dsh-xdpool 2.5.0 → 2.6.0

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-xdpool",
   "displayName": "DSH XD Pool",
   "description": "One DSH model pool for every free quota you have: merge all locally signed-in WorkBuddy accounts with auto-failover, sign in to 13 vendors by QR/web, aggregate 76 vendors' free tiers, plus a usage dashboard, model routing, a local OpenAI-compatible gateway and a points-automation suite.",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "license": "MIT",
   "author": "XDTrees",
   "homepage": "https://github.com/XDTrees/dsh-xdpool#readme",
@@ -75,9 +75,6 @@
       "platform": "web"
     }
   },
-  "optionalDependencies": {
-    "billion-context": "^0.1.197"
-  },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
     "@deepseek-ai/dsh-client-locale": "0.1.5-rc.2",

package/vendor/channel-pack/pack.js

@@ -29837,6 +29837,82 @@ function createPermanentLockStore(ctx) {
 
 // vendor/channel-pack/src/account-pool.ts
 var EMPTY_MODEL_SET = /* @__PURE__ */ new Set();
+
+// [xdpool-local] laneAllowedIds
+//
+// buddy / workbuddy are exempt from the startup silence pass because
+// dsh-xdpool's own pool card owns their model selection (see
+// POOL_OWNED_PROVIDERS below). The exemption avoided a conflict but not a GAP:
+// `disabledModelsFor("buddy")` is therefore always empty, so every adapter
+// returned its whole catalogue and the card's "1 of 16" had no effect on the
+// host's model picker (#121).
+//
+// This helper is the missing link. It intersects the pack's own blacklist with
+// the allow-list dsh-xdpool publishes on `globalThis.__xdpoolLaneSelection`,
+// keyed by lane id. The global is a handoff, not an API: the pack is a build
+// artifact of another repository and cannot import from the plugin's src/, and
+// threading a value through ten adapter constructors would be rejected by the
+// next pack refresh.
+//
+// Semantics that matter:
+//   - an ABSENT entry (undefined) means "no restriction". A lane the user never
+//     touched must keep showing everything; treating it as "empty allow-list"
+//     would blank the picker.
+//   - an EMPTY array means the user disabled every model, which is a real state
+//     and must be honoured — hence the two are distinguished below rather than
+//     folded with `??`.
+function laneAllowedIds(disabled, laneId, catalogue) {
+  // [xdpool-local] laneAllowedIds returns the DISABLED set.
+  //
+  // The call sites consume the result as a BLACKLIST
+  // (`source.filter(model => !disabled.has(model.id))`), so returning the
+  // allow-list inverted the picker: ticking three of sixteen showed the other
+  // thirteen. Building the complement needs the roster, which is what the third
+  // argument carries.
+  //
+  // It is a THUNK: one adapter declares its roster on the line AFTER this call, so
+  // a value would read it before initialization. The body runs later.
+  const table = globalThis.__xdpoolLaneSelection;
+  const allow = table === void 0 || table === null ? void 0 : table[laneId];
+  if (allow === void 0) return disabled;
+  const blocked = disabled === void 0 ? EMPTY_MODEL_SET : disabled;
+  const allowed = new Set(allow);
+  let rows;
+  try {
+    rows = typeof catalogue === "function" ? catalogue() : catalogue;
+  } catch {
+    // A roster that cannot be read yet leaves the pack's own blacklist in charge
+    // rather than blanking the picker.
+    return disabled;
+  }
+  if (!Array.isArray(rows) || rows.length === 0) return disabled;
+  const out = new Set();
+  for (const row of rows) {
+    const id = row === null || row === void 0 ? void 0 : row.id;
+    if (typeof id !== "string" || id === "") continue;
+    // Disabled when the lane forbids it, or when the pack already did.
+    if (!allowed.has(id) || blocked.has(id)) out.add(id);
+  }
+  // Everything allowed: hand back the pack's own gate, which is what `size === 0`
+  // means to the caller.
