dsh-packycode-api 1.1.3 → 1.1.5

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.1.5
+
+- Added `grok-4.7`, displayed as **Grok 4.7**, to the PackyCode `openai-responses` route at `https://cf.api.fan/v1`. [The official Grok 4.7 guide](https://docs.x.ai/developers/grok-4-7) declares a 500,000-token context, text/image input, text output, and `low` / `medium` / `high` / `xhigh` reasoning (default `high`, no off or max). There is no separate documented text-output cap; the numeric pi-ai ceiling is 500,000, bounded by remaining context per request. Only GPT Responses requests keep `prompt_cache_key`: the gateway's Grok route rejects this field with a misleading `Incorrect API key provided` error. Non-GPT Responses requests use pi-ai's `cacheRetention: 'none'` to omit it; the model, protocol, effort and plugin-owned credential stay the same.
+- Settings now has a model checkbox list with Select all / Select none. All models, including newly added catalog entries, are visible by default. The profile stores exclusions, and DSH's picker refreshes when they change. Hiding a model does not prevent an existing session or prepared turn from using it.
+- Fixed saving Auto web search on DSH 0.2 (including the reported macOS Intel installation): require `@deepseek-ai/schemastery` 3.18.4+, which declares volatile preference fields. The previous 3.18.2 dependency silently left them non-volatile, so DSH 0.2 refused the write. All RPC failures now carry Connection's required `code`, `message`, and empty `details`, preserving a safe error instead of `connection: invalid server-response failure`.
+- The live checker now reads only the plugin-owned `packycode-api/keys` credential record, selecting the active usable key or `--key-label LABEL`; legacy references and environment credentials never substitute for it. Invalid YAML produces a safe error without quoting secret-bearing source lines, and checks never modify the stored record.
+- Validation: 276 offline tests, both regenerated bundles and the versioned tarball; built settings UI checkbox/all/none/save-failure checks; the bundled DSH 0.2 Connection parser accepts the fixed failure. Built live gateway checks answered through DeepSeek Flash, GPT-6.1 Sol, GPT-6 Astra and Grok 4.7 and passed key rotation and secret-free projections. All four Grok efforts returned `ok` with a plugin-stored Grok-group key; xhigh first encountered a transient upstream 400 and succeeded on an identical retry. The user confirmed the local desktop build passed testing. The physical Intel desktop UI has not been retested.
+
+## 1.1.4
+
+- **Carry the reviewed plan into the next CLI turn.** The plan previously existed only in `exit_plan_mode` arguments, which the delegated transcript dropped; a fresh CLI then saw only “Plan approved”. The latest complete plan and its matching review result are now recovered from durable native or adapter-generated PTC tool calls, so approval, revision, resume and fork keep their constraints. They are reserved before trimming older chat; an oversized plan/request fails explicitly rather than silently losing constraints. Unrelated tool arguments and arbitrary PTC programs are not forwarded.
+- **Use the actual CLI permission protocol.** Plan runs now request `--permission-prompt-tool stdio` as well as `--permission-mode plan`, making `ExitPlanMode` available to the official print-mode CLI and routing its permission request to the host. A targeted ask rule prevents an existing `ExitPlanMode` allow rule from skipping the handoff. Repeated permission refusals are bounded, including native plan-mode tool-result denials, without counting ordinary execution errors or counting one refusal twice.
+- **Plans belong to one invocation.** Each plan run creates one private temporary planning-artifact directory inside its working directory (the official CLI rejects custom plan directories outside the project root), and supplies it through additive `plansDirectory` settings while preserving the credential/config home and other permission/MCP settings. It never changes project code or project settings; an unwritable workspace fails explicitly rather than using a shared fallback. File fallback and submitted paths are restricted to that directory; shared/global plans and a prior run's recent file are never candidates. Owned resources are cleaned on completion, cancellation, startup failure and unload.
+- **Review follows the host's tool presentation.** Native catalogs receive `exit_plan_mode`; PTC catalogs receive the real `run_code` transport calling `tools.exit_plan_mode`. Missing review transports fail closed instead of inventing an unavailable direct tool call.
+- **Leave plan mode at the correct boundary.** Model preparation can follow a selected pending mode, but `claude_code` execution reads the currently committed mode. Approval's pending exit no longer gives later tools in the same batch edit/full permission before the next accepted step.
+- **Secret-free release preflight.** The OIDC diagnostic now prints only identity claims and the registry exchange status, never the returned credential body, and fails when the publisher is rejected. Truncating a body before regex redaction could previously expose a token prefix. Added regressions for long credential bodies and the registry's successful `201` response. Tag publication now packs and publishes the verified versioned tarball, matching the locally inspected artifact rather than independently repacking the workspace.
+- Added `scripts/cli-plan-check.mjs`, a real-official-CLI/local-fake-gateway check for stdio handoff, private plan files, concurrent ownership, native denials, MCP search and cleanup. It uses no real credentials or quota and does not start DSH.
+- Validation: full offline suite, both bundles and the versioned tarball; official CLI 2.1.295 against local fixtures passed stdio plan handoff, existing-allow-rule interception, concurrent/private plan ownership, native denial limits, MCP and cleanup, plus the existing read-only/edit/full search checks. Actual bundled DSH 0.2.0-rc.2 plan/tool controllers and its Node PTC subprocess passed 50 offline assertions. The built HTTP route answered through `deepseek-flash`, `gpt-6.1-sol` and `gpt-6-astra`, and key rotation and secret-free RPC projections passed the gateway check. The available key does not cover Claude: actual Claude upstream and a running desktop DSH UI integration are not claimed.
+
 ## 1.1.3
 
