mslxdff 0.1.188 → 0.1.197

package/src/providers/raccoon/credits.js

@@ -14,6 +14,7 @@ import {
   raccoonLoginGrantUrl,
 } from "./const.js";
 import { raccoonAuthHeaders } from "./headers.js";
+import { confirmRaccoonSession } from "./login.js";
 import { parseRaccoonEnvelope, raccoonEnvelopeText } from "./envelope.js";
 
 const num = (v) => {
@@ -22,20 +23,33 @@ const num = (v) => {
   return undefined;
 };
 
+/** 上游「新会话未确认」闸门码：先 POST /iam/confirm 再重试一次（与 chat.js 同款兜底）。 */
+const IAM_CONFIRM_REQUIRED = 200901;
+
 async function request(url, { credential, fetchImpl = fetch, env = process.env, method = "GET", body, timeoutMs = RACCOON_REQUEST_TIMEOUT_MS } = {}) {
-  const res = await fetchImpl(url, {
-    method,
-    headers: raccoonAuthHeaders(credential, { env }),
-    ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-    signal: AbortSignal.timeout(timeoutMs),
-  });
-  let parsed;
-  try {
-    parsed = await res.json();
-  } catch {
-    throw new Error(`raccoon: 响应不是 JSON（HTTP ${res.status}）`);
+  const once = async () => {
+    const res = await fetchImpl(url, {
+      method,
+      headers: raccoonAuthHeaders(credential, { env }),
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    let parsed;
+    try {
+      parsed = await res.json();
+    } catch {
+      throw new Error(`raccoon: 响应不是 JSON（HTTP ${res.status}）`);
+    }
+    return { res, envelope: parseRaccoonEnvelope(parsed, res.status) };
+  };
+  let { res, envelope } = await once();
+  // 未确认会话闸门：确认一次后重试（老号 / CLI 直连都可能撞上，登录时已确认的号不会走到这）
+  if (res.status === 400 && Number(envelope.code) === IAM_CONFIRM_REQUIRED) {
+    if (await confirmRaccoonSession(credential, { fetchImpl, env })) {
+      ({ res, envelope } = await once());
+    }
   }
-  return parseRaccoonEnvelope(parsed, res.status);
+  return envelope;
 }
 
 /** 余额五分项（缺项即省略，合计优先取上游的 available_points）。 */

package/src/providers/raccoon/envelope.js

@@ -1,15 +1,23 @@
 // raccoon 上游统一信封：`{ code, message, details, data }`（与 pack.js 的 parseEnvelope 同形）。
-// 约定：code === 0 为成功；HTTP 状态码仅在 code 缺失时兜底（上游错误也可能带 200）。
+// ⚠ 两代通道的成功码不同（2026-10 上游改版）：旧 /api/web/* 用数字 `0`，新 /api/iam/v1/* 用字符串 `"OK"`。
+//   故 `code` 原样保留（数字或字符串），判成功一律走 isRaccoonOk()——**不能**再用 `code === 0`：
+//   字符串码一律不等于 0（把 "OK" 判成失败），而把它兜底成 0 又会把 `AUTH_QRCODE_EXPIRED` 判成成功。
 // 登录态类业务码：200001 未带 token、200003 登录态过期 —— 见 const.js 的 RACCOON_ERROR_KINDS。
 export function parseRaccoonEnvelope(payload, status = 200) {
   const record = typeof payload === "object" && payload !== null && !Array.isArray(payload) ? payload : {};
-  const code = typeof record.code === "number" ? record.code : status >= 400 ? status : 0;
+  const raw = record.code;
+  const code = typeof raw === "number" || typeof raw === "string" ? raw : status >= 400 ? status : 0;
   const message = typeof record.message === "string" ? record.message : "";
   const details = typeof record.details === "string" ? record.details : "";
   const data = typeof record.data === "object" && record.data !== null && !Array.isArray(record.data) ? record.data : undefined;
   return { code, message, details, data, status };
 }
 
