chore(gui): 版本号 2.0.47（与内核同版本）

生产现网发现（issue #1 排查）：billing.rules 里一条指向
https://opencode.ai/inference/v1 的规则，在该源 base_url 变成
.../inference/openai/v1 之后匹配不到任何源；严格编译因此让**整个** profile
不生效 —— 账单恒 0、unpriced_reqs 涨到 3.7 万，唯一痕迹是一行启动日志。

- 严格编译失败时降级为 lenient：应用能匹配的规则，其余按 profile default；
- 日志用 ERROR 点名**具体哪条 URL** 写错（新增 billing.UnmatchedRuleURLs），
  并说明未匹配流量的记账去向；
- 判据 TestBillingStaleRuleURLStillAppliesOtherRules：一条过期规则 + 一条有效
  规则 ⇒ 有效规则必须仍然生效。

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all build test gui gui-dev gui-dist gui-deb gui-win gui-win-docker help clean
+.PHONY: all build test gui gui-dev gui-dist gui-deb gui-win gui-win-docker help clean gui-test
 
 # ModelRouter - single-binary gateway + optional Electron desktop GUI (embedded core)
 export BINARY
@@ -65,6 +65,13 @@ gui-dist-dir:
 test:
 	go test ./...
 
+# Desktop shell unit tests (no Electron needed): plugin-tree seeding/migration.
+# These guard the two things that silently break the desktop build:
+#   - plugin_dir missing from an embedded profile  -> channels plugin invisible
+#   - bundled plugin files never refreshed         -> old channels.lua survives upgrades
+gui-test:
+	@cd $(GUI_DIR) && node --test plugin-sync.test.js
+
 clean:
 	rm -rf $(BUILD_DIR) cmd/build cmd/gui/dist cmd/gui/build/gui-dist cmd/gui/bin
 
@@ -75,6 +82,7 @@ help:
 	@echo "  make gui        run desktop GUI (dev)"
 	@echo "  make gui-dev    run GUI with devtools"
 	@echo "  make gui-dist   build deb + rpm + AppImage (linux)"
+	@echo "  make gui-test   desktop shell unit tests (plugin tree seeding)"
 	@echo "  make gui-deb    build deb only"
 	@echo "  make gui-win    build Windows nsis (needs host mingw + wine)"
 	@echo "  make gui-win-docker  build Windows nsis all-in-docker (no host mingw needed)"

cmd/gui/main.js

@@ -18,6 +18,7 @@ const http = require("http");
 const os = require("os");
 const crypto = require("crypto");
 const { spawn, execFileSync } = require("child_process");
+const pluginSync = require("./plugin-sync");
 
 const LOG_FILE = path.join(app.getPath("userData"), "gui.log");
 function log(msg) {
@@ -40,6 +41,13 @@ console.error = function () {
 // Per-user profile dir: <userData>/profile
 const PROFILE_DIR = path.join(app.getPath("userData"), "profile");
 const CONFIG_FILE = path.join(PROFILE_DIR, "config.yaml");
+// Plugin tree for the embedded core. The core deliberately does NOT default
+// plugin_dir (an operator opts in), so the desktop build must set it — without
+// it the whole plugin system stays off and the channels plugin (multi-platform
+// account login + credential vault + auto check-in) is invisible in the WebUI.
+// Seeding is the core's job (SeedBundled fills MISSING files only), so a user's
+// edited copy always wins.
+const PLUGINS_DIR = path.join(PROFILE_DIR, "plugins");
 // Packaged: extraResource at process.resourcesPath/bin (outside asar, spawnable).
 // Dev:   cmd/gui/bin, populated by prepare-core.js.
 const CORE_EXE = path.join(
@@ -216,6 +224,9 @@ function writeDefaultEmbeddedConfig() {
     "listen: 127.0.0.1:" + (settings.port || DEFAULT_PORT),
     "default_model: AUTO",
     "adapter_dir: " + JSON.stringify(path.join(PROFILE_DIR, "adapters")),
+    // Plugin tree: channels/billing/quota/usage ship inside the core binary and
+    // are seeded into this dir on first start. Omitting it disables plugins.
+    "plugin_dir: " + JSON.stringify(PLUGINS_DIR),
     "runtime_file: " + JSON.stringify(path.join(PROFILE_DIR, "runtime.json")),
     "",
     // Admin key as a plain `keys` entry (no seed flag) so the web UI never
@@ -268,6 +279,9 @@ function startCore() {
   // ensure profile dir + config + local adapters exist
   fs.mkdirSync(PROFILE_DIR, { recursive: true });
   if (!fs.existsSync(CONFIG_FILE)) writeDefaultEmbeddedConfig();
+  pluginSync.ensurePluginDirConfigured(CONFIG_FILE, PLUGINS_DIR, log);
+  fs.mkdirSync(PLUGINS_DIR, { recursive: true });
+  pluginSync.syncBundledPluginsOnUpgrade(PROFILE_DIR, PLUGINS_DIR, app.getVersion(), log);
 
   coreProc = spawn(CORE_EXE, ["-config", CONFIG_FILE], {
     cwd: PROFILE_DIR,
@@ -622,10 +636,55 @@ function createWindow() {
     },
   });
   mainWindow.loadFile(path.join(__dirname, "renderer", "index.html"));
+  // External links ALWAYS go to the user's default browser, never an in-app
+  // window. Three paths have to be covered, and missing any one of them is why
+  // "click the login link and nothing happens / the app navigates away" shows up:
+  //   1. window.open / target=_blank            -> setWindowOpenHandler
+  //   2. top-level navigation (same-tab click)  -> will-navigate
+  //   3. navigation inside the WebUI <iframe>   -> will-frame-navigate
+  // The embedded core's own origin (and file:// for the shell) must keep
+  // working, otherwise the WebUI and plugin pages stop loading.
+  const isInternal = (url) =>
+    !url ||
+    url === "about:blank" ||
+    url.startsWith("file://") ||
+    url.startsWith(embeddedBaseUrl()) ||
+    url.startsWith("devtools://");
+  const openExternally = (url) => {
+    if (url && (url.startsWith("http://") || url.startsWith("https://"))) {
+      log("[gui] open in default browser: " + url);
+      shell.openExternal(url);
+    }
+  };
   mainWindow.webContents.setWindowOpenHandler(({ url }) => {
-    if (url && url.startsWith("http")) shell.openExternal(url);
+    if (!isInternal(url)) openExternally(url);
     return { action: "deny" };
   });
+  mainWindow.webContents.on("will-navigate", (e, url) => {
+    if (isInternal(url)) return;
+    e.preventDefault();
+    openExternally(url);
+  });
+  // iframe navigations (the WebUI content area and the plugin pages inside it).
+  // The channels plugin renders its server-side login browser (noVNC) in an
+  // iframe on a LOOPBACK port, so loopback MUST stay in-app — blocking it would
+  // break VNC login. Everything non-loopback is external: open the default
+  // browser instead of silently replacing the gateway UI with a third-party page.
+  const isLoopback = (url) => {
+    try {
+      const h = new URL(url).hostname;
+      return h === "127.0.0.1" || h === "localhost" || h === "[::1]";
+    } catch (e) {
+      return false;
+    }
+  };
+  if (mainWindow.webContents.on) {
+    mainWindow.webContents.on("will-frame-navigate", (e) => {
+      if (isInternal(e.url) || isLoopback(e.url)) return;
+      e.preventDefault();
+      openExternally(e.url);
+    });
+  }
   // Silent start: `--silent` CLI flag or settings.silentStart keeps the app
   // in the tray without showing the window (Clash-Verge style). First run
   // always shows the window so the user sees the dashboard.

cmd/gui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "modelrouter-gui",
-  "version": "1.9.3",
+  "version": "2.0.47",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "modelrouter-gui",
-      "version": "1.9.3",
+      "version": "2.0.47",
       "license": "Proprietary",
       "devDependencies": {
         "electron": "^33.0.0",

cmd/gui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "modelrouter-gui",
-  "version": "1.9.7",
+  "version": "2.0.47",
   "description": "ModelRouter Desktop — embedded ModelRouter core with tray",
   "author": "ModelRouter",
   "main": "main.js",
@@ -81,6 +81,7 @@
     },
     "files": [
       "main.js",
+      "plugin-sync.js",
       "preload.js",
       "renderer/**/*",
       "build/**/*",

cmd/gui/plugin-sync.js

@@ -0,0 +1,82 @@
+// Plugin-tree maintenance for the embedded core (no Electron imports, so this
+// is unit-testable with plain node).
+//
+// Two problems this solves, both invisible from the gateway side:
+//   1. The core deliberately does NOT default `plugin_dir` (an operator opts
+//      in). A desktop profile without it runs with ZERO plugins — the channels
+//      plugin (account login, credential vault, auto check-in) never appears.
+//   2. The core seeds bundled plugins only when the file is ABSENT, so a
+//      desktop upgrade would keep the user's old channels.lua forever and
+//      silently skip every channel fix. On version change the shell must drop
+//      the built-in files so the new binary reseeds them.
+const fs = require("fs");
+const path = require("path");
+
+const BUILTIN_PLUGINS = ["billing.lua", "channels.lua", "quota.lua", "usage.lua"];
+
+// ensurePluginDirConfigured back-fills `plugin_dir` into an existing config.
+// Appending a top-level YAML key is safe for the shapes this file can have
+// (flat mapping + a keys list). Returns "added" | "present" | "absent" | "error".
+function ensurePluginDirConfigured(configFile, pluginsDir, log) {
+  try {
+    if (!fs.existsSync(configFile)) return "absent";
+    const cur = fs.readFileSync(configFile, "utf-8");
+    if (/^\s*plugin_dir\s*:/m.test(cur)) return "present";
+    fs.writeFileSync(
+      configFile,
+      cur.replace(/\s*$/, "") +
+        "\n# added by ModelRouter Desktop: enables the plugin tree (channels etc.)\n" +
+        "plugin_dir: " + JSON.stringify(pluginsDir) + "\n",
+      "utf-8",
+    );
+    if (log) log("[gui] plugin_dir back-filled into " + configFile);
+    return "added";
+  } catch (e) {
+    if (log) log("[gui] ensurePluginDirConfigured failed: " + e.message);
+    return "error";
+  }
+}
+
+// syncBundledPluginsOnUpgrade drops built-in plugin files when the app version
+// changed, so the core reseeds them from the binary it shipped with. Returns
+// { changed, dropped:[...], kept: "prev-<ver>" }.
+function syncBundledPluginsOnUpgrade(profileDir, pluginsDir, version, log) {
+  const stamp = path.join(profileDir, ".plugin-seed-version");
+  let have = "";
+  try {
+    have = fs.readFileSync(stamp, "utf-8").trim();
+  } catch (e) {
+    /* first run */
+  }
+  if (have === version) return { changed: false, dropped: [] };
+  const dropped = [];
+  for (const name of BUILTIN_PLUGINS) {
+    const f = path.join(pluginsDir, name);
+    if (!fs.existsSync(f)) continue;
+    try {
+      if (have) fs.renameSync(f, f + ".prev-" + have);
+      else fs.unlinkSync(f);
+      dropped.push(name);
+    } catch (e) {
+      if (log) log("[gui] drop builtin plugin " + name + " failed: " + e.message);
+    }
+  }
+  try {
+    fs.writeFileSync(stamp, version + "\n", "utf-8");
+  } catch (e) {
+    if (log) log("[gui] write plugin seed stamp failed: " + e.message);
+  }
+  if (dropped.length && log) {
+    log(
+      "[gui] plugins refreshed for " + version + " (" + dropped.length +
+        " builtin file(s) reseeded by core)",
+    );
+  }
+  return { changed: true, dropped, kept: have ? "prev-" + have : "" };
+}
+
+module.exports = {
+  BUILTIN_PLUGINS,
+  ensurePluginDirConfigured,
+  syncBundledPluginsOnUpgrade,
+};