 - **Plan review when the CLI has no ExitPlanMode.** Print mode often does not offer that tool, so a plan-mode turn wrote `~/.dsh/packycode-claude-cli/plans/*.md` and came back as ordinary text. A plan file written during the run is now submitted through DSH's `exit_plan_mode` when the CLI returns. An older file in that directory is ignored.

package/README.en.md

@@ -25,6 +25,7 @@ The `PackyCode` model group ships with the plugin. No YAML edits and no separate
 | Capability | What it does |
 | --- | --- |
 | **Built-in model route** | Adds a `PackyCode` group to the model picker. No provider configuration and no `cordis.patch.yml` edits |
+| **Choose visible models** | All models are selected by default in Settings. Unchecking a model immediately hides it from the picker; existing sessions can keep using it |
 | **Keys used in order** | An exhausted or rejected key is disabled and the next usable key takes over; the failed step is retried on that key |
 | **Keys chosen by group** | Each key lists its PackyCode groups and the models they reach; when the active key's groups cannot reach the selected model (no `cc` group for Claude, say), that turn runs on a stored key whose groups can |
 | **Visible balance** | Settings lists each key's remaining, used, limit, reset period, and a usage bar, plus a total of those keys. The composer shows the active key's remaining balance |
@@ -44,7 +45,7 @@ Open the desktop application's **Plugins** page, click **Add plugin**, and enter
 dsh-packycode-api
 ```
 
-Choose the **official** install source, then click **Install**. To pin a version, enter `dsh-packycode-api@1.1.3`.
+Choose the **official** install source, then click **Install**. To pin a version, enter `dsh-packycode-api@1.1.5`.
 
 Then **manually restart the desktop application**. Refreshing the page does not reload the plugin inside the Host process.
 
@@ -56,14 +57,14 @@ Open **Settings → PackyCode**. Paste the API key under **Add a key**. A label
 
 ### 3. Select a model
 
-Choose a model from the `PackyCode` group. `deepseek-flash`, `gpt-6.1-sol`, and `gpt-6-astra` work once a key is stored. The three Claude models also need the Claude Code CLI on this device; see below.
+Choose a model from the `PackyCode` group. `deepseek-flash`, `gpt-6.1-sol`, `gpt-6-astra`, and `grok-4.7` use HTTP. The three Claude models also need the Claude Code CLI on this device; see below. Your key's groups must cover the selected model.
 
 <details>
 <summary>Verify the install / other profiles / a local checkout</summary>
 
 The **Plugins** page shows the installed state and version, and is also where you enable, disable, or uninstall.
 
-**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.1.3`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
+**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.1.5`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
 
 A local checkout can be linked with `dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`.
 
@@ -73,6 +74,8 @@ A profile without a browser can still use the model route. It just has no settin
 
 ## Daily use
 
+**Choose visible models.** Under **Settings → PackyCode → Visible models**, check the models you want in the picker. All are selected by default, with Select all / Select none controls. The selection is saved in the current profile and applies immediately; unchecking a model does not interrupt an existing session. New catalog models are selected by default.
+
