mslxdff 0.1.231 → 0.1.232

package/src/providers/registry.js

@@ -1,89 +1,89 @@
-/**
- * 可扩展供应商注册表：新增特殊供应商时，仅在此文件注册 + 新增对应 provider 文件即可
- * 每个条目：{ id, match(id, baseUrl) => bool, load() => Promise<factory> }
- * 匹配优先级：按数组顺序，首个命中即用；未命中走通用 generic
- */
-
-export const customProviders = [
-  {
-    id: "workbuddy",
-    match: (id, baseUrl) => id === "workbuddy" || String(baseUrl).includes("copilot.tencent"),
-    load: () => import("./workbuddy.js").then((m) => m.createWorkbuddyProvider),
-  },
-  {
-    id: "traework",
-    match: (id, baseUrl) => id === "traework" || String(baseUrl).includes("trae"),
-    load: () => import("./traework.js").then((m) => m.createTraeworkProvider),
-  },
-  {
-    id: "cline",
-    match: (id, baseUrl) => id === "cline" || String(baseUrl).includes("cline.bot"),
-    load: () => import("./cline.js").then((m) => m.createClineProvider),
-  },
-  {
-    id: "codearts",
-    match: (id, baseUrl) => id === "codearts" || String(baseUrl).includes("myhuaweicloud.com"),
-    load: () => import("./codearts.js").then((m) => m.createCodeartsProvider),
-  },
-  {
-    id: "qoder",
-    match: (id, baseUrl) => id === "qoder" || String(baseUrl).includes("qoder"),
-    load: () => import("./qoder/index.js").then((m) => m.createQoderProvider),
-  },
-  {
-    // ⚠ 必须排在 qwenwork 之前：qwenwork 的 match 用 `includes("qwenwork")`，
-    // 而 "globalqwenwork" 与 "gateway.qwenwork.ai"/"globalqwenwork://native" 都含该子串，
-    // 若后置会被 cn 条目抢先命中（first-match-wins），把国际站 token 打到 cn 网关。
-    id: "globalqwenwork",
-    match: (id, baseUrl) => id === "globalqwenwork" || String(baseUrl).includes("qwenwork.ai"),
-    load: () => import("./globalqwenwork/index.js").then((m) => m.createGlobalQwenworkProvider),
-  },
-  {
-    id: "qwenwork",
-    match: (id, baseUrl) => id === "qwenwork" || String(baseUrl).includes("qwenwork"),
-    load: () => import("./qwenwork/index.js").then((m) => m.createQwenworkProvider),
-  },
-  {
-    id: "zcode",
-    match: (id, baseUrl) => id === "zcode" || String(baseUrl).includes("zcode.z.ai"),
-    load: () => import("./zcode/index.js").then((m) => m.createZcodeProvider),
-  },
-  {
-    id: "railway",
-    // opencode zen free 层的另一个 IP 出口（Railway 反代），只暴露 free 模型。
-    // 匹配必须排在 generic 之前，且不能与其它条目撞（railway.app 域名足够独特）。
-    match: (id, baseUrl) => id === "railway" || String(baseUrl).includes("railway.app"),
-    load: () => import("./railway.js").then((m) => m.createRailwayProvider),
-  },
-  {
-    id: "raccoon",
-    match: (id, baseUrl) => id === "raccoon" || String(baseUrl).includes("xiaohuanxiong.com"),
-    load: () => import("./raccoon/index.js").then((m) => m.createRaccoonProvider),
-  },
-  // agentrouter 定制工厂已于 2026-10-21 摘除：现网成功率仅 ~48%（502/400/422/500 高发），
-  // 从注册表 + 预热名单移除后网关不再解析 agentrouter/* 模型。工厂文件 src/providers/agentrouter.js
-  // 与其测试保留，日后要重新启用只需在此加回一条 { id:"agentrouter", ... } 并同步 dispatcher 预热名单。
-];
-
-// 供 bench/probe 等需要定制化解析模型列表的场景
-export const customNormalizers = [
-  {
-    id: "cline",
-    match: (baseUrl) => String(baseUrl).includes("cline.bot"),
-    normalize: (json) => Array.isArray(json?.free) ? json.free : null,
-  },
-];
-
-export async function getCustomProviderFactory(id, baseUrl) {
-  for (const entry of customProviders) {
-    try { if (entry.match(id, baseUrl)) return await entry.load(); } catch {}
-  }
-  return null;
-}
-
-export function getCustomNormalizer(baseUrl) {
-  for (const entry of customNormalizers) {
-    try { if (entry.match(baseUrl)) return entry.normalize; } catch {}
-  }
-  return null;
-}
+/**
+ * 可扩展供应商注册表：新增特殊供应商时，仅在此文件注册 + 新增对应 provider 文件即可
+ * 每个条目：{ id, match(id, baseUrl) => bool, load() => Promise<factory> }
+ * 匹配优先级：按数组顺序，首个命中即用；未命中走通用 generic
+ */
+
+export const customProviders = [
+  {
+    id: "workbuddy",
+    match: (id, baseUrl) => id === "workbuddy" || String(baseUrl).includes("copilot.tencent"),
+    load: () => import("./workbuddy.js").then((m) => m.createWorkbuddyProvider),
+  },
+  {
+    id: "traework",
+    match: (id, baseUrl) => id === "traework" || String(baseUrl).includes("trae"),
+    load: () => import("./traework.js").then((m) => m.createTraeworkProvider),
+  },
+  {
+    id: "cline",
+    match: (id, baseUrl) => id === "cline" || String(baseUrl).includes("cline.bot"),
+    load: () => import("./cline.js").then((m) => m.createClineProvider),
+  },
+  {
+    id: "codearts",
+    match: (id, baseUrl) => id === "codearts" || String(baseUrl).includes("myhuaweicloud.com"),
+    load: () => import("./codearts.js").then((m) => m.createCodeartsProvider),
+  },
+  {
+    id: "qoder",
+    match: (id, baseUrl) => id === "qoder" || String(baseUrl).includes("qoder"),
+    load: () => import("./qoder/index.js").then((m) => m.createQoderProvider),
+  },
+  {
+    // ⚠ 必须排在 qwenwork 之前：qwenwork 的 match 用 `includes("qwenwork")`，
+    // 而 "globalqwenwork" 与 "gateway.qwenwork.ai"/"globalqwenwork://native" 都含该子串，
+    // 若后置会被 cn 条目抢先命中（first-match-wins），把国际站 token 打到 cn 网关。
+    id: "globalqwenwork",
+    match: (id, baseUrl) => id === "globalqwenwork" || String(baseUrl).includes("qwenwork.ai"),
+    load: () => import("./globalqwenwork/index.js").then((m) => m.createGlobalQwenworkProvider),
+  },
+  {
+    id: "qwenwork",
+    match: (id, baseUrl) => id === "qwenwork" || String(baseUrl).includes("qwenwork"),
+    load: () => import("./qwenwork/index.js").then((m) => m.createQwenworkProvider),
+  },
+  {
+    id: "zcode",
+    match: (id, baseUrl) => id === "zcode" || String(baseUrl).includes("zcode.z.ai"),
+    load: () => import("./zcode/index.js").then((m) => m.createZcodeProvider),
+  },
+  {
+    id: "railway",
+    // opencode zen free 层的另一个 IP 出口（Railway 反代），只暴露 free 模型。
+    // 匹配必须排在 generic 之前，且不能与其它条目撞（railway.app 域名足够独特）。
+    match: (id, baseUrl) => id === "railway" || String(baseUrl).includes("railway.app"),
+    load: () => import("./railway.js").then((m) => m.createRailwayProvider),
+  },
+  {
+    id: "raccoon",
+    match: (id, baseUrl) => id === "raccoon" || String(baseUrl).includes("xiaohuanxiong.com"),
+    load: () => import("./raccoon/index.js").then((m) => m.createRaccoonProvider),
+  },
+  // agentrouter 定制工厂已于 2026-10-21 摘除：现网成功率仅 ~48%（502/400/422/500 高发），
+  // 从注册表 + 预热名单移除后网关不再解析 agentrouter/* 模型。工厂文件 src/providers/agentrouter.js
+  // 与其测试保留，日后要重新启用只需在此加回一条 { id:"agentrouter", ... } 并同步 dispatcher 预热名单。
+];
+
+// 供 bench/probe 等需要定制化解析模型列表的场景
+export const customNormalizers = [
+  {
+    id: "cline",
+    match: (baseUrl) => String(baseUrl).includes("cline.bot"),
+    normalize: (json) => Array.isArray(json?.free) ? json.free : null,
+  },
+];
+
+export async function getCustomProviderFactory(id, baseUrl) {
+  for (const entry of customProviders) {
+    try { if (entry.match(id, baseUrl)) return await entry.load(); } catch {}
+  }
+  return null;
+}
+
+export function getCustomNormalizer(baseUrl) {
+  for (const entry of customNormalizers) {
+    try { if (entry.match(baseUrl)) return entry.normalize; } catch {}
+  }
+  return null;
+}

