mslxdff 0.1.135 → 0.1.136

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mslxdff",
-  "version": "0.1.135",
+  "version": "0.1.136",
   "description": "测试项目，请勿使用。",
   "type": "module",
   "bin": {

package/src/chat-pipeline/serial-trial.js

@@ -9,7 +9,13 @@ import { handlePeerRelay } from "../routes/chat/peer-handler.js";
 import { handleBroadbandRelay } from "../routes/chat/broadband-handler.js";
 import { handleViaRoute } from "../routes/chat/via-route-handler.js";
 import { handleExhaustedLocal, handleExhaustedAll } from "../routes/chat/exhausted-handler.js";
-import { shouldUseGroupForModel, isHardLocalOnly } from "../state/schemas/use-group.js";
+import { shouldUseGroupForModel, isHardLocalOnly, isKeyProviderDirectOnly } from "../state/schemas/use-group.js";
+
+function groupSkipReason(model) {
+  if (isHardLocalOnly(model)) return "provider local-only（禁组员，仅本机直连）";
+  if (isKeyProviderDirectOnly(model)) return "key provider default direct（仅本机直连，MSLXDFF_USE_GROUP_KEYS=1 可开组员）";
+  return "useGroup=off";
+}
 
 /**
  * 串行 trial — 从 engine.js 抽出的第二段：via-route 单路径 → 串行 trial →
@@ -43,6 +49,8 @@ export async function runSerialTrial(ctx, deps = {}) {
     } catch (e) {
       evt("via-route-exception", { reqId, model: requested, error: errMsg(e) });
     }
+  } else if (!useAuto && requested && requested.includes("/") && canForwardPeers && !lockModel && peers) {
+    evt("group-skip", { reqId, model: requested, reason: `${groupSkipReason(requested)} (via-route)` });
   }
 
   let lastErr = viaRouteLastErr;
@@ -143,7 +151,7 @@ export async function runSerialTrial(ctx, deps = {}) {
     }
     if (canForwardPeers) {
       if (!shouldUseGroupForModel(model)) {
-        evt("group-skip", { reqId, model, reason: isHardLocalOnly(model) ? "provider local-only（禁组员，仅本机直连）" : "useGroup=off (peer)" });
+        evt("group-skip", { reqId, model, reason: `${groupSkipReason(model)} (peer)` });
       } else {
         const pr = await peerRelay({ model, body, lastErr, requested, useAuto, lockModel, auto, peers, handlerCtx, evt, logCall, mark, perf0, stages, startedAt, plugins, res });
         if (pr.handled) return { done: true };
@@ -152,7 +160,7 @@ export async function runSerialTrial(ctx, deps = {}) {
     }
     if (groups) {
       if (!shouldUseGroupForModel(model)) {
-        evt("group-skip", { reqId, model, reason: isHardLocalOnly(model) ? "provider local-only（禁组员，仅本机直连）" : "useGroup=off (broadband)" });
+        evt("group-skip", { reqId, model, reason: `${groupSkipReason(model)} (broadband)` });
       } else {
         const br = await broadbandRelay({ model, body, hops, lastErr, requested, useAuto, lockModel, auto, groups, token, bus, logs, handlerCtx, evt, mark, perf0, stages, res, startedAt, plugins });
         if (br.handled) return { done: true };

package/src/cli/commands/use-group.js

@@ -1,4 +1,4 @@
-import { loadUseGroup, saveUseGroup, getEffectiveUseGroup, getUseGroupEnv } from "../../state/schemas/use-group.js";
+import { loadUseGroup, saveUseGroup, getEffectiveUseGroup, getUseGroupEnv, getUseGroupKeysEnv } from "../../state/schemas/use-group.js";
 import { argValue } from "../policy.js";
 
 function parseInput(v) {
@@ -26,15 +26,18 @@ export async function handleUseGroup(args) {
   const envVal = getUseGroupEnv();
   const effective = getEffectiveUseGroup();
   const stored = loadUseGroup();
+  const keysEnv = getUseGroupKeysEnv();
 