 **Switch keys.** Keys are used in the order they were added. **Use this key** picks the preferred key, effective from the next turn; **Rename** changes its label (at most 60 characters, empty names are refused); **Re-enable** puts a disabled key back after a top-up or replacement.
 
 **See groups.** Under **Accounts and keys**, each key lists its PackyCode groups (hover for the group's description) and which models they reach: ✓ yes, ◐ partly, ✕ no. The groups come from the gateway itself (its refusal of a model id it cannot route names the token's groups; nothing is billed), matched against PackyCode's public model-group table. Claude needs one of `cc` / `cc-sale` / `cc-expensive` / `claude-officially` (`claude-haiku-5-5` only `cc` and `claude-officially`); GPT needs `codex` / `codex-sale`; DeepSeek needs `deepseek-officially` / `deepseek-sale`.
@@ -138,12 +141,17 @@ Claude Code CLI → temporary local MCP web_search → selected PackyCode DeepSe
 | `deepseek-flash` | HTTP, chat/completions | Can be off; `low` / `high` / `max` | `deepseek-officially`, `deepseek-sale` |
 | `gpt-6.1-sol` | HTTP, Responses, images allowed | Cannot be off; `low` / `medium` / `high` / `xhigh` / `max` | `codex`, `codex-sale` |
 | `gpt-6-astra` | Same | Same | Same |
+| `grok-4.7` (Grok 4.7) | HTTP, Responses, text/image input; 500K context | Cannot be off; `low` / `medium` / `high` / `xhigh` | The Grok coverage read from the gateway in Settings |
 | `claude-opus-5-5` | Local Claude Code CLI | The picker offers the same levels; the CLI chooses the actual effort | A group the official CLI is allowed to use; see below |
 | `claude-sonnet-5-5` | Same | Same | Same |
 | `claude-haiku-5-5` | Same; session titles always use this model | Same | Same |
 
 A model in the list does not mean the current token group allows it. When changing groups, do not drop the group that serves the model you still want.
 
+Grok 4.7's context and reasoning levels follow the [official guide](https://docs.x.ai/developers/grok-4-7). There is no separate text-output limit; the plugin uses the context size as its numeric output ceiling, bounded by the remaining context per request.
+
+Only GPT Responses requests keep `prompt_cache_key`; other Responses models omit it by default. This gateway's Grok route reports a misleading `Incorrect API key provided` error when the field is present.
+
 <details>
 <summary>Protocol, group, and CLI constraints</summary>
 
@@ -153,7 +161,7 @@ A model in the list does not mean the current token group allows it. When changi
 - The `cc` group accepts only the official Claude CLI. A normal API client gets `403 This API endpoint is only accessible via the official Claude CLI`. This plugin runs the local `claude` binary for that group instead of switching the token to `cc-sale` or pretending to be the official client. If the token has no group the official CLI may use, the three Claude models still will not run.
 - Selecting a Claude model when the CLI is missing fails that turn with an install hint. It does not surface as a missing binary name alone.
 - The CLI receives this plugin's endpoint and current key (`ANTHROPIC_BASE_URL` / `ANTHROPIC_AUTH_TOKEN`) and an isolated config directory, `~/.dsh/packycode-claude-cli`. Without that isolation, `env` in `~/.claude/settings.json` would override the plugin key.
-- CLI permission follows the session by default: `read-only` stays read-only, `workspace-write` may edit, and `danger-full-access` with approval disabled may use `full`. The CLI cannot ask the DSH user for approval, so a session that still asks never gets `full`. `claudeCliMode` can pin `read-only`, `edit`, or `full`. DSH plan mode wins over that mapping and over the pin: the CLI runs with `--permission-mode plan`. Calling `ExitPlanMode`, or returning after writing the plan file when that tool is absent, submits the plan to DSH's review instead of editing in the same process. The previous mode returns after approval or `/plan off`. Session titles stay out of plan mode. An empty `claudeCliPath` is looked up automatically; an empty `claudeCliCwd` uses the session workspace.