+/** 业务成功判据（两代通道通用）：数字 0，或新 IAM 通道的字符串 "OK"。 */
+export function isRaccoonOk(envelope) {
+  return envelope?.code === 0 || envelope?.code === "OK";
+}
+
 /** 人话错误文本：`message: details`，都没有时用调用方给的兜底句。 */
 export function raccoonEnvelopeText(envelope, fallback = "请求失败") {
   const parts = [envelope?.message, envelope?.details].filter((s) => typeof s === "string" && s.length > 0);

package/src/providers/raccoon/login.js

@@ -1,21 +1,26 @@
 // raccoon 扫码登录状态机与会话续期。
-// 实测依据：`POST /api/web/auth/v1/login_with_qrcode_code` **匿名可达**（HTTP 200 {"code":0,"data":{"status":"pending"}}），
-// 故整条登录链路不需要验证码、不需要浏览器组件（短信登录才要阿里云滑块，本期不做）。
-import { randomBytes } from "node:crypto";
+// ⚠ 2026-10 上游改版（本机实测）：扫码登录**不再是**「客户端自造 code + 旧 web 端点」。
+//   新链路 `/api/iam/v1/auth/mp/qrcode` 里 code 由**服务端签发**（`qr-<uuid>`）并下发
+//   scan_path / expires_in / poll_interval。旧写法（`randomBytes(16)` 当 code）在新通道下
+//   没有服务端会话 —— 微信扫码后查不到该码，症状正是「二维码已过期或已被使用」。
+//   新通道同样匿名可达、不需要验证码，故整条链路仍不需要浏览器组件（短信登录才要滑块，本期不做）。
 import {
   RACCOON_LOGIN_POLL_INTERVAL_MS,
   RACCOON_LOGIN_TIMEOUT_MS,
   RACCOON_REQUEST_TIMEOUT_MS,
-  raccoonQrLoginUrl,
+  raccoonIamConfirmUrl,
+  raccoonQrCancelUrl,
+  raccoonQrCreateUrl,
   raccoonQrPageUrl,
+  raccoonQrPollUrl,
   raccoonRefreshUrl,
   raccoonUserInfoUrl,
 } from "./const.js";
 import { raccoonAnonymousHeaders, raccoonAuthHeaders } from "./headers.js";
 import { decodeJwtExpMs } from "./auth.js";
-import { parseRaccoonEnvelope, raccoonEnvelopeText } from "./envelope.js";
+import { isRaccoonOk, parseRaccoonEnvelope, raccoonEnvelopeText } from "./envelope.js";
 
-/** 上游 `data.status` 四态（pack.js RACCOON_QR_STATUS 同形）。 */
+/** 上游 `data.status` 四态（与网站登录页 chunk 实测一致）。 */
 export const RACCOON_QR_STATUS = Object.freeze({
   pending: "pending",
   logging: "logging",
@@ -23,24 +28,17 @@ export const RACCOON_QR_STATUS = Object.freeze({
   success: "success",
 });
 
-/** 一次性登录码：16 字节 hex（32 字符），既是二维码内容参数也是轮询凭据。 */
-export function createQrCode() {
-  return randomBytes(16).toString("hex");
-}
-
-/** 二维码/链接内容：用户用手机扫码或直接打开它完成确认。 */
-export function buildQrUrl(code) {
-  return raccoonQrPageUrl(code);
-}
+/** 码在服务端不存在/已作废时 IAM 通道回的业务码。 */
+export const RACCOON_QR_EXPIRED_CODE = "AUTH_QRCODE_EXPIRED";
 
 const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
-async function postJson(url, body, { fetchImpl = fetch, env = process.env, timeoutMs = RACCOON_REQUEST_TIMEOUT_MS } = {}) {
+async function postJson(url, body, { fetchImpl = fetch, env = process.env, timeoutMs = RACCOON_REQUEST_TIMEOUT_MS, method = "POST" } = {}) {
   let res;
   try {
     res = await fetchImpl(url, {
-      method: "POST",
-      headers: raccoonAnonymousHeaders({ env }),
+      method,
+      headers: { ...raccoonAnonymousHeaders({ env }), "Accept-Language": "zh-CN" },
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(timeoutMs),
     });
@@ -56,6 +54,46 @@ async function postJson(url, body, { fetchImpl = fetch, env = process.env, timeo
   return parseRaccoonEnvelope(parsed, res.status);
 }
 
