cortico-world-workbuddy 0.1.6 → 0.1.7

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # 更新日志
 
+## 0.1.7
+
+按 WorkBuddy 官方对话给出的合规口径，给桥接加「安全清单」闸门（仍只在本机，未推送 / 未发布）。
+
+- **新增 `src/safety.js`**：把 WorkBuddy 的筛选原则固化成 `SAFE_MODEL_IDS`（21 个公开对话模型）、
+  分组表 `SAFE_MODEL_GROUPS`、谨慎档 `CAUTION_MODEL_IDS`（hy3 系列与 preview）与 `classifyModel()`。
+  `classifyModel` 把目录里每个模型判成 `safe / caution / alias / disabled / media / code / retired /
+  format / experimental / unknown` 十档，附中文理由；`allow` 只对前两档为真。
+- **闸门默认开启**（`worlds.workbuddy.safeOnly = true`）：`wb_chat`、`wb_select_model` 与面板的
+  「使用」按钮都会拒绝安全清单外的模型，并给出「判定档位 + 理由 + 如何解除」的说明；
+  关掉这个配置才能调用 disabled / 内部别名 / 预览等模型，风险自负。
+- **`wb_list_models` 默认只列安全清单**（按 DeepSeek / GLM / 混元 / Kimi / 其他分组，带此刻倍率），
+  传 `all=true` 才追加其余模型及其排除理由。
+- **被排除的典型项**：`wb-lite`（目录 `disabled:true`）、`auto` / `fast-model` / `balanced-model` /
+  `deep-model`（内部路由别名）、`hunyuan-image-alpha*` / `kling-video-v3` / `minimax-video-h3`（媒体）、
+  `codewise-*`（代码补全）、`hy4-preview*`（实验预览）、19 个已下架（11102）、`glm-5.0-turbo`（11150）。
+- **模型目录面板**新增「合规」列（安全清单 / 安全清单·谨慎 / 各排除档位，悬停看理由），
+  默认只显示安全清单，勾选「显示全部模型（含不建议项）」才展开；不安全项的选择按钮置灰。
+- `envPromptVars()` 增加 `workbuddy.safeOnly`；`ENV_PROMPT.md` 增加一条：闸门开着时不要绕过拒绝，
+  应该告诉用户原因并改推荐安全清单里的模型。
+- `describe.json` 的 `envPrompt` 与 `wb_list_models` 描述同步（多了 `all` 参数）。
+
 ## 0.1.6
 
 新增「用量」面板与真实的时段优惠计算（只在本机验证，未发布）。
@@ -22,7 +44,6 @@
 - `wb_list_models` 标注此刻生效倍率（含原价对比、时段）与优惠徽标；`wb_select_model` 提示此刻倍率。
 - 环境提示词新增 `{{workbuddy.todayCredit}}` / `{{workbuddy.todayTokens}}`，并在倍率旁说明已含生效中的限时优惠。
 - 详情页徽标增加「今日积分」。
-- 仓库补 `package-lock.json`（锁定 esbuild 0.24.2），CI 改为 `npm ci`：`dist` 的构建产物必须逐字节稳定，否则「dist 未同步」的检查会误报。
 
 ## 0.1.5
 

package/README.md

@@ -139,11 +139,31 @@ Coopanion (Coo)
 
 | 面板 | 内容 |
 |---|---|
-| 模型目录 | 刷新目录；逐模型一行：名称/id、**此刻倍率**（含限时折扣时显示 `x0.5 ← x0.79 23:00–07:50`，x0 标「免费」）、上下文、推理档、「选用」按钮 |
+| 模型目录 | 刷新目录；逐模型一行：名称/id、**合规档位**、**此刻倍率**（含限时折扣时显示 `x0.5 ← x0.79 23:00–07:50`，x0 标「免费」）、上下文、推理档、「选用」按钮；默认只列安全清单，勾选「显示全部模型（含不建议项）」才展开其余项 |
 | 账号 | 登录态来源（本机发现 / 手动）、掩码 token、积分余额查询、重新检测、手动 token 存取 |
 | 是否启用 WorkBuddy | 「中转站优先」开关 + 主进程状态，与开始页按钮同步 |
 | 用量 | 区间概览（今天 / 近 7 天 / 近 30 天）、按模型聚合、积分包明细、限时优惠清单、最近调用；带「刷新余额」「清空本地账本」 |
 
+### 安全清单（合规闸门）
+
+WorkBuddy 官方对话给出的口径是：只调用「官方公开目录里、当前可正常对话」的模型，
+`disabled`、内部路由别名、媒体/代码补全与状态不明的模型都不要经外部软件调用，否则有风控/封号风险。
+这里把它落成代码：
+
+- 白名单 21 个（`src/safety.js` 的 `SAFE_MODEL_IDS`，按 DeepSeek / GLM / 混元 / Kimi / 其他分组）：
+  `deepseek-v4.1-flash`、`deepseek-v4-flash`、`deepseek-v4-pro`、`deepseek-v3-2-volc`、
+  `glm-5.3-flash`、`glm-5.3`、`glm-5.2`、`hy3`、`hy3-b`、`hy3-c`、`hy3-x`、`hunyuan-chat`、
+  `kimi-k2.5`、`kimi-k2.8-preview`、`kimi-k3-1`、`kimi-k3.1-pro`、`minimax-m2.7`、
+  `minimax-m3.1-flash`、`mimo-v2.6-pro`、`space-bunny`、`step-5-preview`。
+  其中 `hy3*` 与 `*preview` 标为「谨慎」（免费试用/预览，别做高频自动化）。
+- 其余全部**拒绝**：`wb-lite`（目录 `disabled:true`）、`auto` / `fast-model` / `balanced-model` /
+  `deep-model`（内部路由别名）、4 个媒体模型、`codewise-*`、`hy4-preview*`、19 个已下架的、
+  `glm-5.0-turbo`（11150 请求格式不符）。
+- 闸门是 `worlds.workbuddy.safeOnly`（默认 `true`）。开着时 `wb_chat` / `wb_select_model` / 面板「选用」
+  三处一致拒绝，并说明「判定档位 + 理由 + 怎么解除」；关掉才放行，属于明示的风险自负。
+- 清单是按 2026-11 的官方目录定的，官方加新模型不会被自动信任——这正是「未列入安全清单」这一档的意义。
+
+
 ### 倍率与限时优惠怎么算
 
