dsh-workbuddy-xdpool 1.8.0 → 1.8.2

package/CHANGELOG.md

@@ -4,6 +4,84 @@
 
 版本号遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## 1.8.2 — 免费的那个被限流了，旁边那个收费的同款还能用
+
+> 免费模型被限流的时候，插件以前只会说一句「所有账号都在冷却」。这句话没错，但它让用户以为自己只剩一条路：等。其实同一个模型往往还有一条**收费的**产品行，而且在限流器眼里它们是两个不同的模型——免费行被关小黑屋的时候，收费行通常毫发无伤。这个版本就是把这个「另一条路」写出来。
+
+### 同一个模型，凭什么有两行
+
+上游把一条产品线按**多行**卖，每行有自己的 id、自己的价格、自己的限流额度，但**显示名字是一样的**。实测两个网关：
+
+| 网关 | 免费行 | 收费行 |
+| --- | --- | --- |
+| 国际版 | `deepseek-v4.1-flash`（x0.00） | `deepseek-v4.1-flash-sg`（x0.03） |
+| 国内版 | `hy3`（x0.00） | `hy3-x`（x0.05） |
+
+注意 `-sg` 和 `-x` 跟免费行**没有任何前缀关系**，能把它们认成一家的只有那个相同的显示名。所以匹配是按名字来的，不是按 id 猜的。
+
+### 现在会怎么提示
+
+- **模型列表**：免费行后面挂一个小灰标「付费同款 deepseek-v4.1-flash-sg（0.03x）」，鼠标悬停解释「免费档先被限流；同一个模型的付费行不受这个限制影响」。灰的、低调的——这一行现在仍然是免费的那个，标签只是告诉你退路在哪，不是催你花钱。
+- **429 报错**：以前是「every account is rate-limited for model deepseek-v4.1-flash (4/4 cooling, tried 0)」，现在后面会接一句「deepseek-v4.1-flash-sg is the same model on a paid row (x0.03 credits) and is rate-limited separately; switch to it to keep going」。
+- **账号卡片**：某个账号上「`hy4-preview` cooling to 10:14」这种小标后面，也会跟上「→ 收费行的 id（倍率）还能用」。
+
+### 刻意没做的事
+
+- **收费行不标标签。** 只有倍率等于 0 的行才找孪生兄弟。否则「GLM-5.3」这种本身收费、又恰好有个更便宜的闪速版的模型，也会被挂上一个标签，最后满屏都是提示，等于没提示。
+- **没有收费同款就不说话。** 独苗模型（整条线只有它自己）不会有任何多余文字，也不会留下一个孤零零的分隔符。
+- **不把另一个免费行当退路。** 两个免费行是一起被限流的，切过去纯属换个人排队，说了等于骗人。
+- **倍率未知的行不算数。** 上游没给价格的兄弟行不能被承诺成「那个收费的」——用户切过去以为知道价钱，结果未必。
+
+### 顺带说清楚：国际版没有「每天领 30 积分」
+
+上一版已经查过一遍，这次把话说完整。国际版（`www.workbuddy.ai`）**没有**签到活动，也**没有** `daily-checkin` 这条路由：
+
+- `POST /v2/billing/meter/checkin-activity-status` 返回 200，但 `active: false`（字段在，活动没开）；
+- `GET /v2/billing/meter/get-user-resource` 直接 404（国内版才有这个接口）；
+- `/v2/billing/meter/checkin`、`/daily-checkin-activity`、`/checkin-activity` 全是 404。
+
+国际版真正有的是另一套东西：**成长任务板**（5 条：完成一次对话、安装技能、绑定微信、召唤专家、使用模板）和 **streak 连续打卡**（7 天 / 14 天 / 28 天档位，分别给 0 / 50 / 150 积分）。但它的字段形状跟国内版不一样（没有 credit / energy / target / current），插件目前解析不了，所以**没有**为国际版开自动化——没有可领的东西，开了也只是每天准时去撞 404。
+
+国内版的签到是正常的，多账号逐个领取的链路本来就有，不受本次改动影响。
+
+## 1.8.1 — 一个过期的登录状态，不再拖着整个池子陪跑
+
+> 有人的卡片上，好几个账号下面顶着一大段红色英文，大意是「上游不认这个登录了，去桌面端重新登录」。话说得没错，可问题是：它只说了结论，没解决过程——那几个账号明明已经废了，每次请求还是要挨个撞一遍，撞得头破血流，旁边几个好端端的账号一次都轮不上。
+
+### 事情是怎么变成这样的
+
+上游吊销一个登录状态时，**不会顺手把凭据文件里的过期时间改掉**。于是本机留着一份「看起来还有效」的凭据：过期时间写着 11 月 4 日，今天才 10 月，一切正常。
+
+插件就信了。它把这三个账号当成健康账号，按顺序一个一个试：
+
+1. 拿账号 A 去请求，上游回 401；
+2. 插件想「可能是 token 过期了」，于是刷新 token；
+3. 上游回答「这个 refresh token 早就没了」（`invalid_grant: Offline user session not found`）；
+4. 插件刷新失败，但**没有记仇**，转头又拿 A 去试；
+5. 八次重试名额（`maxAttempts`）就这么全喂给了同一个死账号，健康账号一次都没被碰过。
+
+所以现象是「明明还有能用的账号，请求却一直失败」，外加卡片上一片红。
+
+### 现在怎么处理
+
+给账号加了第三种状态：**判死**（前两种是「正常」和「限流冷却」）。
+
+- **只有上游亲口说死才算死。** 判据是 `invalid_grant` / `Offline user session not found` 这类明确答复。网络超时、DNS 抽风、5xx 一律不算——否则一次网络抖动就会把好账号关进小黑屋半小时，那比原来的 bug 还难查。
+- **判死的账号立刻退出轮换**，不再参与 `acquire` 的选择，请求当场换健康账号继续，不用等到八次重试耗尽。
+- **想复活有两条路**：在 WorkBuddy 桌面端重新登录该账号（插件发现 refresh token 变了，自动放行），或者点卡片上的「清除所有冷却」手动再给它一次机会。
+- **全池都死了的时候**，返回的不再是含含糊糊的「你还没登录」，而是 401 `session_dead`：`N/M WorkBuddy account(s) for this gateway were rejected by the upstream (their sign-in was revoked); sign in again in the WorkBuddy desktop app to restore them`。「等待」和「重新登录」是两种完全不同的处置方式，不能混着报。
+
+### 卡片上的红字也收拾了一下
+
+- 原来那段整段英文报错**直接铺在「积分包」面板里**，把面板撑得老长，右边的「合计」都被挤出屏幕。现在折叠成一个红色小标「**登录已被拒绝**」，鼠标悬停才显示原文。
+- 账号行上加了红色的「登录已被拒绝」标签，下面补一句「请在 WorkBuddy 桌面端重新登录该账号以恢复」——红色是故意的，用琥珀色会让人以为「等一会儿就好」，而这个状态等多久都不会好。
+- 判死的账号**不再参与卡片刷新时的积分 / 签到探测**。以前每刷新一次卡片，就对每个死账号白打两个必定 401 的请求，刷新越勤越热闹。
+
+### 已知边界
+
+- 判死状态记在内存里，重启后重新判定。也就是说重启后的第一次请求还会再试一次那个账号，然后才把它请出去——这一次的代价是必要的，否则「重启一下就好了」的临时故障会被误判成永久失效。
+- 国际版每日签到活动（`checkin-activity-status`）实测当前是 `active: false`，所以「多账号自动领 30 积分」目前没有可领的东西；国内版的活动是正常的，逐账号领取的链路本来就有。
+
 ## 1.8.0 — 四种模式，终于排得像个样子了
 
 > 上一版加了第四种模式「每对话固定」，功能是好的，排版是坏的。坏得很实在：格子还是按三个排的，第四个只好委屈地掉到下一行，占着半个身位，像个插班生。

package/README.md

@@ -50,6 +50,8 @@
 
 - **模型目录带标注**：列出池里能用的模型，附带积分倍率（如 `GLM-5.2 · x0.79`）、免费 / 限时免费 / 夜间折扣标签、能否收图和上下文窗口大小，全部跟随上游实时更新。
 