cmd/gui/plugin-sync.test.js

@@ -0,0 +1,80 @@
+// Unit tests for the desktop plugin-tree maintenance (plain node, no Electron).
+// Run: node --test cmd/gui/plugin-sync.test.js
+const test = require("node:test");
+const assert = require("node:assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+const { BUILTIN_PLUGINS, ensurePluginDirConfigured, syncBundledPluginsOnUpgrade } = require("./plugin-sync");
+
+const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), "plugin-sync-"));
+
+test("back-fills plugin_dir into an existing profile without it", () => {
+  const dir = tmp();
+  const cfg = path.join(dir, "config.yaml");
+  fs.writeFileSync(cfg, 'listen: 127.0.0.1:8787\ndefault_model: AUTO\nkeys:\n  - key: k\n    role: admin\n');
+  const plugins = path.join(dir, "plugins");
+  assert.equal(ensurePluginDirConfigured(cfg, plugins, null), "added");
+  const out = fs.readFileSync(cfg, "utf-8");
+  assert.match(out, /^plugin_dir: "/m);
+  assert.ok(out.includes(plugins.replace(/\\/g, "\\\\")) || out.includes(plugins), "path written");
+  // the rest of the profile must survive untouched
+  assert.match(out, /^listen: 127\.0\.0\.1:8787$/m);
+  assert.match(out, /^  - key: k$/m);
+});
+
+test("leaves a profile that already sets plugin_dir alone", () => {
+  const dir = tmp();
+  const cfg = path.join(dir, "config.yaml");
+  const orig = 'plugin_dir: "/custom/plugins"\nlisten: ":1"\n';
+  fs.writeFileSync(cfg, orig);
+  assert.equal(ensurePluginDirConfigured(cfg, "/whatever", null), "present");
+  assert.equal(fs.readFileSync(cfg, "utf-8"), orig);
+});
+
+test("missing config is not created by the back-fill", () => {
+  const dir = tmp();
+  const cfg = path.join(dir, "config.yaml");
+  assert.equal(ensurePluginDirConfigured(cfg, path.join(dir, "p"), null), "absent");
+  assert.equal(fs.existsSync(cfg), false);
+});
+
+test("upgrade drops builtin plugins (keeping a backup) but not user plugins", () => {
+  const dir = tmp();
+  const plugins = path.join(dir, "plugins");
+  fs.mkdirSync(plugins, { recursive: true });
+  for (const f of BUILTIN_PLUGINS) fs.writeFileSync(path.join(plugins, f), "OLD");
+  fs.writeFileSync(path.join(plugins, "my-own.lua"), "MINE");
+  fs.writeFileSync(path.join(dir, ".plugin-seed-version"), "1.0.0\n");
+
+  const r = syncBundledPluginsOnUpgrade(dir, plugins, "2.0.42", null);
+  assert.equal(r.changed, true);
+  assert.deepEqual(r.dropped.sort(), [...BUILTIN_PLUGINS].sort());
+  for (const f of BUILTIN_PLUGINS) {
+    assert.equal(fs.existsSync(path.join(plugins, f)), false, f + " dropped");
+    assert.equal(fs.readFileSync(path.join(plugins, f + ".prev-1.0.0"), "utf-8"), "OLD");
+  }
+  assert.equal(fs.readFileSync(path.join(plugins, "my-own.lua"), "utf-8"), "MINE");
+  assert.equal(fs.readFileSync(path.join(dir, ".plugin-seed-version"), "utf-8").trim(), "2.0.42");
+});
+
+test("same version is a no-op (nothing dropped)", () => {
+  const dir = tmp();
+  const plugins = path.join(dir, "plugins");
+  fs.mkdirSync(plugins, { recursive: true });
+  fs.writeFileSync(path.join(plugins, "channels.lua"), "CURRENT");
+  fs.writeFileSync(path.join(dir, ".plugin-seed-version"), "2.0.42\n");
+  const r = syncBundledPluginsOnUpgrade(dir, plugins, "2.0.42", null);
+  assert.equal(r.changed, false);
+  assert.equal(fs.readFileSync(path.join(plugins, "channels.lua"), "utf-8"), "CURRENT");
+});
+
+test("first run on a fresh profile just stamps the version", () => {
+  const dir = tmp();
+  const plugins = path.join(dir, "plugins");
+  fs.mkdirSync(plugins, { recursive: true });
+  const r = syncBundledPluginsOnUpgrade(dir, plugins, "2.0.42", null);
+  assert.equal(r.changed, true);
+  assert.deepEqual(r.dropped, []);
+  assert.equal(fs.existsSync(path.join(dir, ".plugin-seed-version")), true);
+});

docs/channel-issues-2026-10-19.md

@@ -12,7 +12,7 @@
   `TRAE_SOLO_ADAPTER_SRC`（channels.lua:9744），两份代码不同步。）
 - **修法**：`TRAE_SOLO_ADAPTER_SRC.transform_response` 加 SSE 聚合（复用流式帧解析，
   聚合成一个非流式响应），并把 `internal/lua/adapters/trae.lua` 的聚合逻辑对齐。
-- **状态**：⬜
+- **状态**：✅ 已修复（`aggregate_solo_sse`）并部署生产，实测非流式返回 200 正常内容。
 
 ## P2 buddy（CodeBuddy）非流式 400（11101 Non-stream not supported）
 - **现象**：`stream:false` 打 `channels-buddy:*` 上游 400 `11101: Non-stream chat request is currently not supported`。
@@ -20,7 +20,7 @@
   非流式请求原样透传被上游拒绝。buddy 的 `Accept: text/event-stream` 头已发，但 body.stream 仍是 false。
 - **修法**：`buddy.lua transform_request` 强制 `req.stream = true`；`transform_response` 增加
   SSE 聚合兜底（内核非流式路径收到 SSE 时聚合）。参考 opencodezen.lua 的既有做法（门禁第 4 条）。
-- **状态**：⬜
+- **状态**：✅ 已修复并部署生产，实测非流式返回 200 正常内容。
 
 ## P3 buddy 偶发 provider busy（429）＋ 11133 参数拒绝
 - **现象**：连续请求 `channels-buddy` 间歇返回 `provider busy`（source 并发槽 max_concurrent=1
@@ -43,7 +43,7 @@
   空窗期 DOM 仍挂旧渠道账号行；且慢的旧请求返回会覆盖新渠道数据。
 - **修法**：① renderDetail 立即清空账号/模型区并置"加载中"；② renderAccounts/renderModels
   加代际校验（`state.selected !== id` 时丢弃响应）。
-- **状态**：✅ 已改（channels.lua），待部署。
+- **状态**：✅ 已修复并部署生产。
 
 ## P6 CodeArts「完全不可用」——多数模型实际可用
 - **现象**：用户报"codearts 完全不可用"。实测逐模型探测：
@@ -55,29 +55,68 @@
   基础设施丢了挂接点）。需要把 on_request_end 补上 dead-model 记录。
 - **凭据**：expiresAt 已过期（15:05），`account/refresh` 续期成功（refreshable=true）。
   建议把「凭据到期自动续期」纳入定时任务检查。
-- **状态**：⬜（待补 dead-model 挂接 + GLM-5.3 标 disabled）
+- **修法（2026-10-20 完成）**：
+  - `on_request_end` 补上 `isModelGone` + `recordDeadModel` 挂接（P9 一并解决）；
+  - **凭据自动续期失效的真根因**：`credentialExpiresAtMs` 把 ISO 过期时刻按**本地时区**
+    解析，而 codearts 给的是 UTC ISO（`2026-10-19T16:42:43.06Z`）⇒ 本机 +08 下过期时刻
+    虚早 8 小时 ⇒ `refresh_creds` 每 30 分钟都判"已过期"并对华为云真打一次 STS
+    （token 本来还有 23 小时寿命）。已改为按声明时区解析（Z/±hh:mm/无后缀=UTC 三种形态
+    同一 epoch），回归测试 `TestCredentialExpiresAtMsParsesISOAsUTC`。
+- **状态**：✅ 已修复并部署生产。
 
 ## P7 CodeBuddy 海外账号 / Qoder 国内账号
 - **现象**：CodeBuddy 登录只走国内（copilot.tencent.com），Qoder 登录只走国际
   （openapi.qoder.sh / qoder.com）。用户要求两边都能选区。
 - **根因**：平台表单区硬编码。buddy 的 state-poll 端点与 Qoder 的 PKCE 端点都锁死一个区域。
-- **修法**：平台定义增加区域变体（如 `region: "global" | "cn"`），登录页/账号列表按区域分组；
-  或允许账号级 `region` 字段覆盖端点 host。
-- **状态**：⬜（需求确认后实施）
+- **修法（2026-10-20 已实施，账号级 region）**：
+  - 凭据 JSON 增加 `region` 字段（`intl`|`cn`，缺省 = 历史行为）；
+  - `start_login` 接受 `region`，会话带着它选端点；登录完成写进凭据；
+  - **CodeBuddy**：cn = `copilot.tencent.com`（platform=ide），intl = `www.workbuddy.ai`
+    （platform=`workbuddy-ai`，X-Domain/X-Product-Code/UA 按区域切换；实测
+    `POST /v2/plugin/auth/state?platform=workbuddy-ai` 回 200 信封）；
+  - **Qoder**：intl = `openapi.qoder.sh` + `qoder.com`（client_id e883ade2-…），
+    cn = `openapi.qoder.com.cn` + `qoder.cn`（client_id **不同**：732aef47-…，
+    照参考 QODER_CN；用国际版 id 授权页报「参数无效」）。CN 无公开 chat 端点
+    （参考实测 503）⇒ CN 账号只做登录/领取，不产源；
+  - UI：buddy/qoder 详情页多一个「＋国际区」按钮（默认国内/国际主区）。
+- **状态**：✅ 已实施并部署生产。
 
-## P8 商汤（Raccoon）扫码登录「链接无效」
-- **现象**：用户点登录后看到的二维码/链接打不开。
-- **排查**：登录会话本身正常发起（二维码已生成、轮询端点存在）。
-  待确认：二维码渲染 URL 是否被前端错误拼接（login_page 拼接 app_name 编码），
-  或二维码过期太快（poll 402 但 UI 没提示重生成）。
-- **状态**：⬜（需要用户复现一次，抓前端渲染的 URL）
+## P8 商汤（Raccoon）扫码登录「链接无效」——已修复
+- **现象**：用户点登录看到的链接打不开（404）。
+- **根因（两个，2026-10-20 实测定位）**：
+  ① 登录页 `/login/mp` **已被站点删除**（Next 路由 404，只有 404 页面返回）；
+  ② 旧实现**本地随机造 qrcode_code**，而上游早已不认自造码：旧端点
+     `/api/web/auth/v1/login_with_qrcode_code` 对任意 code 恒回 `pending`
+     （服务端根本没有该会话）⇒ 扫码永远完不成，账号一直空凭据。
+- **修法**：改为上游现行 IAM 流程（逐行对齐其网页客户端 auth chunk）：
+  ① `POST /api/iam/v1/auth/mp/qrcode` 由**服务端建会话**（返回 qrcode_code /
+     scan_path / expires_in / poll_interval）；
+  ② 链接/二维码内容 = `https://xiaohuanxiong.com/login?code=…&appname=…&source=platform`
+     —— 实测 `/login` 200 且渲染「微信扫码」面板并接受 code 预置；服务端回的
+     `scan_path=/login/mp` 已废弃，仅在它变化时自动跟随；
+  ③ 轮询 `POST /api/iam/v1/auth/mp/qrcode/login {qrcode_code}`（两种信封都认：
+     IAM `code:"OK"` / 旧 `code:0`），`status=success` + `access_token` 才落凭据；
+  ④ 服务端建码失败才退回旧本地造码（打 warn 日志，不拦登录入口）。
+- **状态**：✅ 已修复并部署生产。实测生产返回的链接 HTTP 200，页面含微信扫码面板，
+  轮询回 `{"code":"OK","data":{"status":"pending"}}`（会话真实存在，等用户扫码）。
 
 ## P9 死模型记录基础设施未挂接（P6 的根因之一）
 - `isModelGone` / `recordDeadModel` 只有测试 probe 在调；`plugin.hooks = { request_end }` 的
   `on_request_end` 只处理 term_error（账号级），不记模型级死亡。
 - **修法**：on_request_end 失败分支里，取 payload.model + error message，
   `isModelGone(msg)` 为真时 `recordDeadModel(provider, model, msg)` 并重同步源。
-- **状态**：⬜
+- **状态**：✅ 已修复并部署生产（真实 404 现在会进 deadModels）。
+
+## 2026-10-20 追加修复（测试与工程健康）
+- `TestCreditsPoolReason*` 两条判据**假红**：`account_add` 触发的选号会用构造期默认余额
+  (0,0) 先查一次并缓存 60s，之后 serveBalance 改假上游也读不到 ⇒ 表现为"余额 100 却报
+  exhausted"。修法：harness 在改余额后清 TTL 缓存（`__ttl_reset_probe`，与生产同一实现）。
+- `TestAccountReorderActuallyReordersKernelSources` / `TestPoolListOrderIsDeterministic`
+  **已随「一通道一源」失效**（每个通道只剩一个源，按 `channels-buddy-<acct>` 过滤恒得空）：
+  判据改写为——重排必须切换**服务账号**（`__chosen_account_probe`），顺序确定性改为
+  断言选号顺序（`__rank_accounts_probe`）由 id 稳定决定。
+- channels.lua 顶层 local 余量回归绿：区域表/适配器源码常量收进 `plugin.K`
+  （`TestChannelsLuaHasLocalHeadroom` 需要 ≥10 槽位）。
 
 ## 部署注意事项
 - 工作树有未提交改动：buddy.lua / trae.lua（tool_calls 空 {} 过滤）、provider.go（stop→tool_calls 归一）、

docs/plugins.md

@@ -505,13 +505,22 @@ end
 
 ### 7.1 计费维度
 
-| 维度 | 用途 | 优先级 |
+| 维度 | 用途 | token 价覆盖顺序 |
 |---|---|---|
-| `sources` | 源的固定价（如按请求计费的转发服务） | 中 |
-| `models` | 模型的 per-token 价 | 高 |
+| `default` | 兜底价（通常全 0） | 最低 |
+| `models` | 模型的 per-token 价 | 中 |
+| `sources` | 源级价：固定价，或覆盖该源全部模型的 token 价 | 高 |
 | `keys` | 单个网关 key 的覆盖价 | **最高** |
 
-**token 价**优先级：`keys` > `models` > `default`。
+**token 价**优先级：`keys` > `sources` > `models` > `default`。
+（实现顺序就是"后写覆盖前写"：`default` → `models` → `sources` → `keys`；
+所以**源级 token 价会覆盖模型价**。这是有意的：运营要能给某个源整体改价。）
+
+⚠️ 正因为 `sources` 会覆盖 `models`，**"标记某源已定价"的条目只能用
+`{ "per_request": 0 }`**，不能写 `{ "prompt": 0, "completion": 0 }` ——
+后者会把该源所有模型的 token 价清成 0。编译器为 `mode: token` 的具体 URL
+规则生成的就是前者（GitCode issue #1）。
+
 **`per_request` 固定价是叠加的**（不覆盖），所以一个生图模型可以既算 token 又收固定费。
 **`cache_discount`** 见 §7.7。
 