 - 目录来自 `GET /v3/config`（应用身份 UA）：一次同时拿到 `models`、`modelPromotions`、`modelTiers`。
@@ -167,9 +187,9 @@ Coopanion (Coo)
 
 | 工具 | 作用 |
 |---|---|
-| `wb_list_models` | 列出目录中全部模型及**此刻倍率**（含限时优惠与时段），并单列优惠清单（只读） |
-| `wb_select_model` | 按 id 选择 `wb_chat` 的默认模型，持久化；提示此刻倍率 |
-| `wb_chat` | 用选中模型回答一个单轮问题（**真实消耗积分**，需主进程在跑）；回执附输入/输出/缓存 token 与本次积分 |
+| `wb_list_models` | 列出**安全清单内**的模型及此刻倍率（含限时优惠与时段），并单列优惠清单；传 `all=true` 才带上被排除项与理由（只读） |
+| `wb_select_model` | 按 id 选择 `wb_chat` 的默认模型，持久化；提示此刻倍率；安全清单外会被拒 |
+| `wb_chat` | 用选中模型回答一个单轮问题（**真实消耗积分**，需主进程在跑）；回执附输入/输出/缓存 token 与本次积分；安全清单外会被拒 |
 | `wb_credits` | 只读查询积分余额与本周期已用（需主进程在跑） |
 
 ## 配置（`worlds.workbuddy.*`）
@@ -184,6 +204,7 @@ Coopanion (Coo)
 | `envPrompt` | `true` | 是否把桥接状态写进 system 前缀（关掉后「中转站优先」也不生效） |
 | `prefer` | `false` | 「中转站优先」，由开始页按钮 / 详情页开关写入 |
 | `hostInject` | `true` | 是否注入「开始」页按钮（关掉后不碰宿主文件，只用详情页开关） |
+| `safeOnly` | `true` | 只允许调用安全清单内的公开对话模型；关掉会放行 disabled / 别名 / 预览等项，风险自负 |
 
 ## 开发与校验
 

package/describe.json

@@ -2,10 +2,10 @@
   "tools": [
     {
       "name": "wb_list_models",
-      "description": "List the WorkBuddy models available to the signed-in account, each with its default credit multiplier (e.g. x0.79), context window and reasoning efforts. Read-only; costs nothing.",
+      "description": "List the WorkBuddy chat models that are safe to call (official public catalog only), each with its credit multiplier (e.g. x0.79, already including time-limited discounts), context window and reasoning efforts. Read-only; costs nothing. Pass all=true to also list models that are disabled, internal routing aliases, media/code models or delisted ones — those are not callable through this bridge while worlds.workbuddy.safeOnly is on.",
       "summary": {
-        "zh": "列出本机 WorkBuddy 账号可用的模型及各自的默认积分倍率。",
-        "en": "Lists WorkBuddy models for the signed-in account with each default credit multiplier."
+        "zh": "列出 WorkBuddy 公开对话模型（安全清单）及各自的积分倍率、上下文与推理档；all=true 时附上被排除的项与原因。",
+        "en": "Lists the safe WorkBuddy chat models with multiplier, context and reasoning efforts; all=true also lists excluded ones with reasons."
       },
       "tags": [
         "read"
@@ -13,12 +13,17 @@
       "parameters": {
         "type": "object",
         "additionalProperties": false,
-        "properties": {}
+        "properties": {
+          "all": {
+            "type": "boolean",
+            "description": "Also list models outside the safe list (shown with their risk reason)."
+          }
+        }
       }
     },
     {
       "name": "wb_select_model",
-      "description": "Select which WorkBuddy model wb_chat should use by default. The id must come from wb_list_models. Persists across restarts.",
+      "description": "Select which WorkBuddy model wb_chat should use by default. The id must come from wb_list_models. Refused when worlds.workbuddy.safeOnly is on and the model is outside the safe list. Persists across restarts.",
       "summary": {
         "zh": "选择 wb_chat 默认调用的 WorkBuddy 模型。",
         "en": "Selects the default WorkBuddy model for wb_chat."
@@ -98,5 +103,5 @@
       }
     }
   ],
-  "envPrompt": "## WorkBuddy bridge\n\nThis machine has a WorkBuddy desktop sign-in bridged in (region: {{workbuddy.region}}; signed in: {{workbuddy.authed}}).\nThe model catalog holds {{workbuddy.catalogSize}} models. The currently selected model is `{{workbuddy.model}}` with default credit multiplier {{workbuddy.multiplier}}.\nWorkBuddy desktop main process: {{workbuddy.process}}. Relay-first switch: {{workbuddy.priority}}.\nSpent today through the bridge: {{workbuddy.todayCredit}} credits / {{workbuddy.todayTokens}} tokens (locally recorded).\nThe multiplier above already includes any time-limited discount or free window that is active right now; `wb_list_models` also marks which offers are active and their hours.\n\n- Use `wb_list_models` to see every model with its multiplier before choosing; prefer low-multiplier models for casual tasks.\n- Use `wb_select_model` when the user asks to switch the WorkBuddy model.\n- `wb_chat` only works while the WorkBuddy desktop main process is running; otherwise it returns「未检测到 WorkBuddy 主进程」. Every call spends the user's own credits at that model's multiplier.\n- `wb_credits` is read-only and costs nothing (also requires the desktop process).\n\n### Relay first: {{workbuddy.priority}}\n\n- Switch `on` **and** process `running`: every user turn that expects a conversational answer (question, chat, writing, reasoning, rewrite, translation, summary) must be answered by a WorkBuddy model first — call `wb_chat` (omit `model` to use `{{workbuddy.model}}`), then speak the returned answer back in your own voice and name the model that answered. Only fall back to your own model if the call fails.\n- Switch `off` (default): do not call `wb_chat`; answer with your own model. If the user explicitly asks for WorkBuddy, `wb_chat` is still allowed — the desktop process must be running.\n- Tool errors and empty answers are not a reason to flip the switch; just say what happened.\n"
+  "envPrompt": "## WorkBuddy bridge\n\nThis machine has a WorkBuddy desktop sign-in bridged in (region: {{workbuddy.region}}; signed in: {{workbuddy.authed}}).\nThe model catalog holds {{workbuddy.catalogSize}} models. The currently selected model is `{{workbuddy.model}}` with default credit multiplier {{workbuddy.multiplier}}.\nWorkBuddy desktop main process: {{workbuddy.process}}. Relay-first switch: {{workbuddy.priority}}.\nSpent today through the bridge: {{workbuddy.todayCredit}} credits / {{workbuddy.todayTokens}} tokens (locally recorded).\nThe multiplier above already includes any time-limited discount or free window that is active right now; `wb_list_models` also marks which offers are active and their hours.\n\n- Use `wb_list_models` to see every model with its multiplier before choosing; prefer low-multiplier models for casual tasks.\n- Safe-list gate: {{workbuddy.safeOnly}}. When it is `on`, only the models WorkBuddy publishes as public chat models are callable — `disabled` entries, internal routing aliases (`auto`, `fast-model`, `balanced-model`, `deep-model`), media/code models and delisted ones are refused. Do not try to work around a refusal; tell the user why and offer a safe model instead. `wb_list_models` with `all=true` shows the refused ones with reasons.\n- Use `wb_select_model` when the user asks to switch the WorkBuddy model.\n- `wb_chat` only works while the WorkBuddy desktop main process is running; otherwise it returns「未检测到 WorkBuddy 主进程」. Every call spends the user's own credits at that model's multiplier.\n- `wb_credits` is read-only and costs nothing (also requires the desktop process).\n\n### Relay first: {{workbuddy.priority}}\n\n- Switch `on` **and** process `running`: every user turn that expects a conversational answer (question, chat, writing, reasoning, rewrite, translation, summary) must be answered by a WorkBuddy model first — call `wb_chat` (omit `model` to use `{{workbuddy.model}}`), then speak the returned answer back in your own voice and name the model that answered. Only fall back to your own model if the call fails.\n- Switch `off` (default): do not call `wb_chat`; answer with your own model. If the user explicitly asks for WorkBuddy, `wb_chat` is still allowed — the desktop process must be running.\n- Tool errors and empty answers are not a reason to flip the switch; just say what happened.\n"
 }