+- **被限流时告诉你退路**：免费档被 429 冷却时，卡片和报错都会点名**同名的付费行**（如国际版 `deepseek-v4.1-flash` 对 `deepseek-v4.1-flash-sg`、国内版 `hy3` 对 `hy3-x`）。上游按「行」分别限流，所以免费行被关小黑屋时，收费行通常还是通的。
+
 - **国内版 / 国际版自动适配**：按账号凭据里的登录域名自动选上游——国际版登录（`workbuddy.ai`）走 `www.workbuddy.ai`，国内版（默认）走 `copilot.tencent.com`。两种账号可以混在同一个池里。
 
 - **想手动做点啥也行**：卡片和命令行都提供「重新检测账号」「清除所有冷却」「每日签到」三个操作。

package/lib/bin.js

@@ -2644,6 +2644,28 @@ function idleWeight(lastUsedAt, now) {
 }
 /** Default rest for an account whose credits ran out (packs reset on their own schedule). */
 const EXHAUST_COOLDOWN_MS = 18e5;
+/**
+* Default rest for an account the upstream rejected the sign-in of (401/403).
+*
+* Unlike a rate limit there is no reset time to read: only signing in again in
+* the desktop app revives the account. The rest is therefore long enough that a
+* single request never burns its whole retry budget on the same dead credential,
+* but short enough that a user who just signed in is not locked out of their own
+* account for long — and a newer credential file clears the mark outright.
+*/
+const CREDENTIAL_DEAD_COOLDOWN_MS = 18e5;
+/**
+* Does this refresh failure prove the credential itself is dead?
+*
+* The upstream answers a revoked refresh token with `invalid_grant: Offline user
+* session not found` (HTTP 400/401). Network failures, DNS errors and 5xx do NOT
+* prove anything about the credential and must not mark it dead — that would
+* take a working account out of rotation for half an hour over a hiccup.
+*/
+function isCredentialDeadError(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	return message.includes("invalid_grant") || message.includes("Offline user session not found") || message.includes("session_dead");
+}
 var WorkBuddyAccountPool = class {
 	logger;
 	authDirs;
@@ -2654,6 +2676,11 @@ var WorkBuddyAccountPool = class {
 	* rate-limit window, so this is much longer than `cooldownMs`.
 	*/
 	exhaustCooldownMs;
+	/**
+	* How long an account stays out of rotation after the upstream rejected its
+	* sign-in. Cleared by a newer credential file or an explicit sign-in.
+	*/
+	credentialDeadCooldownMs;
 	client;
 	refreshMarginMs;
 	accounts = [];
@@ -2736,6 +2763,7 @@ var WorkBuddyAccountPool = class {
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
 		this.cooldownMs = options.cooldownMs ?? 6e4;
 		this.exhaustCooldownMs = options.exhaustCooldownMs ?? EXHAUST_COOLDOWN_MS;
+		this.credentialDeadCooldownMs = options.credentialDeadCooldownMs ?? CREDENTIAL_DEAD_COOLDOWN_MS;
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.distribution = options.distribution ?? "priority";
@@ -2822,11 +2850,15 @@ var WorkBuddyAccountPool = class {
 				});
 				continue;
 			}
-			if (isFresher(credential, existing.credential)) byId.set(id, {
-				...existing,
-				credential,
-				label: accountLabel(credential)
-			});
+			if (isFresher(credential, existing.credential)) {
+				const signedInAgain = credential.refreshToken !== existing.credential.refreshToken || credential.accessToken !== existing.credential.accessToken;
+				byId.set(id, {
+					...existing,
+					credential,
+					label: accountLabel(credential),
+					...signedInAgain ? { credentialDeadUntilMs: 0 } : {}
+				});
+			}
 		}
 		const ordered = [...byId.values()];
 		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
@@ -2857,6 +2889,7 @@ var WorkBuddyAccountPool = class {
 				if (balance !== void 0 && balance <= reserve) return false;
 			}
 			if (account.cooldownUntilMs > now) return false;
+			if ((account.credentialDeadUntilMs ?? 0) > now) return false;
 			if (modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now) return false;
 			if (region !== void 0 && regionOf(account.credential.domain) !== region) return false;
 			return true;
@@ -2882,15 +2915,21 @@ var WorkBuddyAccountPool = class {
 			total: 0,
 			cooling: 0,
 			disabled: 0,
+			dead: 0,
 			reason: "empty"
 		};
 		let cooling = 0;
 		let disabled = 0;
+		let dead = 0;
 		for (const account of inRegion) {
 			if (this.disabledIds.has(account.id)) {
 				disabled += 1;
 				continue;
 			}
+			if ((account.credentialDeadUntilMs ?? 0) > now) {
+				dead += 1;
+				continue;
+			}
 			const modelCooling = modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now;
 			if (account.cooldownUntilMs > now || modelCooling) {
 				cooling += 1;
@@ -2903,26 +2942,37 @@ var WorkBuddyAccountPool = class {
 					total: inRegion.length,
 					cooling,
 					disabled,
+					dead,
 					reason: "reserve"
 				};
 			}
 		}
+		if (dead > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			dead,
+			reason: "session_dead"
+		};
 		if (cooling > 0) return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "cooling"
 		};
 		if (disabled > 0) return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "disabled"
 		};
 		return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "none"
 		};
 	}
@@ -3026,31 +3076,28 @@ var WorkBuddyAccountPool = class {
 	*/
 	async acquire(modelId, region, conversationKey) {
 		if (this.accounts.length === 0) await this.scan();
-		let pool = this.available(Date.now(), modelId, region);
-		if (pool.length === 0) {
-			await this.scan();
-			pool = this.available(Date.now(), modelId, region);
-		}
-		if (pool.length === 0) return void 0;
-		if (this.preferredId !== void 0) {
-			const preferred = pool.find((account) => account.id === this.preferredId);
-			if (preferred !== void 0) {
-				await this.ensureFresh(preferred);
-				return preferred;
+		const maxTries = this.accounts.length + 1;
+		for (let attempt = 0; attempt < maxTries; attempt += 1) {
+			let pool = this.available(Date.now(), modelId, region);
+			if (pool.length === 0 && attempt === 0) {
+				await this.scan();
+				pool = this.available(Date.now(), modelId, region);
 			}
-		}
-		if (this.distribution === "sticky") {
-			const bound = this.affinityAccount(pool, conversationKey);
-			if (bound !== void 0) {
-				await this.ensureFresh(bound);
-				return bound;
+			if (pool.length === 0) return void 0;
+			if (this.preferredId !== void 0) {
+				const preferred = pool.find((account) => account.id === this.preferredId);
+				if (preferred !== void 0 && await this.ensureFresh(preferred)) return preferred;
+			}
+			if (this.distribution === "sticky") {
+				const bound = this.affinityAccount(pool, conversationKey);
+				if (bound !== void 0 && await this.ensureFresh(bound)) return bound;
 			}
+			const account = this.distribution === "round-robin" || this.distribution === "sticky" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : pool[0];
+			if (account === void 0) return void 0;
+			if (!await this.ensureFresh(account)) continue;
+			if (this.distribution === "sticky" && conversationKey !== void 0 && conversationKey !== "") this.bindAffinity(conversationKey, account.id);
+			return account;
 		}
-		const account = this.distribution === "round-robin" || this.distribution === "sticky" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : pool[0];
-		if (account === void 0) return void 0;
-		if (this.distribution === "sticky" && conversationKey !== void 0 && conversationKey !== "") this.bindAffinity(conversationKey, account.id);
-		await this.ensureFresh(account);
-		return account;
 	}
 	/** Pin the account the plugin card should prefer; tokens stay out of settings. */
 	/** How the pool currently spreads requests. Shown on the card. */
@@ -3154,31 +3201,68 @@ var WorkBuddyAccountPool = class {
 		return newest?.id;
 	}
 	/** Best-effort refresh of one account after a session-dead upstream answer. */
-	async refreshAccount(accountId) {
+	async refreshAccount(accountId, options) {
+		const account = this.accounts.find((item) => item.id === accountId);
+		if (account === void 0) return false;
+		return await this.ensureFresh(account, options?.force === true);
+	}
+	/**
+	* Cool a whole account because the upstream REJECTED its sign-in (401/403).
+	*
+	* Called with direct evidence (the request just came back `session_dead`), so
+	* it does not need to guess: without this, the next retry of the SAME request
+	* picks the same account again — its credential file still claims to be valid
+	* — and a request with 8 attempts spends all 8 on one dead account while
+	* healthy accounts are never tried.
+	*/
+	penalizeCredentialDead(accountId) {
 		const account = this.accounts.find((item) => item.id === accountId);
 		if (account === void 0) return;
-		await this.ensureFresh(account);
+		const until = Date.now() + this.credentialDeadCooldownMs;
+		account.credentialDeadUntilMs = Math.max(account.credentialDeadUntilMs ?? 0, until);
+		this.logger?.warn(`dsh-workbuddy-xdpool: ${account.label} sign-in was rejected by the upstream; keeping it out of rotation until ${new Date(until).toISOString()} (sign in again to restore it)`);
+	}
+	/** Put an account back in rotation after its sign-in was proven good again. */
+	clearCredentialDead(accountId) {
+		const account = this.accounts.find((item) => item.id === accountId);
+		if (account === void 0) return;
+		account.credentialDeadUntilMs = 0;
+	}
+	/** Accounts currently kept out of rotation because their sign-in was rejected. */
+	deadCredentials() {
+		const now = Date.now();
+		return this.accounts.filter((account) => (account.credentialDeadUntilMs ?? 0) > now);
 	}
 	/**
 	* Refresh the account's access token when it is within the margin (or already
 	* expired), in-flight de-duped per account. A failed refresh keeps the
 	* existing token when it has not yet expired, so an unreachable refresh
 	* endpoint never takes down a working session.
+	*
+	* `force` skips the "is it expiring?" gate. That gate is a cost optimisation,
+	* not a correctness rule: it exists so a healthy token is not re-fetched on
+	* every acquire. After the upstream has ALREADY rejected the token, the gate
+	* is actively wrong — a revoked token keeps its future `expiresAtMs` — and the
+	* caller needs the refresh attempted so the credential can be proven dead.
+	*
+	* Returns true when the token is known good afterwards (refreshed, or still
+	* valid), false when the credential was proven dead.
 	*/
-	async ensureFresh(account) {
-		if (this.client === void 0) return;
+	async ensureFresh(account, force = false) {
+		if (this.client === void 0) return true;
 		const credential = account.credential;
-		if (!(credential.expiresAtMs <= 0 || credential.expiresAtMs <= Date.now() + this.refreshMarginMs)) return;
+		if (!(credential.expiresAtMs <= 0 || credential.expiresAtMs <= Date.now() + this.refreshMarginMs) && !force) return true;
 		const existing = this.refreshInflight.get(account.id);
 		if (existing !== void 0) {
 			await existing;
-			return;
+			return (account.credentialDeadUntilMs ?? 0) <= Date.now();
 		}
 		const run = (async () => {
 			if (credential.refreshToken === "") {
-				if (credential.expiresAtMs > Date.now() + 3e4) return;
+				if (credential.expiresAtMs > Date.now() + 3e4) return true;
 				this.logger?.warn(`dsh-workbuddy-xdpool: ${account.label} token expired with no refresh token; sign in again`);
-				return;
+				this.penalizeCredentialDead(account.id);
+				return false;
 			}
 			try {
 				const outcome = await this.client.refreshToken(credential);
@@ -3189,15 +3273,23 @@ var WorkBuddyAccountPool = class {
 					expiresAtMs: outcome.expiresInSec !== void 0 ? Date.now() + outcome.expiresInSec * 1e3 : credential.expiresAtMs,
 					...outcome.domain === void 0 || outcome.domain === "" ? {} : { domain: outcome.domain }
 				};
+				this.clearCredentialDead(account.id);
 				this.logger?.info?.(`dsh-workbuddy-xdpool: refreshed token for ${account.label}`);
+				return true;
 			} catch (error) {
+				if (isCredentialDeadError(error)) {
+					this.penalizeCredentialDead(account.id);
+					this.logger?.warn?.(`dsh-workbuddy-xdpool: ${account.label} refresh token was revoked upstream; sign in again to restore it`, error);
+					return false;
+				}
 				if (credential.expiresAtMs > Date.now() + 3e4) this.logger?.warn?.(`dsh-workbuddy-xdpool: token refresh failed but token still valid for ${account.label}`, error);
 				else this.logger?.error?.(`dsh-workbuddy-xdpool: token refresh failed and token expired for ${account.label}`, error);
+				return true;
 			}
 		})();
 		this.refreshInflight.set(account.id, run);
 		try {
-			await run;
+			return await run;
 		} finally {
 			this.refreshInflight.delete(account.id);
 		}
@@ -3246,6 +3338,7 @@ ${new Date(until).toISOString()}
 			account.cooldownUntilMs = 0;
 			account.modelCooldowns = {};
 			account.rateLimitHits = 0;
+			account.credentialDeadUntilMs = 0;
 		}
 	}
 	/** Diagnostics snapshot. Account-wide cooling count (per-model cooling excluded:
@@ -3255,6 +3348,7 @@ ${new Date(until).toISOString()}
 		return {
 			count: this.accounts.length,
 			cooling: this.accounts.filter((account) => account.cooldownUntilMs > now).length,
+			dead: this.accounts.filter((account) => (account.credentialDeadUntilMs ?? 0) > now).length,
 			lastScanAtMs: this.lastScanAtMs
 		};
 	}