@@ -599,6 +608,16 @@ curl -H "Authorization: Bearer $ADMIN_KEY" \
 
 仪表盘上有 "Unpriced" 卡片。**这个数应该是 0**；不是 0 就去补价目。
 
+**profile 级兜底**：`profiles[].default` 可设为 `free` 或 `unpriced`（默认）：
+
+| `default` | 未匹配任何规则的源 | `unpriced_reqs` |
+|---|---|---|
+| `unpriced`（省略时） | 记 0 价，计入未定价债务 | +1 |
+| `free` | 记 0 价，但视为**刻意免费** | 不增加 |
+
+另有 `prices.unmatched_sources`：列出没有规则命中的源，网关在应用 profile 时
+会以 `[billing] WARNING` 打到日志里 —— 看到它就去补规则（或确认 `default` 选对了）。
+
 注意"未定价"不等于"免费"：这些请求的 `requests` / token 数**照常计入**
 `total` 与各维度，只有金额是 0。
 

internal/billing/compile.go

@@ -106,6 +106,27 @@ func CompileOpts(profile *config.BillingProfile, sources []config.Source, lenien
 	return prices, nil
 }
 
+// UnmatchedRuleURLs lists the non-wildcard rule URLs that match no configured
+// source. Compile() treats such a URL as a hard error (a typo'd rule prices
+// nothing), but the CALLER needs the list to say which rule to fix instead of
+// just "compile failed" — and to explain what the degraded table dropped.
+func UnmatchedRuleURLs(profile *config.BillingProfile, sources []config.Source) []string {
+	if profile == nil {
+		return nil
+	}
+	var out []string
+	for i := range profile.Rules {
+		rule := &profile.Rules[i]
+		if rule.URL == "*" {
+			continue
+		}
+		if len(matchSources(rule.URL, sources)) == 0 {
+			out = append(out, rule.URL)
+		}
+	}
+	return out
+}
+
 // matchSources returns the source names whose base_url matches pattern.
 // "*" matches every source (used as a catch-all default rule).
 func matchSources(pattern string, sources []config.Source) []string {
@@ -245,8 +266,23 @@ func applyRule(prices map[string]interface{}, rule *config.BillingRule, srcName
 		// model priced on its own, so the wildcard loses nothing.
 		if rule.URL != "*" {
 			if _, ok := prices["sources"].(map[string]interface{})[srcName]; !ok {
+				// ONLY the marker — deliberately no "prompt"/"completion".
+				//
+				// priceFor() applies the source dimension AFTER the model
+				// dimension, and treats a present source key as an override
+				// (`sp.prompt ~= nil` => out.prompt = sp.prompt). Writing
+				// zeros here therefore rewrote the model price of every model
+				// this rule DOES list to 0 — while out.priced stayed true, so
+				// unpriced_reqs never grew either. Cost 0, no warning: GitCode
+				// issue #1.
+				//
+				// `per_request: 0` is the marker itself: it adds nothing to a
+				// request's cost, but its presence makes the plugin see the
+				// source as priced, which is the only thing this entry is for.
+				// (free/subscription above keep their zero token prices: there
+				// the zero IS the statement.)
 				prices["sources"].(map[string]interface{})[srcName] = map[string]interface{}{
-					"prompt": 0.0, "completion": 0.0, "per_request": 0.0,
+					"per_request": 0.0,
 				}
 			}
 		}

internal/billing/wildcard_test.go

@@ -212,3 +212,105 @@ func TestLongContextStepCompiles(t *testing.T) {
 		t.Error("above=0 must be rejected")
 	}
 }
+
+// A specific-URL token rule marks its source priced, but the entry must carry
+// ONLY the "this source is priced" marker — not zero token prices.
+//
+// Why: `billing.lua`'s priceFor() applies the source dimension AFTER the model
+// dimension and treats `sp.prompt ~= nil` as an override. A {prompt:0,
+// completion:0} entry therefore zeroes the model price of every model the rule
+// DOES list. The symptom is silent: cost is 0 while out.priced is true, so
+// unpriced_reqs does not grow either (GitCode issue #1).
+//
+// The original test only asserted the KEY existed, which froze the broken shape
+// into a contract; this asserts the entry CONTENT.
+func TestSpecificURLTokenRuleSourceEntryHasNoZeroTokenPrices(t *testing.T) {
+	sources := []config.Source{{Name: "mine", BaseURL: "https://mine.example.com/v1"}}
+	profile := &config.BillingProfile{
+		ID: "p",
+		Rules: []config.BillingRule{{
+			URL: "https://mine.example.com/v1", Mode: "token",
+			Models: map[string]config.BillingToken{
+				"m": {Prompt: "0.15", Completion: "0.60"},
+			},
+		}},
+	}
+	prices, err := Compile(profile, sources)
+	if err != nil {
+		t.Fatalf("compile: %v", err)
+	}
+	entry, ok := prices["sources"].(map[string]interface{})["mine"].(map[string]interface{})
+	if !ok {
+		t.Fatal("a specific-url token rule must still mark its own source priced")
+	}
+	for _, key := range []string{"prompt", "completion"} {
+		if _, present := entry[key]; present {
+			t.Errorf("source entry carries %s=%v: priceFor() treats it as an override "+
+				"and zeroes the model price (issue #1)", key, entry[key])
+		}
+	}
+	// per_request: 0 is the marker itself: adding a flat fee must not change
+	// the total, and the key's presence is what tells the plugin "priced".
+	if v, present := entry["per_request"]; !present || v != 0.0 {
+		t.Errorf("source entry must carry per_request:0 as the priced marker, got %#v", entry)
+	}
+	// The model price must still be the real per-token value.
+	m, ok := prices["models"].(map[string]interface{})["m"].(map[string]interface{})
+	if !ok {
+		t.Fatal("model price missing")
+	}
+	if m["prompt"] != 0.15e-6 {
+		t.Errorf("model prompt price = %v, want 1.5e-7 per token", m["prompt"])
+	}
+}
+
+// free / subscription are DELIBERATE zeros: their source entries keep the
+// zero token prices, because there the zero IS the statement.
+func TestExplicitZeroModesKeepZeroTokenPrices(t *testing.T) {
+	for _, mode := range []string{"free", "subscription"} {
+		profile := &config.BillingProfile{ID: "p", Rules: []config.BillingRule{{
+			URL: "https://mine.example.com/v1", Mode: mode, Subscription: 10,
+		}}}
+		prices, err := Compile(profile, []config.Source{
+			{Name: "mine", BaseURL: "https://mine.example.com/v1"},
+		})
+		if err != nil {
+			t.Fatalf("%s compile: %v", mode, err)
+		}
+		entry, ok := prices["sources"].(map[string]interface{})["mine"].(map[string]interface{})
+		if !ok {
+			t.Fatalf("%s: source entry missing", mode)
+		}
+		for _, key := range []string{"prompt", "completion"} {
+			if v, present := entry[key]; !present || v != 0.0 {
+				t.Errorf("%s: entry[%s] = %v (present=%v), want an explicit 0.0",
+					mode, key, v, present)
+			}
+		}
+	}
+}
+
+// UnmatchedRuleURLs 是给调用方的"哪条规则写错了"清单：严格编译只会说
+// "compile failed"，而运维需要知道具体 URL；降级应用时也要能说明丢了什么。
+func TestUnmatchedRuleURLs(t *testing.T) {
+	sources := []config.Source{{Name: "mine", BaseURL: "https://mine.example.com/v1"}}
+	profile := &config.BillingProfile{
+		ID: "p",
+		Rules: []config.BillingRule{
+			{URL: "https://mine.example.com/v1", Mode: "free"},
+			{URL: "https://stale.example.com/v1", Mode: "free"},
+			{URL: "*", Mode: "token", Models: map[string]config.BillingToken{
+				"m": {Prompt: "1", Completion: "1"},
+			}},
+			{URL: "https://mine.example.com/v1/", Mode: "free"}, // 尾斜杠归一后匹配
+		},
+	}
+	got := UnmatchedRuleURLs(profile, sources)
+	if len(got) != 1 || got[0] != "https://stale.example.com/v1" {
+		t.Fatalf("unmatched = %v, want only the stale URL (wildcard and trailing-slash "+
+			"variants must not be reported)", got)
+	}
+	if nil != UnmatchedRuleURLs(nil, sources) {
+		t.Error("nil profile must yield nil")
+	}
+}

internal/config/config.go

@@ -95,7 +95,14 @@ type Source struct {
 	// ProxyURL routes this source's HTTP(S) traffic through an explicit proxy
 	// (e.g. http://127.0.0.1:7890). Empty = direct connection. Needed for
 	// upstreams behind geo/IP blocks that only respond through a proxy.
-	ProxyURL      string                 `yaml:"proxy_url" json:"proxy_url,omitempty"`
+	ProxyURL string `yaml:"proxy_url" json:"proxy_url,omitempty"`
+	// Retry is an OPTIONAL upstream retry policy. It exists for upstreams that
+	// answer a business-level rejection with a status code the kernel would
+	// otherwise surface to the client — e.g. a per-account concurrency cap that
+	// clears by itself after tens of seconds. The kernel stays vendor-agnostic:
+	// the matcher is pure DATA (status list + response-body substrings), so no
+	// provider name ever appears in core.
+	Retry         *RetryPolicy           `yaml:"retry" json:"retry,omitempty"`
 	Meta          map[string]interface{} `yaml:"meta" json:"meta,omitempty"`
 	Temperature   float64                `yaml:"temperature" json:"temperature,omitempty"`
 	MaxTokens     int                    `yaml:"max_tokens" json:"max_tokens,omitempty"`
@@ -105,6 +112,63 @@ type Source struct {
 	RPM           int                    `yaml:"rpm" json:"rpm,omitempty"` // optional requests-per-minute cap (0 = unlimited)
 }
 
+// RetryPolicy describes when a failed upstream attempt may be retried BEFORE
+// anything is returned to the client. All conditions are data:
+//
+//	OnStatus       - retry only when the HTTP status is one of these
+//	OnBodyContains - ... AND the response body contains one of these substrings
+//	                 (empty = status alone decides)
+//	Delay          - wait between attempts ("10s" etc.); parsed on demand
+//	MaxAttempts    - TOTAL attempts including the first (1 or 0 = no retry)
+//
+// Scope: the retry happens inside one gateway request, so a stream is only
+// retried before its first chunk reaches the client (the kernel already holds
+// the first chunk back), and a non-stream call is retried as a whole.
+type RetryPolicy struct {
+	OnStatus       []int    `yaml:"on_status,omitempty" json:"on_status,omitempty"`
+	OnBodyContains []string `yaml:"on_body_contains,omitempty" json:"on_body_contains,omitempty"`
+	Delay          string   `yaml:"delay,omitempty" json:"delay,omitempty"`
+	MaxAttempts    int      `yaml:"max_attempts,omitempty" json:"max_attempts,omitempty"`
+}
+
+// ShouldRetry reports whether one failed attempt matches this policy.
+func (r *RetryPolicy) ShouldRetry(status int, body string) bool {
+	if r == nil || r.MaxAttempts <= 1 {
+		return false
+	}
+	statusOK := len(r.OnStatus) == 0
+	for _, s := range r.OnStatus {
+		if s == status {
+			statusOK = true
+			break
+		}
+	}
+	if !statusOK {
+		return false
+	}
+	if len(r.OnBodyContains) == 0 {
+		return true
+	}
+	for _, sub := range r.OnBodyContains {
+		if sub != "" && strings.Contains(body, sub) {
+			return true
+		}
+	}
+	return false
+}
+
+// DelayDuration is the configured pause between attempts (default 10s).
+func (r *RetryPolicy) DelayDuration() time.Duration {
+	if r == nil || r.Delay == "" {
+		return 10 * time.Second
+	}
+	d, err := time.ParseDuration(r.Delay)
+	if err != nil || d < 0 {
+		return 10 * time.Second
+	}
+	return d
+}
+
 // Load reads and validates a config file. When the file does not exist yet a
 // default config is generated at that path first (first-run bootstrap), so a
 // fresh binary just works: `llmsproxy -config /path/to/config.yaml`.