+/**
+ * 请服务端签发一个二维码会话。
+ *
+ * 返回 `{ qrcodeCode, scanPath, expiresIn, pollInterval, qrUrl }`。
+ * 任何字段不合契约都**抛错**而不是产出降级码 —— 自造 code 正是这次故障的根因，
+ * 再"兜底"一个扫不出来的码等于把同一类故障换个说法。
+ */
+export async function createQrSession(opts = {}) {
+  const envelope = await postJson(raccoonQrCreateUrl(), { product_codes: [] }, opts);
+  if (!isRaccoonOk(envelope)) throw new Error(`raccoon: 二维码签发失败：${raccoonEnvelopeText(envelope)}`);
+  const code = typeof envelope.data?.qrcode_code === "string" ? envelope.data.qrcode_code.trim() : "";
+  if (!code) throw new Error("raccoon: 二维码签发响应缺少 qrcode_code");
+  const scanPath = typeof envelope.data.scan_path === "string" ? envelope.data.scan_path : "/login/mp";
+  const expiresIn = Number(envelope.data.expires_in);
+  const pollInterval = Number(envelope.data.poll_interval);
+  return {
+    qrcodeCode: code,
+    scanPath,
+    expiresInMs: Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn * 1000 : RACCOON_LOGIN_TIMEOUT_MS,
+    pollIntervalMs: Number.isFinite(pollInterval) && pollInterval > 0
+      ? Math.max(1000, Math.min(60_000, pollInterval * 1000))
+      : RACCOON_LOGIN_POLL_INTERVAL_MS,
+    qrUrl: raccoonQrPageUrl(code, scanPath),
+  };
+}
+
+/** 递归渲染用的二维码内容；scanPath 由签发响应给出。 */
+export function buildQrUrl(code, scanPath) {
+  return raccoonQrPageUrl(code, scanPath);
+}
+
+/** 回收服务端会话（过期/退出时调用，失败不影响用户）。 */
+export async function cancelQrSession(code, opts = {}) {
+  try {
+    await postJson(raccoonQrCancelUrl(), { qrcode_code: String(code || ""), status: "canceled" }, { ...opts, method: "PUT" });
+  } catch {
+    // 取消是礼貌动作，不是流程一部分：网络不通时静默即可（码自己会到期）
+  }
+}
+
 /** 从登录成功信封里取凭据；缺 access_token 视为失败（不写半截凭据）。 */
 export function raccoonCredentialFromEnvelope(envelope) {
   const data = envelope?.data ?? {};
@@ -74,32 +112,44 @@ export function raccoonCredentialFromEnvelope(envelope) {
 
 /**
  * 轮询一轮。网络抖动一律折成 `pending`（用户还在扫码，不该因为一次超时把整轮打断）；
- * `canceled` / `success` 是终态。
+ * `canceled` / `expired` / `success` 是终态。
  */
 export async function pollQrLoginOnce(code, opts = {}) {
   let envelope;
   try {
-    envelope = await postJson(raccoonQrLoginUrl(), { qrcode_code: String(code || "") }, opts);
+    envelope = await postJson(raccoonQrPollUrl(), { qrcode_code: String(code || "") }, opts);
   } catch {
     return { status: RACCOON_QR_STATUS.pending };
   }
-  if (envelope.code !== 0 || envelope.data === undefined) return { status: RACCOON_QR_STATUS.pending };
+  if (!isRaccoonOk(envelope)) {
+    // 码在服务端不存在/已作废 —— 必须区分出来：继续轮询只会一直失败，用户却以为还在等扫描
+    if (String(envelope.code) === RACCOON_QR_EXPIRED_CODE) return { status: "expired" };
+    return { status: RACCOON_QR_STATUS.pending };
+  }
+  if (envelope.data === undefined) return { status: RACCOON_QR_STATUS.pending };
   const status = typeof envelope.data.status === "string" ? envelope.data.status : "";
   const expiredAt = typeof envelope.data.expired_at === "string" ? envelope.data.expired_at : undefined;
+  const pollIntervalMs = Number.isFinite(Number(envelope.data.poll_interval)) && Number(envelope.data.poll_interval) > 0
+    ? Number(envelope.data.poll_interval) * 1000
+    : undefined;
+  const jitter = pollIntervalMs === undefined ? {} : { pollIntervalMs };
   if (status === RACCOON_QR_STATUS.canceled) return { status: RACCOON_QR_STATUS.canceled };
-  if (status === RACCOON_QR_STATUS.logging) return { status: RACCOON_QR_STATUS.logging, ...(expiredAt ? { expiredAt } : {}) };
+  if (status === RACCOON_QR_STATUS.logging) return { status: RACCOON_QR_STATUS.logging, ...jitter, ...(expiredAt ? { expiredAt } : {}) };
   if (status === RACCOON_QR_STATUS.success) {
     try {
-      return { status: RACCOON_QR_STATUS.success, credential: raccoonCredentialFromEnvelope(envelope) };
+      return { status: RACCOON_QR_STATUS.success, ...jitter, credential: raccoonCredentialFromEnvelope(envelope) };
     } catch {
-      return { status: RACCOON_QR_STATUS.pending };
+      return { status: RACCOON_QR_STATUS.pending, ...jitter };
     }
   }
-  return { status: RACCOON_QR_STATUS.pending };
+  return { status: RACCOON_QR_STATUS.pending, ...jitter };
 }
 