package/dist/webui.js

@@ -77,7 +77,14 @@ var TEXT = {
     noData: "\u6682\u65E0\u6570\u636E",
     totalCredit: "\u5408\u8BA1\u79EF\u5206",
     todayCredit: "\u4ECA\u65E5\u79EF\u5206",
-    todayTokens: "\u4ECA\u65E5 token"
+    todayTokens: "\u4ECA\u65E5 token",
+    colSafety: "\u5408\u89C4",
+    safetySafe: "\u5B89\u5168\u6E05\u5355",
+    safetyCaution: "\u5B89\u5168\u6E05\u5355\xB7\u8C28\u614E",
+    showAllModels: "\u663E\u793A\u5168\u90E8\u6A21\u578B\uFF08\u542B\u4E0D\u5EFA\u8BAE\u9879\uFF09",
+    unsafePick: "\u8BE5\u6A21\u578B\u4E0D\u5728\u5B89\u5168\u6E05\u5355\u5185\uFF0C\u5DF2\u62D2\u7EDD\u9009\u62E9",
+    safeOnlyOn: "\u4EC5\u8C03\u7528\u5B89\u5168\u6E05\u5355\u6A21\u578B",
+    safeOnlyOff: "safeOnly \u5DF2\u5173\u95ED\uFF1A\u5168\u90E8\u6A21\u578B\u53EF\u8C03\u7528\uFF08\u542B WorkBuddy \u4E0D\u5EFA\u8BAE\u5916\u90E8\u8C03\u7528\u7684\u9879\uFF09"
   },
   en: {
     refresh: "Refresh from WorkBuddy",
@@ -156,7 +163,14 @@ var TEXT = {
     noData: "No data",
     totalCredit: "Total credits",
     todayCredit: "Credits today",
-    todayTokens: "Tokens today"
+    todayTokens: "Tokens today",
+    colSafety: "Policy",
+    safetySafe: "Safe list",
+    safetyCaution: "Safe list \xB7 caution",
+    showAllModels: "Show all models (including discouraged ones)",
+    unsafePick: "This model is outside the safe list and cannot be selected",
+    safeOnlyOn: "Safe-list only",
+    safeOnlyOff: "safeOnly is off: every model is callable (including ones WorkBuddy discourages)"
   }
 };
 function strings(ctx) {
@@ -190,33 +204,42 @@ function mountModels(ctx) {
   const { ui } = ctx;
   const sheet = ui.sheet({
     title: s.colModel === "\u6A21\u578B" ? "WorkBuddy \u6A21\u578B\u76EE\u5F55" : "WorkBuddy model catalog",
-    desc: s.empty
+    desc: s.colModel === "\u6A21\u578B" ? "\u9ED8\u8BA4\u53EA\u5217 WorkBuddy \u516C\u5F00\u5BF9\u8BDD\u6A21\u578B\uFF08\u5B89\u5168\u6E05\u5355\uFF09\uFF1B\u52FE\u9009\u300C\u663E\u793A\u5168\u90E8\u6A21\u578B\u300D\u53EF\u67E5\u770B\u88AB\u6392\u9664\u9879\u53CA\u5176\u7406\u7531\u3002" : 'Only WorkBuddy public chat models are listed by default; tick "Show all models" to see excluded ones and why.'
   });
   ctx.root.append(sheet.el);
   const head = ui.rowbar();
   const refreshBtn = ui.button(s.refresh, { variant: "primary" });
   const stateChip = ui.chip("", "plain");
   const currentChip = ui.chip("", "accent");
-  head.append(refreshBtn, stateChip, currentChip);
+  const allBox = ui.checkbox(s.showAllModels, { checked: false });
+  head.append(refreshBtn, stateChip, currentChip, allBox.el);
   sheet.body.append(head);
   const errLine = ui.msgline();
   sheet.body.append(errLine);
   const table = ui.table({
-    head: [s.colModel, s.colMultiplier, s.colContext, s.colReasoning, s.colAction],
+    head: [s.colModel, s.colSafety, s.colMultiplier, s.colContext, s.colReasoning, s.colAction],
     maxHeight: "calc(100vh - 320px)"
   });
   sheet.body.append(table.el);
   let state = null;
   function renderChips() {
-    stateChip.textContent = `${s.lastRefresh}: ${fmtTs(state?.catalogAt, s)} \xB7 ${state?.models?.length ?? 0} ${s.models}`;
+    const models = state?.models ?? [];
+    const safeCount = models.filter((m) => m.safety?.allow).length;
+    stateChip.textContent = `${s.lastRefresh}: ${fmtTs(state?.catalogAt, s)} \xB7 ${safeCount}/${models.length} ${s.models} \xB7 ${state?.safeOnly === false ? s.safeOnlyOff : s.safeOnlyOn}`;
     currentChip.textContent = `${s.currentModel}: ${state?.model || "\u2014"}`;
   }
+  function pickable(m) {
+    if (state?.safeOnly === false) return true;
+    return m.safety?.allow !== false;
+  }
   function renderTable() {
-    const models = state?.models ?? [];
+    const all = state?.models ?? [];
+    const models = allBox.checked ? all : all.filter((m) => m.safety?.allow);
     table.clear(models.length ? void 0 : s.empty);
     for (const m of models) {
       const mul = fmtMultiplier(m, s);
       const isCurrent = state.model === m.id;
+      const safety = m.safety ?? {};
       const nameCell = ui.h("div");
       nameCell.append(ui.h("div", null, m.name || m.id));
       const sub = ui.h("div", "dim", m.id);
@@ -224,12 +247,26 @@ function mountModels(ctx) {
       sub.style.opacity = "0.65";
       nameCell.append(sub);
       if (m.description) nameCell.title = m.description;
+      const safePill = ui.pill(
+        safety.label ?? "\u2014",
+        safety.allow ? safety.caution ? "plain" : "on" : "plain"
+      );
+      if (safety.reason) safePill.title = safety.reason;
+      if (!safety.allow) {
+        safePill.style.opacity = "0.6";
+        nameCell.style.opacity = "0.6";
+      }
       const mulPill = ui.pill(mul.text, mul.free ? "on" : "plain");
       if (mul.promo) mulPill.title = mul.promo;
+      const allowed = pickable(m);
       const btn = ui.button(isCurrent ? s.selected : s.select, {
         size: "sm",
         variant: isCurrent ? "plain" : "primary",
         onClick: async () => {
+          if (!allowed) {
+            ui.toast(`${s.unsafePick}${safety.reason ? `\uFF1A${safety.reason}` : ""}`, "bad");
+            return;
+          }
           const off = ui.disable(btn);
           try {
             const r = await ctx.invoke("select", [m.id]);
@@ -249,8 +286,13 @@ function mountModels(ctx) {
         }
       });
       if (isCurrent) btn.disabled = true;
+      if (!allowed) {
+        btn.disabled = true;
+        btn.title = safety.reason ?? "";
+      }
       table.addRow([
         nameCell,
+        safePill,
         mulPill,
         m.contextWindow ? String(m.contextWindow) : "\u2014",
         m.reasoning?.supportedEfforts?.join(" / ") ?? "\u2014",
@@ -258,6 +300,10 @@ function mountModels(ctx) {
       ]);
     }
   }
+  allBox.input.addEventListener("change", () => {
+    renderChips();
+    renderTable();
+  });
   async function load() {
     state = await ctx.invoke("state");
     renderChips();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cortico-world-workbuddy",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "type": "module",
   "description": "把 Windows 端已登录的 WorkBuddy 客户端模型桥接进 Coopanion：读取本机登录态，列出模型目录与默认积分倍率，供 Coo 调用。",
   "license": "MIT",

