mslxdff 0.1.66 → 0.1.67

package/src/providers/openrouter.js

@@ -1,87 +1,31 @@
-import { createKeyRing } from "./keyring.js";
-import { loadProviderKeys } from "../state.js";
-import { envInt, joinUrl, getUndici, createAgent, createChatRunner, createListModelsRunner, createPreheatRunner } from "./base.js";
-import { joinModelId } from "./model-id.js";
+import { createGenericProvider } from "./generic.js";
 
-const { UndiciFetch } = getUndici();
 const DEFAULT_BASE_URL = "https://openrouter.ai/api/v1";
 
-function collectApiKeys(apiKeys, apiKey) {
-  const list = [
-    ...(Array.isArray(apiKeys) ? apiKeys : [apiKeys].filter(Boolean)),
-    apiKey,
-    ...(apiKeys === undefined && apiKey === undefined ? loadProviderKeys("openrouter") : []),
-  ].filter((k) => typeof k === "string" && k.trim().length);
-  return [...new Set(list.map((k) => k.trim()))];
-}
-
 export function createOpenRouterProvider({
   apiKeys,
   apiKey,
   baseUrl = process.env.MSLXDFF_OPENROUTER_BASE_URL || DEFAULT_BASE_URL,
-  connectTimeoutMs = Number(process.env.MSLXDFF_OPENROUTER_TIMEOUT_MS) || 30_000,
-  cooldownMs = envInt("MSLXDFF_OPENROUTER_COOLDOWN_MS", 30_000),
-  retry = {
-    network: { attempts: 2, delayMs: 300 },
-    429: { attempts: 1, delayMs: 100 },
-    502: { attempts: 1, delayMs: 100 },
-    503: { attempts: 1, delayMs: 100 },
-    504: { attempts: 1, delayMs: 100 },
-  },
   fetchImpl,
-  headers: extraHeaders,
+  headers,
   noAgent = false,
+  ...rest
 } = {}) {
-  if (!fetchImpl) fetchImpl = UndiciFetch || fetch;
-  const ring = createKeyRing(collectApiKeys(apiKeys, apiKey), { cooldownMs });
-  let dispatcher = null; let agent = null;
-  if (!noAgent) {
-    const a = createAgent({
-      keepAliveTimeout: envInt("MSLXDFF_OA_KEEPALIVE_TIMEOUT", 30_000),
-      keepAliveMaxTimeout: envInt("MSLXDFF_OA_KEEPALIVE_MAX_TIMEOUT", 60_000),
-      connections: envInt("MSLXDFF_OA_KEEPALIVE_CONNECTIONS", 20),
-    });
-    agent = a.agent; dispatcher = a.dispatcher;
-  }
-
-  function buildHeaders(body, key) {
-    const isStream = body?.stream !== false;
-    const h = {
-      "Content-Type": "application/json",
-      Accept: isStream ? "text/event-stream" : "*/*",
-      "User-Agent": "mslxdff",
+  return createGenericProvider({
+    id: "openrouter",
+    baseUrl,
+    apiKeys,
+    apiKey,
+    modelsPath: "/models",
+    chatPath: "/chat/completions",
+    headers: {
       "HTTP-Referer": process.env.MSLXDFF_OPENROUTER_REFERER || "https://github.com/mslxdff",
       "X-Title": process.env.MSLXDFF_OPENROUTER_TITLE || "mslxdff",
-    };
-    if (key) h["Authorization"] = `Bearer ${key}`;
-    return { ...h, ...extraHeaders };
-  }
-
-  const { runChat } = createChatRunner({
-    id: "openrouter", ring, cooldownMs, retry, fetchImpl, dispatcher, buildHeaders,
-    getUrl: () => `${baseUrl}/chat/completions`,
-    connectTimeoutMs,
-  });
-
-  async function chat(body) { return runChat(body, ring, "MSLXDFF_OPENROUTER_KEY"); }
-  async function chatWithKeys(body, keys) {
-    const tmp = createKeyRing(keys, { cooldownMs });
-    return runChat(body, tmp, "shared provider keys");
-  }
-
-  const { listModels } = createListModelsRunner({
-    id: "openrouter", ring, dispatcher, fetchImpl,
-    getUrl: () => `${baseUrl}/models`,
-    // openrouter 仅暴露免费模型
+      ...(headers || {}),
+    },
     mapModel: (raw) => raw.filter((m) => Number(m.pricing?.prompt || 0) === 0 && Number(m.pricing?.completion || 0) === 0),
+    fetchImpl,
+    noAgent,
+    ...rest,
   });
-
-  const { preheat } = createPreheatRunner({
-    dispatcher, fetchImpl, getUrl: () => `${baseUrl}/models`,
-    id: "openrouter", ring,
-  });
-
-  async function close() { if (agent?.close) { try { await agent.close(); } catch {} } }
-
