clavue-v1 1.5.0 → 1.7.0

package/CHANGELOG.md

@@ -4,6 +4,42 @@ clavue / 克拉维 发布说明。本文件在构建时注入运行时，驱动
 
 格式约定（`parseChangelog` 依赖）：二级标题为 `## <版本> - <日期>`，条目以 `- ` 开头，一行一条，命令与模型名保留英文。
 
+## Unreleased
+
+## 1.7.0 - 2026-09-03
+
+- 产品路由环境变量统一为 `CLAVUE_*`（`CLAVUE_BASE_URL` / `CLAVUE_API_KEY` 等）；旧 `ANTHROPIC_*` 路由名只作只读兼容
+- 官方云默认填 light=`clavue-2.1-fast`、plan=`clavue-2.1-pro`、review=`clavue-2.1-rev`，不盖 `/model`；`CLAVUE_COMBO_OFF=1` 或单槽 `0` 关闭
+- 无视觉模型（含官方 coding SKU 与 light 槽）读图 / 扫描页改为 clavue-ocr 抽字，不再把多模态块塞给不能看图的模型
+- 三方网关采信 `GET /v1/models` 数字窗口作为压缩依据；官方 host 不采信虚标 1M
+- `/girl` `/boy` `/bigdaddy` 改为岗位而不是召唤人设：收口写交接包，破局/交付门能走的工作流会立刻提交 `/mao`
+- `/girl remote` `/boy remote` `/bigdaddy remote` 把同一岗位派到 clavue-bot，优先 clavue-worktree，回来是 PR / 清单 / go-no-go 证据卡
+- `/boy remote` 会先调用 clavue-worktree clone API 打开工作副本，破局岗开树失败则夜班直接 no-go
+- 远程派发带上当前仓库 origin 与分支，worktree 只作工作副本
+- `/girl open|qr|status` 回看上次夜班
+- 摸摸动画不再加羁绊；羁绊只在岗位交付成功时增加
+- 破局岗 remote 默认在 worktree 开树并向 origin 开 PR；收口/交付门不开 PR
+- `/boy remote --no-pr` 只改副本、不开 PR
+
+## 1.6.0 - 2026-09-03
+
+- 启动时弹出升级对话框：发现新版本后可在对话框内用 Ctrl+U / Enter 立即安装，Esc 本次跳过；开发树与 headless 不弹
+- 新增 `/update`：检查并安装最新 clavue-v1，成功后提示退出重开
+- npm 版本查询与全局安装改为包名 clavue-v1，不再误查 clavue
+- 流中途断开后自动续写：已产出的内容保留，不再整轮重发；与输出截断恢复共享 3 次预算，`CLAVUE_STREAM_CUT_RESUME=0` 关闭
+- 被截断的工具调用若参数完整则照常执行，不完整则丢弃并要求重发
+- 工具调用死循环守卫：相同调用、相同结果连续 3 次提醒模型换路，5 次中止本轮；`CLAVUE_TOOL_LOOP_WARN` / `CLAVUE_TOOL_LOOP_ABORT` / `CLAVUE_TOOL_LOOP_GUARD=0`
+- 槽位回退链：`CLAVUE_COMBO_MAIN=deepseek-v4,glm-5.3` 逗号分隔即回退链，模型不存在 / 过载耗尽 / 连续 5xx 时会话内粘性切换到下一个并提示一次；`/provider current` 与仪表盘显示当前位置；`CLAVUE_COMBO_CHAIN=0` 关闭
+- 每槽位 effort：`CLAVUE_COMBO_<SLOT>_EFFORT=low|medium|high|xhigh|max` 对任意模型下发（Anthropic 方言 `output_config.effort`，Responses 方言 `reasoning.effort`），被 400 拒绝即去掉重试并记住该模型；`/effort` 仍只作用于 main 槽
+- 失控预算（默认开启）：`CLAVUE_MAX_CONCURRENT_SUBAGENTS`（默认 20）、`CLAVUE_MAX_SUBAGENTS_PER_SESSION`（默认 200，`/clear` 重置）、`CLAVUE_MAX_SUBAGENT_SPAWN_DEPTH`（默认 3）、`CLAVUE_MAX_WEB_SEARCHES_PER_SESSION`（默认 200）；超限返回预算错误而非故障，`CLAVUE_RUNAWAY_BUDGETS=0` 关闭
+- 子代理碰到 `maxTurns` 时父代理看到的内容以 `[partial]` 开头，并提示可通过 SendMessage 续接，不再伪装成已完成
+- `/tasks` 与代理详情显示每个子代理的槽位 · 模型 · effort
+- 网关鲁棒性（默认开启，`CLAVUE_GATEWAY_NORMALIZE=0` 关闭）：流中 `tool_use` 缺 `id` 时补 `toolu_clavue_<n>`，缺 `name` 时降级为文本；非流式回退丢弃缺字段的 thinking/text 块而不崩溃
+- 恢复会话时清洗孤儿 `tool_result`、补齐缺失结果、剔除空 content 与非法块类型；有修复时一行提示「已修复 N 处历史记录问题」，不改写其他 CLI 的源文件
+- 非流式整轮重发只允许零字节输出（无 `message_start` 或无 `content_block_start`）；已产出内容走流中断续写，避免双倍计费
+- idle watchdog 把 SSE 注释行与 `event: ping` 心跳视为活动，避免自定义网关 keep-alive 被误杀
+- `/cost` 增加缓存命中率 / miss / 重缓存 / 冷热一行；statusline JSON 增加 `prompt_cache`；前缀因 tools / system / model / effort / betas 变化时按类别首次提示一行，`/doctor` 列出最近 5 次；`CLAVUE_CACHE_PREFIX_GUARD=0` 关闭观察与提示
+
 ## 1.5.0 - 2026-09-02
 