package/scripts/verify-ui.mjs

@@ -356,6 +356,23 @@ for (let run = 1; run <= RUNS; run += 1) {
     row.checks.usageRows = usage.rows;
     row.checks.usageChip = usage.chip;
     if (SHOTS && run === 1) { await sleep(300); await shot('world-usage'); }
+    // --- 模型目录：合规列 + 默认只列安全清单 ---
+    await evaluate(clickByText('模型目录'));
+    const modelsView = await waitFor('模型目录渲染', async () => {
+      const v = await evaluate(`(() => {
+        const th = [...document.querySelectorAll('th')].map((n) => n.textContent.trim());
+        const rows = document.querySelectorAll('table tr').length;
+        const safePills = [...document.querySelectorAll('td span')].filter((n) => /安全清单/.test(n.textContent || '')).length;
+        const allBox = [...document.querySelectorAll('input[type="checkbox"]')].length;
+        return { hasPolicy: th.includes('合规'), headers: th.join('|'), rows, safePills, checkboxes: allBox };
+      })()`);
+      return v.hasPolicy && v.rows > 10 ? v : false;
+    });
+    row.checks.modelsPolicyColumn = modelsView.hasPolicy;
+    row.checks.modelsRows = modelsView.rows;
+    row.checks.modelsSafePills = modelsView.safePills;
+    row.checks.modelsHasShowAll = modelsView.checkboxes >= 1;
+    if (SHOTS && run === 1) { await sleep(300); await shot('world-models'); }
     if (KEEP) await shot(`run${run}-world`);
     void pane;
   } catch (err) {

package/src/ENV_PROMPT.md

@@ -7,6 +7,7 @@ Spent today through the bridge: {{workbuddy.todayCredit}} credits / {{workbuddy.
 The multiplier above already includes any time-limited discount or free window that is active right now; `wb_list_models` also marks which offers are active and their hours.
 
 - Use `wb_list_models` to see every model with its multiplier before choosing; prefer low-multiplier models for casual tasks.
+- Safe-list gate: {{workbuddy.safeOnly}}. When it is `on`, only the models WorkBuddy publishes as public chat models are callable — `disabled` entries, internal routing aliases (`auto`, `fast-model`, `balanced-model`, `deep-model`), media/code models and delisted ones are refused. Do not try to work around a refusal; tell the user why and offer a safe model instead. `wb_list_models` with `all=true` shows the refused ones with reasons.
 - Use `wb_select_model` when the user asks to switch the WorkBuddy model.
 - `wb_chat` only works while the WorkBuddy desktop main process is running; otherwise it returns「未检测到 WorkBuddy 主进程」. Every call spends the user's own credits at that model's multiplier.
 - `wb_credits` is read-only and costs nothing (also requires the desktop process).

package/src/config.js

@@ -29,6 +29,12 @@ export const WB_DEFAULTS = {
   prefer: false,
   /** 是否允许改写宿主控制台 index.html 注入「中转站优先」按钮；关闭后不注入也不还原。 */
   hostInject: true,
+  /**
+   * 只允许调用 WorkBuddy 公开对话模型（安全清单）。
+   * 关掉后能用 disabled / 内部别名 / 预览等模型，但那属于「已知会违反对方使用建议」的操作，
+   * 默认必须是 true。
+   */
+  safeOnly: true,
 };
 