   if (raw === null || raw === undefined || raw === "") {
     // 查询模式
-    console.log(`use-group: ${effective ? "on" : "off"} (effective)`);
+    console.log(`use-group: ${effective ? "on" : "off"} (effective, 仅 opencode 免费池)`);
     console.log(`  stored: ${stored ? "on" : "off"} (state.json useGroup)`);
     if (envVal !== null) console.log(`  env MSLXDFF_USE_GROUP=${envVal ? "on" : "off"} (overrides stored)`);
+    console.log(`  keys: ${keysEnv ? "on" : "off"} (env MSLXDFF_USE_GROUP_KEYS, 默认 off: 带 key 上游恒直连)`);
     console.log(`  default: on`);
-    console.log(`  usage: mslxdff -use-group on|off  (本机失败时是否走组员网络，默认 on)`);
+    console.log(`  usage: mslxdff -use-group on|off  (opencode 失败时是否走组员网络，默认 on)`);
     console.log(`  env:   MSLXDFF_USE_GROUP=0|1  (优先级高于 state)`);
+    console.log(`  env:   MSLXDFF_USE_GROUP_KEYS=1  (把 key 供应商开回组员，cline/workbuddy 仍硬禁)`);
     process.exit(0);
   }
 
@@ -50,7 +53,8 @@ export async function handleUseGroup(args) {
 
   saveUseGroup(parsed);
   console.log(`use-group set to ${parsed ? "on" : "off"} (stored in state.json)`);
-  console.log(`  ${parsed ? "允许" : "不再允许"}走组员网络（via-route/hedge/peer/broadband，全部供应商）`);
+  console.log(`  ${parsed ? "允许 opencode" : "opencode 也不再"}走组员网络（via-route/hedge/peer/broadband）`);
+  console.log(`  带 key 上游默认恒直连（不受本开关影响，MSLXDFF_USE_GROUP_KEYS=1 可开回，cline/workbuddy 仍硬禁）`);
   if (!parsed) console.log(`  提示：所有请求将仅在本机重试，不再走组员中继`);
   process.exit(0);
 }

package/src/model-capabilities/index.js

@@ -117,8 +117,22 @@ export function createCapabilitiesService({
   function providers() {
     return [...capsIndex.keys()].sort();
   }
-
-  return { ready, get, list, providers, npmIndex: () => new Map(npmIndex) };
+  // readyWarm：仅用内存/磁盘缓存热身，绝不网络请求。/models 富化用它避免冷启动阻塞；
+  // 冷缓存时后台拉新（不 await），下次请求即富化。
+  async function readyWarm() {
+    const t = now();
+    if (raw && t - loadedAt < ttl) return true;
+    const disk = readCache();
+    if (disk) {
+      raw = disk;
+      capsIndex = buildIndex(disk);
+      loadedAt = t;
+      return true;
+    }
+    ready().catch(() => {}); // 后台拉新，失败静默（/models 原样降级）
+    return false;
+  }
+  return { ready, readyWarm, get, list, providers, npmIndex: () => new Map(npmIndex) };
 }
 
 // 模块级单例：HTTP handler 懒加载，测试 _reset 后注入
@@ -128,7 +142,6 @@ export function globalCapabilities() {
   return _global;
 }
 export function _resetGlobalCapabilities() { _global = null; }
-
 // 缓存落盘位置：MSLXDFF_MODELS_DEV_CACHE 覆盖 > ~/.config/mslxdff/models-dev.json（与 state 同目录）
 function defaultCacheFile() {
   const override = process.env.MSLXDFF_MODELS_DEV_CACHE;