package/lib/client.js

@@ -249,9 +249,17 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-account-tag{padding:1px 8px;border-radius:999px;font-size:11px;line-height:18px;background:var(--dsw-alias-state-success-subtle,rgba(34,160,107,.12));color:var(--dsw-alias-state-success-primary,#22a06b)}
 .dsm-workbuddy-xdpool-account-tag-cooling{background:var(--dsw-alias-state-warning-subtle,rgba(217,119,6,.15));color:var(--dsw-alias-state-warning-primary,#d97706)}
 .dsm-workbuddy-xdpool-account-tag-error{background:var(--dsw-alias-state-error-subtle,rgba(239,68,68,.12));color:var(--dsw-alias-state-error-primary,#ef4444)}
+/* A rejected sign-in is red, not amber: unlike a cooldown it will not clear by
+   waiting, and it is the one state where the user has to go do something. */
+.dsm-workbuddy-xdpool-account-tag-dead{background:var(--dsw-alias-state-error-subtle,rgba(239,68,68,.12));color:var(--dsw-alias-state-error-primary,#ef4444)}
 .dsm-workbuddy-xdpool-account-meta{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:12px;line-height:18px;display:flex;flex-wrap:wrap;gap:10px}
+.dsm-workbuddy-xdpool-account-meta-dead{color:var(--dsw-alias-state-error-primary,#ef4444)}
 .dsm-workbuddy-xdpool-account-modelcool{display:flex;flex-wrap:wrap;gap:6px;margin-top:2px}
 .dsm-workbuddy-xdpool-account-modelcool-chip{display:inline-flex;align-items:center;gap:4px;padding:1px 8px;border-radius:999px;font-size:11px;line-height:18px;background:var(--dsw-alias-state-warning-subtle,rgba(217,119,6,.12));color:var(--dsw-alias-state-warning-primary,#d97706)}
+/* "→ deepseek-v4.1-flash-sg (0.03x) still works" inside a cooling chip. Keeps
+   the warning tint of its parent but drops the weight: it is the way out, not
+   a second problem. */
+.dsm-workbuddy-xdpool-account-modelcool-twin{color:var(--dsw-alias-label-secondary,#c6c9d0);cursor:help}
 .dsm-workbuddy-xdpool-account-error{margin:0;color:var(--dsw-alias-state-error-primary,#ef4444);font-size:13px;line-height:20px}
 