 /** World 配置组（WebUI 通用渲染的旋钮）。模型选择走自定义面板，不在这里。 */
@@ -84,6 +90,13 @@ export const WB_CONFIG_GROUP = {
         description: '在「开始」页加一个「中转站优先」按钮（会改写 Coopanion 的 build/console/index.html，停用或卸载时自动还原）。关掉后只能用 World 详情页的开关。',
         'x-hot': true,
       },
+      'worlds.workbuddy.safeOnly': {
+        type: 'boolean',
+        title: '只调用安全清单模型',
+        description:
+          '默认开：wb_chat / wb_select_model 只接受 WorkBuddy 公开目录里的对话模型（21 个），disabled、内部路由别名、媒体与代码补全模型一律拒绝。关掉可绕过限制，但那属于违反对方使用建议的操作，风险自负。',
+        'x-hot': true,
+      },
     },
   },
 };

package/src/safety.js

@@ -0,0 +1,168 @@
+/**
+ * 模型安全清单（合规口径）。
+ *
+ * 依据：WorkBuddy 官方对话给出的「避免违反用户协议/触发风控」筛选原则——
+ * 只调用「官方公开目录里、当前可正常对话」的模型；凡是 disabled、内部路由别名、
+ * 状态不明（请求格式报错）、媒体/代码补全模型，一律不通过外部软件调用。
+ *
+ * 这里把结论固化成三件事：
+ *   1. SAFE_MODEL_IDS：可直接用 wb_chat 调用的白名单（WorkBuddy 给的 21 个）；
+ *   2. classifyModel()：给目录里每个模型打等级与理由，供面板展示与拦截；
+ *   3. DEFAULT_SAFE_MODEL：当前选择失效时的回落项（同样是白名单内的 flash 档）。
+ *
+ * 清单会随官方目录变化而过时——这正是 classifyModel 返回 safe=false 时给出
+ * 「不在安全清单内」的原因，而不是断言模型不可用。用户可以显式关掉 safeOnly
+ * 自行承担风险，扩展不做单方面放行。
+ */
+
+/** WorkBuddy 建议的公开对话模型白名单。 */
+export const SAFE_MODEL_IDS = [
+  // DeepSeek
+  'deepseek-v4.1-flash',
+  'deepseek-v4-flash',
+  'deepseek-v4-pro',
+  'deepseek-v3-2-volc',
+  // GLM
+  'glm-5.3-flash',
+  'glm-5.3',
+  'glm-5.2',
+  // 混元
+  'hy3',
+  'hy3-b',
+  'hy3-c',
+  'hy3-x',
+  'hunyuan-chat',
+  // Kimi
+  'kimi-k2.5',
+  'kimi-k2.8-preview',
+  'kimi-k3-1',
+  'kimi-k3.1-pro',
+  // 其他
+  'minimax-m2.7',
+  'minimax-m3.1-flash',
+  'mimo-v2.6-pro',
+  'space-bunny',
+  'step-5-preview',
+];
+
+/** 白名单分组（面板与 wb_list_models 用同一份顺序）。 */
+export const SAFE_MODEL_GROUPS = [
+  { label: 'DeepSeek', ids: ['deepseek-v4.1-flash', 'deepseek-v4-flash', 'deepseek-v4-pro', 'deepseek-v3-2-volc'] },
+  { label: 'GLM', ids: ['glm-5.3-flash', 'glm-5.3', 'glm-5.2'] },
+  { label: '混元', ids: ['hy3', 'hy3-b', 'hy3-c', 'hy3-x', 'hunyuan-chat'] },
+  { label: 'Kimi', ids: ['kimi-k2.5', 'kimi-k2.8-preview', 'kimi-k3-1', 'kimi-k3.1-pro'] },
+  { label: '其他', ids: ['minimax-m2.7', 'minimax-m3.1-flash', 'mimo-v2.6-pro', 'space-bunny', 'step-5-preview'] },
+];
+
+/** 白名单里属于「免费试用/预览」的模型：能用，但不适合高频自动化调用。 */
+export const CAUTION_MODEL_IDS = ['hy3', 'hy3-b', 'hy3-c', 'kimi-k2.8-preview', 'step-5-preview'];
+
+/** 当前选择失效时的回落模型。 */
+export const DEFAULT_SAFE_MODEL = 'deepseek-v4.1-flash';
+
+/** 内部路由别名：疑似仅限 WorkBuddy 应用内 UI 使用。 */
+const ALIAS_IDS = ['auto', 'fast-model', 'balanced-model', 'deep-model'];
+
+/** 媒体生成模型：不属于 /v2/chat/completions 的对话范围。 */
+const MEDIA_IDS = ['hunyuan-image-alpha', 'hunyuan-image-alpha-edit', 'kling-video-v3', 'minimax-video-h3'];
+
+/** 代码补全模型：走补全接口，对话接口只会回空。 */
+const CODE_IDS = ['codewise-rewrite', 'codewise-nes-a4-027-aide', 'codewise-jump', 'codewise-completions'];
+
+/** 实测已下架（11102 service info not found）的模型，仅用于展示时置灰。 */
+const RETIRED_IDS = [
+  'hy4-preview-x',
+  'minimax-m2.5',
+  'glm-4.6v',
+  'kimi-k2-thinking',
+  'glm-4.6',
+  'deepseek-v3-1-volc',
+  'deepseek-v3-1',
+  'deepseek-v3-0324-lkeap',
+  'deepseek-r1-0528-lkeap',
+  'kimi-k2-instruct-taiji',
+  'completion-gf',
+  'default-1.1',
+  'default-1.2',
+  'hunyuan-3b',
+  'hunyuan-7b-dense',
+  'hunyuan-2.0-instruct',
+  'deepseek-r1-0528',
+  'deepseek-v3-0324',
+  'deepseek-v3-0324-taco-completion',
+];
+
+/** 请求格式不符（11150）的模型，状态不明。 */
+const FORMAT_UNSUPPORTED_IDS = ['glm-5.0-turbo'];
+
+/** 实验预览系列（能对话，但未列入安全清单）。 */
+const EXPERIMENTAL_PREFIXES = ['hy4-preview', 'hy4preview-'];
+
+const TIER_LABEL = {
+  safe: '安全清单',
+  caution: '安全清单（谨慎）',
+  alias: '内部路由别名',
+  disabled: '目录已标 disabled',
+  media: '媒体生成模型',
+  code: '代码补全模型',
+  retired: '已下架',
+  format: '状态不明',
+  experimental: '实验预览',
+  unknown: '不在安全清单',
+};
+
+function inList(id, list) {
+  return list.includes(id);
+}
+
+function startsWithAny(id, prefixes) {
+  return prefixes.some((p) => id.startsWith(p));
+}
+
+/**
+ * 判定一个模型属于哪一档。
+ * @param {string} id
+ * @param {{ disabled?: boolean }} [model]
+ * @returns {{ id: string, tier: string, label: string, reason: string, allow: boolean, caution: boolean }}
+ */
+export function classifyModel(id, model) {
+  const mid = String(id ?? '');
+  const make = (tier, reason) => ({
+    id: mid,
+    tier,
+    label: TIER_LABEL[tier] ?? tier,
+    reason,
+    allow: tier === 'safe' || tier === 'caution',
+    caution: tier === 'caution',
+  });
+
+  if (model?.disabled === true) return make('disabled', '目录里标了 disabled，WorkBuddy 明确建议不要调用');
+  if (inList(mid, SAFE_MODEL_IDS)) {
+    return inList(mid, CAUTION_MODEL_IDS)
+      ? make('caution', '公开对话模型；属免费试用或 preview，能用但不适合高频自动化调用')
+      : make('safe', '公开对话模型，WorkBuddy 建议的调用范围');
+  }
+  if (inList(mid, ALIAS_IDS)) return make('alias', '内部路由别名，疑似仅限 WorkBuddy 应用内使用');
+  if (inList(mid, MEDIA_IDS)) return make('media', '图像/视频生成模型，不在对话接口范围内');
+  if (inList(mid, CODE_IDS)) return make('code', '代码补全模型，对话接口不会给出正文');
+  if (inList(mid, RETIRED_IDS)) return make('retired', '已下架（11102 service info not found）');
+  if (inList(mid, FORMAT_UNSUPPORTED_IDS)) return make('format', '请求格式不符（11150），状态不明');
+  if (startsWithAny(mid, EXPERIMENTAL_PREFIXES)) return make('experimental', '实验预览模型，未列入安全清单');
+  return make('unknown', 'WorkBuddy 未把它列为公开对话模型');
+}
+
+/** 白名单模型的建议默认次序：优先 flash 档，避开试用/预览。 */
+export function preferredSafeModel(availableIds = SAFE_MODEL_IDS) {
+  const order = [DEFAULT_SAFE_MODEL, 'deepseek-v4-flash', 'glm-5.3-flash', 'minimax-m3.1-flash'];
+  for (const id of order) if (availableIds.includes(id)) return id;
+  const firstStable = availableIds.find((id) => inList(id, SAFE_MODEL_IDS) && !inList(id, CAUTION_MODEL_IDS));
+  return firstStable ?? DEFAULT_SAFE_MODEL;
+}
+
+/** 白名单按分组展开，只保留确实在目录里的。 */
+export function safeGroupsOf(availableIds) {
+  const set = new Set(availableIds ?? []);
+  return SAFE_MODEL_GROUPS.map((g) => ({ label: g.label, ids: g.ids.filter((id) => set.has(id)) })).filter(
+    (g) => g.ids.length > 0,
+  );
+}

