because their sign-in was rejected. */
+  deadCredentials(): readonly WorkBuddyAccount[];
   /**
    * Refresh the account's access token when it is within the margin (or already
    * expired), in-flight de-duped per account. A failed refresh keeps the
    * existing token when it has not yet expired, so an unreachable refresh
    * endpoint never takes down a working session.
+   *
+   * `force` skips the "is it expiring?" gate. That gate is a cost optimisation,
+   * not a correctness rule: it exists so a healthy token is not re-fetched on
+   * every acquire. After the upstream has ALREADY rejected the token, the gate
+   * is actively wrong — a revoked token keeps its future `expiresAtMs` — and the
+   * caller needs the refresh attempted so the credential can be proven dead.
+   *
+   * Returns true when the token is known good afterwards (refreshed, or still
+   * valid), false when the credential was proven dead.
    */
   private ensureFresh;
   /**
@@ -1168,6 +1219,7 @@ export declare class WorkBuddyAccountPool {
   status(): {
     count: number;
     cooling: number;
+    dead: number;
     lastScanAtMs: number;
   };
 }
@@ -1218,6 +1270,15 @@ interface PoolWebAccount {
   cooling: boolean;
   /** ISO timestamp when the account-wide 429 cooldown lifts; only while cooling. */
   cooldownUntil?: string;
+  /**
+   * The upstream REJECTED this account's sign-in (401/403) — the credential file
+   * still looks valid because the upstream never rewrites its expiry when it
+   * revokes a token. Distinct from `cooling`: waiting does not fix it, only
+   * signing in again in the desktop app does.
+   */
+  credentialDead?: boolean;
+  /** ISO timestamp when the dead mark expires and the account is retried; only while `credentialDead`. */
+  credentialDeadUntil?: string;
   /**
    * Per-model cooldowns currently active. The account is NOT `cooling` while a
    * model is limited — its other models still serve — but each entry tells the

package/lib/index.js

@@ -2752,6 +2752,28 @@ function idleWeight(lastUsedAt, now) {
 }
 /** Default rest for an account whose credits ran out (packs reset on their own schedule). */
 const EXHAUST_COOLDOWN_MS = 18e5;
+/**
+* Default rest for an account the upstream rejected the sign-in of (401/403).
+*
+* Unlike a rate limit there is no reset time to read: only signing in again in
+* the desktop app revives the account. The rest is therefore long enough that a
+* single request never burns its whole retry budget on the same dead credential,
+* but short enough that a user who just signed in is not locked out of their own
+* account for long — and a newer credential file clears the mark outright.
+*/
+const CREDENTIAL_DEAD_COOLDOWN_MS = 18e5;
+/**
+* Does this refresh failure prove the credential itself is dead?
+*
+* The upstream answers a revoked refresh token with `invalid_grant: Offline user
+* session not found` (HTTP 400/401). Network failures, DNS errors and 5xx do NOT
+* prove anything about the credential and must not mark it dead — that would
+* take a working account out of rotation for half an hour over a hiccup.
+*/
+function isCredentialDeadError(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	return message.includes("invalid_grant") || message.includes("Offline user session not found") || message.includes("session_dead");
+}
 var WorkBuddyAccountPool = class {
 	logger;
 	authDirs;
@@ -2762,6 +2784,11 @@ var WorkBuddyAccountPool = class {
 	* rate-limit window, so this is much longer than `cooldownMs`.
 	*/
 	exhaustCooldownMs;
+	/**
+	* How long an account stays out of rotation after the upstream rejected its
+	* sign-in. Cleared by a newer credential file or an explicit sign-in.