+- CLI permission follows the session by default: `read-only` stays read-only, `workspace-write` may edit, and `danger-full-access` with approval disabled may use `full`. The CLI cannot ask the DSH user for approval, so a session that still asks never gets `full`. `claudeCliMode` can pin `read-only`, `edit`, or `full`. DSH plan mode wins over that mapping and over the pin: the CLI runs read-only with `--permission-mode plan --permission-prompt-tool stdio`, using one private hidden temporary plan directory inside the working directory per invocation (the CLI rejects custom plan directories outside the project root). This stores only planning artifacts, changes no project code or settings, and fails explicitly for an unwritable workspace. `ExitPlanMode` hands the plan to DSH for review; it never starts implementation in that CLI process. File fallback reads only this invocation's directory, which is cleaned afterwards. Review works in native and PTC tool modes, and the complete plan and review feedback reach the next turn; exceeding the conversation budget fails explicitly instead of silently truncating constraints. Approval or `/plan off` takes effect from the next step; delegations in the same tool batch keep the current plan state. Session titles stay out of plan mode. An empty `claudeCliPath` is looked up automatically; an empty `claudeCliCwd` uses the session workspace.
 - Thinking and tool activity (`▸ Bash`, `▸ Read`, and `✗` on failure) appear in that turn's reasoning block. They are progress, not DSH tool calls. The CLI's own tools are outside the DSH sandbox.
 - The reasoning block opens with `▸ 启动 Claude Code CLI…` and then shows the CLI's version and model once it is up. When the gateway throttles or is busy (429, 503 `账号并发排队已满` / per-account wait queue full, and similar), the CLI retries up to 10 times on its own; each retry now shows as `↻ 网关返回 HTTP 503，CLI 自动重试 n/10` instead of looking hung. When the retries run out, the turn says PackyCode's Claude upstream is busy, not that the key is bad. A CLI that prints nothing for 2 minutes after starting is stopped and reported.
 - The conversation and its images reach the CLI over stdin (`--input-format stream-json`), not argv: a Windows command line is length-limited and cannot carry an image. Images in the conversation are sent to Claude as images, at the HTTP route's request size (at most 2048×2048, about 1 MiB each; at most 20 images and 20 MiB per turn, dropping the oldest first). An image left out is named with its read-only local copy, which the CLI can open with Read.
@@ -214,6 +222,8 @@ pnpm run check
 
 `node scripts/cli-search-check.mjs` runs the real CLI against a local test gateway and MCP bridge; Claude responses and search data are mocked by default, with no quota consumed. It checks all three permission modes, native-search exclusion and temporary-resource cleanup. `--live --backend deepseek` or `--live --backend gpt` sends the read-only mode's one search to the real backend (edit/full remain mocked). This does not verify actual Claude upstream turns or a running DSH integration.
 
+`node scripts/cli-plan-check.mjs` checks plan mode with the real CLI and a local fake gateway: stdio handoff, concurrent plan ownership, invocation-only file fallback, stale-plan exclusion, actual denial limits and cleanup. It reads no real credentials, spends no quota and starts no DSH instance.
+
 Read [AGENTS.md](AGENTS.md) before agent-assisted changes or a release. Publishing is the [Publish workflow](.github/workflows/publish.yml), triggered by pushing a `v*` tag. Do not run `npm publish` locally.
 
 ## License

package/README.md

@@ -25,6 +25,7 @@
 | 能力 | 使用体验 |
 | --- | --- |
 | **自带模型路由** | 安装后模型选择器出现 `PackyCode` 分组，不需要配置 provider，也不用改 `cordis.patch.yml` |
+| **自选显示的模型** | 设置页的模型列表默认全选；取消勾选后，切换列表立即隐藏该模型，已有会话仍可继续使用 |
 | **多 Key 按顺序使用** | 额度用尽或 Key 被拒绝时自动切到下一个可用 Key；失败的那一步由重试接手 |
 | **按分组选 Key** | 每个 Key 后面列出它所在的 PackyCode 分组和能用的模型；当前 Key 的分组用不了所选模型（例如没有 cc 分组却选了 Claude）时，这一轮自动改用分组合适的 Key |
 | **余额一眼可见** | 设置页列出每个 Key 的剩余、已用、额度、重置周期和用量条，并给出这些 Key 的合计；输入框右侧显示当前 Key 的剩余额度 |
@@ -48,7 +49,7 @@
 dsh-packycode-api
 ```
 