-  return { id: "openrouter", chat, chatWithKeys, listModels, preheat, close, agent, keyRing: ring };
 }

package/src/providers/workbuddy/auth.js

@@ -0,0 +1,175 @@
+import { joinUrl } from "../base.js";
+import { WORKBUDDY_DEFAULT_BASE_URL } from "../../state/schemas/provider.js";
+
+export function decodeJwtExp(token) {
+  try {
+    const payload = String(token || "").split(".")[1];
+    if (!payload) return 0;
+    let b64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const pad = b64.length % 4;
+    if (pad) b64 += "=".repeat(4 - pad);
+    const json = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
+    return Number(json.exp || 0);
+  } catch {
+    return 0;
+  }
+}
+
+export function isInsufficientStatus(status, bodyText, cached) {
+  if (cached && Number(cached.total) === 0) return true;
+  if (status === 402) return true;
+  if (status === 403 || status === 429) {
+    const t = String(bodyText || "").toLowerCase();
+    if (t.includes("insufficient") || t.includes("quota") || t.includes("balance") || t.includes("credit") || t.includes("exhaust") || t.includes("402") || t.includes("10002") || t.includes("10003")) return true;
+  }
+  return false;
+}
+
+export function isAuthError(status, bodyText) {
+  if (status === 401 || status === 403) return true;
+  const t = String(bodyText || "").toLowerCase();
+  if (t.includes("unauthorized") || t.includes("authenticate") || t.includes("invalid token") || t.includes("token expired") || t.includes("token invalid") || t.includes("access token") || t.includes("login expired") || t.includes("need login") || t.includes("session expired")) return true;
+  if (t.includes("code") && (t.includes("401") || t.includes("403")) && t.includes("token")) return true;
+  if (status === 400 && t.includes("token")) return true;
+  return false;
+}
+
+export function createAuthService({
+  baseUrl,
+  fetchImpl,
+  clock = Date.now,
+  dispatcher,
+  file,
+  store, // optional { saveProviderConfig, keysRef, authListRef } or custom saveFn
+  saveFn,
+} = {}) {
+  const resolvedBase = baseUrl ? String(baseUrl).trim().replace(/\/+$/, "") : WORKBUDDY_DEFAULT_BASE_URL;
+  if (!fetchImpl) {
+    try {
+      const { getUndici } = awaitImportUndici();
+      fetchImpl = getUndici()?.UndiciFetch || fetch;
+    } catch {
+      fetchImpl = fetch;
+    }
+  }
+  // lazy resolve UndiciFetch if not provided
+  if (!fetchImpl) fetchImpl = fetch;
+
+  const inflightRefresh = new Map();
+
+  async function refreshTokenFor(key, auth) {
+    const rt = auth?.refreshToken;
+    const uid = auth?.uid;
+    if (!rt || !uid) return null;
+    const dedupKey = String(uid);
+    if (inflightRefresh.has(dedupKey)) {
+      try { return await inflightRefresh.get(dedupKey); } catch { return null; }
+    }
+    const p = (async () => {
+      const url = joinUrl(resolvedBase, "/v2/plugin/auth/token/refresh");
+      const headers = {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${key}`,
+        "X-Refresh-Token": rt,
+        "X-User-Id": uid,
+        "X-Domain": auth.domain || "www.codebuddy.cn",
+        "User-Agent": "CLI/2.115.0 WorkBuddy/2.115.0",
+        Origin: "https://www.codebuddy.cn",
+        Referer: "https://www.codebuddy.cn/",
+      };
+      try {
+        const opts = { method: "POST", headers, body: "{}" };
+        if (dispatcher) opts.dispatcher = dispatcher;
+        const res = await fetchImpl(url, opts);
+        const text = await res.text();
+        let j;
+        try { j = JSON.parse(text); } catch { return null; }
+        if (j.code === 0 && j.data?.accessToken) {
+          const newAt = j.data.accessToken;
+          const newRt = j.data.refreshToken || rt;
+          // attempt to persist if store provided
+          try {
+            if (saveFn) {
+              await saveFn({ newAt, newRt, uid, oldKey: key, auth });