 - 新增 `/resume-codex`、`/resume-claude`、`/resume-grok`：列出其他 CLI 在当前项目的会话，`latest / 序号 / id 前缀 / 标题关键词` 一键导入并在 Clavue 中接续；`--all` 浏览所有项目

package/README.md

@@ -65,8 +65,8 @@ npx -y clavue-v1
 Run a specific version with `npx`:
 
 ```bash
-npx -y clavue-v1@1.5.0 --version
-npx -y clavue-v1@1.5.0
+npx -y clavue-v1@1.7.0 --version
+npx -y clavue-v1@1.7.0
 ```
 
 Install globally from npm when you want the `clavue-v1` command to stay available:
@@ -88,7 +88,7 @@ curl -fsSL https://unpkg.com/clavue-v1/install.sh | bash
 Install a specific version globally:
 
 ```bash
-curl -fsSL https://unpkg.com/clavue-v1@1.5.0/install.sh | bash -s -- 1.5.0
+curl -fsSL https://unpkg.com/clavue-v1@1.7.0/install.sh | bash -s -- 1.7.0
 ```
 
 ## Quick Start: Official Clavue Cloud
@@ -119,6 +119,15 @@ points from the `x-clavue-points-*` response headers. Official identity is
 decided by exact host match only — a third-party gateway can never be
 mistaken for the official cloud.
 
+Official sessions fill combo slots without writing them into your shell:
+`light=clavue-2.1-fast`, `plan=clavue-2.1-pro`, `review=clavue-2.1-rev`. MAIN
+stays `/model` (or the profile primary). `CLAVUE_COMBO_OFF=1` or a per-slot
+`0` / `off` turns that fill off.
+
+Product routing env names are `CLAVUE_BASE_URL` and `CLAVUE_API_KEY`.
+Legacy `ANTHROPIC_BASE_URL` / `ANTHROPIC_API_KEY` still work as read-only
+aliases until a provider profile is applied.
+
 ## Quick Start: Custom API
 
 Fastest path for custom API users:
@@ -181,6 +190,17 @@ The startup box is a single-column dashboard rather than a marketing panel. Unde
 - Provider smoke-test sessions (`Reply with exactly: OK`, `ping`, …) are hidden from `最近会话`.
 - The full dashboard appears after an upgrade or during project onboarding; routine startups use the condensed header. Set `CLAVUE_FORCE_FULL_LOGO=1` to always show it.
 