package/src/model-capabilities/merge.js

@@ -0,0 +1,127 @@
+// /v1/models 能力富化（ADR-0022）：把 models.dev 目录（+ workbuddy 原生字段兜底）
+// 的能力合并进 /v1/models 每条 data 条目的 `capabilities` 子对象，客户端与 CLI 一眼可读。
+// 逃生门：GET /v1/models?raw=1 保持 ADR-0016 的原始透传形状；codex 调用者恒原始 + 空 models:[]。
+// 全程 best-effort：目录不可用 → 原样返回，绝不让 /models 因富化失败挂掉。
+import { globalCapabilities } from "./index.js";
+
+// "clinebot/deepseek/deepseek-v4-flash" → { provider: "clinebot", raw: "deepseek/deepseek-v4-flash" }；裸 id 归 opencode
+export function splitModelId(id) {
+  const s = String(id || "").trim();
+  const i = s.indexOf("/");
+  if (i > 0) return { provider: s.slice(0, i).toLowerCase(), raw: s.slice(i + 1) };
+  return { provider: "opencode", raw: s };
+}
+
+function stripFreeSuffix(raw) {
+  return raw.replace(/-free$/i, "");
+}
+
+// 上游原生 wire API：muse-spark* 只认 /responses（zen /chat 500 实测）；
+// models.dev 标 npm @ai-sdk/openai 的模型上游走 responses；其余 chat。
+export function upstreamApiFor(caps, raw) {
+  const bare = stripFreeSuffix(String(raw || ""));
+  if (/^muse-spark/i.test(bare)) return "responses";
+  if (caps?.npm === "@ai-sdk/openai") return "responses";
+  return "chat";
+}
+
+// caps → 对外 capabilities 子对象（只填有值的键，未收录字段不硬造）
+export function capsPayloadFor(caps, raw) {
+  if (!caps) return null;
+  const payload = {
+    reasoning: Boolean(caps.reasoning),
+    ...(caps.effortType ? { effortType: caps.effortType } : {}),
+    ...(Array.isArray(caps.effortValues) && caps.effortValues.length
+      ? { effortValues: caps.effortValues.map(String) }
+      : {}),
+    ...(caps.defaultEffort ? { defaultEffort: String(caps.defaultEffort) } : {}),
+    imageInput: Boolean(caps.imageInput),
+    inputModalities: Array.isArray(caps.inputModalities) && caps.inputModalities.length
+      ? caps.inputModalities
+      : ["text"],
+    outputModalities: Array.isArray(caps.outputModalities) && caps.outputModalities.length
+      ? caps.outputModalities
+      : ["text"],
+    toolCall: Boolean(caps.toolCall),
+    ...(Number(caps.context) > 0 ? { context: Number(caps.context) } : {}),
+    ...(Number(caps.maxOutput) > 0 ? { maxOutput: Number(caps.maxOutput) } : {}),
+    ...((caps.costIn != null || caps.costOut != null)
+      ? { costIn: Number(caps.costIn) || 0, costOut: Number(caps.costOut) || 0 }
+      : {}),
+    // 网关两侧端点都收：/v1/responses 复用 ChatPipeline 翻译层；upstreamApi 记上游原生协议
+    endpoints: ["chat", "responses"],
+    upstreamApi: upstreamApiFor(caps, raw),
+  };
+  return payload;
+}
+
+// 单条 id 的目录匹配：精确裸 id → 剥 -free 后缀 → 二级厂商前缀（clinebot/deepseek/x → deepseek/x）
+function lookupCaps(svc, provider, raw) {
+  return (
+    svc.get(provider, raw) ||
+    svc.get(provider, stripFreeSuffix(raw)) ||
+    null
+  );
+}
+
+function lookupCapsDeep(svc, provider, raw) {
+  const direct = lookupCaps(svc, provider, raw);
+  if (direct) return direct;
+  const parts = raw.split("/");
+  if (parts.length >= 2) {
+    const head = parts[0];
+    const rest = parts.slice(1).join("/");
+    return svc.get(head, rest) || svc.get(head, stripFreeSuffix(rest)) || null;
+  }
+  return null;
+}
+
+/**
+ * 把能力合并进 { object:"list", data:[...] } 的每条条目。
+ * capsSvc/wbSource 为测试接缝；生产用全局单例（models.dev 24h 缓存）+ workbuddy 动态源。
+ * wbSource 显式 null 禁用 workbuddy 兜底（测试用）。
+ */
+export async function mergeModelsList(data, { capsSvc, wbSource } = {}) {
+  const svc = capsSvc === undefined ? globalCapabilities() : capsSvc;
+  const entries = Array.isArray(data?.data) ? data.data : [];
+  if (!svc || !entries.length) return data;
+  // 只用内存/磁盘缓存热身；冷缓存绝不阻塞请求（后台拉新，下次请求即富化）
+  try {
+    const warmed = svc.readyWarm ? await svc.readyWarm() : await svc.ready();
+    if (!warmed) return data;
+  } catch {
+    return data;
+  }
+  // 第一遍：目录直查；workbuddy 未命中记下，第二遍走上游原生字段
+  const resolved = new Map(); // index -> caps
+  const needWb = []; // [index, raw]
+  entries.forEach((entry, i) => {
+    const id = String(entry?.id || "");
+    if (!id) return;
+    const { provider, raw } = splitModelId(id);
+    const caps = lookupCapsDeep(svc, provider, raw);
+    if (caps) resolved.set(i, caps);
+    else if (provider === "workbuddy" && wbSource !== null) needWb.push([i, raw]);
+  });
+  if (needWb.length) {
+    try {
+      const { workbuddyCapsFromModels, workbuddyAllModels } = await import("./index.js");
+      const wbMap = await workbuddyCapsFromModels(wbSource || workbuddyAllModels)();
+      for (const [i, raw] of needWb) {
+        const caps = wbMap?.[raw] || null;
+        if (caps) resolved.set(i, caps);
+      }
+    } catch {
+      // workbuddy 源不可用：这些条目保持无能力，不拖垮整个列表
+    }
+  }
+  if (!resolved.size) return data;
+  const next = entries.map((entry, i) => {
+    const caps = resolved.get(i);
+    if (!caps) return entry;
+    const { raw } = splitModelId(String(entry?.id || ""));
+    const payload = capsPayloadFor(caps, raw);
+    return payload ? { ...entry, capabilities: payload } : entry;
+  });
+  return { ...data, data: next };
+}