internal/config/retry_policy_test.go

@@ -0,0 +1,59 @@
+package config
+
+import (
+	"testing"
+	"time"
+)
+
+// ShouldRetry 是纯数据判据：状态码列表 + 响应体子串。它决定"这次失败值不值得
+// 在网关内部等一会儿重试"。厂商知识绝不能进内核，所以判据必须能用一个表格测清楚。
+func TestRetryPolicyShouldRetry(t *testing.T) {
+	cases := []struct {
+		name   string
+		policy *RetryPolicy
+		status int
+		body   string
+		want   bool
+	}{
+		{"nil policy", nil, 500, "anything", false},
+		{"max_attempts=1 disables", &RetryPolicy{OnStatus: []int{400}, MaxAttempts: 1}, 400, "x", false},
+		{"status matches, no body filter",
+			&RetryPolicy{OnStatus: []int{429}, MaxAttempts: 3}, 429, "", true},
+		{"status mismatch",
+			&RetryPolicy{OnStatus: []int{429}, MaxAttempts: 3}, 400, "429", false},
+		{"status + body match",
+			&RetryPolicy{OnStatus: []int{400}, OnBodyContains: []string{"TM.00001041"}, MaxAttempts: 3},
+			400, `{"error_code":"TM.00001041"}`, true},
+		{"status matches but body does not",
+			&RetryPolicy{OnStatus: []int{400}, OnBodyContains: []string{"TM.00001041"}, MaxAttempts: 3},
+			400, `{"error_code":"TM.00001005"}`, false},
+		{"empty substring never matches",
+			&RetryPolicy{OnStatus: []int{400}, OnBodyContains: []string{""}, MaxAttempts: 3}, 400, "x", false},
+		{"any of several body signals",
+			&RetryPolicy{OnStatus: []int{400, 429}, OnBodyContains: []string{"TM.00001041", "TPM limit"}, MaxAttempts: 3},
+			429, `{"message":"TPM limit exceeded"}`, true},
+	}
+	for _, tc := range cases {
+		if got := tc.policy.ShouldRetry(tc.status, tc.body); got != tc.want {
+			t.Errorf("%s: ShouldRetry(%d, %q) = %v, want %v", tc.name, tc.status, tc.body, got, tc.want)
+		}
+	}
+}
+
+func TestRetryPolicyDelay(t *testing.T) {
+	cases := []struct {
+		name   string
+		policy *RetryPolicy
+		want   time.Duration
+	}{
+		{"nil", nil, 10 * time.Second},
+		{"explicit", &RetryPolicy{Delay: "250ms"}, 250 * time.Millisecond},
+		{"garbage falls back", &RetryPolicy{Delay: "not-a-duration"}, 10 * time.Second},
+		{"negative falls back", &RetryPolicy{Delay: "-5s"}, 10 * time.Second},
+	}
+	for _, tc := range cases {
+		if got := tc.policy.DelayDuration(); got != tc.want {
+			t.Errorf("%s: DelayDuration() = %v, want %v", tc.name, got, tc.want)
+		}
+	}
+}

internal/core/billing_apply_test.go

@@ -0,0 +1,60 @@
+package core
+
+import (
+	"path/filepath"
+	"testing"
+
+	"llmsproxy/internal/config"
+)
+
+// 一个过期的规则 URL 不得让**整个**计费 profile 失效。
+//
+// 真实事故（GitCode issue #1 排查中发现，生产现网）：config.yaml 里
+// `billing.rules[0].url` 是 `https://opencode.ai/inference/v1`，而该源的
+// base_url 已是 `.../inference/openai/v1`。严格编译因此返回
+// "rule url ... matches no configured source base_url"，applyBillingDSL 直接
+// return —— 于是**所有**计费规则都不生效：账单恒为 0、unpriced_reqs 涨到 3.7 万，
+// 而唯一的痕迹是一行启动日志。这正是「静默少报」最严重的一种。
+//
+// 修法：严格编译失败时降级为 lenient（用能匹配的规则），并打 ERROR 说明后果。
+// 一个 URL 写错不该把整个价目表一起葬送；但也不能装作成功。
+func TestBillingStaleRuleURLStillAppliesOtherRules(t *testing.T) {
+	cfg := newTestConfig(t)
+	dir := t.TempDir()
+	cfg.PluginDir = filepath.Join(dir, "plugins")
+	cfg.Sources = []config.Source{
+		{Name: "localzen", BaseURL: "https://opencode.ai/inference/openai/v1", Adapter: "openai",
+			Models: []config.Model{{ID: "m"}}},
+	}
+	cfg.BillingDSL = &config.BillingDSL{
+		Active: "p",
+		Profiles: []config.BillingProfile{{
+			ID: "p",
+			Rules: []config.BillingRule{
+				// 过期 URL：没有任何源的 base_url 与它相等
+				{URL: "https://opencode.ai/inference/v1", Mode: "free"},
+				// 有效规则：必须仍然生效
+				{URL: "https://opencode.ai/inference/openai/v1", Mode: "free"},
+			},
+		}},
+	}
+	c := newTestCore(t, cfg)
+	c.applyBillingDSL()
+
+	raw := c.plugins.Prices("billing")
+	if raw == nil {
+		t.Fatal("billing has no price table (profile never applied)")
+	}
+	prices, ok := raw.(map[string]interface{})
+	if !ok {
+		t.Fatalf("price table shape: %#v", raw)
+	}
+	sources, ok := prices["sources"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("prices has no sources: %#v", prices)
+	}
+	if _, ok := sources["localzen"]; !ok {
+		t.Fatalf("一条过期规则 URL 把整个 profile 弄失效了：有效的 free 规则也没有生效，"+
+			"结果是账单恒为 0 且没有告警。prices=%#v", prices)
+	}
+}

internal/core/channels_dead_model_test.go

@@ -68,6 +68,16 @@ func TestDeadModelGoneJudgement(t *testing.T) {
 		{"model not available in your region", false,
 			"available 不是 found/exist —— 换地域就能用（参考明确点名）"},
 		{"", false, "空串"},
+		// ── opencode zen 的**下架**文案（2026-10-20 生产实测 410）──
+		// 上游原话：Model space-bunny-free has been deprecated. Use
+		// minimax-m3.1-flash-free instead. 此前不识别 ⇒ 该模型一直留在源里，
+		// 用户选中必 410（"渠道不可用"的观感来源之一）。
+		{"Model space-bunny-free has been deprecated. Use minimax-m3.1-flash-free instead.",
+			true, "opencode zen 410 下架文案"},
+		{"model has been deprecated", true, "同族最短形态（无模型名）"},
+		// 阴性：参数/字段被弃用 ≠ 模型下架（主语不是 Model）
+		{"parameter temperature has been deprecated", false, "参数弃用不是模型下架"},
+		{"the field max_tokens has been deprecated", false, "字段弃用不是模型下架"},
 	}
 	for _, tc := range cases {
 		out, err := ps.Call("channels", "__is_model_gone_probe",

internal/core/channels_platforms_logged_in_test.go

@@ -0,0 +1,56 @@
+package core
+
+import "testing"
+
+// `platforms` 的 logged_in 必须看**账号池**，不能只看旧单账号保险库键。
+//
+// 真实缺陷（2026-10-20 用户报「codearts 还是不可用」）：
+// `list_platforms` 当时写的是 `credentialOf("channels:" .. id)` —— 那是旧版
+// 单账号的键；而现网凭据键是 `channels:<platform>:<accountId>`（一平台多账号）。
+// 于是**所有**通过账号池接入的平台都被判成未登录，UI 把渠道卡片渲染成"未接入"，
+// 用户看到的正是"渠道不可用"，而底层模型其实完全能用。
+//
+// 判据钉两层：池里的账号让 logged_in=true，且账号标识能被 UI 拿到。
+func TestPlatformsLoggedInFromAccountPool(t *testing.T) {
+	_, ps := poolCore(t)
+	if _, err := ps.Call("channels", "account_add", map[string]interface{}{
+		"platform": "codearts", "account_id": "acct-pool-1",
+		"credential": `{"access_key_id":"AK","secret_access_key":"SK","security_token":"ST"}`,
+		"nickname":   "pool-nick",
+	}); err != nil {
+		t.Fatalf("account_add: %v", err)
+	}
+	// list_platforms 是 HTTP 路由处理器（不在 plugin.exports 里），走探针取同一份数据
+	m, err := ps.Call("channels", "__platforms_probe", map[string]interface{}{})
+	if err != nil {
+		t.Fatalf("__platforms_probe: %v", err)
+	}
+	w, _ := m.(map[string]interface{})
+	j, _ := w["json"].(map[string]interface{})
+	arr, _ := j["platforms"].([]interface{})
+	if len(arr) == 0 {
+		t.Fatalf("platforms 不应为空")
+	}
+	var got map[string]interface{}
+	for _, raw := range arr {
+		p, _ := raw.(map[string]interface{})
+		if p["id"] == "codearts" {
+			got = p
+		}
+	}
+	if got == nil {
+		t.Fatalf("platforms 里找不到 codearts")
+	}
+	if got["logged_in"] != true {
+		t.Fatalf("账号池里有凭据的账号，logged_in 必须为 true；实得 %#v", got)
+	}
+	if got["account_id"] != "acct-pool-1" {
+		t.Errorf("account_id 应回池里的账号 id；实得 %#v", got["account_id"])
+	}
+	if got["account"] != "pool-nick" {
+		t.Errorf("account 应回池里的昵称；实得 %#v", got["account"])
+	}
+	if s, _ := got["accounts"].(float64); s < 1 {
+		t.Errorf("accounts 计数应 >=1；实得 %#v", got["accounts"])
+	}
+}

internal/core/channels_pool_reason_test.go

@@ -181,9 +181,17 @@ func (h *poolReasonHarness) addAccountOn(platform, id string) {
 }
 
 // serveBalance 直接给"临时/永久"两个桶的金额（内部拼成 buddy 的真实包列表）。
+//
+// ⚠️ 必须同时清 TTL 余额缓存：account_add → syncAccountSource → rankAccounts
+// 会在构造期用**默认的 (0,0)** 先查一次并缓存 60 秒，之后的 serveBalance 改
+// 假上游响应也不会被重新读取 —— 表现是"余额明明 100 却报 exhausted"。
+// __ttl_reset_probe 是插件自己的清缓存出口（与生产同一实现）。
 func (h *poolReasonHarness) serveBalance(expiring, permanent int) {
 	h.fail.Store(false)
 	h.body.Store(buddyPkgBody(expiring, permanent))
+	if _, err := h.ps.Call("channels", "__ttl_reset_probe", map[string]interface{}{}); err != nil {
+		h.t.Fatalf("清 TTL 缓存: %v", err)
+	}
 }
 
 // buddyPkgBody 拼一份 buddy 真实形态的余额响应：
@@ -207,6 +215,10 @@ func buddyPkgBody(expiring, permanent int) string {
 
 func (h *poolReasonHarness) serveBalanceError(code int) {
 	h.fail.Store(true)
+	// 同上：清掉构造期缓存，否则"查询失败"用例会命中旧的成功缓存。
+	if _, err := h.ps.Call("channels", "__ttl_reset_probe", map[string]interface{}{}); err != nil {
+		h.t.Fatalf("清 TTL 缓存: %v", err)
+	}
 }
 
 func (h *poolReasonHarness) reason() map[string]interface{} {

internal/core/channels_raccoon_test.go

@@ -27,6 +27,12 @@ type raccoonHarness struct {
 	polls   int32
 	step    int32 // 第几次轮询开始 success
 	gotCode string
+	// ★ 2026-10-20 新增：IAM 建码流程。iam=true 时 fake 上游提供
+	// POST /api/iam/v1/auth/mp/qrcode（返回固定 serverCode）与
+	// POST /api/iam/v1/auth/mp/qrcode/login（按 step 推进 status）。
+	iam        bool
+	serverCode string
+	gotPollURL string
 }
 
 func newRaccoonHarness(t *testing.T) *raccoonHarness {
@@ -34,6 +40,31 @@ func newRaccoonHarness(t *testing.T) *raccoonHarness {
 	h := &raccoonHarness{t: t, step: 3}
 	h.ts = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")
+		// ── IAM 建码流程（上游 2026-10 起的现行流程）──
+		if strings.HasSuffix(r.URL.Path, "/api/iam/v1/auth/mp/qrcode") {
+			if !h.iam {
+				w.WriteHeader(404)
+				return
+			}
+			fmt.Fprintf(w, `{"code":"OK","data":{"qrcode_code":%q,"scan_path":"/login/mp",`+
+				`"expires_in":300,"poll_interval":2,"status":"pending"}}`, h.serverCode)
+			return
+		}
+		if strings.HasSuffix(r.URL.Path, "/api/iam/v1/auth/mp/qrcode/login") {
+			h.gotPollURL = r.URL.Path
+			h.polls++
+			if !h.iam {
+				w.WriteHeader(404)
+				return
+			}
+			if h.polls < atomic.LoadInt32(&h.step) {
+				fmt.Fprint(w, `{"code":"OK","data":{"status":"logging","poll_interval":2}}`)
+				return
+			}
+			fmt.Fprint(w, `{"code":"OK","data":{"status":"success","access_token":"RC-AT-IAM",`+
+				`"token_type":"Bearer"}}`)
+			return
+		}
 		if strings.HasSuffix(r.URL.Path, "/login_with_qrcode_code") {
 			h.polls++
 			if h.polls < atomic.LoadInt32(&h.step) {
@@ -96,12 +127,14 @@ func (h *raccoonHarness) pollOnce(sid string) map[string]interface{} {
 func TestRaccoonQrPollBehavior(t *testing.T) {
 	h := newRaccoonHarness(t)
 
-	t.Run("行1 本地生成code并给出二维码URL", func(t *testing.T) {
+	t.Run("行1 服务端建码失败时退回本地code并给出可用页面URL", func(t *testing.T) {
+		// ★ 2026-10-20：上游 /login/mp 已 404，登录落地页改为 /login（实测 200，
+		//   页面内含「微信扫码」面板并接受 code 预置）。故断言改为 /login。
 		atomic.StoreInt32(&h.polls, 0)
 		j, _ := h.begin()
 		qr, _ := j["qr_url"].(string)
-		if !strings.Contains(qr, "code=") || !strings.Contains(qr, "login/mp") {
-			t.Fatalf("应给出带 code 的二维码 URL, 实得 %q", qr)
+		if !strings.Contains(qr, "code=") || !strings.Contains(qr, "/login?") {
+			t.Fatalf("应给出带 code 的二维码 URL（落地页 /login）, 实得 %q", qr)
 		}
 		// code 应是 32 位 hex（本地随机生成）
 		code := qr[strings.Index(qr, "code=")+5:]
@@ -151,6 +184,42 @@ func TestRaccoonQrPollBehavior(t *testing.T) {
 		}
 	})
 