-在**安装源**中选择**官方源**，然后点击**安装**。需要固定版本时填入 `dsh-packycode-api@1.1.3`。
+在**安装源**中选择**官方源**，然后点击**安装**。需要固定版本时填入 `dsh-packycode-api@1.1.5`。
 
 完成后**手动重启桌面应用**。仅刷新页面不会重新加载 Host 里的插件。
 
@@ -60,14 +61,14 @@ dsh-packycode-api
 
 ### 3. 选择模型
 
-回到对话，在模型选择器里选 `PackyCode` 分组下的模型。`deepseek-flash`、`gpt-6.1-sol` 和 `gpt-6-astra` 添加 Key 后即可用。三个 Claude 模型还需要本机装有 Claude Code CLI，见下文。
+回到对话，在模型选择器里选 `PackyCode` 分组下的模型。`deepseek-flash`、`gpt-6.1-sol`、`gpt-6-astra` 和 `grok-4.7` 通过 HTTP 调用；三个 Claude 模型还需要本机装有 Claude Code CLI，见下文。Key 的分组必须覆盖所选模型。
 
 <details>
 <summary>检查安装 / 其它 profile / 本地目录</summary>
 
 桌面应用的**插件**页可以看到已安装状态与版本，也可以在那里启用、停用或卸载。
 
-**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.1.3`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
+**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.1.5`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
 
 本地开发可以用绝对路径：`dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`。
 
@@ -77,6 +78,8 @@ dsh-packycode-api
 
 ## 日常使用
 
+**选择显示的模型。** 在 **设置 → PackyCode → 显示的模型** 中勾选要在切换列表里看到的模型，默认全选，也支持「全选」和「全不选」。选择保存在当前 profile，修改后立即生效；取消勾选不会中断已有会话。后续新增的模型默认勾选。
+
 **换 Key。** Key 按添加顺序使用。点「切到此 Key」指定优先使用的 Key，下一轮就生效；「重命名」改备注（最多 60 字，不能为空）；充值或更换后点「重新启用」。
 
 **看分组。** 「账户与 Key」里每个 Key 下面列出它所在的 PackyCode 分组（鼠标悬停可看分组说明），以及能用哪些模型：✓ 可用、◐ 部分可用、✕ 不可用。分组由网关自己报出（对一个不存在的模型 id 的拒绝里会写明「已选分组」，不产生费用），再对照 PackyCode 公开的模型分组表。Claude 需要 `cc` / `cc-sale` / `cc-expensive` / `claude-officially` 之一（`claude-haiku-5-5` 只在 `cc` 和 `claude-officially`）；GPT 需要 `codex` / `codex-sale`；DeepSeek 需要 `deepseek-officially` / `deepseek-sale`。
@@ -142,12 +145,17 @@ Claude Code CLI → 本机临时 MCP web_search → 插件选定的 DeepSeek/GPT
 | `deepseek-flash` | HTTP，chat/completions | 可关；`low` / `high` / `max` | `deepseek-officially`、`deepseek-sale` |
 | `gpt-6.1-sol` | HTTP，Responses，可带图 | 不能关；`low` / `medium` / `high` / `xhigh` / `max` | `codex`、`codex-sale` |
 | `gpt-6-astra` | 同上 | 同上 | 同上 |
+| `grok-4.7`（Grok 4.7） | HTTP，Responses，可带图；500k 上下文 | 不能关；`low` / `medium` / `high` / `xhigh` | 以设置页从网关读取的 Grok 分组覆盖为准 |
 | `claude-opus-5-5` | 本机 Claude Code CLI | 选择器档位同上，实际档位由 CLI 决定 | 能给官方 CLI 用的分组，比如cc分组 |
 | `claude-sonnet-5-5` | 同上 | 同上 | 同上 |
 | `claude-haiku-5-5` | 同上；会话标题也固定走它 | 同上 | 同上 |
 