package/src/providers/classify.js

@@ -1,10 +1,10 @@
 // ADR-0015：供应商路由分类三态 + EMA 纯函数（零依赖，防循环 import）
-// local-only：本机账号绑定（workbuddy），组员转发无效
+// local-only：本机账号绑定（workbuddy/cline 系），组员转发无效
 // quota-pool：图额度不图速度（opencode free），直连先行、429 后组员兜底
 // latency-compare：key/token 类，direct vs link+remote 比延迟
 export function classifyProvider(id) {
   const s = String(id || "").trim().toLowerCase();
-  if (s === "workbuddy") return "local-only";
+  if (s === "workbuddy" || s === "cline" || s === "clinebot") return "local-only";
   if (s === "opencode") return "quota-pool";
   return "latency-compare";
 }

package/src/providers/dispatcher.js

@@ -50,7 +50,7 @@ export function createProviderDispatcher(providers = [], opts = {}) {
     // ADR-0008：本请求携带瞬时共享 key（shareKeys 由组员侧按 header 解析后传入）。
     const sharedKeys = opts?.shareKeys?.[provider.id];
     if (sharedKeys && sharedKeys.length && typeof provider.chatWithKeys === "function") {
-      return provider.chatWithKeys(forwarded, sharedKeys);
+      return provider.chatWithKeys(forwarded, sharedKeys, opts);
     }
     if (provider.id === "workbuddy" && workbuddyUid) {
       return provider.chat(forwarded, { ...opts, workbuddyUid });

package/src/providers/generic.js

@@ -2,6 +2,8 @@ import { createKeyRing } from "./keyring.js";
 import { loadProviderKeys, loadProviderBaseUrl, loadProviderModelsPath, loadProviderChatPath } from "../state.js";
 import { envInt, joinUrl, getUndici, createAgent, collectApiKeysGeneric, createChatRunner, createListModelsRunner, createPreheatRunner } from "./base.js";
 import { compatFetch } from "../compat.js";
+import crypto from "node:crypto";
+import { genId, opencodeUa, digestIdTail } from "../opencode-identity.js";
 
 const { UndiciFetch } = getUndici();
 