 /**
- * 轮询直到终态。返回 `{ status, credential? }`；
+ * 轮询直到终态。返回 `{ status, credential? }`。
+ *
+ * `deadlineMs` 用**服务端下发的有效期**（不是本地常量）：码的生死由上游决定，
+ * 本地猜一个更长的窗口只会在码已作废后继续空转，把「已过期」拖成「超时」。
  * 超时返回 `{ status: "timeout" }`（调用方据此输出人话并非零退出）。
  */
 export async function pollQrLogin(code, {
@@ -113,6 +163,7 @@ export async function pollQrLogin(code, {
 } = {}) {
   const deadline = now() + timeoutMs;
   let ticks = 0;
+  let interval = intervalMs;
   for (;;) {
     const result = await pollQrLoginOnce(code, { fetchImpl, env });
     ticks += 1;
@@ -121,8 +172,11 @@ export async function pollQrLogin(code, {
     }
     if (result.status === RACCOON_QR_STATUS.success) return result;
     if (result.status === RACCOON_QR_STATUS.canceled) return { status: RACCOON_QR_STATUS.canceled };
+    if (result.status === "expired") return { status: "expired" };
+    // 服务端可以调快/调慢节奏，以它下发的为准（夹在 1s–60s，防被一个坏值卡住）
+    if (Number.isFinite(result.pollIntervalMs)) interval = Math.max(1000, Math.min(60_000, result.pollIntervalMs));
     if (now() >= deadline) return { status: "timeout" };
-    await sleepFn(intervalMs);
+    await sleepFn(interval);
   }
 }
 
@@ -150,12 +204,13 @@ export async function refreshRaccoonCredential(credential, opts = {}) {
     throw new Error(`raccoon: 续期响应不是 JSON（HTTP ${res.status}）`);
   }
   const envelope = parseRaccoonEnvelope(parsed, res.status);
-  if (res.status === 401 || envelope.code === 200003) {
+  // 登录态失效判据两代都收：旧通道数字 200003，IAM 通道字符串 AUTH_ACCESS_TOKEN_EXPIRED
+  if (res.status === 401 || envelope.code === 200003 || String(envelope.code) === "AUTH_ACCESS_TOKEN_EXPIRED") {
     const err = new Error("raccoon: 登录态已过期，请重新登录");
     err.authExpired = true;
     throw err;
   }
-  if (envelope.code !== 0) throw new Error(`raccoon: 续期失败：${raccoonEnvelopeText(envelope)}`);
+  if (!isRaccoonOk(envelope)) throw new Error(`raccoon: 续期失败：${raccoonEnvelopeText(envelope)}`);
   const accessToken = typeof envelope.data?.access_token === "string" ? envelope.data.access_token : "";
   if (!accessToken) throw new Error("raccoon: 续期响应缺少 access_token");
   const nextRefresh = typeof envelope.data.refresh_token === "string" && envelope.data.refresh_token.length > 0
@@ -170,6 +225,35 @@ export async function refreshRaccoonCredential(credential, opts = {}) {
   };
 }
 