+            } else if (store && typeof store.save === "function") {
+              await store.save({ newAt, newRt, uid, oldKey: key, auth });
+            } else if (store && Array.isArray(store.keys) && Array.isArray(store.authList)) {
+              // direct mutation fallback (legacy shape)
+              const idx = store.keys.indexOf(key);
+              if (idx >= 0) {
+                store.keys[idx] = newAt;
+                store.authList[idx] = { ...auth, refreshToken: newRt };
+                try {
+                  const { saveProviderConfig } = await import("../../state.js");
+                  saveProviderConfig("workbuddy", { baseUrl: resolvedBase, keys: [...store.keys], auths: [...store.authList] }, file ? { file } : {});
+                } catch {}
+                try {
+                  const { writeFileSync, mkdirSync, existsSync } = await import("node:fs");
+                  const { join, dirname } = await import("node:path");
+                  const { tmpdir } = await import("node:os");
+                  const isTest = process.env.NODE_ENV === "test" || (process.env.MSLXDFF_STATE_FILE && String(process.env.MSLXDFF_STATE_FILE).includes("mslxdff-test"));
+                  const authDir = process.env.WORKBUDDY_AUTH_DIR || (isTest ? join(tmpdir(), "mslxdff-test-auths") : (file && String(file).includes("mslxdff-") ? join(dirname(String(file)), "auths") : join(process.cwd(), "auths")));
+                  mkdirSync(authDir, { recursive: true });
+                  const expAt = (() => { try { return JSON.parse(Buffer.from(newAt.split(".")[1], "base64").toString()).exp; } catch { return Math.floor(Date.now() / 1000) + 5184000; } })();
+                  const doc = { account: { uid, enterpriseId: auth.enterpriseId || "", nickname: "" }, auth: { accessToken: newAt, refreshToken: newRt, expiresAt: expAt, domain: auth.domain || "www.codebuddy.cn" } };
+                  const fp = join(authDir, `workbuddy-${uid}.json`);
+                  const tmp = fp + ".tmp";
+                  writeFileSync(tmp, JSON.stringify(doc, null, 2), { mode: 0o600 });
+                  try {
+                    if (existsSync(fp)) {
+                      const { unlinkSync, renameSync } = await import("node:fs");
+                      unlinkSync(fp);
+                      renameSync(tmp, fp);
+                    } else {
+                      const { renameSync } = await import("node:fs");
+                      renameSync(tmp, fp);
+                    }
+                  } catch {
+                    writeFileSync(fp, JSON.stringify(doc, null, 2), { mode: 0o600 });
+                  }
+                } catch {}
+              }
+            }
+          } catch {}
+          return newAt;
+        }
+      } catch {}
+      return null;
+    })();
+    inflightRefresh.set(dedupKey, p);
+    try {
+      const r = await p;
+      return r;
+    } finally {
+      inflightRefresh.delete(dedupKey);
+    }
+  }
+
+  function maybeProactiveRefresh(auth, key) {
+    try {
+      const exp = decodeJwtExp(key);
+      if (!exp) return;
+      const remain = exp * 1000 - clock();
+      if (remain < 5 * 60 * 1000 && remain > -60 * 60 * 1000) {
+        void refreshTokenFor(key, auth).catch(() => {});
+      }
+    } catch {}
+  }
+
+  return { refreshTokenFor, maybeProactiveRefresh, decodeJwtExp, isAuthError, isInsufficientStatus, _inflight: inflightRefresh };
+}
+
+function awaitImportUndici() {
+  try {
+    // dynamic to avoid top-level await
+    let UndiciFetch = null;
+    try {
+      // eslint-disable-next-line no-undef
+      const mod = globalThis.__mslxdff_undici || null;
+      if (mod) return mod;
+    } catch {}
+    return { UndiciFetch: null };
+  } catch {