+### Startup update / 启动升级
+
+Interactive TUI sessions check npm for a newer `clavue-v1` after first paint (the check does not block the first frame). If an update is available, a Chinese dialog offers in-place install:
+
+```text
+发现新版本 1.7.0（当前 1.6.0）
+Ctrl+U / Enter 立即升级 · Esc 本次跳过 · /update 随时再来
+```
+
+npm global/local and native installs apply in-process. Package-manager and `npx` sessions show the exact command (`brew upgrade clavue`, `npx -y clavue-v1@latest`) instead of running `npm i -g`. `/update` repeats the same check from the prompt. Set `CLAVUE_STARTUP_UPDATE_PROMPT=0` to hide the dialog; silent auto-install then follows the existing updater unless `DISABLE_AUTOUPDATER` is set.
+
 ### Data sharing (帮助改进 Clavue)
 
 Sessions that run on the **official Clavue cloud** (`api.clavue.com`) are used to improve Clavue models, in the same shape as Claude and Grok: participation is on by default, the CLI tells you once at startup, and you can turn it off at any time.
@@ -233,8 +253,10 @@ On macOS, Clavue avoids Keychain by default and stores local credentials in `~/.
 ## Cross-Family Combo Review
 
 The review slot puts an independent model family between "the code changed"
-and "the work is done". Since 1.2.0 review is scheduled so it does not tax
-every edit:
+and "the work is done". Official cloud sessions fill `light` / `plan` /
+`review` by default (see Official Clavue Cloud). BYOK combo stays opt-in via
+`CLAVUE_COMBO_*`. Since 1.2.0 review is scheduled so it does not tax every
+edit:
 
 ```bash
 CLAVUE_COMBO_MAIN=glm-5.3-flash          # developer model (any slot model is passed through verbatim)
@@ -246,6 +268,28 @@ CLAVUE_COMBO_REVIEW_GRACE_MS=5000        # bounded wait for the final verdict at
 CLAVUE_COMBO_REVIEW_FIX_LOOP=1           # opt-in: a chain-end "P0:" verdict grants one bounded fix turn
 ```
 