 列表里看得到模型，不代表当前令牌分组一定放行。换分组时不要把对应分组一起去掉。
 
+Grok 4.7 的上下文与推理档位来自 [官方文档](https://docs.x.ai/developers/grok-4-7)。官方没有单独限制文字输出长度；插件将输出上限设为上下文大小，并按每次请求的剩余上下文收紧。
+
+Responses 请求只有 GPT 模型保留 `prompt_cache_key`，其他 Responses 模型默认省略。当前网关的 Grok 路由会将这个字段误报成 `Incorrect API key provided`。
+
 <details>
 <summary>协议、分组和 CLI 的具体约束</summary>
 
@@ -157,7 +165,7 @@ Claude Code CLI → 本机临时 MCP web_search → 插件选定的 DeepSeek/GPT
 - `cc`（Claude Code 专用）只接受官方 Claude CLI。用普通 API 客户端调 Claude 会 403：`This API endpoint is only accessible via the official Claude CLI`。本插件因此调用本机 `claude`，而不是改去 `cc-sale`，也不是伪造客户端身份。令牌如果没有开放给官方 CLI 的分组，这三个模型仍然不可用。
 - 选了 Claude 模型但本机没有 CLI 时，这一回合会直接说明未安装，并指向设置页的安装按钮。
 - CLI 使用插件配置的地址和当前 Key（`ANTHROPIC_BASE_URL` / `ANTHROPIC_AUTH_TOKEN`），以及独立配置目录 `~/.dsh/packycode-claude-cli`。不隔离的话，`~/.claude/settings.json` 里的 `env` 会盖掉插件 Key。
-- CLI 权限默认跟随当前会话：`read-only` → 只读，`workspace-write` → 可编辑，`danger-full-access` 且不再审批 → `full`。CLI 不能向 DSH 弹审批，所以只要会话还要审批，就不会给它 `full`。也可把设置项 `claudeCliMode` 固定成 `read-only` / `edit` / `full`。DSH 计划模式优先于该映射和这个固定档：CLI 以 `--permission-mode plan` 只读探索。它调用 `ExitPlanMode`，或在没有该工具时把计划写进计划文件后返回，都会交给 DSH 审阅；批准或 `/plan off` 之后才恢复原来的档位。会话标题不进入计划模式。`claudeCliPath` 留空则自动查找；`claudeCliCwd` 留空则用当前会话工作区。
+- CLI 权限默认跟随当前会话：`read-only` → 只读，`workspace-write` → 可编辑，`danger-full-access` 且不再审批 → `full`。CLI 不能向 DSH 弹审批，所以只要会话还要审批，就不会给它 `full`。也可把设置项 `claudeCliMode` 固定成 `read-only` / `edit` / `full`。DSH 计划模式优先于该映射和这个固定档：CLI 以 `--permission-mode plan --permission-prompt-tool stdio` 只读探索，每轮在工作目录内创建一个独占的隐藏临时计划目录（CLI 不接受工作区外的自定义计划目录）；只存计划工件，不改项目代码或设置，工作区不可写时明确失败。`ExitPlanMode` 交给 DSH 审阅，不允许 CLI 在同一进程开始实施；只在本轮目录中查找未显式提交的计划，结束时清理。原生和 PTC 工具模式都支持审阅，完整计划及审阅反馈会带到下一轮；超过对话预算会明确报错，不静默截断约束。批准或 `/plan off` 在下一步生效，同一工具批次内的委派仍遵守当前计划状态。会话标题不进入计划模式。`claudeCliPath` 留空则自动查找；`claudeCliCwd` 留空则用当前会话工作区。
 - 思考过程和工具调用（`▸ Bash`、`▸ Read`，失败时带 `✗`）会出现在这一回合的思考区。它们是进度，不是 DSH 的工具调用。CLI 自己的工具不受 DSH 沙箱约束。
 - 思考区第一行是「▸ 启动 Claude Code CLI…」，CLI 起来后显示版本和模型。网关限流或繁忙（429、503 `账号并发排队已满` 等）时，CLI 会自己重试最多 10 次，每次重试都会显示成 `↻ 网关返回 HTTP 503，CLI 自动重试 n/10`，不再像卡住。重试用完仍失败时，会说明是 PackyCode 的 Claude 上游繁忙，不是 Key 的问题。CLI 启动后 2 分钟内没有任何输出会被停止并报告原因。
 - 对话记录和图片通过 stdin 交给 CLI（`--input-format stream-json`），不走命令行参数：Windows 命令行长度有上限，而且命令行带不了图片。对话里的图片会以图片形式发给 Claude（与 HTTP 路由相同的压缩规格：每张不超过 2048×2048、约 1 MiB；一回合最多 20 张、合计 20 MiB，超出时先舍弃最早的）。没随消息发出的图片会写明本机只读副本的路径，CLI 需要时可以用 Read 读取。
@@ -218,6 +226,8 @@ pnpm run check
 