+    return { UndiciFetch: null };
+  }
+}

package/src/providers/workbuddy/balance.js

@@ -0,0 +1,84 @@
+const BALANCE_TTL_MS = 5 * 60 * 1000;
+
+export function createBalanceCache({ ttlMs = BALANCE_TTL_MS, now = Date.now } = {}) {
+  const map = new Map(); // uid -> { total, dailyPacks, activeCount, nextExpire, fetchedAt, totalStr? }
+  function getCachedBalance(uid) {
+    const v = map.get(String(uid));
+    if (!v) return null;
+    if (now() - v.fetchedAt > ttlMs) {
+      map.delete(String(uid));
+      return null;
+    }
+    return v;
+  }
+  function setCachedBalance(uid, data) {
+    const v = { ...data, fetchedAt: now() };
+    map.set(String(uid), v);
+    return v;
+  }
+  function getBalanceCache() { return map; }
+  function clearBalanceCache() { map.clear(); }
+
+  async function fetchBalance({ uid, key, auth, domain, baseUrl = "https://www.codebuddy.cn", fetchImpl } = {}) {
+    const at = key || auth?.accessToken || "";
+    const u = uid || auth?.uid || "";
+    const d = domain || auth?.domain || "www.codebuddy.cn";
+    if (!u || !at) return null;
+    const fetcher = fetchImpl || fetch;
+    const body = JSON.stringify({
+      PageNumber: 1, PageSize: 100, ProductCode: "p_tcaca", Status: [0, 3],
+      PackageEndTimeRangeBegin: "2026-08-01 00:00:00",
+      PackageEndTimeRangeEnd: "2030-01-01 00:00:00",
+    });
+    try {
+      const res = await fetcher(`${baseUrl.replace(/\/+$/, "")}/v2/billing/meter/get-user-resource`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${at}`,
+          "Content-Type": "application/json",
+          "X-User-Id": u,
+          "X-Domain": d,
+        },
+        body,
+      });
+      if (!res.ok) return null;
+      const j = await res.json().catch(() => null);
+      const accs = j?.data?.Response?.Data?.Accounts || j?.data?.Response?.data?.Accounts || [];
+      const accounts = Array.isArray(accs) ? accs : [];
+      const active = accounts.filter(a => a.Status === 0);
+      const total = active.reduce((s, a) => s + Number(a.CycleCapacityRemainPrecise || a.CycleCapacityRemain || 0), 0);
+      const dailyPacks = active.filter(a => a.PackageName?.includes("裂变包") && String(a.CycleCapacitySizePrecise) === "100");
+      const sorted = [...active].sort((a,b)=> new Date(a.CycleEndTime) - new Date(b.CycleEndTime));
+      const nextExpire = sorted[0]?.CycleEndTime || null;
+      const data = {
+        total: Number(total.toFixed(2)),
+        dailyPacks: dailyPacks.length,
+        activeCount: active.length,
+        nextExpire,
+        fetchedAt: now(),
+      };
+      data.totalStr = total.toFixed(2);
+      setCachedBalance(u, data);
+      return data;
+    } catch {
+      return null;
+    }
+  }
+
+  async function getBalanceWithCache({ uid, key, auth, domain, baseUrl, fetchImpl } = {}) {
+    const cached = getCachedBalance(uid || auth?.uid);
+    if (cached) return cached;
+    return fetchBalance({ uid, key, auth, domain, baseUrl, fetchImpl });
+  }
+
+  return { getCachedBalance, setCachedBalance, getBalanceCache, clearBalanceCache, fetchBalance, getBalanceWithCache, _map: map, _ttlMs: ttlMs };
+}
+
+// 默认单例（保持与 src/providers/workbuddy-balance.js 兼容，供未注入场景使用）
+const defaultCache = createBalanceCache();
+export const getCachedBalance = defaultCache.getCachedBalance;
+export const setCachedBalance = defaultCache.setCachedBalance;
+export const getBalanceCache = defaultCache.getBalanceCache;
+export const clearBalanceCache = defaultCache.clearBalanceCache;
+export const fetchBalance = defaultCache.fetchBalance;
+export const getBalanceWithCache = defaultCache.getBalanceWithCache;

package/src/providers/workbuddy/chat.js

@@ -0,0 +1,310 @@
+import { joinUrl } from "../base.js";
+import { isAuthError, isInsufficientStatus } from "./auth.js";