+### Slot chains and per-slot effort
+
+Each `CLAVUE_COMBO_<SLOT>` value may be a comma-separated fallback chain.
+The first model is primary; on 404 / model-not-found, exhausted 529 overload,
+or exhausted 5xx the session sticks to the next element and prints one Chinese
+warning. `/provider current` and the dashboard slot row show `a → b (当前 2/2)`.
+`CLAVUE_COMBO_CHAIN=0` keeps the first element only. `--fallback-model` still
+applies when no `main` chain is set.
+
+```bash
+CLAVUE_COMBO_MAIN=deepseek-v4,glm-5.3
+CLAVUE_COMBO_REVIEW=gpt-5.4,claude-sonnet-4-6
+CLAVUE_COMBO_MAIN_EFFORT=xhigh           # low|medium|high|xhigh|max; any model string
+CLAVUE_COMBO_REVIEW_EFFORT=medium        # plan/review/light hops use their own slot
+# CLAVUE_COMBO_CHAIN=0                   # disable sticky advancing
+# CLAVUE_SLOT_EFFORT_LEARN=0             # do not remember effort-parameter 400s
+```
+
+Slot effort is sent as Anthropic `output_config.effort` (Responses dialect maps
+it to `reasoning.effort`). A 400 that names effort is retried once without it
+and remembered for the process. `/effort` still only affects the `main` slot.
+
 - `overlap` fires the review hop without blocking; the verdict is injected
   at the next loop boundary so the developer model actually acts on it.
   In the shipped A/B it roughly halves the review tax versus `serial`
@@ -265,11 +309,11 @@ Subagents (`Agent` tool, `/agents` definitions, `Explore`, `Plan`, teams) pick t
 1. `CLAUDE_CODE_SUBAGENT_MODEL` (written by a provider profile's subagent slot) — an explicit global override that wins over everything.
 2. The `model` the caller or agent definition asked for:
    - a combo slot name — `light`, `main`, `plan`, `review` — resolves to that `CLAVUE_COMBO_*` model verbatim; an unconfigured `light` falls back to `haiku`, the other slots to `inherit`;
-   - `haiku` is the fast tier: with `CLAVUE_COMBO_LIGHT` set it runs there (this is what `Explore` uses), otherwise it follows `ANTHROPIC_DEFAULT_HAIKU_MODEL`;
-   - `sonnet` / `opus` follow the parent's exact model when the parent is the same tier, else `ANTHROPIC_DEFAULT_*_MODEL`.
+   - `haiku` is the fast tier: with `CLAVUE_COMBO_LIGHT` set it runs there (this is what `Explore` uses), otherwise it follows `CLAVUE_DEFAULT_HAIKU_MODEL`;
+   - `sonnet` / `opus` follow the parent's exact model when the parent is the same tier, else `CLAVUE_DEFAULT_*_MODEL`.
 3. `inherit` (the default) uses the parent conversation's model.
 
-Safety net for non-Claude routes: a bare tier alias that is not pinned by any of the variables above, on a gateway whose parent model is not a Claude model, inherits the parent instead of asking the route for a `claude-*` ID it cannot serve. Set `CLAVUE_COMBO_LIGHT` (or the `ANTHROPIC_DEFAULT_*_MODEL` pins that provider profiles write) to route tiers deliberately.
+Safety net for non-Claude routes: a bare tier alias that is not pinned by any of the variables above, on a gateway whose parent model is not a Claude model, inherits the parent instead of asking the route for a `claude-*` ID it cannot serve. Set `CLAVUE_COMBO_LIGHT` (or the `CLAVUE_DEFAULT_*_MODEL` pins that provider profiles write) to route tiers deliberately.
 
 ```bash
 CLAVUE_COMBO_MAIN=deepseek-v4            # developer
@@ -299,7 +343,7 @@ Version check:
 