+	*/
+	credentialDeadCooldownMs;
 	client;
 	refreshMarginMs;
 	accounts = [];
@@ -2844,6 +2871,7 @@ var WorkBuddyAccountPool = class {
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
 		this.cooldownMs = options.cooldownMs ?? 6e4;
 		this.exhaustCooldownMs = options.exhaustCooldownMs ?? EXHAUST_COOLDOWN_MS;
+		this.credentialDeadCooldownMs = options.credentialDeadCooldownMs ?? CREDENTIAL_DEAD_COOLDOWN_MS;
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.distribution = options.distribution ?? "priority";
@@ -2930,11 +2958,15 @@ var WorkBuddyAccountPool = class {
 				});
 				continue;
 			}
-			if (isFresher(credential, existing.credential)) byId.set(id, {
-				...existing,
-				credential,
-				label: accountLabel(credential)
-			});
+			if (isFresher(credential, existing.credential)) {
+				const signedInAgain = credential.refreshToken !== existing.credential.refreshToken || credential.accessToken !== existing.credential.accessToken;
+				byId.set(id, {
+					...existing,
+					credential,
+					label: accountLabel(credential),
+					...signedInAgain ? { credentialDeadUntilMs: 0 } : {}
+				});
+			}
 		}
 		const ordered = [...byId.values()];
 		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
@@ -2965,6 +2997,7 @@ var WorkBuddyAccountPool = class {
 				if (balance !== void 0 && balance <= reserve) return false;
 			}
 			if (account.cooldownUntilMs > now) return false;
+			if ((account.credentialDeadUntilMs ?? 0) > now) return false;
 			if (modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now) return false;
 			if (region !== void 0 && regionOf(account.credential.domain) !== region) return false;
 			return true;
@@ -2990,15 +3023,21 @@ var WorkBuddyAccountPool = class {
 			total: 0,
 			cooling: 0,
 			disabled: 0,
+			dead: 0,
 			reason: "empty"
 		};
 		let cooling = 0;
 		let disabled = 0;
+		let dead = 0;
 		for (const account of inRegion) {
 			if (this.disabledIds.has(account.id)) {
 				disabled += 1;
 				continue;
 			}
+			if ((account.credentialDeadUntilMs ?? 0) > now) {
+				dead += 1;
+				continue;
+			}
 			const modelCooling = modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now;
 			if (account.cooldownUntilMs > now || modelCooling) {
 				cooling += 1;
@@ -3011,26 +3050,37 @@ var WorkBuddyAccountPool = class {
 					total: inRegion.length,
 					cooling,
 					disabled,
+					dead,
 					reason: "reserve"
 				};
 			}
 		}
+		if (dead > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			dead,
+			reason: "session_dead"
+		};
 		if (cooling > 0) return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "cooling"
 		};
 		if (disabled > 0) return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "disabled"
 		};
 		return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "none"
 		};
 	}
@@ -3134,31 +3184,28 @@ var WorkBuddyAccountPool = class {
 	*/
 	async acquire(modelId, region, conversationKey) {
 		if (this.accounts.length === 0) await this.scan();
-		let pool = this.available(Date.now(), modelId, region);
-		if (pool.length === 0) {
-			await this.scan();
-			pool = this.available(Date.now(), modelId, region);
-		}
-		if (pool.length === 0) return void 0;
-		if (this.preferredId !== void 0) {
-			const preferred = pool.find((account) => account.id === this.preferredId);
-			if (preferred !== void 0) {
-				await this.ensureFresh(preferred);
-				return preferred;
+		const maxTries = this.accounts.length + 1;
+		for (let attempt = 0; attempt < maxTries; attempt += 1) {
+			let pool = this.available(Date.now(), modelId, region);
+			if (pool.length === 0 && attempt === 0) {
+				await this.scan();
+				pool = this.available(Date.now(), modelId, region);
 			}
-		}
-		if (this.distribution === "sticky") {
-			const bound = this.affinityAccount(pool, conversationKey);
-			if (bound !== void 0) {
-				await this.ensureFresh(bound);
-				return bound;
+			if (pool.length === 0) return void 0;
+			if (this.preferredId !== void 0) {
+				const preferred = pool.find((account) => account.id === this.preferredId);
+				if (preferred !== void 0 && await this.ensureFresh(preferred)) return preferred;
+			}
+			if (this.distribution === "sticky") {
+				const bound = this.affinityAccount(pool, conversationKey);
+				if (bound !== void 0 && await this.ensureFresh(bound)) return bound;
 			}
+			const account = this.distribution === "round-robin" || this.distribution === "sticky" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : pool[0];
+			if (account === void 0) return void 0;
+			if (!await this.ensureFresh(account)) continue;
+			if (this.distribution === "sticky" && conversationKey !== void 0 && conversationKey !== "") this.bindAffinity(conversationKey, account.id);
+			return account;
 		}
-		const account = this.distribution === "round-robin" || this.distribution === "sticky" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : pool[0];
-		if (account === void 0) return void 0;
-		if (this.distribution === "sticky" && conversationKey !== void 0 && conversationKey !== "") this.bindAffinity(conversationKey, account.id);
-		await this.ensureFresh(account);
-		return account;
 	}
 	/** Pin the account the plugin card should prefer; tokens stay out of settings. */
 	/** How the pool currently spreads requests. Shown on the card. */
@@ -3262,31 +3309,68 @@ var WorkBuddyAccountPool = class {
 		return newest?.id;
 	}
 	/** Best-effort refresh of one account after a session-dead upstream answer. */
-	async refreshAccount(accountId) {
+	async refreshAccount(accountId, options) {
+		const account = this.accounts.find((item) => item.id === accountId);
+		if (account === void 0) return false;
+		return await this.ensureFresh(account, options?.force === true);
+	}
+	/**
+	* Cool a whole account because the upstream REJECTED its sign-in (401/403).
+	*
+	* Called with direct evidence (the request just came back `session_dead`), so
+	* it does not need to guess: without this, the next retry of the SAME request
+	* picks the same account again — its credential file still claims to be valid
+	* — and a request with 8 attempts spends all 8 on one dead account while
+	* healthy accounts are never tried.