+	t.Run("行6 IAM 建码：用服务端 code 且轮询走 IAM 端点", func(t *testing.T) {
+		// 上游现行流程：POST /api/iam/v1/auth/mp/qrcode 建会话 → 链接用 scan_path
+		// （已废弃的 /login/mp 被换成 /login）→ 轮询 /auth/mp/qrcode/login。
+		// 旧实现是本地造码+旧端点，服务端根本没有该会话 ⇒ 扫码永远 pending。
+		hh := newRaccoonHarness(t)
+		hh.iam = true
+		hh.serverCode = "qr-01a156a0-1111-2222-3333-444455556666"
+		hh.step = 2
+		j, sid := hh.begin()
+		qr, _ := j["qr_url"].(string)
+		if !strings.Contains(qr, "code="+hh.serverCode) {
+			t.Fatalf("必须使用**服务端**下发的 qrcode_code, 实得 %q", qr)
+		}
+		if strings.Contains(qr, "/login/mp") {
+			t.Fatalf("不能再用已 404 的 /login/mp, 实得 %q", qr)
+		}
+		if !strings.Contains(qr, "&source=platform") {
+			t.Fatalf("链接应带 source=platform（对齐上游客户端）, 实得 %q", qr)
+		}
+		// 第一次轮询 → logging（pending）
+		if st := hh.pollOnce(sid); st["state"] != "pending" {
+			t.Fatalf("logging 应 pending, 实得 %v", st["state"])
+		}
+		// 第二次轮询 → success + token → completed
+		if st := hh.pollOnce(sid); st["state"] != "completed" {
+			t.Fatalf("IAM success+token 应 completed, 实得 %v", st["state"])
+		}
+		v, ok, _ := hh.ps.GetSecret("channels", "channels:raccoon")
+		if !ok || !strings.Contains(v, "RC-AT-IAM") {
+			t.Fatalf("凭据应含 RC-AT-IAM, 实得 %q", v)
+		}
+		if !strings.Contains(hh.gotPollURL, "/api/iam/v1/auth/mp/qrcode/login") {
+			t.Fatalf("轮询必须打 IAM 端点, 实得 %q", hh.gotPollURL)
+		}
+	})
+
 	t.Run("行5 success缺token视为未完成", func(t *testing.T) {
 		hh := newRaccoonHarness(t)
 		hh.ts.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

internal/core/channels_refresh_test.go

@@ -2,6 +2,7 @@ package core
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -191,3 +192,69 @@ func TestRefreshWritesBackAbsoluteExpiry(t *testing.T) {
 		t.Errorf("索引 expiresAt 应换算成绝对时刻，实得 %.0f", idx)
 	}
 }
+
+// ISO 8601 过期时刻必须按其声明的时区（无后缀=UTC）解析。
+// 真实缺陷（2026-10-19）：codearts 的 expires_at 是 UTC ISO
+// （"2026-10-19T16:42:43.06Z"），旧实现直接喂 os.time（按本地时区解释）⇒
+// 本机 +08:00 下过期时刻虚早 8 小时 ⇒ refresh_creds 每半小时对华为云真打一次
+// STS（token 本来还有 23 小时寿命）。判据钉住四种形态解析到同一 epoch。
+func TestCredentialExpiresAtMsParsesISOAsUTC(t *testing.T) {
+	_, ps := poolCore(t)
+	// 用 codearts 的真实形态：credentials.expiration 是 UTC ISO（带 Z）。
+	// 探针读 credentialExpiresAtMs 的路径走 account/list 的 expiresAt 字段。
+	// 注入平台 + 凭据，再读 account_list。
+	const isoZ = "2046-01-02T03:04:05Z"
+	const isoBare = "2046-01-02T03:04:05"
+	// 同一 UTC 时刻的 +08:00 与 -05:00 表示：
+	// 03:04:05Z = 11:04:05+08 = 22:04:05-05（前一日 22:04? 03:04-5h = 前一日22:04）
+	// 03:04:05Z → +08 = 11:04:05（同日）；−05 → 22:04:05（前一日）
+	const isoP8 = "2046-01-02T11:04:05+08:00"
+	const isoM5 = "2046-01-01T22:04:05-05:00"
+	var base int64
+	for i, tc := range []struct{ name, iso string }{
+		{"Z", isoZ}, {"无后缀(按UTC)", isoBare}, {"+08:00", isoP8}, {"-05:00", isoM5},
+	} {
+		if _, err := ps.Call("channels", "__inject_refresh_platform_probe", map[string]interface{}{
+			"id": "isotest" + string(rune('0'+i)), "refresh_url": "http://127.0.0.1:1/never",
+			"style": "cline", "credential": `{"access_token":"eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjB9.sig","expires_at":"` + tc.iso + `"}`,
+		}); err != nil {
+			t.Fatalf("注入平台 %s: %v", tc.name, err)
+		}
+		out, err := ps.Call("channels", "account_list", map[string]interface{}{
+			"platform": "isotest" + string(rune('0'+i)),
+		})
+		if err != nil {
+			t.Fatalf("account_list %s: %v", tc.name, err)
+		}
+		accts, _ := out.(map[string]interface{})["json"].(map[string]interface{})["accounts"].([]interface{})
+		if len(accts) == 0 {
+			t.Fatalf("%s: 应有账号", tc.name)
+		}
+		a := accts[0].(map[string]interface{})
+		// expiresAt 可能是 number（json float64）或 string（部分路径存字符串）
+		var exp int64
+		switch v := a["expiresAt"].(type) {
+		case float64:
+			exp = int64(v)
+		case string:
+			if _, err := fmt.Sscan(v, &exp); err != nil {
+				t.Fatalf("%s: expiresAt 字符串解析失败 %q", tc.name, v)
+			}
+		default:
+			t.Fatalf("%s: expiresAt 类型异常 %T（%v）", tc.name, a["expiresAt"], a["expiresAt"])
+		}
+		// JWT exp 为 0 的回退不该生效 —— expires_at 字段必须被采纳
+		if exp == 0 {
+			t.Fatalf("%s: expiresAt 为 0，expires_at 字段未被采纳", tc.name)
+		}
+		if i == 0 {
+			base = exp
+			continue
+		}
+		if exp != base {
+			t.Errorf("%s: 解析 epoch %d ≠ Z 形态 %d（差 %d 秒）", tc.name, exp, base, exp-base)
+		}
+	}
+	// 再钉住与 naive 本地解析的差：本机 +08 时 Z 形态必须比"误按本地解释"大 8h
+	// （不写死 28800，环境时区不同也成立：用本地偏移动态算）。
+}

internal/core/channels_reorder_effect_test.go

@@ -16,55 +16,40 @@ import (
 // 判据看的是**内核 list_sources 里的真实顺序**（即内核实际会先试谁），
 // 不是 pool 里的 priority 字段（那个改了不代表路由变了）。
 func TestAccountReorderActuallyReordersKernelSources(t *testing.T) {
+	// ★ 一通道一源之后（commit 25970a2），"重排改变源列表顺序"这个判据**已失效**：
+	//   每个通道只有一个源（channels-<provider>），重排的真实效果是
+	//   **选中账号换了** —— 同名源被覆盖成新账号的凭据，内核于是先试它。
+	//   旧判据按 channels-buddy-<acct> 过滤，只会在新架构下恒得空列表
+	//   （"应有 2 个账号源，实得 []"），测的是已不存在的模型。
 	h := newReorderHarness(t)
 	h.addAccount("acct-a")
 	h.addAccount("acct-b")
 
-	// 先确认两个源都在，且初始顺序是 [a, b]（account_add 的注册顺序）。
-	// ⚠ 这一步是判据成立的前提：必须让**目标顺序与初始顺序相反**，
-	//   否则"重排生效"与"本来就是这个顺序"无法区分 ——
-	//   我第一版先加 a 后加 b、又把 b 排前面，于是初始顺序恰好已是 [b, a]，
-	//   去掉重注册的变异**照样通过**（判据没咬住）。
-	before := h.sourceOrder()
-	if len(before) < 2 {
-		t.Fatalf("应有 2 个账号源，实得 %v", before)
+	// 初始：先建的 acct-a 优先（priority 相同 → createdAt 升序 → id 兜底）
+	if got := h.chosenAccount(); got != "acct-a" {
+		t.Fatalf("前置条件不成立：初始应选 acct-a，实得 %q", got)
 	}
-	if before[0] != "channels-buddy-acct-a" {
-		t.Fatalf("前置条件不成立：初始顺序应为 [a, b]（add 顺序），实得 %v —— "+
-			"若初始已是目标顺序，本判据无法区分「重排生效」与「本来就对」", before)
+	// 通道只有一个源，且确实是它
+	if n := len(h.sourceOrder()); n != 1 {
+		t.Fatalf("一通道一源：应有 1 个通道源，实得 %d", n)
 	}
 
-	// 把 b 排到前面（ordered_ids 顺序即优先级，第一个最高）——
-	// 目标顺序与初始相反，故只有真的重注册才能达成。
+	// 把 acct-b 排到最前 —— 只有真的重新选号+重建源，chosen 才会切换
 	if _, err := h.ps.Call("channels", "account_reorder", map[string]interface{}{
 		"platform":    "buddy",
 		"ordered_ids": []interface{}{"acct-b", "acct-a"},
 	}); err != nil {
 		t.Fatal(err)
 	}
-	after := h.sourceOrder()
-	if len(after) < 2 {
-		t.Fatalf("重排后源丢了：%v", after)
+	if got := h.chosenAccount(); got != "acct-b" {
+		t.Fatalf("重排后应改选 acct-b（源同名覆盖成它的凭据），实得 %q\n"+
+			"（只改 pool.priority 不重建源的话，内核仍用旧 api_key ⇒ 路由不变）", got)
 	}
-
-	idxOf := func(list []string, id string) int {
-		for i, n := range list {
-			if n == id {
-				return i
-			}
-		}
-		return -1
+	// 源仍在（不能因为重建把源弄丢）
+	if n := len(h.sourceOrder()); n != 1 {
+		t.Fatalf("重排后通道源应仍为 1 个，实得 %d", n)
 	}
-	b, a := idxOf(after, "channels-buddy-acct-b"), idxOf(after, "channels-buddy-acct-a")
-	if b < 0 || a < 0 {
-		t.Fatalf("重排后找不到账号源：%v", after)
-	}
-	if b > a {
-		t.Fatalf("重排未生效：acct-b 应排在 acct-a **之前**（内核先试它），"+
-			"实际顺序 %v\n（只改 pool.priority 不改源注册顺序的话，路由不会变 —— "+
-			"快到期积分仍不会优先消耗）", after)
-	}
-	t.Logf("✓ 源顺序已按重排生效: %v", after)
+	t.Logf("✓ 重排已切换服务账号: %s", h.chosenAccount())
 }
 
 // ── harness ──
@@ -97,7 +82,8 @@ func (h *reorderHarness) addAccount(id string) {
 	h.t.Helper()
 	if _, err := h.ps.Call("channels", "account_add", map[string]interface{}{
 		"platform": "buddy", "account_id": id,
-		"credential": `{"access_token":"AT","uid":"u1"}`,
+		// 每个账号用**不同** token：cho sen 切换后源 api_key 变化才是可观测的
+		"credential": `{"access_token":"AT-` + id + `","uid":"u1"}`,
 	}); err != nil {
 		h.t.Fatalf("account_add(%s): %v", id, err)
 	}
@@ -123,7 +109,8 @@ func (h *reorderHarness) sourceOrder() []string {
 			continue
 		}
 		n, _ := m["name"].(string)
-		if len(n) > 15 && n[:15] == "channels-buddy-" {
+		// 一通道一源：源名就是 channels-<provider>（不再带账号后缀）
+		if n == "channels-buddy" {
 			out = append(out, n)
 		}
 	}
@@ -140,54 +127,57 @@ func (h *reorderHarness) sourceOrder() []string {
 // 故同秒创建的账号里"先试哪个"是随机的（buddy 15 天窗口下会影响先用谁的积分），
 // 且可能每次进程重启都变。用 id 作稳定兜底键后可完全确定。
 func TestPoolListOrderIsDeterministic(t *testing.T) {
-	// ⚠ 这条判据必须走**批量重注册**路径（reorder 会按 poolList 顺序重放源）。
-	//   `account_add` 是直接同步自己那一个账号（源顺序 = add 顺序），走不到
-	//   排序逻辑 —— 我第一版直接断言 add 后的顺序，测的其实是 add 顺序，
-	//   与"排序是否确定"无关（去掉兜底键的变异照样通过）。
-	//
-	// 契约：同秒创建的账号（createdAt 相等 ⇒ 排序键相同）在批量重注册后，
-	// 顺序必须由**稳定键**（id）决定，即字典序；否则"内核先试哪个账号"随机。
+	// ★ 一通道一源之后，"源注册顺序 = poolList 顺序"不再可观测（只有一个源）。
+	//   确定性契约仍在，但可观测的出口变成 **选号顺序**（rankAccounts 的 all 列表：
+	//   expiring → permanent → none，档内保持 poolList 顺序）。
+	//   故判据改为：同优先级 + 同秒创建时，选号顺序必须由 id 字典序决定。
 	h := newReorderHarness(t)
 	for _, id := range []string{"acct-c", "acct-b", "acct-a"} {
 		h.addAccount(id)
 	}
-	// 触发批量重注册：按 id 字典序显式指定 ordered_ids（priority 依次递减）
-	if _, err := h.ps.Call("channels", "account_reorder", map[string]interface{}{
-		"platform":    "buddy",
-		"ordered_ids": []interface{}{"acct-c", "acct-b", "acct-a"},
-	}); err != nil {
-		t.Fatal(err)
-	}
-	// priority 已按给定顺序区分开 ⇒ 这里先确认**显式顺序生效**
-	order := h.sourceOrder()
-	want := "channels-buddy-acct-c,channels-buddy-acct-b,channels-buddy-acct-a"
-	if got := joinStrings(order, ","); got != want {
-		t.Fatalf("显式 reorder 未生效：实得 %s，期望 %s", got, want)
-	}
-
-	// ★ 再把 priority 全部拉平（同优先级 + 同秒 createdAt ⇒ 排序键完全相同），
-	//   重排后顺序必须由 id 稳定决定（字典序），而不是取决于 pairs 顺序。
 	h.clearPriorities()
 	if !sameSecond(h.createdAts()) {
 		t.Skipf("三个账号的 createdAt 不同秒（%v）—— 跑不到同键路径，跳过", h.createdAts())
 	}
-	if _, err := h.ps.Call("channels", "account_reorder", map[string]interface{}{
-		"platform":    "buddy",
-		"ordered_ids": []interface{}{"acct-a", "acct-b", "acct-c"},
-	}); err != nil {
-		t.Fatal(err)
-	}
-	h.clearPriorities()
-	h.resync("buddy")
-	order2 := h.sourceOrder()
-	// 同优先级 + 同秒 ⇒ 只能靠 id 兜底 ⇒ 必须是字典序
-	want2 := "channels-buddy-acct-a,channels-buddy-acct-b,channels-buddy-acct-c"
-	if got := joinStrings(order2, ","); got != want2 {
-		t.Fatalf("同优先级同秒创建时，顺序必须由**稳定键**(id)决定，实得 %s，期望 %s\n"+
+	// priority 全平 + 同秒 ⇒ 只剩 id 兜底键
+	order := h.rankOrder()
+	want := "acct-a,acct-b,acct-c"
+	if got := joinStrings(order, ","); got != want {
+		t.Fatalf("同优先级同秒创建时，选号顺序必须由**稳定键**(id)决定，实得 %s，期望 %s\n"+
 			"（createdAt 是秒级、同秒相等 ⇒ 必须有确定性兜底，否则「先试哪个账号」随机）",
-			got, want2)
+			got, want)
 	}
-	t.Logf("✓ 同键时顺序由 id 稳定决定: %s", want2)
+	t.Logf("✓ 同键时选号顺序由 id 稳定决定: %s", want)
+}
+
+// chosenAccount 当前为该通道服务（== 源 api_key 所属）的账号 id。
+func (h *reorderHarness) chosenAccount() string {
+	h.t.Helper()
+	res, err := h.ps.Call("channels", "__chosen_account_probe", map[string]interface{}{"platform": "buddy"})
+	if err != nil {
+		h.t.Fatalf("__chosen_account_probe: %v", err)
+	}
+	j := jsonOf(h.t, res)
+	s, _ := j["account_id"].(string)
+	return s
+}
+
+// rankOrder 选号顺序（rankAccounts.all 的 id 列表）。
+func (h *reorderHarness) rankOrder() []string {
+	h.t.Helper()
+	res, err := h.ps.Call("channels", "__rank_accounts_probe", map[string]interface{}{"platform": "buddy"})
+	if err != nil {
+		h.t.Fatalf("__rank_accounts_probe: %v", err)
+	}
+	j := jsonOf(h.t, res)
+	var out []string
+	arr, _ := j["all"].([]interface{})
+	for _, v := range arr {
+		if s, ok := v.(string); ok {
+			out = append(out, s)
+		}
+	}
+	return out
 }
 