package/src/upstream.js

@@ -401,6 +401,8 @@ function normalizeModel(m) {
     supportsToolCall: m.supportsToolCall === true || m.supports_tool_call === true,
     description: str(m.descriptionZh ?? m.description ?? m.descriptionEn),
     reasoning: parseReasoning(m.reasoning),
+    /** 目录里标了 disabled=true 的模型：调用它们等于绕过官方限制，安全清单直接拒。 */
+    disabled: m.disabled === true,
   };
   return out;
 }

package/src/webui/client.js

@@ -85,6 +85,13 @@ const TEXT = {
     totalCredit: '合计积分',
     todayCredit: '今日积分',
     todayTokens: '今日 token',
+    colSafety: '合规',
+    safetySafe: '安全清单',
+    safetyCaution: '安全清单·谨慎',
+    showAllModels: '显示全部模型（含不建议项）',
+    unsafePick: '该模型不在安全清单内，已拒绝选择',
+    safeOnlyOn: '仅调用安全清单模型',
+    safeOnlyOff: 'safeOnly 已关闭：全部模型可调用（含 WorkBuddy 不建议外部调用的项）',
   },
   en: {
     refresh: 'Refresh from WorkBuddy',
@@ -166,6 +173,13 @@ const TEXT = {
     totalCredit: 'Total credits',
     todayCredit: 'Credits today',
     todayTokens: 'Tokens today',
+    colSafety: 'Policy',
+    safetySafe: 'Safe list',
+    safetyCaution: 'Safe list · caution',
+    showAllModels: 'Show all models (including discouraged ones)',
+    unsafePick: 'This model is outside the safe list and cannot be selected',
+    safeOnlyOn: 'Safe-list only',
+    safeOnlyOff: 'safeOnly is off: every model is callable (including ones WorkBuddy discourages)',
   },
 };
 
@@ -205,7 +219,10 @@ function mountModels(ctx) {
 
   const sheet = ui.sheet({
     title: s.colModel === '模型' ? 'WorkBuddy 模型目录' : 'WorkBuddy model catalog',
-    desc: s.empty,
+    desc:
+      s.colModel === '模型'
+        ? '默认只列 WorkBuddy 公开对话模型（安全清单）；勾选「显示全部模型」可查看被排除项及其理由。'
+        : 'Only WorkBuddy public chat models are listed by default; tick "Show all models" to see excluded ones and why.',
   });
   ctx.root.append(sheet.el);
 
@@ -213,14 +230,15 @@ function mountModels(ctx) {
   const refreshBtn = ui.button(s.refresh, { variant: 'primary' });
   const stateChip = ui.chip('', 'plain');
   const currentChip = ui.chip('', 'accent');
-  head.append(refreshBtn, stateChip, currentChip);
+  const allBox = ui.checkbox(s.showAllModels, { checked: false });
+  head.append(refreshBtn, stateChip, currentChip, allBox.el);
   sheet.body.append(head);
 
   const errLine = ui.msgline();
   sheet.body.append(errLine);
 
   const table = ui.table({
-    head: [s.colModel, s.colMultiplier, s.colContext, s.colReasoning, s.colAction],
+    head: [s.colModel, s.colSafety, s.colMultiplier, s.colContext, s.colReasoning, s.colAction],
     maxHeight: 'calc(100vh - 320px)',
   });
   sheet.body.append(table.el);
@@ -228,16 +246,29 @@ function mountModels(ctx) {
   let state = null;
 
   function renderChips() {
-    stateChip.textContent = `${s.lastRefresh}: ${fmtTs(state?.catalogAt, s)} · ${state?.models?.length ?? 0} ${s.models}`;
+    const models = state?.models ?? [];
+    const safeCount = models.filter((m) => m.safety?.allow).length;
+    stateChip.textContent = `${s.lastRefresh}: ${fmtTs(state?.catalogAt, s)} · ${safeCount}/${models.length} ${s.models} · ${
+      state?.safeOnly === false ? s.safeOnlyOff : s.safeOnlyOn
+    }`;
     currentChip.textContent = `${s.currentModel}: ${state?.model || '—'}`;
   }
 