 /* Two-column stats: packages on the left, total + check-in on the right. */
@@ -260,6 +268,9 @@ window.__ModuleLoader__.load({
 .dsm-workbuddy-xdpool-panel-title{color:var(--dsw-alias-label-tertiary,#999);font-size:11px;line-height:16px;letter-spacing:.03em;text-transform:uppercase;font-weight:600}
 .dsm-workbuddy-xdpool-panel-empty{color:var(--dsw-alias-label-tertiary,#999);font-size:14px;line-height:20px}
 .dsm-workbuddy-xdpool-panel-error{color:var(--dsw-alias-state-error-primary,#ef4444);font-size:12px;line-height:18px;word-break:break-word}
+/* A rejected sign-in gets a compact chip: the upstream paragraph is long, and
+   printed inline it pushed the neighbouring "Total" panel off screen. */
+.dsm-workbuddy-xdpool-panel-error-dead{display:inline-flex;align-items:center;align-self:flex-start;padding:1px 8px;border-radius:999px;background:var(--dsw-alias-state-error-subtle,rgba(239,68,68,.12));font-size:11px;line-height:18px;white-space:nowrap;cursor:help}
 .dsm-workbuddy-xdpool-panel-foot{display:flex;align-items:baseline;justify-content:space-between;gap:10px;margin-top:9px;padding-top:9px;border-top:1px solid var(--dsw-alias-border-l2,#36373b);color:var(--dsw-alias-label-secondary,#c6c9d0);font-size:12px;line-height:18px}
 .dsm-workbuddy-xdpool-panel-foot strong{color:var(--dsw-alias-label-primary,#e6e6e6);font-size:15px;font-variant-numeric:tabular-nums}
 .dsm-workbuddy-xdpool-packages{display:flex;flex-direction:column;gap:5px;margin:0;padding:0;list-style:none}
@@ -300,6 +311,10 @@ window.__ModuleLoader__.load({
 /* "活动至 10-31": the campaign's end date. Muted — it is context for planning,
    not a claim about the current price. */
 .dsm-workbuddy-xdpool-model-meta-promo{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:11px;line-height:16px;opacity:.85}
+/* "付费同款 deepseek-v4.1-flash-sg (0.03x)": the way out when the free row is
+   rate-limited. Muted like the other meta chips — it is an alternative, not a
+   warning, and the row it sits on is still the free one. */
+.dsm-workbuddy-xdpool-model-meta-twin{color:var(--dsw-alias-label-tertiary,#9aa0a8);font-size:11px;line-height:16px;opacity:.85;cursor:help}
 /* Unreadable credential files: a warning tint, since it explains a smaller pool
    and "encrypted" is actionable (start the app once). */
 .dsm-workbuddy-xdpool-skipped{margin:6px 0 0;padding:7px 10px;border-radius:8px;background:var(--dsw-alias-state-warning-subtle,rgba(217,119,6,.12));display:flex;flex-direction:column;gap:3px}
@@ -503,6 +518,43 @@ window.__ModuleLoader__.load({
 			return status?.kind === "free" || status?.kind === "night";
 		}
 		//#endregion
+		//#region src/siblings.ts
+		/**
+		* The cheapest PAID model sharing `model`'s display name, or undefined.
+		*
+		* Cheapest rather than first, because the point of the hint is "there is a
+		* cheap way out": offering the most expensive twin would make switching look
+		* like a trap. A sibling whose price is unknown is skipped — an unpriced row
+		* cannot be promised as "the paid one".
+		*/
+		function paidSiblingOf(model, models) {
+			let best;
+			for (const candidate of models) {
+				if (candidate.id === model.id) continue;
+				if (candidate.name !== model.name) continue;
+				const multiplier = candidate.multiplier;
+				if (multiplier === void 0 || multiplier <= 0) continue;
+				if (best === void 0 || multiplier < best.multiplier) best = {
+					id: candidate.id,
+					name: candidate.name,
+					multiplier
+				};
+			}
+			return best;
+		}
+		/**
+		* The paid sibling of a model, but ONLY when the model itself is free.
+		*
+		* The guard is the whole point: a `x0.79` row with a `x0.06` cousin is not a
+		* "free model with a paid twin", it is just a more expensive row, and labelling
+		* it would be noise on most of the list. The hint answers one question — "the
+		* free one is limited, what now".
+		*/
+		function paidAlternativeFor(model, models) {
+			if (model.multiplier !== 0) return void 0;
+			return paidSiblingOf(model, models);
+		}
+		//#endregion
 		//#region src/client/PoolCard.tsx
 		/**
 		* WorkBuddy XD Pool card contributed to DSH Plugin configuration.
@@ -1610,6 +1662,7 @@ window.__ModuleLoader__.load({
 							})(),
 							status?.accounts.map((account) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(AccountBlock, {
 								account,
+								models: status?.models ?? [],
 								...checkinBusyId === void 0 ? {} : { checkinBusyId },
 								onClaimCheckin: (accountId) => {
 									claimCheckin(accountId);
@@ -1716,6 +1769,7 @@ window.__ModuleLoader__.load({
 							children: [...status?.models ?? []].sort((a, b) => Number(isFreeNow(b, now, activeRegion)) - Number(isFreeNow(a, now, activeRegion))).map((model) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelRow, {
 								model,
 								region: activeRegion,
+								paidTwin: paidAlternativeFor(model, status?.models ?? []),
 								t,
 								draft: modelDraft[model.id] ?? {
 									enabled: model.enabled,
@@ -1732,12 +1786,16 @@ window.__ModuleLoader__.load({
 			});
 		}
 		/** One account block: label + status tag + meta + optional credit panels. */
-		function AccountBlock({ account, t, checkinBusyId, onClaimCheckin, accountBusyId, onToggleDisabled, onIgnoreAccount, onSaveCreditReserve, reserveBusyId }) {
+		function AccountBlock({ account, models, t, checkinBusyId, onClaimCheckin, accountBusyId, onToggleDisabled, onIgnoreAccount, onSaveCreditReserve, reserveBusyId }) {
 			const isDisabled = account.disabled === true;
 			const isCooling = account.cooling === true;
+			const isDead = account.credentialDead === true;
 			const cooldownUntil = account.cooldownUntil !== void 0 ? Date.parse(account.cooldownUntil) : void 0;
 			const modelCooldowns = account.modelCooldowns ?? [];
-			const tag = isCooling ? {
+			const tag = isDead ? {
+				text: t?.("row.credentialDeadTag") ?? "Sign-in rejected",
+				cls: "dsm-workbuddy-xdpool-account-tag dsm-workbuddy-xdpool-account-tag-dead"
+			} : isCooling ? {
 				text: t?.("row.cooling") ?? "Cooling",
 				cls: "dsm-workbuddy-xdpool-account-tag dsm-workbuddy-xdpool-account-tag-cooling"
 			} : null;
@@ -1795,15 +1853,30 @@ window.__ModuleLoader__.load({
 										t?.("row.cooldownHits", { hits: account.rateLimitHits ?? 0 }) ?? `${account.rateLimitHits ?? 0} hit(s)`