 Claude CLI 的 MCP 接口验证用 `node scripts/cli-search-check.mjs`：运行真实 CLI，普通 Claude 响应和搜索数据默认由本地测试服务模拟，不消费额度；会检查三种权限模式、原生搜索禁用和临时资源清理。加 `--live --backend deepseek` 或 `--live --backend gpt` 会让只读模式的那一次搜索走真实后端（其它两种模式仍模拟）。这不等于验证了真实 Claude 上游对话或运行中的 DSH 集成。
 
+计划模式另用 `node scripts/cli-plan-check.mjs` 验证：真实 CLI 对接本地模拟网关，检查 stdio 计划提交、并发计划归属、本轮文件回退、旧计划隔离、实际拒绝次数上限和清理；不读取真实凭据、不消费额度、不启动 DSH。
+
 使用 Agent 修改或发布时，先读 [AGENTS.md](AGENTS.md)。发布由推送 `v*` 标签触发 [Publish workflow](.github/workflows/publish.yml)，不要在本机执行 `npm publish`。
 
 ## License

package/lib/client.js

@@ -84,6 +84,14 @@ window.__ModuleLoader__.load({
 			groupsMiss: "不可用",
 			groupsPartial: "部分",
 			groupsStale: "分组为上次读取的结果",
+			modelsTitle: "显示的模型",
+			modelsIntro: "切换模型时只显示已勾选的 PackyCode 模型，默认全选。修改后立即生效；已有会话仍可继续使用原模型。",
+			modelsChecking: "正在读取模型设置…",
+			modelsFailed: "模型设置读取或保存失败",
+			modelsAll: "全选",
+			modelsNone: "全不选",
+			modelsCount: "已选 {count} / {total}",
+			modelsEmpty: "未勾选任何模型，切换列表将隐藏 PackyCode 的模型。",
 			advanced: "高级：接口地址",
 			apiHost: "模型接口地址",
 			statusHost: "余额接口地址",
@@ -162,6 +170,14 @@ window.__ModuleLoader__.load({
 		};
 		const en = {
 			nav: "PackyCode",
+			modelsTitle: "Visible models",
+			modelsIntro: "Only selected PackyCode models appear when switching models. All are selected by default. Changes apply immediately; existing sessions can keep their current model.",
+			modelsChecking: "Reading model settings…",
+			modelsFailed: "Could not read or save model settings",
+			modelsAll: "Select all",
+			modelsNone: "Select none",
+			modelsCount: "{count} / {total} selected",
+			modelsEmpty: "No models selected. PackyCode models are hidden from the picker.",
 			intro: "Paste a PackyCode (PackyAPI) API key to use the built-in model route. Keys are used in order: an exhausted or rejected key hands over to the next one, and a key whose groups cannot reach the selected model is passed over for one whose groups can.",
 			accountsTitle: "Accounts and keys",
 			refresh: "Refresh",
@@ -364,6 +380,13 @@ window.__ModuleLoader__.load({
 .pkc-reach>span[data-state=no]{color:var(--dsw-alias-label-caption);text-decoration:line-through}
 .pkc-add{display:flex;flex-direction:column;gap:8px;padding-top:14px;border-top:.5px solid var(--dsw-alias-border-l2)}
 