+	*/
+	penalizeCredentialDead(accountId) {
+		const account = this.accounts.find((item) => item.id === accountId);
+		if (account === void 0) return;
+		const until = Date.now() + this.credentialDeadCooldownMs;
+		account.credentialDeadUntilMs = Math.max(account.credentialDeadUntilMs ?? 0, until);
+		this.logger?.warn(`dsh-workbuddy-xdpool: ${account.label} sign-in was rejected by the upstream; keeping it out of rotation until ${new Date(until).toISOString()} (sign in again to restore it)`);
+	}
+	/** Put an account back in rotation after its sign-in was proven good again. */
+	clearCredentialDead(accountId) {
 		const account = this.accounts.find((item) => item.id === accountId);
 		if (account === void 0) return;
-		await this.ensureFresh(account);
+		account.credentialDeadUntilMs = 0;
+	}
+	/** Accounts currently kept out of rotation because their sign-in was rejected. */
+	deadCredentials() {
+		const now = Date.now();
+		return this.accounts.filter((account) => (account.credentialDeadUntilMs ?? 0) > now);
 	}
 	/**
 	* Refresh the account's access token when it is within the margin (or already
 	* expired), in-flight de-duped per account. A failed refresh keeps the
 	* existing token when it has not yet expired, so an unreachable refresh
 	* endpoint never takes down a working session.
+	*
+	* `force` skips the "is it expiring?" gate. That gate is a cost optimisation,
+	* not a correctness rule: it exists so a healthy token is not re-fetched on
+	* every acquire. After the upstream has ALREADY rejected the token, the gate
+	* is actively wrong — a revoked token keeps its future `expiresAtMs` — and the
+	* caller needs the refresh attempted so the credential can be proven dead.
+	*
+	* Returns true when the token is known good afterwards (refreshed, or still
+	* valid), false when the credential was proven dead.
 	*/
-	async ensureFresh(account) {
-		if (this.client === void 0) return;
+	async ensureFresh(account, force = false) {
+		if (this.client === void 0) return true;
 		const credential = account.credential;
-		if (!(credential.expiresAtMs <= 0 || credential.expiresAtMs <= Date.now() + this.refreshMarginMs)) return;
+		if (!(credential.expiresAtMs <= 0 || credential.expiresAtMs <= Date.now() + this.refreshMarginMs) && !force) return true;
 		const existing = this.refreshInflight.get(account.id);
 		if (existing !== void 0) {
 			await existing;
-			return;
+			return (account.credentialDeadUntilMs ?? 0) <= Date.now();
 		}
 		const run = (async () => {
 			if (credential.refreshToken === "") {
-				if (credential.expiresAtMs > Date.now() + 3e4) return;
+				if (credential.expiresAtMs > Date.now() + 3e4) return true;
 				this.logger?.warn(`dsh-workbuddy-xdpool: ${account.label} token expired with no refresh token; sign in again`);
-				return;
+				this.penalizeCredentialDead(account.id);
+				return false;
 			}
 			try {
 				const outcome = await this.client.refreshToken(credential);
@@ -3297,15 +3381,23 @@ var WorkBuddyAccountPool = class {
 					expiresAtMs: outcome.expiresInSec !== void 0 ? Date.now() + outcome.expiresInSec * 1e3 : credential.expiresAtMs,
 					...outcome.domain === void 0 || outcome.domain === "" ? {} : { domain: outcome.domain }
 				};
+				this.clearCredentialDead(account.id);
 				this.logger?.info?.(`dsh-workbuddy-xdpool: refreshed token for ${account.label}`);
+				return true;
 			} catch (error) {
+				if (isCredentialDeadError(error)) {
+					this.penalizeCredentialDead(account.id);
+					this.logger?.warn?.(`dsh-workbuddy-xdpool: ${account.label} refresh token was revoked upstream; sign in again to restore it`, error);
+					return false;
+				}
 				if (credential.expiresAtMs > Date.now() + 3e4) this.logger?.warn?.(`dsh-workbuddy-xdpool: token refresh failed but token still valid for ${account.label}`, error);
 				else this.logger?.error?.(`dsh-workbuddy-xdpool: token refresh failed and token expired for ${account.label}`, error);
+				return true;
 			}
 		})();
 		this.refreshInflight.set(account.id, run);
 		try {
-			await run;
+			return await run;
 		} finally {
 			this.refreshInflight.delete(account.id);
 		}
@@ -3354,6 +3446,7 @@ ${new Date(until).toISOString()}
 			account.cooldownUntilMs = 0;
 			account.modelCooldowns = {};
 			account.rateLimitHits = 0;
+			account.credentialDeadUntilMs = 0;
 		}
 	}
 	/** Diagnostics snapshot. Account-wide cooling count (per-model cooling excluded:
@@ -3363,6 +3456,7 @@ ${new Date(until).toISOString()}
 		return {
 			count: this.accounts.length,
 			cooling: this.accounts.filter((account) => account.cooldownUntilMs > now).length,
+			dead: this.accounts.filter((account) => (account.credentialDeadUntilMs ?? 0) > now).length,
 			lastScanAtMs: this.lastScanAtMs
 		};
 	}
@@ -5900,6 +5994,10 @@ function createWorkBuddyShim(options) {
 					writeOpenAIError(res, 402, "reserve_floor", `every WorkBuddy account is at or below its credit reserve (${why.total} account(s)); lower the reserve on the pool card or top up credits`);
 					return;
 				}
+				if (why.reason === "session_dead") {
+					writeOpenAIError(res, 401, "session_dead", `${why.dead}/${why.total} WorkBuddy account(s) for this gateway were rejected by the upstream (their sign-in was revoked); sign in again in the WorkBuddy desktop app to restore them`);
+					return;
+				}
 				writeOpenAIError(res, 401, "not_signed_in", why.total === 0 ? "no WorkBuddy credential found for this gateway; sign in on the desktop app (or set WORKBUDDY_AUTH_FILE)" : `no usable WorkBuddy credential among ${why.total} account(s) for this gateway; sign in again on the desktop app`);
 				return;
 			}
@@ -5916,7 +6014,11 @@ function createWorkBuddyShim(options) {
 			};
 			if (result.kind === "session_dead") {
 				logger?.warn(`dsh-workbuddy-xdpool: ${account.label} session dead; refreshing token and retrying`);
-				await pool.refreshAccount(account.id);
+				const before = account.credential.accessToken;
+				if (!await pool.refreshAccount(account.id, { force: true }) || account.credential.accessToken === before) {
+					pool.penalizeCredentialDead(account.id);
+					logger?.warn(`dsh-workbuddy-xdpool: ${account.label} sign-in is no longer valid (attempt ${attempt + 1}/${maxAttempts}); rotating`);
+				}
 				continue;
 			}
 			if (result.kind === "hard_credit") {
@@ -6109,7 +6211,8 @@ async function recoverFromContextOverrun(options) {
 			detail: "prompt still exceeded the window after compaction"
 		};
 		if (result.kind === "session_dead") {
-			await pool.refreshAccount(account.id);
+			const before = account.credential.accessToken;
+			if (!await pool.refreshAccount(account.id, { force: true }) || account.credential.accessToken === before) pool.penalizeCredentialDead(account.id);
 			continue;
 		}
 		if (result.kind === "hard_credit") {
@@ -6401,6 +6504,8 @@ function parseAutomationRun(body) {
 function toWebAccount(account, disabled, reserve, reserved) {
 	const now = Date.now();
 	const cooling = account.cooldownUntilMs > now;
+	const deadUntil = account.credentialDeadUntilMs ?? 0;
+	const credentialDead = deadUntil > now;
 	const modelCooldowns = Object.entries(account.modelCooldowns).filter(([, until]) => until > now).sort((a, b) => a[1] - b[1]).map(([modelId, until]) => ({
 		modelId,
 		until: new Date(until).toISOString()
@@ -6413,6 +6518,8 @@ function toWebAccount(account, disabled, reserve, reserved) {
 		...account.credential.expiresAtMs === 0 ? {} : { expiresAt: new Date(account.credential.expiresAtMs).toISOString() },
 		cooling,
 		...cooling ? { cooldownUntil: new Date(account.cooldownUntilMs).toISOString() } : {},
+		credentialDead,
+		...credentialDead ? { credentialDeadUntil: new Date(deadUntil).toISOString() } : {},
 		...modelCooldowns.length === 0 ? {} : { modelCooldowns },
 		disabled,
 		creditReserve: reserve,
@@ -6452,7 +6559,7 @@ async function poolWebStatus(deps, region = "cn") {
 		const row = toWebAccount(account, deps.pool.isDisabled(account.id), deps.pool.creditReserveOf(account.id), deps.pool.isReserved(account.id));
 		const earned = deps.scheduler?.().earningsToday[account.id];
 		if (earned !== void 0) Object.assign(row, { automationToday: earned });
-		if (!row.cooling) {
+		if (!row.cooling && row.credentialDead !== true) {
 			try {
 				const credits = await deps.client.fetchCredits(account.credential);
 				deps.pool.noteCredits(account.id, credits.total);

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-xdpool",
   "displayName": "DSH WorkBuddy XD Pool",
   "description": "Merge every locally signed-in WorkBuddy account into DeepSeek Harness as one auto-failing-over model pool (multi-account rotation, live credits, daily check-in and model catalog).",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-workbuddy-xdpool#readme",