 									]
 								}) : null,
+								isDead ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "dsm-workbuddy-xdpool-account-meta dsm-workbuddy-xdpool-account-meta-dead",
+									children: t?.("row.credentialDeadHint") ?? "Sign in again in the WorkBuddy desktop app to restore it"
+								}) : null,
 								modelCooldowns.length > 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
 									className: "dsm-workbuddy-xdpool-account-modelcool",
-									children: modelCooldowns.map((mc) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										className: "dsm-workbuddy-xdpool-account-modelcool-chip",
-										children: t?.("row.modelCooling", {
-											model: mc.modelId,
-											time: formatDateTime(mc.until)
-										}) ?? `${mc.modelId} cooling to ${formatDateTime(mc.until)}`
-									}, mc.modelId))
+									children: modelCooldowns.map((mc) => {
+										const coolingModel = models.find((model) => model.id === mc.modelId);
+										const twin = coolingModel === void 0 ? void 0 : paidAlternativeFor(coolingModel, models);
+										return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
+											className: "dsm-workbuddy-xdpool-account-modelcool-chip",
+											children: [t?.("row.modelCooling", {
+												model: mc.modelId,
+												time: formatDateTime(mc.until)
+											}) ?? `${mc.modelId} cooling to ${formatDateTime(mc.until)}`, twin === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+												className: "dsm-workbuddy-xdpool-account-modelcool-twin",
+												title: t?.("row.paidTwinHint") ?? "Same model, paid row",
+												children: t?.("row.rateLimitedPaidTwin", {
+													id: twin.id,
+													rate: twin.multiplier.toFixed(2)
+												}) ?? `→ ${twin.id} (${twin.multiplier.toFixed(2)}x) still works`
+											})]
+										}, mc.modelId);
+									})
 								}) : null
 							]
 						}),
@@ -1976,8 +2049,9 @@ window.__ModuleLoader__.load({
 							children: t?.("row.creditsPackages") ?? "Credit packages"
 						}),
 						account.creditsError !== void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-							className: "dsm-workbuddy-xdpool-panel-error",
-							children: account.creditsError
+							className: `dsm-workbuddy-xdpool-panel-error${account.credentialDead === true ? " dsm-workbuddy-xdpool-panel-error-dead" : ""}`,
+							title: account.creditsError,
+							children: account.credentialDead === true ? t?.("row.credentialDead") ?? "Sign-in rejected" : t?.("row.creditsError") ?? "credits unavailable"
 						}) : packages.length === 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: "dsm-workbuddy-xdpool-panel-empty",
 							children: "–"
@@ -2069,7 +2143,7 @@ window.__ModuleLoader__.load({
 		* context radios stay disabled rather than pretending an edit took hold. The
 		* draft lives in the parent, so this component only ever reports intent.
 		*/
-		function ModelRow({ model, region, t, draft, editable, onToggle, onToggleImage, onBudget }) {
+		function ModelRow({ model, region, paidTwin, t, draft, editable, onToggle, onToggleImage, onBudget }) {
 			const now = /* @__PURE__ */ new Date();
 			const tag = tagFor(model, now, region);
 			const promo = promoStatusFor(model, now, region);
@@ -2168,6 +2242,14 @@ window.__ModuleLoader__.load({
 							className: "dsm-workbuddy-xdpool-model-meta-promo",
 							children: promoUntil
 						}),
+						paidTwin === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+							className: "dsm-workbuddy-xdpool-model-meta-twin",
+							title: t?.("row.paidTwinHint") ?? "Same model, paid row",
+							children: t?.("row.paidTwin", {
+								id: paidTwin.id,
+								rate: paidTwin.multiplier.toFixed(2)
+							}) ?? `paid twin ${paidTwin.id} (${paidTwin.multiplier.toFixed(2)}x)`
+						}),
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: "dsm-workbuddy-xdpool-model-cap",
 							children: t?.("row.modelOutput", { size: formatCapacity(model.maxOutputTokens) }) ?? `out ${formatCapacity(model.maxOutputTokens)}`
@@ -2282,6 +2364,9 @@ window.__ModuleLoader__.load({
 			"row.creditsPackages": "Credit packages",
 			"row.creditsPackage": "{remain} / {size}",
 			"row.creditsError": "credits unavailable",
+			"row.credentialDead": "Sign-in rejected",
+			"row.credentialDeadTag": "Sign-in rejected",
+			"row.credentialDeadHint": "The upstream no longer accepts this sign-in. Sign in again in the WorkBuddy desktop app to restore it.",
 			"row.creditsSoon": "Expiring in 3 days",
 			"row.creditsExpiresAt": "Expires {time}",
 			"row.creditsExpiresSoonTitle": "Expiring within 3 days",
@@ -2326,6 +2411,9 @@ window.__ModuleLoader__.load({
 			"row.nightFreeNow": "free until {time}",
 			"row.nightFreeLater": "free from {time}",
 			"row.promoUntil": "promo to {date}",
+			"row.paidTwin": "paid twin {id} ({rate}x)",
+			"row.paidTwinHint": "The free tier is rate-limited first; this same model has a paid row that keeps working",
+			"row.rateLimitedPaidTwin": "Tip: {id} is the same model on a paid row ({rate}x credits) and is limited separately — switch to it to keep going",
 			"row.skippedFiles": "{count} credential file(s) could not be read",
 			"row.skippedEncrypted": "encrypted — start WorkBuddy once so its key can be read",
 			"row.skippedUnreadable": "file could not be read",
@@ -2437,6 +2525,9 @@ window.__ModuleLoader__.load({
 			"row.creditsPackages": "积分包",
 			"row.creditsPackage": "{remain} / {size}",
 			"row.creditsError": "积分不可用",
+			"row.credentialDead": "登录已被拒绝",
+			"row.credentialDeadTag": "登录已被拒绝",
+			"row.credentialDeadHint": "上游已不再接受这个登录状态。请在 WorkBuddy 桌面端重新登录该账号以恢复。",
 			"row.creditsSoon": "3 天内到期",
 			"row.creditsExpiresAt": "到期 {time}",
 			"row.creditsExpiresSoonTitle": "3 天内到期",
@@ -2481,6 +2572,9 @@ window.__ModuleLoader__.load({
 			"row.nightFreeNow": "免费至 {time}",
 			"row.nightFreeLater": "{time} 起免费",
 			"row.promoUntil": "活动至 {date}",
+			"row.paidTwin": "付费同款 {id}（{rate}x）",
+			"row.paidTwinHint": "免费档先被限流；同一个模型的付费行不受这个限制影响",
+			"row.rateLimitedPaidTwin": "提示：{id} 是同一个模型的付费行（{rate}x 积分），限流是分开算的 —— 切过去就能继续用",
 			"row.skippedFiles": "有 {count} 个凭据文件读不出来",
 			"row.skippedEncrypted": "已加密 —— 启动一次 WorkBuddy 才能取到密钥",
 			"row.skippedUnreadable": "文件读不出来",