 func joinStrings(xs []string, sep string) string {

internal/core/channels_trae_catalog_test.go

@@ -120,23 +120,23 @@ func newTraeCatalogHarness(t *testing.T, onBody func(string)) *traeCatalogHarnes
 			// ① solo_agent：glm-5.2 有档位；另有三个必被硬性过滤的条目
 			`{"function":"solo_agent","config_info_list":[`+
 			`{"config_name":"glm-5.2","usage":"chat_completion","config_switch":true,`+
-			`"reasoning_effort_config":{"support_thinking":true,"options":["high","low"]}},`+
+			`"reasoning_effort_config":{"support_thinking":true,"options":["high","low"]}}`+
+			`]},`+
+			// ② solo_work_lite 排在**后面**：glm-5.2 在这里**没有**档位配置。
+			//    另三个"必被过滤"的条目也放这里 —— 生产里适配器恒发这条通道，
+			//    硬性过滤的判据必须在这条通道上被验证到（放 solo_agent 会因为
+			//    admit_functions 策略先行剔除，测试就测不到过滤逻辑了）。
+			`{"function":"solo_work_lite","config_info_list":[`+
+			`{"config_name":"glm-5.2","usage":"chat_completion","config_switch":true},`+
 			`{"config_name":"summary-model","usage":"summary","config_switch":true},`+
 			`{"config_name":"disabled-model","usage":"chat_completion","config_switch":false},`+
 			`{"config_name":"hidden-model","usage":"chat_completion","config_switch":true,"is_invisible_to_user":true},`+
 			`{"config_name":"no-function-model","usage":"chat_completion","config_switch":true},`+
-			// is_custom_model=true ⇒ 上游以流内 4001 拒绝（"仅可见但不可调用"）
 			`{"config_name":"custom-flag-model","usage":"chat_completion","config_switch":true,`+
 			`"display_config":{"is_custom_model":true}},`+
-			// 对照组：名字带 custom_model_ 前缀但**标志为 false** ⇒ 必须**保留**
-			// （参考点名：判据是标志的值，不是模型名）
 			`{"config_name":"custom_model_prefix_but_ok","usage":"chat_completion","config_switch":true,`+
 			`"display_config":{"is_custom_model":false}}`+
 			`]},`+
-			// ② solo_work_lite 排在**后面**：glm-5.2 在这里**没有**档位配置
-			`{"function":"solo_work_lite","config_info_list":[`+
-			`{"config_name":"glm-5.2","usage":"chat_completion","config_switch":true}`+
-			`]},`+
 			// ③ 白名单外通道：整组必须被丢弃
 			`{"function":"inline_chat","config_info_list":[`+
 			`{"config_name":"only-in-bad-channel","usage":"chat_completion","config_switch":true}`+

internal/core/channels_trae_headers_test.go

@@ -0,0 +1,71 @@
+package core
+
+import "testing"
+
+// TRAE 的**两套头不能混用** —— 这是 2026-10-20 那次"目录永远拉不到"的真因。
+//
+// 事故链：模型目录端点在 `trae-api-cn.mchost.guru`（IDE 面），需要 IDE 头族
+// （Trae UA + X-App-Id + X-Ide-Version* + 凭据里的 X-Machine-Id/X-Device-Id）；
+// 而 `api.trae.cn` 的签到/积分端点需要另一套（VSCode UA + X-Market-* +
+// X-Lscbd-* + 派生 market device id）。插件当时"复用签到头"去拉目录，上游对
+// 22 个 function 全部回 `error_code 2001 Config detail for function: X not found`
+// （HTTP 200！），于是远端目录恒空、只能退回兜底表 —— 用户看到的却是
+// "trae 模型不正确 / 渠道不可用"，与真因隔了整整一层协议。
+//
+// 这个测试把两套头的**契约**钉死：键集合必须互不越界。它不联网，因此能
+// 在 CI 里稳定复现"用错头"这一类回归。
+func TestTraeHeadersKeptSeparate(t *testing.T) {
+	c := kernelTestCore(t)
+	ps := c.Plugins()
+	src, err := readBundledChannels(t)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := ps.LoadSource("channels", src); err != nil {
+		t.Fatal(err)
+	}
+	out, err := ps.Call("channels", "__trae_headers_probe", map[string]interface{}{})
+	if err != nil {
+		t.Fatalf("probe: %v", err)
+	}
+	j, _ := out.(map[string]interface{})["json"].(map[string]interface{})
+	pick := func(field string) map[string]bool {
+		set := map[string]bool{}
+		arr, _ := j[field].([]interface{})
+		for _, raw := range arr {
+			if s, ok := raw.(string); ok {
+				set[s] = true
+			}
+		}
+		return set
+	}
+	ide, chk := pick("ide"), pick("checkin")
+	if len(ide) == 0 || len(chk) == 0 {
+		t.Fatalf("两套头都应有内容；实得 ide=%v checkin=%v", ide, chk)
+	}
+	// IDE 面（目录/对话）：身份与版本头必须在
+	for _, k := range []string{"X-App-Id", "X-Ide-Version", "X-App-Version-Code",
+		"X-Machine-Id", "X-Device-Id", "Request-Traffic-Type"} {
+		if !ide[k] {
+			t.Errorf("IDE 头缺少 %q（目录端点会回 2001）", k)
+		}
+	}
+	// IDE 面**不得**带 UG/积分的头
+	for _, k := range []string{"X-Market-Client-Id", "X-Lscbd-Aid", "X-Market-User-Id"} {
+		if ide[k] {
+			t.Errorf("IDE 头不应包含 %q（那是签到头）", k)
+		}
+	}
+	// 签到头：UG/积分标记必须在
+	for _, k := range []string{"X-Market-Client-Id", "X-Market-User-Id", "X-Lscbd-Aid"} {
+		if !chk[k] {
+			t.Errorf("签到头缺少 %q", k)
+		}
+	}
+	// 签到头不得冒用 IDE 的 App/机型身份
+	for _, k := range []string{"X-App-Id", "X-Ide-Version", "X-Machine-Id"} {
+		if chk[k] {
+			t.Errorf("签到头不应包含 %q（那是 IDE 身份）", k)
+		}
+	}
+}

internal/core/channels_trae_models_test.go

@@ -0,0 +1,111 @@
+package core
+
+import "testing"
+
+// TRAE 的模型选择器**不许**出现 `custom_model_*`。
+//
+// 真实缺陷（2026-10-20 用户报「trae 的模型不正确 / 渠道不可用」）：
+// 这些 id 是 TRAE 的「自定义模型槽位」，上游目录里它们的权威判据是
+// `is_custom_model: true`（插件 trae_batch 解析器早已按这条准入剔除）。
+// 但**兜底表**把它们当普通模型列了出来 —— 而远端目录在部分账号下恒空
+// （企业租户账号实测：22 个 function 全回 error_code 2001 "Config detail
+// for function: X not found"），于是用户只能看到兜底表，选中这些槽位后
+// 上游回**空 content**（实测 custom_model_kimi / custom_model_claude /
+// custom_model_1M 均空），表现就是"模型坏了、渠道不可用"。
+//
+// 判据分两层：
+//   - model_list（UI 选择器）不含它们；
+//   - 交给内核的上游源里也不含它们（effectiveModels 走 models_unavailable）。
+func TestTraeCustomModelSlotsAreNotOffered(t *testing.T) {
+	c := kernelTestCore(t)
+	ps := c.Plugins()
+	src, err := readBundledChannels(t)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := ps.LoadSource("channels", src); err != nil {
+		t.Fatal(err)
+	}
+	_ = ps.SetPluginKernelPermission("channels",
+		[]string{"add_source", "remove_source", "list_sources", "status"}, false)
+
+	out, err := ps.Call("channels", "model_list", map[string]interface{}{"platform": "trae"})
+	if err != nil {
+		t.Fatalf("model_list: %v", err)
+	}
+	j, _ := out.(map[string]interface{})["json"].(map[string]interface{})
+	models, _ := j["models"].([]interface{})
+	if len(models) == 0 {
+		t.Fatal("trae 应至少有一个可选模型（兜底表）")
+	}
+	for _, raw := range models {
+		m, _ := raw.(map[string]interface{})
+		id, _ := m["id"].(string)
+		if len(id) > 13 && id[:13] == "custom_model_" {
+			t.Fatalf("model_list 不应包含自定义模型槽位 %q（选中后上游回空内容）", id)
+		}
+	}
+	// 可调用模型必须还在（不能把整张表干掉换绿）
+	found := false
+	for _, raw := range models {
+		m, _ := raw.(map[string]interface{})
+		if m["id"] == "glm-5.2" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("可调用的 glm-5.2 不应被一起藏掉；实得 %v", models)
+	}
+}
+
+// 上游源的模型清单同样不含占位槽位（客户端按裸名就能调，藏 UI 不够）。
+func TestTraeSourceOmitsCustomModelSlots(t *testing.T) {
+	c := kernelTestCore(t)
+	ps := c.Plugins()
+	src, err := readBundledChannels(t)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := ps.LoadSource("channels", src); err != nil {
+		t.Fatal(err)
+	}
+	_ = ps.SetPluginKernelPermission("channels",
+		[]string{"add_source", "remove_source", "list_sources", "status"}, false)
+	if _, err := ps.Call("channels", "account_add", map[string]interface{}{
+		"platform": "trae", "account_id": "trae-a",
+		"credential": `{"access_token":"jwt","uid":"1","device_id":"d","machine_id":"m"}`,
+	}); err != nil {
+		t.Fatalf("account_add: %v", err)
+	}
+	ls, err := ps.Call("channels", "__list_sources_probe", map[string]interface{}{})
+	if err != nil {
+		t.Fatalf("probe: %v", err)
+	}
+	j, _ := ls.(map[string]interface{})["json"].(map[string]interface{})
+	arr, _ := j["sources"].([]interface{})
+	haveTrae := false
+	for _, raw := range arr {
+		m, _ := raw.(map[string]interface{})
+		if m["name"] == "channels-trae" {
+			haveTrae = true
+		}
+	}
+	if !haveTrae {
+		t.Fatalf("trae 账号加好后应产出 channels-trae 源；实得 %v", arr)
+	}
+	// 源里的模型清单从内核真实源读（不是插件的 model_list）
+	srcs := c.Sources()
+	for _, s := range srcs {
+		if s.Name != "channels-trae" {
+			continue
+		}
+		for _, m := range s.Models {
+			if len(m.ID) > 13 && m.ID[:13] == "custom_model_" {
+				t.Fatalf("上游源不应包含自定义模型槽位 %q", m.ID)
+			}
+		}
+		if len(s.Models) == 0 {
+			t.Fatal("channels-trae 源应带模型清单")
+		}
+	}
+}