+.pkc-models{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px;margin:0;padding:0;min-width:0;border:0}
+.pkc-model{display:flex;align-items:center;gap:10px;min-width:0;padding:10px 12px;border-radius:var(--dsw-radius-md,12px);background:var(--dsw-alias-interactive-bg-hover);cursor:pointer}
+.pkc-model>input{flex:none;width:16px;height:16px;margin:0;accent-color:var(--dsw-alias-state-business-primary)}
+.pkc-model>span{display:flex;flex-direction:column;min-width:0;gap:2px}
+.pkc-model b{font-size:13px;font-weight:500}
+.pkc-models:disabled .pkc-model{opacity:.5;cursor:not-allowed}
+
 .pkc-setting{display:grid;grid-template-columns:112px minmax(0,1fr);gap:6px 16px;align-items:start}
 .pkc-setting>.pkc-label{padding-top:5px}
 .pkc-setting>div{display:flex;flex-direction:column;gap:6px;min-width:0}
@@ -389,6 +412,7 @@ window.__ModuleLoader__.load({
 @media (max-width:640px){
   .pkc-stats{grid-template-columns:1fr}
   .pkc-setting{grid-template-columns:1fr}
+  .pkc-models{grid-template-columns:1fr}
   .pkc-setting>.pkc-label{padding-top:0}
 }
 `;
@@ -473,6 +497,7 @@ window.__ModuleLoader__.load({
 		const MODEL_FAMILIES = [
 			["DeepSeek", ["deepseek-flash"]],
 			["GPT", ["gpt-6.1-sol", "gpt-6-astra"]],
+			["Grok", ["grok-4.7"]],
 			["Claude", [
 				"claude-opus-5-5",
 				"claude-sonnet-5-5",
@@ -1006,6 +1031,95 @@ window.__ModuleLoader__.load({
 				]
 			});
 		}
+		function ModelsCard({ call, t }) {
+			const [state, setState] = react.useState();
+			const [busy, setBusy] = react.useState(false);
+			const [error, setError] = react.useState();
+			react.useEffect(() => {
+				let live = true;
+				call("models/status").then((value) => {
+					if (live) setState(value);
+				}).catch((failure) => {
+					if (live) setError(clearMessage(failure));
+				});
+				return () => {
+					live = false;
+				};
+			}, [call]);
+			const models = state?.models ?? [];
+			const selectedIds = models.filter((model) => model.selected).map((model) => model.id);
+			const disabled = busy || state?.writable !== true;
+			const update = (ids) => {
+				if (disabled) return;
+				setBusy(true);
+				setError(void 0);
+				call("models/update", { selectedIds: ids }).then(setState).catch((failure) => setError(clearMessage(failure))).finally(() => setBusy(false));
+			};
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(Card, {
+				title: t("modelsTitle"),
+				aside: state !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+					className: "pkc-meta",
+					children: fill(t("modelsCount"), {
+						count: selectedIds.length,
+						total: models.length
+					})
+				}),
+				children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "pkc-note",
+						children: t("modelsIntro")
+					}),
+					state === void 0 && error === void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "pkc-note",
+						role: "status",
+						children: t("modelsChecking")
+					}),
+					state !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+							className: "pkc-actions",
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Button, {
+								disabled: disabled || selectedIds.length === models.length,
+								onClick: () => update(models.map((model) => model.id)),
+								children: t("modelsAll")
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(Button, {
+								disabled: disabled || selectedIds.length === 0,
+								onClick: () => update([]),
+								children: t("modelsNone")
+							})]
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)("fieldset", {
+							className: "pkc-models",
+							"aria-label": t("modelsTitle"),
+							disabled,
+							children: models.map((model) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+								className: "pkc-model",
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+									type: "checkbox",
+									checked: model.selected,
+									onChange: (event) => update(event.target.checked ? [...selectedIds, model.id] : selectedIds.filter((id) => id !== model.id))
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("b", { children: model.name }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: "pkc-meta pkc-mono",
+									children: model.id
+								})] })]
+							}, model.id))
+						}),
+						selectedIds.length === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "pkc-note",
+							children: t("modelsEmpty")
+						}),
+						state.writable !== true && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: "pkc-note",
+							children: t("searchNotWritable")
+						})
+					] }),
+					error !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+						className: "pkc-error",
+						role: "alert",
+						children: `${t("modelsFailed")}: ${error}`
+					})
+				]
+			});
+		}
 		/** Web search routing and backend, written through the host. */
 		function SearchCard({ call, t }) {
 			const [state, setState] = react.useState();
@@ -1469,6 +1583,10 @@ window.__ModuleLoader__.load({
 						call,
 						t
 					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ModelsCard, {
+						call,
+						t
+					}),
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(SearchCard, {
 						call,
 						t