+import { appendRotationLog as defaultAppend } from "./rotation-log.js";
+
+function buildAuthHeaders(key, auth) {
+  const h = {
+    "Content-Type": "application/json",
+    Accept: "text/event-stream",
+    "User-Agent": "CLI/2.115.0 WorkBuddy/2.115.0",
+    Origin: "https://www.codebuddy.cn",
+    Referer: "https://www.codebuddy.cn/",
+    "X-Product": "SaaS",
+  };
+  if (key) h["Authorization"] = `Bearer ${key}`;
+  if (auth?.uid) h["X-User-Id"] = auth.uid;
+  if (auth?.domain) h["X-Domain"] = auth.domain;
+  else h["X-Domain"] = "www.codebuddy.cn";
+  if (auth?.enterpriseId) {
+    h["X-Enterprise-Id"] = auth.enterpriseId;
+    h["X-Tenant-Id"] = auth.enterpriseId;
+  }
+  return h;
+}
+
+function withUidHeader(res, uid) {
+  try {
+    res.headers.set("x-mslxdff-workbuddy-uid", uid);
+    return res;
+  } catch {
+    try {
+      const h = new Headers(res.headers);
+      h.set("x-mslxdff-workbuddy-uid", uid);
+      const clone = new Response(res.body, { status: res.status, statusText: res.statusText, headers: h });
+      clone._t = res._t;
+      return clone;
+    } catch {
+      return res;
+    }
+  }
+}
+
+function sleep(ms) { return new Promise((r) => setTimeout(r, ms)); }
+
+export function createChatService({
+  id = "workbuddy",
+  baseUrl,
+  chatPath,
+  keys, // mutable array ref
+  authList, // mutable array ref
+  ring, // keyRing instance for auto mode
+  fetchImpl,
+  dispatcher,
+  connectTimeoutMs = 30_000,
+  retry = {
+    network: { attempts: 2, delayMs: 300 },
+    429: { attempts: 1, delayMs: 100 },
+    502: { attempts: 1, delayMs: 100 },
+    503: { attempts: 1, delayMs: 100 },
+    504: { attempts: 1, delayMs: 100 },
+  },
+  balanceCache, // { getCachedBalance, setCachedBalance }
+  authService, // { refreshTokenFor, maybeProactiveRefresh }
+  logger, // { append } or null
+  clock = Date.now,
+  cooldownMs = 30_000,
+} = {}) {
+  const getBalance = balanceCache?.getCachedBalance || (() => null);
+  const setBalance = balanceCache?.setCachedBalance || (() => {});
+  const doLog = (opts) => {
+    if (logger && typeof logger.append === "function") {
+      try { logger.append(opts); } catch {}
+      return;
+    }
+    if (logger && typeof logger.log === "function") {
+      try { logger.log(opts); } catch {}
+      return;
+    }
+    // fallback to default append (may write to fs; test passes noop logger so not called)
+    try { defaultAppend(opts); } catch {}
+  };
+
+  function authForKey(key) {
+    const idx = keys.indexOf(key);
+    if (idx >= 0 && authList[idx]) return authList[idx];
+    if (authList.length) return authList[0];
+    return { uid: "", domain: "www.codebuddy.cn", enterpriseId: "", refreshToken: "" };
+  }
+
+  async function attemptOnce(url, body, key) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new Error(`${id} timed out after ${connectTimeoutMs}ms`)), connectTimeoutMs);
+    try {
+      const auth = authForKey(key);
+      const headers = buildAuthHeaders(key, auth);
+      const finalBody = { ...body, stream: true };
+      const opts = { method: "POST", headers, body: JSON.stringify(finalBody), signal: controller.signal };
+      if (dispatcher) opts.dispatcher = dispatcher;
+      const res = await fetchImpl(url, opts);
+      return res;
+    } catch (err) {
+      return err;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
+  async function runChat(body, activeRing, opts = {}) {
+    const url = joinUrl(baseUrl, chatPath);
+    const t0 = typeof performance !== "undefined" && performance.now ? performance.now() : clock();
+    const preferredUid = opts?.workbuddyUid ? String(opts.workbuddyUid).trim() : "";
+    const modelForLog = body?.model || "";
+
+    if (preferredUid) {
+      const idx = authList.findIndex(a => a.uid === preferredUid || a.uid.startsWith(preferredUid));