package/lib/index.d.ts

@@ -810,6 +810,20 @@ interface WorkBuddyAccount {
   modelCooldowns: Record<string, number>;
   /** Consecutive rate-limit hits, for diagnostics. */
   rateLimitHits: number;
+  /**
+   * Epoch ms until which this account is skipped because the upstream REJECTED
+   * its sign-in (401/403), not because of a rate limit.
+   *
+   * A revoked session is invisible from the credential file: the upstream does
+   * not rewrite `expiresAtMs` when it kills a refresh token, so a dead account
+   * looks perfectly fresh and, without this field, gets picked again on the very
+   * next attempt. With `maxAttempts` retries that meant one dead account could
+   * absorb an entire request while healthy accounts were never tried.
+   *
+   * Only a fresh sign-in in the desktop app clears it, so the cooldown is long;
+   * `0`/undefined means "not known to be dead".
+   */
+  credentialDeadUntilMs?: number;
 }
 /**
  * Platform-default directories holding the desktop app's auth files.
@@ -845,6 +859,11 @@ interface AccountPoolOptions {
   cooldownMs?: number;
   /** How long an account rests after its credits run out (default 30 minutes). */
   exhaustCooldownMs?: number;
+  /**
+   * How long an account rests after the upstream rejects its sign-in
+   * (default 30 minutes). Only a fresh sign-in in the desktop app clears it.
+   */
+  credentialDeadCooldownMs?: number;
   /** Upstream client used to refresh near-expiry tokens. */
   client?: TokenRefresher;
   /** Refresh this long before actual expiry; default five minutes. */
@@ -874,6 +893,11 @@ export declare class WorkBuddyAccountPool {
    * rate-limit window, so this is much longer than `cooldownMs`.
    */
   private exhaustCooldownMs;
+  /**
+   * How long an account stays out of rotation after the upstream rejected its
+   * sign-in. Cleared by a newer credential file or an explicit sign-in.
+   */
+  private credentialDeadCooldownMs;
   private readonly client;
   private readonly refreshMarginMs;
   private accounts;
@@ -1018,7 +1042,9 @@ export declare class WorkBuddyAccountPool {
     total: number;
     cooling: number;
     disabled: number;
-    reason: 'empty' | 'cooling' | 'disabled' | 'reserve' | 'none';
+    /** Accounts skipped because the upstream rejected their sign-in. */
+    dead: number;
+    reason: 'empty' | 'cooling' | 'disabled' | 'reserve' | 'session_dead' | 'none';
   };
   /** Round-robin: the legacy cursor walk, kept for the distribution that asks for it. */
   private pickRoundRobin;
@@ -1135,12 +1161,37 @@ export declare class WorkBuddyAccountPool {
    */
   lastServedId(): string | undefined;
   /** Best-effort refresh of one account after a session-dead upstream answer. */
-  refreshAccount(accountId: string): Promise<void>;
+  refreshAccount(accountId: string, options?: {
+    force?: boolean;
+  }): Promise<boolean>;
+  /**
+   * Cool a whole account because the upstream REJECTED its sign-in (401/403).
+   *
+   * Called with direct evidence (the request just came back `session_dead`), so
+   * it does not need to guess: without this, the next retry of the SAME request
+   * picks the same account again — its credential file still claims to be valid
+   * — and a request with 8 attempts spends all 8 on one dead account while
+   * healthy accounts are never tried.
+   */
+  penalizeCredentialDead(accountId: string): void;
+  /** Put an account back in rotation after its sign-in was proven good again. */
+  clearCredentialDead(accountId: string): void;
+  /** Accounts currently kept out of rotation because their sign-in was rejected. */
+  deadCredentials(): readonly WorkBuddyAccount[];
   /**
    * Refresh the account's access token when it is within the margin (or already
    * expired), in-flight de-duped per account. A failed refresh keeps the
    * existing token when it has not yet expired, so an unreachable refresh
    * endpoint never takes down a working session.
+   *
+   * `force` skips the "is it expiring?" gate. That gate is a cost optimisation,
+   * not a correctness rule: it exists so a healthy token is not re-fetched on
+   * every acquire. After the upstream has ALREADY rejected the token, the gate
+   * is actively wrong — a revoked token keeps its future `expiresAtMs` — and the
+   * caller needs the refresh attempted so the credential can be proven dead.
+   *
+   * Returns true when the token is known good afterwards (refreshed, or still
+   * valid), false when the credential was proven dead.
    */
   private ensureFresh;
   /**
@@ -1168,6 +1219,7 @@ export declare class WorkBuddyAccountPool {
   status(): {
     count: number;
     cooling: number;
+    dead: number;
     lastScanAtMs: number;
   };
 }
@@ -1218,6 +1270,15 @@ interface PoolWebAccount {
   cooling: boolean;
   /** ISO timestamp when the account-wide 429 cooldown lifts; only while cooling. */
   cooldownUntil?: string;
+  /**
+   * The upstream REJECTED this account's sign-in (401/403) — the credential file
+   * still looks valid because the upstream never rewrites its expiry when it
+   * revokes a token. Distinct from `cooling`: waiting does not fix it, only
+   * signing in again in the desktop app does.
+   */
+  credentialDead?: boolean;
+  /** ISO timestamp when the dead mark expires and the account is retried; only while `credentialDead`. */
+  credentialDeadUntil?: string;
   /**
    * Per-model cooldowns currently active. The account is NOT `cooling` while a
    * model is limited — its other models still serve — but each entry tells the