+  return out.size === 0 ? disabled : out;
+}
+
+// [xdpool-local] LANE_DISPLAY_NAME
+//
+// The picker's group names for the two lanes this plugin owns, matching
+// `src/channels.ts` exactly. The vendored upstream constants still call the CN
+// lane "CodeBuddy (腾讯)", which is the endpoint's original product name; a user
+// who signed in to WorkBuddy saw that name in the model picker while every card
+// in this plugin called it "WorkBuddy 国内版" (#119).
+//
+// Scoped to `providerInfo` on purpose: `CODEBUDDY.displayName` also feeds the
+// rate-limit copy, and renaming the constant would rewrite messages about a
+// product the user never installed.
+const LANE_DISPLAY_NAME = {
+  buddy: "WorkBuddy 国内版",
+  workbuddy: "WorkBuddy 国际版"
+};
 function allAccountsRateLimitedForModel(accounts, modelId, now = Date.now()) {
   if (modelId.length === 0) return void 0;
   let earliest;
@@ -32792,7 +32868,22 @@ function isQueueError(status, body) {
   return status === 400 && (body.includes("TM.00001041") || /peak\s+usage|try\s+again\s+after|peak\s+hours/i.test(body) || /high\s+demand|too\s+many\s+requests/i.test(body));
 }
 function isAuthError(status, body) {
-  if (status === 401 || status === 403) return true;
+  // [xdpool-local] 403 is not auth for CodeArts.
+  //
+  // Every IAM rejection this gateway produces is measured to be 401 APIG.0301:
+  // bad SK signature, truncated STS token, wrong AK, and a body rewritten after
+  // signing all answer 401. A rejected User-Agent answers 403 TM.00000001, which
+  // is a WAF verdict on a request header and says nothing about the credential.
+  //
+  // 403 can still be about the token (`APIG.0602 security token has expired` is
+  // real), so the body decides. An unrecognised 403 falls through to the non-auth
+  // path, which is the honest answer: the upstream refused without claiming an
+  // auth failure.
+  if (status === 401) return true;
+  if (status === 403) {
+    return body.includes("APIG.0602")
+      || /invalid\s+token|token\s+expired|token\s+is\s+invalid|signature\s+fail|Unauthorized/i.test(body);
+  }
   return body.includes("APIG.0602") || /invalid\s+token|token\s+expired|token\s+is\s+invalid/i.test(body);
 }
 function isSseQueueErrorCode(code) {
@@ -32819,7 +32910,31 @@ function errorDetail(body) {
   return body;
 }
 function httpErrorCode(status, body) {
-  if (status === 401 || status === 403) return "AUTH";
+  // [xdpool-local] benefitNotFound — see tools/patch-pack-error-kinds.mjs
+  //
+  // CodeArts answers `InferHub.4004.200 benefit not found` when the account has
+  // no entitlement for the model. The request carries `maas_type: benefit`
+  // because the model is in CODEARTS_BENEFIT_FALLBACK, i.e. the plugin asked for
+  // a benefit the ACCOUNT does not have — not a bad credential.
+  //
+  // Checked BEFORE the 401/403 → "AUTH" rule because that rule is what turned
+  // this into "API 密钥无效" and sent users to re-authenticate over a permission
+  // they simply do not hold (#118). Left as INVALID_REQUEST: terminal, not auth,
+  // so the pool does not park a perfectly good account.
+  {
+    const probe = typeof body === "string" ? body : JSON.stringify(body ?? "");
+    if (probe.includes("InferHub.4004.200") || probe.toLowerCase().includes("benefit not found")) {
+      return "INVALID_REQUEST";
+    }
+  }
+  // [xdpool-local] 403 is not auth — see isAuthError. The frontend renders AUTH
+  // as "API 密钥无效", so routing a WAF 403 here produced a confident wrong
+  // diagnosis. Only a 401, or a 403 whose body names the token, is AUTH.