+/**
+ * IAM 会话确认（POST /api/web/auth/v1/iam/confirm，body `{}`，带 Bearer）。
+ *
+ * 2026-10-18 故障取证：上游新登录的会话未确认前，业务端点一律回
+ * `400 {"code":200901,"message":"iam_confirm_required"}`（桌面端旧会话早已确认，
+ * 所以官方 App 无感）。官方前端（c6.js）的处理是「撞 200901 → confirm → 重试原请求」，
+ * 我们对齐同款：chat.js 兜底重试 + 登录成功后主动确认一次。
+ * 返回是否确认成功；任何失败都吞掉返回 false（由调用方的懒重试兜底，绝不阻断主流程）。
+ */
+export async function confirmRaccoonSession(credential, { fetchImpl = fetch, env = process.env, timeoutMs = RACCOON_REQUEST_TIMEOUT_MS } = {}) {
+  try {
+    const res = await fetchImpl(raccoonIamConfirmUrl(), {
+      method: "POST",
+      headers: raccoonAuthHeaders(credential, { env }),
+      body: "{}",
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    let parsed = null;
+    try {
+      parsed = await res.json();
+    } catch {
+      parsed = null;
+    }
+    return res.ok && isRaccoonOk(parseRaccoonEnvelope(parsed, res.status));
+  } catch {
+    return false;
+  }
+}
+
 /** 取用户信息（uid/昵称/手机号/office_identity）；任何失败都返回空对象，不阻断登录。 */
 export async function fetchRaccoonUserInfo(credential, opts = {}) {
   const { fetchImpl = fetch, env = process.env, timeoutMs = RACCOON_REQUEST_TIMEOUT_MS } = opts;
@@ -181,7 +265,7 @@ export async function fetchRaccoonUserInfo(credential, opts = {}) {
     });
     if (!res.ok) return {};
     const envelope = parseRaccoonEnvelope(await res.json(), res.status);
-    if (envelope.code !== 0 || envelope.data === undefined) return {};
+    if (!isRaccoonOk(envelope) || envelope.data === undefined) return {};
     const pick = (k) => (typeof envelope.data[k] === "string" ? envelope.data[k] : "");
     return {
       userId: pick("id"),