+      if (idx < 0) {
+        const errBody = JSON.stringify({ error: `workbuddy uid not found: ${preferredUid}` });
+        const res = new Response(errBody, { status: 403, headers: { "Content-Type": "application/json", "x-mslxdff-workbuddy-reason": "uid-not-found", "x-mslxdff-workbuddy-uid": preferredUid } });
+        res._t = { attempts: [], waitMs: 0, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+        return res;
+      }
+      const key = keys[idx];
+      const auth = authList[idx];
+      authService?.maybeProactiveRefresh?.(auth, key);
+      const cached = getBalance(auth.uid);
+      if (cached && Number(cached.total) === 0) {
+        const errBody = JSON.stringify({ error: `workbuddy uid in cooldown (balance 0): ${auth.uid}` });
+        const res = new Response(errBody, { status: 403, headers: { "Content-Type": "application/json", "x-mslxdff-workbuddy-reason": "uid-cooling", "x-mslxdff-workbuddy-uid": auth.uid } });
+        res._t = { attempts: [], waitMs: 0, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+        return res;
+      }
+      const attempts = [];
+      let waitMs = 0;
+      for (let attempt = 0; ; attempt++) {
+        const t = typeof performance !== "undefined" && performance.now ? performance.now() : clock();
+        let result = await attemptOnce(url, body, key);
+        const type = result instanceof Error ? "network" : `http${result?.status}`;
+        attempts.push({ attempt, type, ms: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t) });
+        if (result instanceof Error) {
+          const entry = retry?.network;
+          if (entry && attempt < entry.attempts) { await sleep(entry.delayMs); waitMs += entry.delayMs; continue; }
+          activeRing.onError(key);
+          result._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+          throw result;
+        }
+        if (attempt === 0) {
+          let bodyText = "";
+          try { bodyText = await result.clone().text(); } catch {}
+          if (isAuthError(result.status, bodyText)) {
+            const newKey = await authService?.refreshTokenFor?.(key, auth);
+            if (newKey) {
+              const auth2 = authForKey(newKey);
+              const headers2 = buildAuthHeaders(newKey, auth2);
+              const finalBody = { ...body, stream: true };
+              const controller2 = new AbortController();
+              const timer2 = setTimeout(() => controller2.abort(new Error(`${id} timed out after ${connectTimeoutMs}ms`)), connectTimeoutMs);
+              try {
+                const opts2 = { method: "POST", headers: headers2, body: JSON.stringify(finalBody), signal: controller2.signal };
+                if (dispatcher) opts2.dispatcher = dispatcher;
+                let res2 = await fetchImpl(url, opts2);
+                let res2Body = "";
+                try { res2Body = await res2.clone().text(); } catch {}
+                const stillAuth = isAuthError(res2.status, res2Body);
+                res2._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0), refreshed: true };
+                res2 = withUidHeader(res2, auth2.uid || auth.uid);
+                if (stillAuth || res2.status === 429 || res2.status >= 500) activeRing.onError(newKey);
+                doLog({ uid: auth2.uid || auth.uid, model: modelForLog, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0), balanceHit: false, error: stillAuth ? `still auth ${res2.status}` : undefined });
+                return res2;
+              } catch (e2) { e2._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) }; throw e2; } finally { clearTimeout(timer2); }
+            }
+          }
+        }
+        const entry = retry?.[result.status];