+  if (status === 401) return "AUTH";
+  if (status === 403 && (String(body).includes("APIG.0602")
+    || /invalid\s+token|token\s+expired|token\s+is\s+invalid|signature\s+fail|Unauthorized/i.test(String(body)))) {
+    return "AUTH";
+  }
   const detail = errorDetail(body);
   if (isQuotaExceededError(detail)) return QUOTA_EXCEEDED_CODE;
   if (status === 429) return "RATE_LIMIT";
@@ -32827,6 +32942,9 @@ function httpErrorCode(status, body) {
     if (isContextWindowExceededError(detail)) return CONTEXT_WINDOW_EXCEEDED_CODE;
     return "INVALID_REQUEST";
   }
+  // [xdpool-local] A 200 body can carry the benefit refusal too (the upstream
+  // answers 200 with an error frame), so the probe above is the only guard that
+  // covers both transports — nothing to do here.
   if (status >= 500) return "SERVER";
   return `HTTP_${status}`;
 }
@@ -33251,6 +33369,17 @@ var CodeArtsAdapter = class extends LlmAdapter {
         extraSignedHeaders
       );
       const headers = new Headers(attributionHeaders());
+      // [xdpool-local] Override the host USER-AGENT, or the gateway answers 403.
+      //
+      // attributionHeaders() stamps the DSH bot UA and snap-access rejects it
+      // outright with 403 {error_code:TM.00000001}. Measured against the live
+      // gateway with the SAME credential, body and endpoint: the harness UA gets
+      // 403, no UA gets 200, an IDE-shaped UA gets 200 — so the UA alone decides,
+      // and every CodeArts request failed with a message that reads like a bad key.
+      //
+      // Only the UA is replaced. The other attribution headers stay: they identify
+      // the host for support and are not rejected.
+      headers.set("user-agent", "CodeArts-Agent/1.0 (Windows NT 10.0; Win64; x64)");
       signed.forEach((value, key) => {
         if (key !== "content-type") headers.set(key, value);
       });
@@ -33339,6 +33468,28 @@ var CodeArtsAdapter = class extends LlmAdapter {
         const errorText = await response.text().catch(() => "");
         if (isAuthError(response.status, errorText) && !authRefreshed) {
           authRefreshed = true;
+          // [xdpool-local] auth failure rotates the account, not just refresh it.
+          //
+          // This branch used to refresh and continue, which re-reads the SAME
+          // account — so with two accounts in the pool, a credential the gateway
+          // rejects for the first one failed the whole request while the second
+          // would have worked. Every other failure class already rotates via
+          // accountPool.getAvailableAccount; auth was the one exception.
+          //
+          // One shot per account: `rateLimitTried` holds the ids this request has
+          // already spent, so a pool of N accounts gets at most N-1 extra
+          // attempts and the loop cannot spin.
+          if (this.options.accountPool) {
+            const next = await this.options.accountPool.getAvailableAccount(
+              "codearts", options.model, rateLimitTried,
+            );
+            if (next && !rateLimitTried.has(next.entry.id)) {
+              rateLimitTried.add(next.entry.id);
+              credential = next.credential;
+              currentAccountId = next.entry.id;
+              continue;
+            }
+          }
           await this.options.refresh();
           credential = await this.options.resolveCredential();
           if (credential === void 0 || !credential.access_key_id || !credential.secret_access_key || !credential.security_token) {
@@ -33400,7 +33551,20 @@ var CodeArtsAdapter = class extends LlmAdapter {
           const probe = await this.queryQueueStatus(credential, options.model, options.signal);
           if (probe === void 0 || probe.status === "working") {
             const code = httpErrorCode(response.status, errorText);
-            throw new LlmError2(`codearts: model request failed with HTTP ${response.status}`, code, { status: response.status });
+            // [xdpool-local] error detail on the HTTP-status throw.