+  /** 当前是否允许选这个模型：safeOnly 开时只放行安全清单。 */
+  function pickable(m) {
+    if (state?.safeOnly === false) return true;
+    return m.safety?.allow !== false;
+  }
+
   function renderTable() {
-    const models = state?.models ?? [];
+    const all = state?.models ?? [];
+    const models = allBox.checked ? all : all.filter((m) => m.safety?.allow);
     table.clear(models.length ? undefined : s.empty);
     for (const m of models) {
       const mul = fmtMultiplier(m, s);
       const isCurrent = state.model === m.id;
+      const safety = m.safety ?? {};
+
       const nameCell = ui.h('div');
       nameCell.append(ui.h('div', null, m.name || m.id));
       const sub = ui.h('div', 'dim', m.id);
@@ -246,13 +277,28 @@ function mountModels(ctx) {
       nameCell.append(sub);
       if (m.description) nameCell.title = m.description;
 
+      const safePill = ui.pill(
+        safety.label ?? '—',
+        safety.allow ? (safety.caution ? 'plain' : 'on') : 'plain',
+      );
+      if (safety.reason) safePill.title = safety.reason;
+      if (!safety.allow) {
+        safePill.style.opacity = '0.6';
+        nameCell.style.opacity = '0.6';
+      }
+
       const mulPill = ui.pill(mul.text, mul.free ? 'on' : 'plain');
       if (mul.promo) mulPill.title = mul.promo;
 
+      const allowed = pickable(m);
       const btn = ui.button(isCurrent ? s.selected : s.select, {
         size: 'sm',
         variant: isCurrent ? 'plain' : 'primary',
         onClick: async () => {
+          if (!allowed) {
+            ui.toast(`${s.unsafePick}${safety.reason ? `：${safety.reason}` : ''}`, 'bad');
+            return;
+          }
           const off = ui.disable(btn);
           try {
             const r = await ctx.invoke('select', [m.id]);
@@ -272,9 +318,14 @@ function mountModels(ctx) {
         },
       });
       if (isCurrent) btn.disabled = true;
+      if (!allowed) {
+        btn.disabled = true;
+        btn.title = safety.reason ?? '';
+      }
 
       table.addRow([
         nameCell,
+        safePill,
         mulPill,
         m.contextWindow ? String(m.contextWindow) : '—',
         m.reasoning?.supportedEfforts?.join(' / ') ?? '—',
@@ -283,6 +334,11 @@ function mountModels(ctx) {
     }
   }
 
+  allBox.input.addEventListener('change', () => {
+    renderChips();
+    renderTable();
+  });
+
   async function load() {
     state = await ctx.invoke('state');
     renderChips();

package/src/world.js

@@ -12,6 +12,7 @@ import { discoverCredentials, maskToken, resolveTokensWithKey } from './credenti
 import { detectWorkBuddy } from './wbproc.js';
 import { attachPromos, dailyWindowText, discountText, priceViewOf, promoActiveAt } from './promo.js';
 import { UsageLedger, summarize } from './usage.js';
+import { DEFAULT_SAFE_MODEL, SAFE_MODEL_IDS, classifyModel, preferredSafeModel, safeGroupsOf } from './safety.js';
 import { backupPathOf, describeHostInjection, ensureHostInjection, findAppRoot, inspectHostInjection, removeHostInjection } from './host.js';
 
 const ENV_PROMPT_FILE = fileURLToPath(new URL('./ENV_PROMPT.md', import.meta.url));
@@ -53,9 +54,15 @@ export const WB_TOOL_DECLS = [
   {
     name: 'wb_list_models',
     description:
-      'List the WorkBuddy models available to the signed-in account, each with its default credit multiplier (e.g. x0.79), context window and reasoning efforts. Read-only; costs nothing.',
+      'List the WorkBuddy chat models that are safe to call (official public catalog only), each with its credit multiplier (e.g. x0.79, already including time-limited discounts), context window and reasoning efforts. Read-only; costs nothing. Pass all=true to also list models that are disabled, internal routing aliases, media/code models or delisted ones — those are not callable through this bridge while worlds.workbuddy.safeOnly is on.',
     tags: ['read'],
-    parameters: { type: 'object', additionalProperties: false, properties: {} },
+    parameters: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {
+        all: { type: 'boolean', description: 'Also list models outside the safe list (shown with their risk reason).' },
+      },
+    },
   },
   {
     name: 'wb_select_model',
@@ -434,6 +441,37 @@ export class WorkBuddyWorld {
     return this.catalog.find((m) => m.id === id);
   }
 
+  // -------------------------------------------------------------------------
+  // 合规闸门：只放行 WorkBuddy 公开对话模型
+  // -------------------------------------------------------------------------
+
+  /** 目录里哪些模型进了安全清单（按目录顺序）。 */
+  safeModelIds() {
+    return this.catalog.filter((m) => classifyModel(m.id, m).allow).map((m) => m.id);
+  }
+
+  /** 单个模型的合规判定。 */
+  safetyOf(id) {
+    return classifyModel(id, this.findModel(id));
+  }
+
+  /** 把模型的合规判定挂进 models/state 的返回，供面板渲染。 */
+  describeModel(m) {
+    const safety = classifyModel(m.id, m);
+    return { ...m, safety, price: priceViewOf(m, Date.now()) };
+  }
+
+  /**
+   * wb_chat / wb_select_model 的准入检查。
+   * @returns {string|null} 拒绝时返回给模型看的说明，放行时 null。
+   */
+  rejectUnsafeModel(id) {
+    const safety = this.safetyOf(id);
+    if (safety.allow || this.cfg.safeOnly === false) return null;
+    const hint = '（workbuddy.safeOnly 已开；如确需使用，可在 World 配置里关掉它，风险自负）';
+    return `模型 ${id} 不在 WorkBuddy 安全清单内，判定为「${safety.label}」：${safety.reason}。${hint}`;
+  }
+
   // -------------------------------------------------------------------------
   // World 契约
   // -------------------------------------------------------------------------
@@ -454,6 +492,7 @@ export class WorkBuddyWorld {
       'workbuddy.authed': this.tokens ? 'yes' : 'no',
       'workbuddy.priority': this.preferOn ? 'on' : 'off',
       'workbuddy.process': this.proc.running ? 'running' : 'stopped',
+      'workbuddy.safeOnly': this.cfg.safeOnly === false ? 'off' : 'on',
       'workbuddy.todayCredit': String(Math.round(this.today.credit * 100) / 100),
       'workbuddy.todayTokens': String(this.today.prompt + this.today.completion),
     };
@@ -463,7 +502,7 @@ export class WorkBuddyWorld {
     return [
       {
         ...WB_TOOL_DECLS[0],
-        handler: async () => this.toolListModels(),
+        handler: async (args) => this.toolListModels({ all: args?.all === true }),
       },
       {
         ...WB_TOOL_DECLS[1],
@@ -581,10 +620,12 @@ export class WorkBuddyWorld {
   // 工具实现（回执只陈述可确认的事实）
   // -------------------------------------------------------------------------
 