 ```bash
 npx -y clavue-v1 --version
-npx -y clavue-v1@1.5.0 --version
+npx -y clavue-v1@1.7.0 --version
 # available after a global install
 clavue-v1 --version
 ```
@@ -335,6 +379,45 @@ Canonical configuration names:
 
 ## In-Session Workflows
 
+### Turn reliability guards
+
+Turns resume instead of silently completing or re-billing when a stream dies after content has already arrived. Incomplete tool calls are dropped and re-asked; complete ones still run. A loop of the same tool, same arguments, and same result warns the model at 3 repeats and aborts the turn at 5.
+
+```text
+CLAVUE_STREAM_CUT_RESUME=0     disable stream-cut continuation (default on)
+CLAVUE_TOOL_LOOP_GUARD=0       disable the tool-call loop guard (default on)
+CLAVUE_TOOL_LOOP_WARN=3        warn after N identical repeats
+CLAVUE_TOOL_LOOP_ABORT=5       abort the turn after N identical repeats
+```
+
+### Cache economics
+
+`/cost` prints a cache line (`命中率` · `miss` · `重缓存` · `热`/`冷`) from session cache-read and cache-write tokens. Statusline JSON includes `prompt_cache: { hit_ratio, misses, recached_tokens, state }` when the guard is on. A prefix-stability observer hashes the finalized system prompt, tools, model, effort, and betas (reusing the existing break-detection hashes) and records the last five changes. The first change of each category in a process prints one dim Chinese line; `/doctor` lists `category  summary`. The guard observes only — it never mutates the request.
+
+```text
+CLAVUE_CACHE_PREFIX_GUARD=0    disable prefix observation and notices (default on)
+```
+
+### Gateway robustness
+
+Third-party gateways sometimes omit `tool_use.id` / `name`, return thinking/text blocks with missing fields, or write illegal content into a session JSONL. Clavue fills missing ids as `toolu_clavue_<n>`, downgrades nameless tool calls to text, drops malformed blocks on the non-streaming fallback, and repairs in-memory history on `/resume` / `--continue` (one Chinese line: `已修复 N 处历史记录问题`). A full non-streaming retry is allowed only for zero-byte streams; content-bearing cuts resume instead of double-billing. SSE comments and `event: ping` keep the idle watchdog alive.
+
+```text
+CLAVUE_GATEWAY_NORMALIZE=0    disable gateway repairs (default on)
+```
+
+### Runaway budgets
+
+Caps stop a session from spawning unbounded nested agents or burning the search quota. Over-limit tool errors name the budget (not a crash) and the env var to raise. `/clear` resets session totals; in-flight children are not killed. A subagent that hits `maxTurns` returns `[partial]` so the parent can continue it with SendMessage. `/tasks` shows slot · model · effort on each agent row.
+
+```text
+CLAVUE_MAX_CONCURRENT_SUBAGENTS=20       live children (0 = unlimited)
+CLAVUE_MAX_SUBAGENTS_PER_SESSION=200     spawned this session (0 = unlimited)
+CLAVUE_MAX_SUBAGENT_SPAWN_DEPTH=3        nest depth (0 = unlimited)
+CLAVUE_MAX_WEB_SEARCHES_PER_SESSION=200  WebSearch calls (0 = unlimited)
+CLAVUE_RUNAWAY_BUDGETS=0                 disable every cap
+```
+
 ### Resume sessions from other CLIs
 
 Work that started in Codex, Claude Code, or Grok Build can be continued in Clavue without copying anything by hand. Each product gets its own command; with no argument it lists that product's sessions for the current project, with a reference it imports the transcript and hands the model a condensed continuation seed.
@@ -386,7 +469,7 @@ Typing `agent teams` at the start of a prompt opens the same native `/team` flow
 `/goal` turns a one-line objective into a durable mission. Clavue writes a ledger under `.clavue/goals/`, defines the plan itself, and keeps working across turns until evidence proves the objective, the budget runs out, or a real blocker appears. The loop is bounded: 20 auto-continued turns or 6 hours, whichever comes first. Exhaustion pauses the goal with an explicit `budget_exhausted` event; `/goal resume` grants a fresh budget. Completion is refused until at least one piece of evidence is on record, and starting a new goal supersedes the live one with an audit event.
 
 ```text
-/goal ship the 1.5.0 release and verify npm, GitHub, and the website
+/goal ship the 1.7.0 release and verify npm, GitHub, and the website
 /goal criteria npm run check passes on main
 /goal evidence npm run test:fast passed (24 files)
 /goal status
@@ -416,12 +499,14 @@ Only completed model turns advance the loop; `/goal status`, `/goal evidence`, a
 /review 128 concurrency and error paths
 ```
 
-Companion commands are still available and can either follow the current app provider or bind to a saved `/provider` profile independently.
+Companion desks are job contracts, not toys: `/girl` recaps and writes a handoff, `/boy` diagnoses or fixes through `/mao`, `/bigdaddy` reviews for go/no-go. `/girl remote` (and the boy/bigdaddy equivalents) dispatch the same desk to Clavue Bot, preferring a clavue-worktree working copy. They can follow the current app provider or bind to a saved `/provider` profile independently.
 
 ```text
-/girl
-/boy
-/bigdaddy
+/girl recap
+/boy fix login timeout
+/bigdaddy review
+/girl remote
+/boy remote fix login timeout
 /girl provider
 /girl provider list
 /girl provider inherit