+            //
+            // "HTTP 403" alone cannot be diagnosed: the 403 in this report was a
+            // WAF verdict on the User-Agent, and with no body in the message the
+            // operator went looking for a credential problem that did not exist.
+            // The body names the cause, truncated so an HTML error page cannot
+            // flood the message.
+            const failureDetail = errorDetail(errorText).slice(0, 200);
+            throw new LlmError2(
+              `codearts: model request failed with HTTP ${response.status}`
+                + (failureDetail === "" ? "" : ` (${failureDetail})`),
+              code,
+              { status: response.status },
+            );
           }
         }
       }
@@ -35128,7 +35292,8 @@ var BuddyAdapter = class _BuddyAdapter extends LlmAdapter2 {
    */
   providerInfo(provider) {
     const id = typeof provider === "string" && provider.length > 0 ? provider : this.product.id;
-    return { id, name: this.product.displayName };
+    // [xdpool-local] The picker's group name follows this plugin's own naming.
+    return { id, name: LANE_DISPLAY_NAME[id] ?? this.product.displayName };
   }
   /**
    * 模型列表：优先使用 /v3/config 动态拉取的远端列表，否则回退静态默认。
@@ -35298,7 +35463,7 @@ var BuddyAdapter = class _BuddyAdapter extends LlmAdapter2 {
     if (!await providerCatalogVisible(this.options.accountPool, this.product.id)) return [];
     await this.ensureRemoteModels();
     const source = this.remoteModels ?? this.staticFallbackModels();
-    const disabled = this.options.accountPool?.disabledModelsFor(this.product.id);
+    const disabled = laneAllowedIds(this.options.accountPool?.disabledModelsFor(this.product.id), this.product.id, () => source);
     const listed = disabled === void 0 || disabled.size === 0 ? source : source.filter((model) => !disabled.has(model.id));
     return listed.map((model) => ({
       provider: this.product.id,
@@ -35455,7 +35620,26 @@ var BuddyAdapter = class _BuddyAdapter extends LlmAdapter2 {
     // its text rather than for claiming another client (measured 2026-10-28).
     for (const message of messages) {
       if ((message.role === "system" || message.role === "assistant") && typeof message.content === "string") {
-        message.content = message.content.replace(/powered by DeepSeek Harness/gi, "running on DeepSeek Harness").replace(/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface").replace(/Relative paths resolve from the workspace root/gi, "Relative paths are resolved against the workspace root");
+        message.content = message.content.replace(/powered by DeepSeek Harness/gi, "running on DeepSeek Harness").replace(/DeepSeek Harness Web GUI/gi, "DeepSeek Harness web interface").replace(/Relative paths resolve from the workspace root/gi, "Relative paths are resolved against the workspace root")
+          // [xdpool-local] codexCliBanner — see tools/patch-pack-codex-banner.mjs
+          //
+          // Codex CLI 0.166 opens with a developer message the gate catalogued.
+          // Measured (#112): the banner's first 184 chars pass, 185 (the same
+          // text plus its newline) fail with 11128, and the same sentences sent
+          // as three separate messages all pass — so the gate compares the first
+          // PARAGRAPH as a unit, not a keyword list and not a length.
+          //
+          // Rewriting the opening CLAUSE is therefore enough, and it is the only
+          // honest option: the rest of the 20 KB banner is ordinary prompt text
+          // the model still needs. Meaning is preserved on purpose — this string
+          // is also what the model reads, and mangling it to dodge a filter
+          // trades a loud failure for a quiet one.
+          //
+          // The two spellings below are the ones Codex emits across its recent
+          // releases; each keeps its own length and sentence shape.