package/src/providers/registry.js

@@ -1,79 +1,79 @@
-/**
- * 可扩展供应商注册表：新增特殊供应商时，仅在此文件注册 + 新增对应 provider 文件即可
- * 每个条目：{ id, match(id, baseUrl) => bool, load() => Promise<factory> }
- * 匹配优先级：按数组顺序，首个命中即用；未命中走通用 generic
- */
-
-export const customProviders = [
-  {
-    id: "workbuddy",
-    match: (id, baseUrl) => id === "workbuddy" || String(baseUrl).includes("copilot.tencent"),
-    load: () => import("./workbuddy.js").then((m) => m.createWorkbuddyProvider),
-  },
-  {
-    id: "traework",
-    match: (id, baseUrl) => id === "traework" || String(baseUrl).includes("trae"),
-    load: () => import("./traework.js").then((m) => m.createTraeworkProvider),
-  },
-  {
-    id: "cline",
-    match: (id, baseUrl) => id === "cline" || String(baseUrl).includes("cline.bot"),
-    load: () => import("./cline.js").then((m) => m.createClineProvider),
-  },
-  {
-    id: "codearts",
-    match: (id, baseUrl) => id === "codearts" || String(baseUrl).includes("myhuaweicloud.com"),
-    load: () => import("./codearts.js").then((m) => m.createCodeartsProvider),
-  },
-  {
-    id: "qoder",
-    match: (id, baseUrl) => id === "qoder" || String(baseUrl).includes("qoder"),
-    load: () => import("./qoder/index.js").then((m) => m.createQoderProvider),
-  },
-  {
-    // ⚠ 必须排在 qwenwork 之前：qwenwork 的 match 用 `includes("qwenwork")`，
-    // 而 "globalqwenwork" 与 "gateway.qwenwork.ai"/"globalqwenwork://native" 都含该子串，
-    // 若后置会被 cn 条目抢先命中（first-match-wins），把国际站 token 打到 cn 网关。
-    id: "globalqwenwork",
-    match: (id, baseUrl) => id === "globalqwenwork" || String(baseUrl).includes("qwenwork.ai"),
-    load: () => import("./globalqwenwork/index.js").then((m) => m.createGlobalQwenworkProvider),
-  },
-  {
-    id: "qwenwork",
-    match: (id, baseUrl) => id === "qwenwork" || String(baseUrl).includes("qwenwork"),
-    load: () => import("./qwenwork/index.js").then((m) => m.createQwenworkProvider),
-  },
-  {
-    id: "zcode",
-    match: (id, baseUrl) => id === "zcode" || String(baseUrl).includes("zcode.z.ai"),
-    load: () => import("./zcode/index.js").then((m) => m.createZcodeProvider),
-  },
-  {
-    id: "raccoon",
-    match: (id, baseUrl) => id === "raccoon" || String(baseUrl).includes("xiaohuanxiong.com"),
-    load: () => import("./raccoon/index.js").then((m) => m.createRaccoonProvider),
-  },
-];
-
-// 供 bench/probe 等需要定制化解析模型列表的场景
-export const customNormalizers = [
-  {
-    id: "cline",
-    match: (baseUrl) => String(baseUrl).includes("cline.bot"),
-    normalize: (json) => Array.isArray(json?.free) ? json.free : null,
-  },
-];
-
-export async function getCustomProviderFactory(id, baseUrl) {
-  for (const entry of customProviders) {
-    try { if (entry.match(id, baseUrl)) return await entry.load(); } catch {}
-  }
-  return null;
-}
-
-export function getCustomNormalizer(baseUrl) {
-  for (const entry of customNormalizers) {
-    try { if (entry.match(baseUrl)) return entry.normalize; } catch {}
-  }
-  return null;
-}
+/**
+ * 可扩展供应商注册表：新增特殊供应商时，仅在此文件注册 + 新增对应 provider 文件即可
+ * 每个条目：{ id, match(id, baseUrl) => bool, load() => Promise<factory> }
+ * 匹配优先级：按数组顺序，首个命中即用；未命中走通用 generic
+ */
+
+export const customProviders = [
+  {
+    id: "workbuddy",
+    match: (id, baseUrl) => id === "workbuddy" || String(baseUrl).includes("copilot.tencent"),
+    load: () => import("./workbuddy.js").then((m) => m.createWorkbuddyProvider),
+  },
+  {
+    id: "traework",
+    match: (id, baseUrl) => id === "traework" || String(baseUrl).includes("trae"),
+    load: () => import("./traework.js").then((m) => m.createTraeworkProvider),
+  },
+  {
+    id: "cline",
+    match: (id, baseUrl) => id === "cline" || String(baseUrl).includes("cline.bot"),
+    load: () => import("./cline.js").then((m) => m.createClineProvider),
+  },
+  {
+    id: "codearts",
+    match: (id, baseUrl) => id === "codearts" || String(baseUrl).includes("myhuaweicloud.com"),
+    load: () => import("./codearts.js").then((m) => m.createCodeartsProvider),
+  },
+  {
+    id: "qoder",
+    match: (id, baseUrl) => id === "qoder" || String(baseUrl).includes("qoder"),
+    load: () => import("./qoder/index.js").then((m) => m.createQoderProvider),
+  },
+  {
+    // ⚠ 必须排在 qwenwork 之前：qwenwork 的 match 用 `includes("qwenwork")`，
+    // 而 "globalqwenwork" 与 "gateway.qwenwork.ai"/"globalqwenwork://native" 都含该子串，
+    // 若后置会被 cn 条目抢先命中（first-match-wins），把国际站 token 打到 cn 网关。
+    id: "globalqwenwork",
+    match: (id, baseUrl) => id === "globalqwenwork" || String(baseUrl).includes("qwenwork.ai"),
+    load: () => import("./globalqwenwork/index.js").then((m) => m.createGlobalQwenworkProvider),
+  },
+  {
+    id: "qwenwork",
+    match: (id, baseUrl) => id === "qwenwork" || String(baseUrl).includes("qwenwork"),
+    load: () => import("./qwenwork/index.js").then((m) => m.createQwenworkProvider),
+  },
+  {
+    id: "zcode",
+    match: (id, baseUrl) => id === "zcode" || String(baseUrl).includes("zcode.z.ai"),
+    load: () => import("./zcode/index.js").then((m) => m.createZcodeProvider),
+  },
+  {
+    id: "raccoon",
+    match: (id, baseUrl) => id === "raccoon" || String(baseUrl).includes("xiaohuanxiong.com"),
+    load: () => import("./raccoon/index.js").then((m) => m.createRaccoonProvider),
+  },
+];
+
+// 供 bench/probe 等需要定制化解析模型列表的场景
+export const customNormalizers = [
+  {
+    id: "cline",
+    match: (baseUrl) => String(baseUrl).includes("cline.bot"),
+    normalize: (json) => Array.isArray(json?.free) ? json.free : null,
+  },
+];
+
+export async function getCustomProviderFactory(id, baseUrl) {
+  for (const entry of customProviders) {
+    try { if (entry.match(id, baseUrl)) return await entry.load(); } catch {}
+  }
+  return null;
+}
+
+export function getCustomNormalizer(baseUrl) {
+  for (const entry of customNormalizers) {
+    try { if (entry.match(baseUrl)) return entry.normalize; } catch {}
+  }
+  return null;
+}