+        if (entry && attempt < entry.attempts) { await sleep(entry.delayMs); waitMs += entry.delayMs; continue; }
+        if (result.status === 401 || result.status === 403 || result.status === 429 || result.status >= 500) activeRing.onError(key);
+        result = withUidHeader(result, auth.uid);
+        result._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+        doLog({ uid: auth.uid, model: modelForLog, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0), balanceHit: false });
+        return result;
+      }
+    }
+
+    // auto rotation
+    const attempts = [];
+    let waitMs = 0;
+    let lastErr = null;
+    const tried = new Set();
+    const maxTries = Math.max(1, keys.length);
+    for (let triedCount = 0; triedCount < maxTries; triedCount++) {
+      const key = activeRing.next();
+      if (!key) {
+        if (triedCount === 0) {
+          const err = new Error(`${id}: all API keys are in cooldown (last error < ${cooldownMs}ms ago) — provider temporarily unavailable`);
+          err._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0), cooldownMs };
+          throw err;
+        }
+        break;
+      }
+      const auth = authForKey(key);
+      const uid = auth?.uid || "";
+      if (tried.has(uid || key)) continue;
+      tried.add(uid || key);
+      const cached = uid ? getBalance(uid) : null;
+      if (cached && Number(cached.total) === 0) {
+        activeRing.onError(key);
+        setBalance(uid, { ...cached, total: 0 });
+        doLog({ uid, model: modelForLog, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0), balanceHit: true });
+        // 单号余额为 0 直接返回 403，避免抛“exhausted”让调用方误判为 500
+        if (keys.length === 1 || activeRing.available() === 0) {
+          const errBody = JSON.stringify({ error: `workbuddy uid in cooldown (balance 0): ${uid}` });
+          const res = new Response(errBody, { status: 403, headers: { "Content-Type": "application/json", "x-mslxdff-workbuddy-reason": "uid-cooling", "x-mslxdff-workbuddy-uid": uid } });
+          res._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+          return res;
+        }
+        continue;
+      }
+      if (!key && activeRing.size === 0) {
+        const err = new Error(`${id}: missing MSLXDFF_WORKBUDDY_KEY (chat requires a real key) — run node workbuddy-token-auto.js`);
+        err._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+        throw err;
+      }
+      authService?.maybeProactiveRefresh?.(auth, key);
+      let result = null;
+      let attempt = 0;
+      for (; ; attempt++) {
+        const t = typeof performance !== "undefined" && performance.now ? performance.now() : clock();
+        result = await attemptOnce(url, body, key);
+        const type = result instanceof Error ? "network" : `http${result?.status}`;
+        attempts.push({ attempt: triedCount * 10 + attempt, type, ms: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t), uid });
+        if (result instanceof Error) {
+          const entry = retry?.network;
+          if (entry && attempt < entry.attempts) { await sleep(entry.delayMs); waitMs += entry.delayMs; continue; }
+          activeRing.onError(key);
+          lastErr = result;
+          result._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+          break;
+        }
+        if (attempt === 0) {
+          let bodyText = "";
+          try { bodyText = await result.clone().text(); } catch {}
+          const needRefresh = isAuthError(result.status, bodyText);
+          if (needRefresh) {
+            const newKey = await authService?.refreshTokenFor?.(key, auth);
+            if (newKey) {
+              const auth2 = authForKey(newKey);
+              const headers2 = buildAuthHeaders(newKey, auth2);
+              const finalBody = { ...body, stream: true };