+          .replace(/You are a coding agent running in the Codex CLI, a terminal-based coding assistant/gi, "You are a coding agent running in this environment, a terminal-based coding assistant")
+          .replace(/You are a coding agent running in the Codex CLI/gi, "You are a coding agent running in this environment")
+          .replace(/Codex CLI is an open source project led by OpenAI/gi, "This coding agent is an open source project");
       }
     }
     const tools = options.tools?.map((tool) => ({
@@ -36799,7 +36983,7 @@ var LobsteraiAdapter = class extends LlmAdapter3 {
     if (!await providerCatalogVisible(this.options.accountPool, this.product.id)) return [];
     await this.ensureRemoteModels();
     const source = this.remoteModels ?? this.staticFallbackModels();
-    const disabled = this.options.accountPool?.disabledModelsFor(this.product.id);
+    const disabled = laneAllowedIds(this.options.accountPool?.disabledModelsFor(this.product.id), this.product.id, () => source);
     const listed = disabled === void 0 || disabled.size === 0 ? source : source.filter((model) => !disabled.has(model.id));
     return listed.map((model) => ({
       provider: this.product.id,
@@ -37882,14 +38066,36 @@ function unwrapQoderEnvelopeStream(response, label) {
         if (classifyInner(inner) === "error") {
           let code;
           let message2 = inner;
+          // [xdpool-local] benefitNotFound / pricingUrl — see
+          // tools/patch-pack-error-kinds.mjs
+          //
+          // A refusal whose body is only a pricingUrl is upstream pointing at its
+          // own pricing page: a QUOTA signal, not a generic model error. The old
+          // fallback (message2 = the whole inner JSON) showed the user a bare URL
+          // next to "(112/model_error)", saying nothing about quota (#118). The
+          // URL moves to detail so it stays diagnosable.
+          let pricingUrl;
+          let hasMessage = false;
+          try {
+            const probe = JSON.parse(inner);
+            if (typeof probe?.pricingUrl === "string") pricingUrl = probe.pricingUrl;
+            hasMessage = typeof probe?.message === "string";
+          } catch {
+          }
           try {
             const parsed = JSON.parse(inner);
             if (parsed.code !== void 0) code = parsed.code;
             if (typeof parsed.message === "string") message2 = parsed.message;
           } catch {
           }
+          const quotaRefusal = pricingUrl !== void 0 && !hasMessage;
           controller.enqueue(
-            encoder2.encode(`data: ${JSON.stringify({
+            encoder2.encode(`data: ${JSON.stringify(quotaRefusal ? {
+              code: QUOTA_EXCEEDED_CODE,
+              message: "qoder: out of quota — upstream pointed at its pricing page",
+              detail: pricingUrl,
+              type: "model_error"
+            } : {
               ...code === void 0 ? {} : { code },
               message: message2,
               type: "model_error"
@@ -38904,8 +39110,8 @@ var QoderAdapter = class extends LlmAdapter4 {
   }
   async listModels(_provider) {
     if (!await providerCatalogVisible(this.options.accountPool, this.product.id)) return [];
-    const disabled = this.options.accountPool?.disabledModelsFor(this.product.id);
     const source = this.product.fallbackModels;
+    const disabled = laneAllowedIds(this.options.accountPool?.disabledModelsFor(this.product.id), this.product.id, () => source);
     const listed = disabled === void 0 || disabled.size === 0 ? source : source.filter((model) => !disabled.has(model.id));
     return listed.map((model) => ({
       provider: this.product.id,
@@ -40594,7 +40800,7 @@ var TraeAdapter = class extends LlmAdapter5 {
     if (!await providerCatalogVisible(this.options.accountPool, this.product.id)) return [];
     await this.ensureRemoteModels();
     const source = this.listAllModels();
-    const disabled = this.options.accountPool?.disabledModelsFor(this.product.id);
+    const disabled = laneAllowedIds(this.options.accountPool?.disabledModelsFor(this.product.id), this.product.id, () => source);