package/src/providers/workbuddy/auth.js

@@ -27,6 +27,32 @@ export function isInsufficientStatus(status, bodyText, cached) {
   return false;
 }
 
+// 频率限制：上游「这个号这一秒用量超了」——该换号顶，但**不是**这个号没额度了。
+// 与 isInsufficientStatus 严格分开：后者命中会被 chat.js 把该号余额标 0（永久跳过），
+// 而腾讯 workbuddy 的 6004 是「使用量已超出频率限制，将在 <时间> 重置」+ 中文措辞，
+// 既不含任何英文字样也没有额度码——历史上正是这里不认，导致 429 原样吐给客户端、从不换号。
+// Note: 为什么 6004 必须走独立判定而不是并入 insufficient — 见 .agents/notes/implemented/bug-fix/2026-10-18-workbuddy-6004-rate-limit-rotate.md
+export function isRateLimitedStatus(status, bodyText) {
+  if (status !== 429) return false;
+  const t = String(bodyText || "");
+  if (/"code"\s*:\s*6004\b/.test(t)) return true;
+  const lower = t.toLowerCase();
+  if (lower.includes("frequency limit") || lower.includes("rate limit") || lower.includes("too many requests")) return true;
+  if (t.includes("频率限制") || t.includes("请求过于频繁") || t.includes("使用量已超出")) return true;
+  return false;
+}
+
+// 上游 msg 里的重置时刻（"将在 2026-10-18 21:14:48 UTC+8 重置"）→ 建议冷却毫秒数；
+// 解析不出返回 0，调用方退回到固定冷却档，绝不因此把号判死。
+export function parseRateLimitResetMs(bodyText, clock = Date.now) {
+  const m = String(bodyText || "").match(/(\d{4}-\d{2}-\d{2})[ T](\d{2}:\d{2}:\d{2})\s*(?:UTC\+8)?\s*重置/);
+  if (!m) return 0;
+  const at = Date.parse(`${m[1]}T${m[2]}+08:00`);
+  if (!Number.isFinite(at)) return 0;
+  const ms = at - clock();
+  return ms > 0 ? ms : 0;
+}
+
 export function isAuthError(status, bodyText) {
   if (status === 401 || status === 403) return true;
   const t = String(bodyText || "").toLowerCase();
@@ -35,7 +61,6 @@ export function isAuthError(status, bodyText) {
   if (status === 400 && t.includes("token")) return true;
   return false;
 }
-
 export function createAuthService({
   baseUrl,
   fetchImpl,