package/lib/index.js

@@ -2752,6 +2752,28 @@ function idleWeight(lastUsedAt, now) {
 }
 /** Default rest for an account whose credits ran out (packs reset on their own schedule). */
 const EXHAUST_COOLDOWN_MS = 18e5;
+/**
+* Default rest for an account the upstream rejected the sign-in of (401/403).
+*
+* Unlike a rate limit there is no reset time to read: only signing in again in
+* the desktop app revives the account. The rest is therefore long enough that a
+* single request never burns its whole retry budget on the same dead credential,
+* but short enough that a user who just signed in is not locked out of their own
+* account for long — and a newer credential file clears the mark outright.
+*/
+const CREDENTIAL_DEAD_COOLDOWN_MS = 18e5;
+/**
+* Does this refresh failure prove the credential itself is dead?
+*
+* The upstream answers a revoked refresh token with `invalid_grant: Offline user
+* session not found` (HTTP 400/401). Network failures, DNS errors and 5xx do NOT
+* prove anything about the credential and must not mark it dead — that would
+* take a working account out of rotation for half an hour over a hiccup.
+*/
+function isCredentialDeadError(error) {
+	const message = error instanceof Error ? error.message : String(error);
+	return message.includes("invalid_grant") || message.includes("Offline user session not found") || message.includes("session_dead");
+}
 var WorkBuddyAccountPool = class {
 	logger;
 	authDirs;
@@ -2762,6 +2784,11 @@ var WorkBuddyAccountPool = class {
 	* rate-limit window, so this is much longer than `cooldownMs`.
 	*/
 	exhaustCooldownMs;
+	/**
+	* How long an account stays out of rotation after the upstream rejected its
+	* sign-in. Cleared by a newer credential file or an explicit sign-in.
+	*/
+	credentialDeadCooldownMs;
 	client;
 	refreshMarginMs;
 	accounts = [];
@@ -2844,6 +2871,7 @@ var WorkBuddyAccountPool = class {
 		this.authDirs = options.authDirs ?? candidateAuthDirs();
 		this.cooldownMs = options.cooldownMs ?? 6e4;
 		this.exhaustCooldownMs = options.exhaustCooldownMs ?? EXHAUST_COOLDOWN_MS;
+		this.credentialDeadCooldownMs = options.credentialDeadCooldownMs ?? CREDENTIAL_DEAD_COOLDOWN_MS;
 		this.client = options.client;
 		this.refreshMarginMs = options.refreshMarginMs ?? 3e5;
 		this.distribution = options.distribution ?? "priority";
@@ -2930,11 +2958,15 @@ var WorkBuddyAccountPool = class {
 				});
 				continue;
 			}
-			if (isFresher(credential, existing.credential)) byId.set(id, {
-				...existing,
-				credential,
-				label: accountLabel(credential)
-			});
+			if (isFresher(credential, existing.credential)) {
+				const signedInAgain = credential.refreshToken !== existing.credential.refreshToken || credential.accessToken !== existing.credential.accessToken;
+				byId.set(id, {
+					...existing,
+					credential,
+					label: accountLabel(credential),
+					...signedInAgain ? { credentialDeadUntilMs: 0 } : {}
+				});
+			}
 		}
 		const ordered = [...byId.values()];
 		ordered.sort((a, b) => compareFreshness(a.credential, b.credential));
@@ -2965,6 +2997,7 @@ var WorkBuddyAccountPool = class {
 				if (balance !== void 0 && balance <= reserve) return false;
 			}
 			if (account.cooldownUntilMs > now) return false;
+			if ((account.credentialDeadUntilMs ?? 0) > now) return false;
 			if (modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now) return false;
 			if (region !== void 0 && regionOf(account.credential.domain) !== region) return false;
 			return true;
@@ -2990,15 +3023,21 @@ var WorkBuddyAccountPool = class {
 			total: 0,
 			cooling: 0,
 			disabled: 0,
+			dead: 0,
 			reason: "empty"
 		};
 		let cooling = 0;
 		let disabled = 0;
+		let dead = 0;
 		for (const account of inRegion) {
 			if (this.disabledIds.has(account.id)) {
 				disabled += 1;
 				continue;
 			}
+			if ((account.credentialDeadUntilMs ?? 0) > now) {
+				dead += 1;
+				continue;
+			}
 			const modelCooling = modelId !== void 0 && (account.modelCooldowns[modelId] ?? 0) > now;
 			if (account.cooldownUntilMs > now || modelCooling) {
 				cooling += 1;
@@ -3011,26 +3050,37 @@ var WorkBuddyAccountPool = class {
 					total: inRegion.length,
 					cooling,
 					disabled,
+					dead,
 					reason: "reserve"
 				};
 			}
 		}
+		if (dead > 0) return {
+			total: inRegion.length,
+			cooling,
+			disabled,
+			dead,
+			reason: "session_dead"
+		};
 		if (cooling > 0) return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "cooling"
 		};
 		if (disabled > 0) return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "disabled"
 		};
 		return {
 			total: inRegion.length,
 			cooling,
 			disabled,
+			dead,
 			reason: "none"
 		};
 	}
@@ -3134,31 +3184,28 @@ var WorkBuddyAccountPool = class {
 	*/
 	async acquire(modelId, region, conversationKey) {
 		if (this.accounts.length === 0) await this.scan();
-		let pool = this.available(Date.now(), modelId, region);
-		if (pool.length === 0) {
-			await this.scan();
-			pool = this.available(Date.now(), modelId, region);
-		}
-		if (pool.length === 0) return void 0;
-		if (this.preferredId !== void 0) {
-			const preferred = pool.find((account) => account.id === this.preferredId);
-			if (preferred !== void 0) {
-				await this.ensureFresh(preferred);
-				return preferred;
+		const maxTries = this.accounts.length + 1;
+		for (let attempt = 0; attempt < maxTries; attempt += 1) {
+			let pool = this.available(Date.now(), modelId, region);
+			if (pool.length === 0 && attempt === 0) {
+				await this.scan();
+				pool = this.available(Date.now(), modelId, region);
 			}
-		}
-		if (this.distribution === "sticky") {
-			const bound = this.affinityAccount(pool, conversationKey);
-			if (bound !== void 0) {
-				await this.ensureFresh(bound);
-				return bound;
+			if (pool.length === 0) return void 0;
+			if (this.preferredId !== void 0) {
+				const preferred = pool.find((account) => account.id === this.preferredId);
+				if (preferred !== void 0 && await this.ensureFresh(preferred)) return preferred;
 			}
+			if (this.distribution === "sticky") {
+				const bound = this.affinityAccount(pool, conversationKey);
+				if (bound !== void 0 && await this.ensureFresh(bound)) return bound;
+			}
+			const account = this.distribution === "round-robin" || this.distribution === "sticky" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : pool[0];
+			if (account === void 0) return void 0;
+			if (!await this.ensureFresh(account)) continue;
+			if (this.distribution === "sticky" && conversationKey !== void 0 && conversationKey !== "") this.bindAffinity(conversationKey, account.id);
+			return account;
 		}
-		const account = this.distribution === "round-robin" || this.distribution === "sticky" ? this.pickRoundRobin(pool) : this.distribution === "balanced" ? this.pickByWeight(pool) : pool[0];
-		if (account === void 0) return void 0;
-		if (this.distribution === "sticky" && conversationKey !== void 0 && conversationKey !== "") this.bindAffinity(conversationKey, account.id);
-		await this.ensureFresh(account);
-		return account;
 	}
 	/** Pin the account the plugin card should prefer; tokens stay out of settings. */
 	/** How the pool currently spreads requests. Shown on the card. */
@@ -3262,31 +3309,68 @@ var WorkBuddyAccountPool = class {
 		return newest?.id;
 	}
 	/** Best-effort refresh of one account after a session-dead upstream answer. */
-	async refreshAccount(accountId) {
+	async refreshAccount(accountId, options) {
+		const account = this.accounts.find((item) => item.id === accountId);
+		if (account === void 0) return false;
+		return await this.ensureFresh(account, options?.force === true);
+	}
+	/**
+	* Cool a whole account because the upstream REJECTED its sign-in (401/403).
+	*
+	* Called with direct evidence (the request just came back `session_dead`), so
+	* it does not need to guess: without this, the next retry of the SAME request
+	* picks the same account again — its credential file still claims to be valid
+	* — and a request with 8 attempts spends all 8 on one dead account while
+	* healthy accounts are never tried.
+	*/
+	penalizeCredentialDead(accountId) {
+		const account = this.accounts.find((item) => item.id === accountId);
+		if (account === void 0) return;
+		const until = Date.now() + this.credentialDeadCooldownMs;
+		account.credentialDeadUntilMs = Math.max(account.credentialDeadUntilMs ?? 0, until);
+		this.logger?.warn(`dsh-workbuddy-xdpool: ${account.label} sign-in was rejected by the upstream; keeping it out of rotation until ${new Date(until).toISOString()} (sign in again to restore it)`);
+	}
+	/** Put an account back in rotation after its sign-in was proven good again. */
+	clearCredentialDead(accountId) {
 		const account = this.accounts.find((item) => item.id === accountId);
 		if (account === void 0) return;
-		await this.ensureFresh(account);
+		account.credentialDeadUntilMs = 0;
+	}
+	/** Accounts currently kept out of rotation because their sign-in was rejected. */
+	deadCredentials() {
+		const now = Date.now();
+		return this.accounts.filter((account) => (account.credentialDeadUntilMs ?? 0) > now);
 	}
 	/**
 	* Refresh the account's access token when it is within the margin (or already
 	* expired), in-flight de-duped per account. A failed refresh keeps the
 	* existing token when it has not yet expired, so an unreachable refresh
 	* endpoint never takes down a working session.
+	*
+	* `force` skips the "is it expiring?" gate. That gate is a cost optimisation,
+	* not a correctness rule: it exists so a healthy token is not re-fetched on
+	* every acquire. After the upstream has ALREADY rejected the token, the gate
+	* is actively wrong — a revoked token keeps its future `expiresAtMs` — and the
+	* caller needs the refresh attempted so the credential can be proven dead.
+	*
+	* Returns true when the token is known good afterwards (refreshed, or still
+	* valid), false when the credential was proven dead.
 	*/
-	async ensureFresh(account) {
-		if (this.client === void 0) return;
+	async ensureFresh(account, force = false) {
+		if (this.client === void 0) return true;
 		const credential = account.credential;