-  toolListModels() {
+  toolListModels({ all = false } = {}) {
     if (this.catalog.length === 0) return `WorkBuddy 模型目录为空。${this.lastError || '请先在面板刷新目录。'}`;
     const now = Date.now();
-    const lines = this.catalog.map((m) => {
+    const safeOnly = this.cfg.safeOnly !== false;
+
+    const describe = (m) => {
       const parts = [`- ${m.id}`];
       if (m.name !== m.id) parts.push(`(${m.name})`);
       const price = priceViewOf(m, now);
@@ -602,10 +643,24 @@ export class WorkBuddyWorld {
       if (m.reasoning?.supportedEfforts) parts.push(`推理档 ${m.reasoning.supportedEfforts.join('/')}`);
       if (m.supportsImages) parts.push('支持图片输入');
       return parts.join('，');
+    };
+
+    const safeModels = this.catalog.filter((m) => classifyModel(m.id, m).allow);
+    const otherModels = this.catalog.filter((m) => !classifyModel(m.id, m).allow);
+
+    const groups = safeGroupsOf(safeModels.map((m) => m.id));
+    const groupBlocks = groups.map((g) => {
+      const rows = g.ids.map((id) => describe(this.findModel(id))).filter(Boolean);
+      return `【${g.label}】\n${rows.join('\n')}`;
     });
+
     const current = this.cfg.model
       ? `当前选择：${this.cfg.model}（此刻 ${this.selectedMultiplier() ?? '倍率未知'}）\n`
       : '当前未选择模型。\n';
+    const policy = safeOnly
+      ? `安全清单：${safeModels.length}/${this.catalog.length} 个模型可调用（WorkBuddy 公开目录里的对话模型；wb_list_models 传 all=true 可看其余项及原因）。\n`
+      : `注意：safeOnly 已关闭，${this.catalog.length} 个模型全部可调用——其中含 disabled/别名/媒体等 WorkBuddy 不建议外部调用的项。\n`;
+
     const promoLines = this.promos
       .filter((p) => Array.isArray(p.modelIds) && p.modelIds.length > 0)
       .map((p) => {
@@ -616,12 +671,28 @@ export class WorkBuddyWorld {
         return `- ${p.id}：${discountText(p)}${when ? `，${when}` : ''}，影响 ${p.modelIds.join('/')}（${flag}）`;
       });
     const promoBlock = promoLines.length > 0 ? `\n限时优惠：\n${promoLines.join('\n')}` : '';
-    return current + lines.join('\n') + promoBlock;
+
+    if (!all) {
+      const body = groupBlocks.length > 0 ? groupBlocks.join('\n') : '（安全清单里的模型当前都不在目录中，先刷新目录。）';
+      return `${current}${policy}\n${body}${promoBlock}`;
+    }
+
+    const otherRows = otherModels.map((m) => {
+      const safety = classifyModel(m.id, m);
+      return `- ${m.id}：${safety.label}——${safety.reason}`;
+    });
+    const otherBlock =
+      otherRows.length > 0
+        ? `\n\n其余 ${otherRows.length} 个模型（不建议通过外部软件调用${safeOnly ? '，当前会被拒绝' : '，但 safeOnly 已关闭'}）：\n${otherRows.join('\n')}`
+        : '';
+    return `${current}${policy}\n${groupBlocks.join('\n')}${otherBlock}${promoBlock}`;
   }
 
   async toolSelectModel(id) {
     const model = this.findModel(id);
     if (!model) return { text: `目录里没有模型「${id}」。先用 wb_list_models 看可用 id。`, failed: true };
+    const reject = this.rejectUnsafeModel(id);
+    if (reject) return { text: reject, failed: true };
     this.cfg.model = id;
     // 框架的 ctx.persist(patch) 必须带 patch；只写本 World 段内的字段。
     this.ctx.persist({ model: id });
@@ -644,7 +715,15 @@ export class WorkBuddyWorld {
       return { text: '未检测到 WorkBuddy 主进程：请先启动 WorkBuddy 桌面端再试。', failed: true };
     }
     const useId = model || this.cfg.model;
-    if (!useId) return { text: '尚未选择模型；先 wb_list_models 再 wb_select_model。', failed: true };
+    if (!useId) {
+      const suggestion = preferredSafeModel(this.safeModelIds());
+      return {
+        text: `尚未选择模型；先 wb_list_models 再 wb_select_model（建议 ${suggestion}）。`,
+        failed: true,
+      };
+    }
+    const reject = this.rejectUnsafeModel(useId);
+    if (reject) return { text: reject, failed: true };
     const tokens = await this.ensureTokens();
     if (!tokens) return { text: '未发现 WorkBuddy 登录态，无法调用。', failed: true };
     const messages = [];
@@ -837,6 +916,7 @@ export class WorkBuddyWorld {
             { name: 'workbuddy.authed', description: '是否已有可用登录态。' },
             { name: 'workbuddy.priority', description: '「中转站优先」开关：on / off。' },
             { name: 'workbuddy.process', description: 'WorkBuddy 主进程状态：running / stopped。' },
+            { name: 'workbuddy.safeOnly', description: '安全清单闸门：on（只放行公开对话模型）/ off。' },
             { name: 'workbuddy.todayCredit', description: '今日已消耗积分（本地记账）。' },
             { name: 'workbuddy.todayTokens', description: '今日 token 用量（本地记账）。' },
           ],
@@ -1034,7 +1114,8 @@ export class WorkBuddyWorld {
         model: this.cfg.model,
         catalogAt: this.catalogAt,
         lastError: this.lastError,
-        models: this.catalog.map((m) => ({ ...m, price: priceViewOf(m, Date.now()) })),
+        safeOnly: this.cfg.safeOnly !== false,
+        models: this.catalog.map((m) => this.describeModel(m)),
         prefer: this.preferOn,
         running: !!this.proc.running,
         mainPid: this.proc.mainPid,
@@ -1053,6 +1134,8 @@ export class WorkBuddyWorld {
       const id = String(args[0] ?? '');
       const found = this.findModel(id);
       if (!found) return { ok: false, error: `unknown model: ${id}` };
+      const reject = this.rejectUnsafeModel(id);
+      if (reject) return { ok: false, error: reject, unsafe: true };
       this.cfg.model = id;
       this.ctx.persist({ model: id });
       return { ok: true, model: id, multiplier: found.creditMultiplier ?? null };