package/src/providers/workbuddy/auth.js

@@ -53,6 +53,18 @@ export function parseRateLimitResetMs(bodyText, clock = Date.now) {
   return ms > 0 ? ms : 0;
 }
 
+// 账号级风控封禁：腾讯 workbuddy `403 {"code":11140,"msg":"request illegal",displayMsg:"…restricted due to unusual activity/账号存在异常行为…"}`。
+// 与 auth 失败、额度耗尽、限流都不同：**刷新 token 无效**（2026-10-21 实测：refresh 成功换发新 token 后照样 11140，
+// 且换新 UA/完整客户端头集合同样 11140——判的是账号本体，不是凭据或请求指纹）。
+// 命中即应长冷却该号并如实把 403 透回，绝不进 refresh→重打 的连锁（旧链每个用户请求白烧 号数×2 次上游调用 + 号数 次 refresh）。
+export function isAccountRestricted(status, bodyText) {
+  if (status !== 403) return false;
+  const t = String(bodyText || "");
+  if (/"code"\s*:\s*11140\b/.test(t)) return true;
+  const lower = t.toLowerCase();
+  return lower.includes("request illegal") || lower.includes("restricted due to unusual activity") || t.includes("账号存在异常行为");
+}
+
 export function isAuthError(status, bodyText) {
   if (status === 401 || status === 403) return true;
   const t = String(bodyText || "").toLowerCase();
@@ -86,10 +98,14 @@ export function createAuthService({
     }
     const p = (async () => {
       const url = joinUrl(resolvedBase, "/v2/plugin/auth/token/refresh");
+      // 回退到 2026-10-21 17:09 实测**可用**的旧头形（refresh 成功换发过新 token）：refresh 无活体抓包，
+      // 不赌未验证口径；11140 只打 chat、refresh 不在风控画像主战场。X-Refresh-Token 是 refresh 特有凭据头。
+      // X-Auth-Refresh-Source: "plugin" 是 CLI bundle 三条 refreshSession 逐字共有的真值（@7064132/@7126898/@7144850），补上无副作用。
       const headers = {
         "Content-Type": "application/json",
         Authorization: `Bearer ${key}`,
         "X-Refresh-Token": rt,
+        "X-Auth-Refresh-Source": "plugin",
         "X-User-Id": uid,
         "X-Domain": auth.domain || "www.codebuddy.cn",
         "User-Agent": "CLI/2.115.0 WorkBuddy/2.115.0",