@@ -12,6 +14,26 @@ function resolveBaseUrl(id, baseUrl) {
   return "";
 }
 
+function isOpencodeHost(baseUrl) {
+  return /opencode\.ai/i.test(String(baseUrl || ""));
+}
+
+// Console Go (zen/go) 要求 x-opencode-session 才能路由（缺失 → 400 MissingSessionID）。
+// 会话取值：已合规（ses_ 前缀）直接用；客户端透传的任意串做 sha1 摘要派生（稳定+合规）；
+// 无则每请求 fresh（与 -chat curl / bench 直连行为一致）。
+function resolveGoSession(sessionId) {
+  const raw = String(sessionId || "").trim();
+  if (/^ses_/.test(raw)) return raw;
+  if (raw) {
+    try {
+      return `ses_${digestIdTail(crypto.createHash("sha1").update(raw).digest())}`;
+    } catch {
+      return genId("ses_");
+    }
+  }
+  return genId("ses_");
+}
+
 export function createGenericProvider({
   id,
   baseUrl,
@@ -41,6 +63,7 @@ export function createGenericProvider({
   const resolvedModelsPath = modelsPath || loadProviderModelsPath(id, file ? { file } : {});
   const resolvedChatPath = chatPath || loadProviderChatPath(id, file ? { file } : {});
   const ring = createKeyRing(collectApiKeysGeneric(id, apiKeys, apiKey, loadProviderKeys), { cooldownMs });
+  const goHost = isOpencodeHost(resolvedBase);
 
   let dispatcher = null;
   let agent = null;
@@ -53,7 +76,7 @@ export function createGenericProvider({
     agent = a.agent; dispatcher = a.dispatcher;
   }
 
-  function buildHeaders(body, key) {
+  function buildHeaders(body, key, opts) {
     const isStream = body?.stream !== false;
     const h = {
       "Content-Type": "application/json",
@@ -61,20 +84,35 @@ export function createGenericProvider({
       "User-Agent": "mslxdff",
     };
     if (key) h["Authorization"] = `Bearer ${key}`;
-    return { ...h, ...extraHeaders };
+    const out = { ...h, ...extraHeaders };
+    // ocgo（opencode.ai 域名）：补 Console Go 路由所需的 opencode 身份头
+    if (goHost) {
+      out["User-Agent"] = opencodeUa();
+      out["x-opencode-client"] = "desktop";
+      out["x-opencode-session"] = resolveGoSession(opts?.sessionId);
+      out["x-opencode-request"] = genId("msg_");
+      out["x-opencode-project"] = "global";
+    }
+    return out;
   }
 
-  const { runChat } = createChatRunner({
-    id, ring, cooldownMs, retry, fetchImpl, dispatcher, buildHeaders,
-    getUrl: () => joinUrl(resolvedBase, resolvedChatPath),
-    connectTimeoutMs,
-  });
+  // base 的 attemptOnce 只调 buildHeaders(body, key)：用闭包把 opts.sessionId 带进去
+  function scopedRunner(activeRing, opts) {
+    return createChatRunner({
+      id, ring: activeRing, cooldownMs, retry, fetchImpl, dispatcher,
+      buildHeaders: (b, k) => buildHeaders(b, k, opts),
+      getUrl: () => joinUrl(resolvedBase, resolvedChatPath),
+      connectTimeoutMs,
+    });
+  }
 