-		if (!(credential.expiresAtMs <= 0 || credential.expiresAtMs <= Date.now() + this.refreshMarginMs)) return;
+		if (!(credential.expiresAtMs <= 0 || credential.expiresAtMs <= Date.now() + this.refreshMarginMs) && !force) return true;
 		const existing = this.refreshInflight.get(account.id);
 		if (existing !== void 0) {
 			await existing;
-			return;
+			return (account.credentialDeadUntilMs ?? 0) <= Date.now();
 		}
 		const run = (async () => {
 			if (credential.refreshToken === "") {
-				if (credential.expiresAtMs > Date.now() + 3e4) return;
+				if (credential.expiresAtMs > Date.now() + 3e4) return true;
 				this.logger?.warn(`dsh-workbuddy-xdpool: ${account.label} token expired with no refresh token; sign in again`);
-				return;
+				this.penalizeCredentialDead(account.id);
+				return false;
 			}
 			try {
 				const outcome = await this.client.refreshToken(credential);
@@ -3297,15 +3381,23 @@ var WorkBuddyAccountPool = class {
 					expiresAtMs: outcome.expiresInSec !== void 0 ? Date.now() + outcome.expiresInSec * 1e3 : credential.expiresAtMs,
 					...outcome.domain === void 0 || outcome.domain === "" ? {} : { domain: outcome.domain }
 				};
+				this.clearCredentialDead(account.id);
 				this.logger?.info?.(`dsh-workbuddy-xdpool: refreshed token for ${account.label}`);
+				return true;
 			} catch (error) {
+				if (isCredentialDeadError(error)) {
+					this.penalizeCredentialDead(account.id);
+					this.logger?.warn?.(`dsh-workbuddy-xdpool: ${account.label} refresh token was revoked upstream; sign in again to restore it`, error);
+					return false;
+				}
 				if (credential.expiresAtMs > Date.now() + 3e4) this.logger?.warn?.(`dsh-workbuddy-xdpool: token refresh failed but token still valid for ${account.label}`, error);
 				else this.logger?.error?.(`dsh-workbuddy-xdpool: token refresh failed and token expired for ${account.label}`, error);
+				return true;
 			}
 		})();
 		this.refreshInflight.set(account.id, run);
 		try {
-			await run;
+			return await run;
 		} finally {
 			this.refreshInflight.delete(account.id);
 		}
@@ -3354,6 +3446,7 @@ ${new Date(until).toISOString()}
 			account.cooldownUntilMs = 0;
 			account.modelCooldowns = {};
 			account.rateLimitHits = 0;
+			account.credentialDeadUntilMs = 0;
 		}
 	}
 	/** Diagnostics snapshot. Account-wide cooling count (per-model cooling excluded:
@@ -3363,6 +3456,7 @@ ${new Date(until).toISOString()}
 		return {
 			count: this.accounts.length,
 			cooling: this.accounts.filter((account) => account.cooldownUntilMs > now).length,
+			dead: this.accounts.filter((account) => (account.credentialDeadUntilMs ?? 0) > now).length,
 			lastScanAtMs: this.lastScanAtMs
 		};
 	}
@@ -5593,6 +5687,43 @@ function injectSummary(compacted, summary) {
 	];
 }
 //#endregion
+//#region src/siblings.ts
+/**
+* The cheapest PAID model sharing `model`'s display name, or undefined.
+*
+* Cheapest rather than first, because the point of the hint is "there is a
+* cheap way out": offering the most expensive twin would make switching look
+* like a trap. A sibling whose price is unknown is skipped — an unpriced row
+* cannot be promised as "the paid one".
+*/
+function paidSiblingOf(model, models) {
+	let best;
+	for (const candidate of models) {
+		if (candidate.id === model.id) continue;
+		if (candidate.name !== model.name) continue;
+		const multiplier = candidate.multiplier;
+		if (multiplier === void 0 || multiplier <= 0) continue;
+		if (best === void 0 || multiplier < best.multiplier) best = {
+			id: candidate.id,
+			name: candidate.name,
+			multiplier
+		};
+	}
+	return best;
+}
+/**
+* The paid sibling of a model, but ONLY when the model itself is free.
+*
+* The guard is the whole point: a `x0.79` row with a `x0.06` cousin is not a
+* "free model with a paid twin", it is just a more expensive row, and labelling
+* it would be noise on most of the list. The hint answers one question — "the
+* free one is limited, what now".
+*/
+function paidAlternativeFor(model, models) {
+	if (model.multiplier !== 0) return void 0;
+	return paidSiblingOf(model, models);
+}
+//#endregion
 //#region src/shim.ts
 /**
 * Loopback OpenAI-compatible endpoint with multi-account failover.
@@ -5778,6 +5909,22 @@ function createWorkBuddyShim(options) {
 	const server = createServer((req, res) => {
 		handle(req, res);
 	});
+	/**
+	* "The same model has a paid row" sentence for a 429 body, or undefined.
+	*
+	* Reads the catalog the shim was built with, so the hint names a row this
+	* gateway ACTUALLY serves — a CN-only id in a global 429 would be worse than
+	* no hint at all. Absent when the cooling model is itself paid, or when the
+	* family has no priced twin.
+	*/
+	function paidTwinHint(modelId) {
+		const models = catalog.current();
+		const model = models.find((candidate) => candidate.id === modelId);
+		if (model === void 0) return void 0;
+		const twin = paidAlternativeFor(model, models);
+		if (twin === void 0) return void 0;
+		return `${twin.id} is the same model on a paid row (x${twin.multiplier.toFixed(2)} credits) and is rate-limited separately; switch to it to keep going`;
+	}
 	const ready = new Promise((resolve, reject) => {
 		server.once("listening", () => resolve());
 		server.once("error", reject);
@@ -5889,7 +6036,8 @@ function createWorkBuddyShim(options) {
 				if (why.reason === "cooling") {
 					const subject = modelId === void 0 ? "every WorkBuddy account is rate-limited" : `every account is rate-limited for model ${modelId}`;
 					const upstream = last === void 0 ? "" : ` — ${last.message.slice(0, 200)}`;
-					writeOpenAIError(res, 429, "soft_rate", `${subject} (${why.cooling}/${why.total} cooling, tried ${tried.length})${tried.length === 0 ? "" : `: ${tried.join(" → ")}`}${upstream}`);
+					const twin = modelId === void 0 ? void 0 : paidTwinHint(modelId);
+					writeOpenAIError(res, 429, "soft_rate", `${subject} (${why.cooling}/${why.total} cooling, tried ${tried.length})${tried.length === 0 ? "" : `: ${tried.join(" → ")}`}${upstream}` + (twin === void 0 ? "" : ` — ${twin}`));
 					return;
 				}
 				if (why.reason === "disabled") {
@@ -5900,6 +6048,10 @@ function createWorkBuddyShim(options) {
 					writeOpenAIError(res, 402, "reserve_floor", `every WorkBuddy account is at or below its credit reserve (${why.total} account(s)); lower the reserve on the pool card or top up credits`);
 					return;
 				}
+				if (why.reason === "session_dead") {
+					writeOpenAIError(res, 401, "session_dead", `${why.dead}/${why.total} WorkBuddy account(s) for this gateway were rejected by the upstream (their sign-in was revoked); sign in again in the WorkBuddy desktop app to restore them`);
+					return;
+				}
 				writeOpenAIError(res, 401, "not_signed_in", why.total === 0 ? "no WorkBuddy credential found for this gateway; sign in on the desktop app (or set WORKBUDDY_AUTH_FILE)" : `no usable WorkBuddy credential among ${why.total} account(s) for this gateway; sign in again on the desktop app`);
 				return;
 			}
@@ -5916,7 +6068,11 @@ function createWorkBuddyShim(options) {
 			};
 			if (result.kind === "session_dead") {
 				logger?.warn(`dsh-workbuddy-xdpool: ${account.label} session dead; refreshing token and retrying`);
-				await pool.refreshAccount(account.id);
+				const before = account.credential.accessToken;
+				if (!await pool.refreshAccount(account.id, { force: true }) || account.credential.accessToken === before) {
+					pool.penalizeCredentialDead(account.id);
+					logger?.warn(`dsh-workbuddy-xdpool: ${account.label} sign-in is no longer valid (attempt ${attempt + 1}/${maxAttempts}); rotating`);
+				}
 				continue;
 			}
 			if (result.kind === "hard_credit") {
@@ -6109,7 +6265,8 @@ async function recoverFromContextOverrun(options) {
 			detail: "prompt still exceeded the window after compaction"
 		};
 		if (result.kind === "session_dead") {
-			await pool.refreshAccount(account.id);
+			const before = account.credential.accessToken;
+			if (!await pool.refreshAccount(account.id, { force: true }) || account.credential.accessToken === before) pool.penalizeCredentialDead(account.id);
 			continue;
 		}
 		if (result.kind === "hard_credit") {
@@ -6401,6 +6558,8 @@ function parseAutomationRun(body) {
 function toWebAccount(account, disabled, reserve, reserved) {
 	const now = Date.now();
 	const cooling = account.cooldownUntilMs > now;
+	const deadUntil = account.credentialDeadUntilMs ?? 0;
+	const credentialDead = deadUntil > now;
 	const modelCooldowns = Object.entries(account.modelCooldowns).filter(([, until]) => until > now).sort((a, b) => a[1] - b[1]).map(([modelId, until]) => ({
 		modelId,
 		until: new Date(until).toISOString()
@@ -6413,6 +6572,8 @@ function toWebAccount(account, disabled, reserve, reserved) {
 		...account.credential.expiresAtMs === 0 ? {} : { expiresAt: new Date(account.credential.expiresAtMs).toISOString() },
 		cooling,
 		...cooling ? { cooldownUntil: new Date(account.cooldownUntilMs).toISOString() } : {},
+		credentialDead,
+		...credentialDead ? { credentialDeadUntil: new Date(deadUntil).toISOString() } : {},
 		...modelCooldowns.length === 0 ? {} : { modelCooldowns },
 		disabled,
 		creditReserve: reserve,
@@ -6452,7 +6613,7 @@ async function poolWebStatus(deps, region = "cn") {
 		const row = toWebAccount(account, deps.pool.isDisabled(account.id), deps.pool.creditReserveOf(account.id), deps.pool.isReserved(account.id));
 		const earned = deps.scheduler?.().earningsToday[account.id];
 		if (earned !== void 0) Object.assign(row, { automationToday: earned });
-		if (!row.cooling) {
+		if (!row.cooling && row.credentialDead !== true) {
 			try {
 				const credits = await deps.client.fetchCredits(account.credential);
 				deps.pool.noteCredits(account.id, credits.total);

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-xdpool",
   "displayName": "DSH WorkBuddy XD Pool",
   "description": "Merge every locally signed-in WorkBuddy account into DeepSeek Harness as one auto-failing-over model pool (multi-account rotation, live credits, daily check-in and model catalog).",
-  "version": "1.8.0",
+  "version": "1.8.2",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-workbuddy-xdpool#readme",