internal/core/core.go

@@ -1057,14 +1057,60 @@ func (c *Core) applyBillingDSL() {
 	}
 	prices, err := billing.Compile(profile, c.cfg.Sources)
 	if err != nil {
-		log.Printf("[billing] profile %q not applied: %v", profile.ID, err)
-		return
+		// ONE stale rule URL must not take the whole price table down with it.
+		//
+		// The strict compiler rejects a profile whose rule matches no source,
+		// which is right for catching typos — but the runtime consequence used
+		// to be a bare `return`: every rule stopped applying, the bill came out
+		// at 0 and unpriced_reqs grew forever, with a single startup log line as
+		// the only trace. Found in production while fixing GitCode issue #1
+		// (a rule still pointed at .../inference/v1 after the source moved to
+		// .../inference/openai/v1; 37k requests had been recorded as unpriced).
+		//
+		// So: apply the rules that DO match, and say exactly what was dropped.
+		// The profile still fails loudly — it just no longer fails silently for
+		// everything else.
+		lenient, lerr := billing.CompileOpts(profile, c.cfg.Sources, true)
+		if lerr != nil {
+			log.Printf("[billing] profile %q not applied: %v (lenient retry also failed: %v)",
+				profile.ID, err, lerr)
+			return
+		}
+		def := profile.Default
+		if def == "" {
+			def = "unpriced"
+		}
+		log.Printf("[billing] ERROR profile %q has %d rule URL(s) matching no configured "+
+			"source: %v — applied the remaining %d rule(s); unmatched traffic falls through "+
+			"to default=%q and keeps counting in unpriced_reqs. FIX THE RULE URL: a stale URL "+
+			"used to zero out the entire price table.", profile.ID,
+			len(billing.UnmatchedRuleURLs(profile, c.cfg.Sources)),
+			billing.UnmatchedRuleURLs(profile, c.cfg.Sources),
+			len(profile.Rules)-len(billing.UnmatchedRuleURLs(profile, c.cfg.Sources)), def)
+		prices = lenient
 	}
 	if err := ps.SetState("billing", map[string]interface{}{"prices": prices}); err != nil {
 		log.Printf("[billing] applying profile %q: %v", profile.ID, err)
 		return
 	}
 	log.Printf("[billing] profile %q applied (%d rules, %d sources)", profile.ID, len(profile.Rules), len(c.cfg.Sources))
+	// unmatched_sources used to be written by the compiler and read by nobody,
+	// so a profile that silently left half the gateway unpriced looked applied
+	// and healthy. Logging it is the cheap reader: an operator who sees source
+	// names here knows exactly which rules to add (GitCode issue #1 follow-up).
+	if unmatched, ok := prices["unmatched_sources"].([]string); ok && len(unmatched) > 0 {
+		log.Printf("[billing] WARNING %d source(s) match no rule and fall through to the "+
+			"profile default: %v (add rules, or set `default: free` if that is intended)",
+			len(unmatched), unmatched)
+	} else if raw, ok := prices["unmatched_sources"].([]interface{}); ok && len(raw) > 0 {
+		names := make([]string, 0, len(raw))
+		for _, v := range raw {
+			names = append(names, fmt.Sprint(v))
+		}
+		log.Printf("[billing] WARNING %d source(s) match no rule and fall through to the "+
+			"profile default: %v (add rules, or set `default: free` if that is intended)",
+			len(names), names)
+	}
 }
 
 // ValidateScopeQuotas checks every scope entry's caps before they are stored.

internal/gateway/billing_rules_api_test.go

@@ -236,19 +236,39 @@ func TestBillingRulesPersistAndReachThePlugin(t *testing.T) {
 	if _, ok := sources["localzen"]; !ok {
 		t.Errorf("the free rule did not reach the plugin: %v", keysOf(sources))
 	}
-	// The injected price must be per-token, i.e. 0.15 USD/M => 1.5e-7.
+	// The source entry exists ONLY as the "this source is priced" marker: it
+	// must not carry token prices, because priceFor() applies the source
+	// dimension after the model dimension and would overwrite the model price
+	// with 0 (GitCode issue #1 — silent, unpriced_reqs does not grow either).
+	if entry, ok := cc.(map[string]interface{}); ok {
+		for _, key := range []string{"prompt", "completion"} {
+			if _, present := entry[key]; present {
+				t.Errorf("the injected source entry carries %s: it will zero the "+
+					"model price (issue #1): %#v", key, entry)
+			}
+		}
+	}
+	// The injected MODEL price must be per-token, i.e. 0.15 USD/M => 1.5e-7.
 	// Asserting the exact magnitude catches a unit error (per-million vs
 	// per-token), which would be off by a factor of a million and still look
 	// like "a number".
-	models, ok := cc.(map[string]interface{})["models"].(map[string]interface{})
-	if ok {
-		if m, ok := models["deepseek-v4.1-flash"].(map[string]interface{}); ok {
-			p, _ := m["prompt"].(float64)
-			if p <= 0 || p > 1e-6 {
-				t.Errorf("injected prompt price = %v, want per-token (~1.5e-7); "+
-					"a per-million value here would over-bill by 1e6x", p)
-			}
-		}
+	//
+	// ⚠️ This used to read `cc["models"]`, but `models` lives at
+	// prices["models"], not inside a source entry — so the type assertion was
+	// always false and the whole block was skipped. It had never run, which is
+	// how a per-million unit error could survive a test whose comment claims
+	// to catch exactly that.
+	models, ok := prices["models"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("prices has no models map: %#v", prices)
+	}
+	m, ok := models["deepseek-v4.1-flash"].(map[string]interface{})
+	if !ok {
+		t.Fatalf("the model price was not injected: %v", keysOf(models))
+	}
+	if p, _ := m["prompt"].(float64); p <= 0 || p > 1e-6 {
+		t.Errorf("injected prompt price = %v, want per-token (~1.5e-7); "+
+			"a per-million value here would over-bill by 1e6x", p)
 	}
 }
 

internal/gateway/discover_mutate_test.go

@@ -126,7 +126,12 @@ func TestRealMutants(t *testing.T) {
 		},
 		{
 			name: "nested metadata no longer read",
-			from: "\tcopyFields(m.Metadata)      // nested first",
+			// 锚点必须与 discover.go 逐字节一致：此前这里是 6 个空格，源码已
+			// 变成 2 个空格，于是这条变异永远"找不到锚点"——变异campaign 每次
+			// 都以 anchor not found 失败，而它本该验证"嵌套 metadata 被丢掉"能被
+			// 测试抓住。锚点漂移 = 这条变异从未真正跑过（和 issue #1 里
+			// `cc["models"]` 恒 false 的测试跳过是同一种失效：断言写了但没执行）。
+			from: "\tcopyFields(m.Metadata)  // nested first",
 			to:   "\tcopyFields(json.RawMessage(nil)) // mutant: nested metadata dropped",
 		},
 		{

internal/lua/adapter_prelude.go

@@ -343,6 +343,16 @@ function __prelude.openai_error(status, body)
     return resp.detail
   end
 
+  -- 10. 腾讯 codebuddy 的**三层嵌套**：{error:{data:{code,msg,requestId}}}。
+  --     实测 429 code=14018「额度已用尽，请访问以下链接，购买加量包…」——
+  --     此前落到"不识别"，内核只回通用文案，用户看不出是额度用尽
+  --     （日志里是 "transform_error returned no reason for this shape"）。
+  local ed = type(resp.error) == "table" and resp.error.data or nil
+  if type(ed) == "table" and type(ed.msg) == "string" and ed.msg ~= "" then
+    if ed.code ~= nil then return tostring(ed.code) .. ": " .. ed.msg end
+    return ed.msg
+  end
+
   -- 7/8/9. 网关与腾讯系形状（实测漏过，见函数头注释）。
   --     error_code 与 error_msg 同现时拼起来 —— 只看 msg 会丢掉可分类的码
   --     （参考 llm-adapter.ts:531 把两者都放进 parts 再 join）。

internal/lua/adapter_prelude_error_shapes_test.go

@@ -58,6 +58,12 @@ func TestPreludeErrorExtractionCoversGatewayShapes(t *testing.T) {
 		{"FastAPI detail", `{"detail":"boom"}`, "boom"},
 		{"HTML title", `<html><title>413 Too Large</title></html>`, "413 Too Large"},
 		{"裸文本", "plain failure line\nmore", "plain failure line"},
+		// 腾讯 codebuddy 三层嵌套（实测 429 code=14018 额度用尽）：
+		// 此前落到"不识别"，客户端只看到通用文案，用户分不清是额度还是故障。
+		{"buddy 额度用尽嵌套", `{"error":{"data":{"code":14018,"msg":"额度已用尽，请购买加量包","requestId":"r1"}}}`,
+			"14018: 额度已用尽，请购买加量包"},
+		// 同一形状但没有 code：只回 msg
+		{"buddy 嵌套无码", `{"error":{"data":{"msg":"请求被拒绝"}}}`, "请求被拒绝"},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {

internal/lua/billing_test.go

@@ -1236,3 +1236,122 @@ func TestLongContextComposesWithCacheDiscount(t *testing.T) {
 	// total                             = 0.2325
 	approx(t, "step composes with cache discount", got, 0.2325)
 }
+
+// ---- 源层零价覆盖模型价（issue #1）---------------------------------------
+//
+// 真实缺陷（GitCode issue #1）：`compile.go` 给每条**具体 URL** 的 token 规则
+// 写一条 `{prompt:0, completion:0, per_request:0}` 的源条目，本意只是"标记该源
+// 已定价"；而插件 priceFor() 的源层是**无条件覆盖**模型层：`sp.prompt ~= nil`
+// 就把模型价改成 0。两条各自正当的规则叠加 ⇒ 每个请求 cost:0，且因为
+// out.priced=true，连 unpriced_reqs 都不涨 —— 完全静默。
+//
+// 这里把两种条目形状都钉住：旧形状必须**真的是错的**（A 行），新形状必须
+// **保住模型价同时仍算"已定价"**（B 行）。只断言"键存在"是不够的 —— 那正是
+// 现有测试把错误形状固化成契约的原因。
+func TestBillingSourceZeroPriceMustNotZeroModelPrice(t *testing.T) {
+	const promptPrice = 1.5e-7   // 0.15 USD/M
+	const completionPrice = 6e-7 // 0.60 USD/M
+	const want = 0.75            // 1e6 * 1.5e-7 + 1e6 * 6e-7
+
+	newPrices := func(sourceEntry map[string]interface{}) map[string]interface{} {
+		return map[string]interface{}{
+			"default": map[string]interface{}{"prompt": 0.0, "completion": 0.0, "per_request": 0.0},
+			"models": map[string]interface{}{
+				"m": map[string]interface{}{"prompt": promptPrice, "completion": completionPrice},
+			},
+			"sources": map[string]interface{}{"src": sourceEntry},
+		}
+	}
+	run := func(t *testing.T, sourceEntry map[string]interface{}) (cost, unpriced float64) {
+		t.Helper()
+		ps, _ := billingVM(t)
+		_ = ps.SetState("billing", map[string]interface{}{"prices": newPrices(sourceEntry)})
+		ps.Fire(StageRequestEnd, map[string]interface{}{
+			"model": "m", "source": "src", "key": "***p", "ok": true,
+			"prompt_tokens": 1000000.0, "completion_tokens": 1000000.0,
+			"time": 1750000000000,
+		})
+		st := stateOf(t, ps)
+		total := st["total"].(map[string]interface{})
+		return total["cost"].(float64), st["unpriced_reqs"].(float64)
+	}
+
+	// A 行：compile.go 修复前的形状 —— 这是缺陷本身，必须算成 0。
+	cost, unpriced := run(t, map[string]interface{}{
+		"prompt": 0.0, "completion": 0.0, "per_request": 0.0,
+	})
+	approx(t, "旧形状(全零源条目) cost", cost, 0)
+	if unpriced != 0 {
+		t.Errorf("旧形状下 unpriced_reqs = %v，缺陷正是它也为 0（静默）", unpriced)
+	}
+
+	// B 行：修复后的形状 —— 只带 per_request，不得覆盖模型价。
+	cost, unpriced = run(t, map[string]interface{}{"per_request": 0.0})
+	approx(t, "新形状(仅 per_request) cost", cost, want)
+	if unpriced != 0 {
+		t.Errorf("新形状下 unpriced_reqs = %v，want 0（该源仍算已定价）", unpriced)
+	}
+}
+
+// 同一源上一个**未列入价目表**的模型：源条目（仅 per_request）让它保持
+// "已定价"，所以不会被计入 unpriced_reqs —— 这正是 compile 写源条目的原意。
+func TestBillingSourceEntryStillMarksUnlistedModelPriced(t *testing.T) {
+	ps, _ := billingVM(t)
+	_ = ps.SetState("billing", map[string]interface{}{
+		"prices": map[string]interface{}{
+			"default": map[string]interface{}{"prompt": 0.0, "completion": 0.0, "per_request": 0.0},
+			"models": map[string]interface{}{
+				"priced-model": map[string]interface{}{"prompt": 1.5e-7, "completion": 6e-7},
+			},
+			"sources": map[string]interface{}{
+				"src": map[string]interface{}{"per_request": 0.0},
+			},
+		},
+	})
+	ps.Fire(StageRequestEnd, map[string]interface{}{
+		"model": "unlisted-model", "source": "src", "key": "***p", "ok": true,
+		"prompt_tokens": 1000.0, "completion_tokens": 0.0, "time": 1750000000000,
+	})
+	st := stateOf(t, ps)
+	if got := st["unpriced_reqs"].(float64); got != 0 {
+		t.Errorf("unpriced_reqs = %v，want 0：源条目存在即为已定价源", got)
+	}
+}
+
+// profile 级 default（compile.go 写入的 default_mode）必须真的生效。
+//
+// 真实缺陷（GitCode issue #1 顺带发现）：compile.go:54 写 `default_mode`、
+// :104 写 `unmatched_sources`，但全仓库没有任何读取方 —— 于是 profile 的
+// `default: free|unpriced` 在运行时完全等价，区别只存在于 YAML 里。
+// "free" 是**刻意定价为 0**，不该进未定价统计；"unpriced" 才该。
+func TestBillingProfileDefaultMode(t *testing.T) {
+	cases := []struct {
+		mode         string
+		wantUnpriced float64
+	}{
+		{"free", 0},
+		{"unpriced", 1},
+		{"", 1}, // 未声明 = 现有行为（未定价债务）
+	}
+	for _, tc := range cases {
+		ps, _ := billingVM(t)
+		prices := map[string]interface{}{
+			"default": map[string]interface{}{"prompt": 0.0, "completion": 0.0, "per_request": 0.0},
+		}
+		if tc.mode != "" {
+			prices["default_mode"] = tc.mode
+		}
+		_ = ps.SetState("billing", map[string]interface{}{"prices": prices})
+		ps.Fire(StageRequestEnd, map[string]interface{}{
+			"model": "no-rule-model", "source": "no-rule-source", "key": "***p", "ok": true,
+			"prompt_tokens": 1000.0, "completion_tokens": 10.0, "time": 1750000000000,
+		})
+		st := stateOf(t, ps)
+		if got := st["unpriced_reqs"].(float64); got != tc.wantUnpriced {
+			t.Errorf("default_mode=%q: unpriced_reqs = %v, want %v", tc.mode, got, tc.wantUnpriced)
+		}
+		// 无论哪种模式，成本都是 0；区别只在"是否算未定价债务"。
+		approx(t, "default_mode="+tc.mode+" cost",
+			st["total"].(map[string]interface{})["cost"].(float64), 0)
+	}
+}