     const listed = disabled === void 0 || disabled.size === 0 ? source : source.filter((model) => !disabled.has(model.id));
     return listed.map((model) => ({
       provider: this.product.id,
@@ -42023,7 +42229,7 @@ var ClineAdapter = class extends LlmAdapter6 {
     if (!await providerCatalogVisible(this.options.accountPool, this.product.id)) return [];
     await this.ensureRemoteModels();
     const source = this.remoteModels ?? this.fallbackCatalog();
-    const disabled = this.options.accountPool?.disabledModelsFor(this.product.id);
+    const disabled = laneAllowedIds(this.options.accountPool?.disabledModelsFor(this.product.id), this.product.id, () => source);
     const listed = disabled === void 0 || disabled.size === 0 ? source : source.filter((model) => !disabled.has(model.id));
     return listed.map((model) => ({
       provider: this.product.id,
@@ -42619,7 +42825,7 @@ var LoomyAdapter = class extends LlmAdapter7 {
   async listModels(_provider) {
     if (!await providerCatalogVisible(this.options.accountPool, this.product.id)) return [];
     const all = await this.loadModels();
-    const disabled = this.options.accountPool?.disabledModelsFor(this.product.id);
+    const disabled = laneAllowedIds(this.options.accountPool?.disabledModelsFor(this.product.id), this.product.id, () => all);
     const listed = disabled === void 0 || disabled.size === 0 ? all : all.filter((model) => !disabled.has(model.id));
     return listed.map((model) => ({
       provider: this.product.id,
@@ -43075,7 +43281,7 @@ var RaccoonAdapter = class extends LlmAdapter8 {
   async listModels(_provider) {
     if (!await providerCatalogVisible(this.options.accountPool, this.product.id)) return [];
     const all = await this.loadModels();
-    const disabled = this.options.accountPool?.disabledModelsFor(this.product.id);
+    const disabled = laneAllowedIds(this.options.accountPool?.disabledModelsFor(this.product.id), this.product.id, () => all);
     const listed = disabled === void 0 || disabled.size === 0 ? all : all.filter((model) => !disabled.has(model.id));
     return listed.map((model) => ({
       provider: this.product.id,
@@ -54830,7 +55036,7 @@ var ZcodeAdapter = class extends LlmAdapter9 {
     if (!await this.ready()) return [];
     if (!await providerCatalogVisible(this.options.accountPool, this.product.id)) return [];
     const all = await this.loadModels();
-    const disabled = this.options.accountPool?.disabledModelsFor(this.product.id);
+    const disabled = laneAllowedIds(this.options.accountPool?.disabledModelsFor(this.product.id), this.product.id, () => all);
     const listed = disabled === void 0 || disabled.size === 0 ? all : all.filter((model) => !disabled.has(model.id));
     return listed.map((model) => ({
       provider: this.product.id,
@@ -58624,7 +58830,7 @@ var GeminiAdapter = class extends LlmAdapter10 {
   async listModels(_provider) {
     if (!await providerCatalogVisible(this.options.accountPool, this.product.id)) return [];
     const all = this.loadModels();
-    const disabled = this.options.accountPool?.disabledModelsFor(this.product.id);
+    const disabled = laneAllowedIds(this.options.accountPool?.disabledModelsFor(this.product.id), this.product.id, () => all);
     const listed = disabled === void 0 || disabled.size === 0 ? all : all.filter((model) => !disabled.has(model.id));
     return listed.map((model) => ({
       provider: this.product.id,
@@ -66419,7 +66625,7 @@ var MinimaxAdapter = class extends LlmAdapter11 {
   async listModels(_provider) {
     if (!await providerCatalogVisible(this.options.accountPool, this.product.id)) return [];
     const all = await this.loadModels();
-    const disabled = this.options.accountPool?.disabledModelsFor(this.product.id);
+    const disabled = laneAllowedIds(this.options.accountPool?.disabledModelsFor(this.product.id), this.product.id, () => all);
     const listed = disabled === void 0 || disabled.size === 0 ? all : all.filter((model) => !disabled.has(model.id));
     return listed.map((model) => ({
       provider: this.product.id,