+              const controller2 = new AbortController();
+              const timer2 = setTimeout(() => controller2.abort(new Error(`${id} timed out after ${connectTimeoutMs}ms`)), connectTimeoutMs);
+              try {
+                const opts2 = { method: "POST", headers: headers2, body: JSON.stringify(finalBody), signal: controller2.signal };
+                if (dispatcher) opts2.dispatcher = dispatcher;
+                let res2 = await fetchImpl(url, opts2);
+                let res2Body = "";
+                try { res2Body = await res2.clone().text(); } catch {}
+                const stillAuth = isAuthError(res2.status, res2Body);
+                res2._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0), refreshed: true };
+                res2 = withUidHeader(res2, auth2.uid || uid);
+                if (stillAuth || res2.status === 429 || res2.status >= 500) activeRing.onError(newKey);
+                doLog({ uid: auth2.uid || uid, model: modelForLog, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0), balanceHit: false, error: stillAuth ? `still auth ${res2.status}` : undefined });
+                if (stillAuth) {
+                  lastErr = new Error(`workbuddy auth still failing after refresh for ${uid}: ${res2Body.slice(0, 120)}`);
+                  lastErr._t = res2._t;
+                  activeRing.onError(newKey);
+                  break;
+                }
+                return res2;
+              } catch (e2) { e2._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) }; lastErr = e2; break; } finally { clearTimeout(timer2); }
+            } else {
+              lastErr = new Error(`workbuddy refresh failed for ${uid}: ${bodyText.slice(0, 120)}`);
+              lastErr._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+              activeRing.onError(key);
+              break;
+            }
+          }
+        }
+        const entry = retry?.[result.status];
+        if (entry && attempt < entry.attempts) { await sleep(entry.delayMs); waitMs += entry.delayMs; continue; }
+        break;
+      }
+      if (result instanceof Error) {
+        continue;
+      }
+      let bodyText = "";
+      let isInsuff = false;
+      if (result.status === 402 || result.status === 403 || result.status === 429) {
+        try { bodyText = await result.clone().text(); } catch { try { bodyText = await result.text(); } catch { bodyText = ""; } }
+        isInsuff = isInsufficientStatus(result.status, bodyText, cached);
+      }
+      if (isInsuff) {
+        activeRing.onError(key);
+        if (uid) setBalance(uid, { total: 0, dailyPacks: 0, activeCount: 0, nextExpire: null, fetchedAt: clock() });
+        doLog({ uid, model: modelForLog, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0), balanceHit: true, error: bodyText.slice(0, 120) });
+        lastErr = new Error(`workbuddy insufficient for ${uid}: ${bodyText.slice(0, 120)}`);
+        lastErr._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+        continue;
+      }
+      if (result.status === 401 || result.status === 403 || result.status === 429 || result.status >= 500) activeRing.onError(key);
+      result = withUidHeader(result, uid);
+      result._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+      doLog({ uid, model: modelForLog, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0), balanceHit: false });
+      return result;
+    }
+    if (lastErr) throw lastErr;
+    const err = new Error(`${id}: all workbuddy accounts exhausted or unavailable`);
+    err._t = { attempts, waitMs, totalMs: Math.round((typeof performance !== "undefined" && performance.now ? performance.now() : clock()) - t0) };
+    throw err;
+  }
+
+  return { runChat, authForKey, buildAuthHeaders, withUidHeader, attemptOnce };
+}