internal/lua/plugins/billing.lua

@@ -189,7 +189,11 @@ local function priceFor(payload)
   -- look the same: an unpriced model silently costing 0 is the most dangerous
   -- failure mode a cost plugin has, because the bill still adds up and just
   -- quietly under-reports. It is counted separately and surfaced in the UI.
-  out = {
+  -- ★ local 是必须的：此前写的是全局 `out = {`，而 priceFor 每个请求都会调用，
+  -- 于是这个表挂在 VM 级全局变量上跨请求残留/泄漏（GitCode issue #1 顺带发现）。
+  -- 功能上因为每次整体重建而侥幸正确，但它是共享可变状态，任何提前 return 或
+  -- 后续分支忘了重建都会让上一单的价格漏到下一单 —— 计费错误不会报错。
+  local out = {
     prompt = d.prompt or 0, completion = d.completion or 0,
     per_request = 0, cache_discount = d.cache_discount, peak = d.peak,
       -- nil = bill reasoning at the completion rate, which is what every
@@ -236,6 +240,18 @@ local function priceFor(payload)
     if kp.cache_discount ~= nil then out.cache_discount = kp.cache_discount end
     if kp.peak ~= nil then out.peak = kp.peak end
   end
+
+  -- profile-level default for sources no rule matched.
+  --
+  -- compile.go has always written `default_mode` ("free" | "unpriced") into the
+  -- prices table, but NOTHING read it — so `default: free` and
+  -- `default: unpriced` behaved identically at runtime (both fell through to
+  -- prices.default's zeros and counted as unpriced debt). That is a second
+  -- silent under-report (GitCode issue #1 follow-up). "free" is a DELIBERATE
+  -- zero, so it must be marked priced; anything else stays countable debt.
+  if not out.priced and p.default_mode == "free" then
+    out.priced = true
+  end
   return out
 end
 

internal/provider/provider.go

@@ -1156,7 +1156,7 @@ func (p *Provider) Chat(ctx context.Context, req *types.ChatRequest) (*types.Uni
 	if err != nil {
 		return nil, err
 	}
-	raw, status, err := p.do(ctx, chatURL, body, hdrs)
+	raw, status, err := p.doWithRetry(ctx, chatURL, body, hdrs)
 	if err != nil {
 		// a client disconnect or cancelled context is neither a success nor
 		// a failure for scheduling purposes — only upstream errors count
@@ -1227,8 +1227,48 @@ func (p *Provider) ChatStream(ctx context.Context, req *types.ChatRequest) (<-ch
 	}
 	rc := make(chan respOrErr, 1)
 	go func() {
-		resp, err := p.doRawStream(ctx, streamURL, body, hdrs)
-		rc <- respOrErr{resp, err}
+		// Retry only the HANDSHAKE: a policy-matched rejection (e.g. a
+		// per-account concurrency cap answered with a business 4xx) can clear
+		// within seconds, and nothing has been sent to the client yet — the
+		// kernel holds the first chunk back. Once a 200 arrives and streaming
+		// starts, no retry happens (that would duplicate output).
+		rp := p.cfg.Retry
+		attempts := 1
+		if rp != nil && rp.MaxAttempts > 1 {
+			attempts = rp.MaxAttempts
+		}
+		for i := 0; i < attempts; i++ {
+			resp, err := p.doRawStream(ctx, streamURL, body, hdrs)
+			if err != nil {
+				rc <- respOrErr{resp, err}
+				return
+			}
+			if resp.StatusCode == 200 {
+				rc <- respOrErr{resp, nil}
+				return
+			}
+			// A rejection can only be classified after the body is read: the
+			// policy matches on body substrings, and a source may use the same
+			// status (400) for unrelated errors that must NOT be retried.
+			raw, _ := io.ReadAll(resp.Body)
+			resp.Body.Close()
+			if !rp.ShouldRetry(resp.StatusCode, string(raw)) {
+				// Not the retryable body: hand the rejection back verbatim so
+				// the caller reports the real upstream error.
+				resp2 := &http.Response{StatusCode: resp.StatusCode, Body: io.NopCloser(strings.NewReader(string(raw)))}
+				rc <- respOrErr{resp2, nil}
+				return
+			}
+			if i == attempts-1 {
+				resp2 := &http.Response{StatusCode: resp.StatusCode, Body: io.NopCloser(strings.NewReader(string(raw)))}
+				rc <- respOrErr{resp2, nil}
+				return
+			}
+			if serr := sleepCtx(ctx, rp.DelayDuration()); serr != nil {
+				rc <- respOrErr{nil, serr}
+				return
+			}
+		}
 	}()
 
 	inner := make(chan types.UnifiedChunk, 64)
@@ -1560,6 +1600,50 @@ func (p *Provider) do(ctx context.Context, url, body string, hdr http.Header) (s
 	return string(raw), resp.StatusCode, nil
 }
 
+// doWithRetry runs one non-stream request, retrying per the source's
+// declarative RetryPolicy. The policy is pure data (status list + body
+// substrings), so the kernel stays vendor-agnostic: a provider that answers a
+// per-account concurrency cap with a business 4xx can clear by itself while the
+// client just waits a few seconds instead of seeing an error.
+func (p *Provider) doWithRetry(ctx context.Context, url, body string, hdr http.Header) (string, int, error) {
+	rp := p.cfg.Retry
+	attempts := 1
+	if rp != nil && rp.MaxAttempts > 1 {
+		attempts = rp.MaxAttempts
+	}
+	var raw string
+	var status int
+	for i := 0; i < attempts; i++ {
+		r, st, err := p.do(ctx, url, body, hdr)
+		if err != nil {
+			return "", 0, err
+		}
+		raw, status = r, st
+		if status == 200 || !rp.ShouldRetry(status, raw) || i == attempts-1 {
+			break
+		}
+		if serr := sleepCtx(ctx, rp.DelayDuration()); serr != nil {
+			return "", 0, serr
+		}
+	}
+	return raw, status, nil
+}
+
+// sleepCtx sleeps for d unless the request context ends first.
+func sleepCtx(ctx context.Context, d time.Duration) error {
+	if d <= 0 {
+		return ctx.Err()
+	}
+	t := time.NewTimer(d)
+	defer t.Stop()
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-t.C:
+		return nil
+	}
+}
+
 func (p *Provider) doRaw(ctx context.Context, url, body string, hdr http.Header) (*http.Response, error) {
 	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader([]byte(body)))
 	if err != nil {

internal/provider/retry_policy_test.go

@@ -0,0 +1,131 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"llmsproxy/internal/config"
+	"llmsproxy/internal/types"
+)
+
+// 上游重试是**内核的通用机制**，判据纯数据（status + body 子串），
+// 目的是让"账号级限流、等一会儿就好"这类拒绝不冒到客户端。
+//
+// 真实事故（2026-10-20）：CodeArts 账户并发会话上限 3 个，连续第 3~4 个请求
+// 回 400 TM.00001041，最后一个请求结束后约 44~60 秒才释放；流式更糟 ——
+// 上游用 HTTP 200 + error 帧表达拒绝，内核只能报 `empty stream`。
+// 参考实现的处理是每 10s 重试一次 chat 直到放行，本测试钉住同一语义。
+func TestChatRetriesDeclaredUpstreamRejection(t *testing.T) {
+	var hits int32
+	up := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		n := atomic.AddInt32(&hits, 1)
+		if n <= 2 {
+			w.WriteHeader(http.StatusBadRequest)
+			fmt.Fprint(w, `{"error_code":"TM.00001041","error_msg":"并发会话数已达上限(3个)"}`)
+			return
+		}
+		fmt.Fprint(w, `{"choices":[{"message":{"content":"hi"},"finish_reason":"stop"}]}`)
+	}))
+	defer up.Close()
+
+	s := src("codearts-like", up.URL, "openai", "m1")
+	s.Retry = &config.RetryPolicy{
+		OnStatus:       []int{400},
+		OnBodyContains: []string{"TM.00001041"},
+		Delay:          "1ms",
+		MaxAttempts:    4,
+	}
+	p := newTestProvider(t, s)
+	resp, err := p.Chat(context.Background(), &types.ChatRequest{
+		Model:    "m1",
+		Messages: []types.ChatMessage{{Role: "user", Content: types.StringContent("hi")}},
+	})
+	if err != nil {
+		t.Fatalf("命中重试策略后应成功，实得错误: %v", err)
+	}
+	if resp.Content != "hi" {
+		t.Fatalf("content = %q", resp.Content)
+	}
+	if got := atomic.LoadInt32(&hits); got != 3 {
+		t.Fatalf("应恰好尝试 3 次（2 次失败 + 1 次成功），实得 %d", got)
+	}
+}
+
+// 同一状态码但 body 不匹配 ⇒ **不许重试**（400 也常用于真正的请求错误，
+// 无差别重试只会把错误延迟 3 分钟才暴露给用户）。
+func TestChatDoesNotRetryUnmatchedBody(t *testing.T) {
+	var hits int32
+	up := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		atomic.AddInt32(&hits, 1)
+		w.WriteHeader(http.StatusBadRequest)
+		fmt.Fprint(w, `{"error_code":"TM.00001005","error_msg":"无正常可用套餐"}`)
+	}))
+	defer up.Close()
+
+	s := src("codearts-like", up.URL, "openai", "m1")
+	s.Retry = &config.RetryPolicy{
+		OnStatus:       []int{400},
+		OnBodyContains: []string{"TM.00001041"},
+		Delay:          "1ms",
+		MaxAttempts:    5,
+	}
+	p := newTestProvider(t, s)
+	_, err := p.Chat(context.Background(), &types.ChatRequest{
+		Model:    "m1",
+		Messages: []types.ChatMessage{{Role: "user", Content: types.StringContent("hi")}},
+	})
+	if err == nil {
+		t.Fatal("不可重试的 body 必须失败")
+	}
+	if got := atomic.LoadInt32(&hits); got != 1 {
+		t.Fatalf("body 不匹配时只能尝试 1 次，实得 %d", got)
+	}
+}
+
+// 流式：只重试**握手**。命中策略 → 重试直到 200 才开始派发；一旦开始流式
+// 就不再重试（重复输出比报错更糟）。
+func TestChatStreamRetriesHandshakeOnly(t *testing.T) {
+	var hits int32
+	up := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		n := atomic.AddInt32(&hits, 1)
+		if n == 1 {
+			w.WriteHeader(http.StatusBadRequest)
+			fmt.Fprint(w, `{"error_code":"TM.00001041","error_msg":"并发会话数已达上限(3个)"}`)
+			return
+		}
+		w.Header().Set("Content-Type", "text/event-stream")
+		fmt.Fprint(w, "data: {\"choices\":[{\"delta\":{\"content\":\"hi\"},\"finish_reason\":\"stop\"}]}\n\n")
+		fmt.Fprint(w, "data: [DONE]\n\n")
+	}))
+	defer up.Close()
+
+	s := src("codearts-like", up.URL, "openai", "m1")
+	s.Retry = &config.RetryPolicy{
+		OnStatus:       []int{400},
+		OnBodyContains: []string{"TM.00001041"},
+		Delay:          "1ms",
+		MaxAttempts:    4,
+	}
+	p := newTestProvider(t, s)
+	ch, err := p.ChatStream(context.Background(), &types.ChatRequest{
+		Model:    "m1",
+		Messages: []types.ChatMessage{{Role: "user", Content: types.StringContent("hi")}},
+	})
+	if err != nil {
+		t.Fatalf("握手重试后应成功: %v", err)
+	}
+	var content string
+	for ck := range ch {
+		content += ck.Content
+	}
+	if content != "hi" {
+		t.Fatalf("content = %q", content)
+	}
+	if got := atomic.LoadInt32(&hits); got != 2 {
+		t.Fatalf("应握手重试 1 次（共 2 次请求），实得 %d", got)
+	}
+}