-  async function chat(body) {
+  async function chat(body, opts) {
+    const { runChat } = scopedRunner(ring, opts);
     return runChat(body, ring, `MSLXDFF_${id.toUpperCase()}_KEY`);
   }
-  async function chatWithKeys(body, keys) {
+  async function chatWithKeys(body, keys, opts) {
     const tmp = createKeyRing(keys, { cooldownMs });
+    const { runChat } = scopedRunner(tmp, opts);
     return runChat(body, tmp, "shared provider keys");
   }
 

package/src/providers/share-keys.js

@@ -10,7 +10,7 @@ export const SHARE_KEYS_HEADER = "x-mslxdff-share-keys";
 const NEVER_SHARE_IDS = new Set(["cline", "clinebot"]);
 
 // 本节点应 cast key 到出站转发的供应商 id 集合 = 所有「本机有 key」的供应商，
-// 减去：opencode（无 key 且恒排除）、local-only（workbuddy，本就不走组员）、刷新型凭据。
+// 减去：opencode（无 key 且恒排除）、local-only（workbuddy/cline系，本就不走组员）、刷新型凭据。
 export function shareableProviderIds({ file } = {}) {
   const ids = [];
   for (const id of listProviderIdsWithKeys({ file })) {

package/src/routes/models-route.js

@@ -1,6 +1,7 @@
 import { json, errMsg } from "./helpers.js";
 import { runHook } from "../plugins.js";
 import { isModelAllowed } from "../state.js";
+import { mergeModelsList } from "../model-capabilities/merge.js";
 import { globalCapabilities } from "../model-capabilities/index.js";
 
 // Codex 自定义 provider 拉目录要顶层 `models` 数组（codex-rs endpoint/models.rs 解 ModelsResponse{models}），
@@ -14,12 +15,21 @@ export function isCodexModelsCaller(req) {
   return /(^|&)client_version=/.test(q);
 }
 
-export async function modelsHandler({ req, res, models, plugins }) {
+export async function modelsHandler({ req, res, models, plugins, capabilities, wbSource }) {
   if (!models) return json(res, 501, { error: "Models service not configured" });
   const codex = isCodexModelsCaller(req);
   const withCodex = (out) => (codex && out && typeof out === "object" ? { ...out, models: [] } : out);
   try {
     let data = await models.get();
+    // ADR-0022：默认把能力富化进每条条目（capabilities 子对象）；?raw=1 逃生门回原始形状，
+    // codex 调用者保持原始 + 顶层空 models:[]（富化白做）。best-effort，失败原样返回。
+    const qs = String(req?.url || "").split("?")[1] || "";
+    const rawMode = /(^|&)raw=1(&|$)/.test(qs);
+    if (!codex && !rawMode) {
+      try {
+        data = await mergeModelsList(data, { capsSvc: capabilities, wbSource });
+      } catch { /* 富化失败不阻塞 /models */ }
+    }
     // 插件 hook：models:list — 返回数组可替换对外模型列表（{object:"list",data:[...]} 或纯 id 数组）
     if (plugins?.length) {
       const ml = await runHook(plugins, "models:list", { data });

package/src/state/schemas/use-group.js

@@ -1,5 +1,6 @@
 import { defaultStateFile, readState, writeStateImmediate } from "../store.js";
 import { classifyProvider } from "../../providers/classify.js";
+import { getModelAlias, normalizeProviderId, DEFAULT_PROVIDER } from "../../providers/model-id.js";
 
 function parseBool(v) {
   if (typeof v === "boolean") return v;
@@ -36,23 +37,63 @@ export function getEffectiveUseGroup({ file = defaultStateFile() } = {}) {
   return loadUseGroup({ file });
 }
 
+// key 供应商组员开关：默认 off（仅 opencode 免费池走 peer 兜底，其他带 key 上游恒直连）。
+// MSLXDFF_USE_GROUP_KEYS=1/on 可显式开回来（调试/弱网应急）；同样受全局 off 约束。
+export function getUseGroupKeysEnv() {
+  const raw = process.env.MSLXDFF_USE_GROUP_KEYS;
+  if (raw === undefined || raw === null || raw === "") return false;
+  return parseBool(raw) === true;
+}
+
+// 取模型对应的供应商 head：兼容 canonical（workbuddy/xxx、clinebot/xxx）、
+// dash 别名（clinebot-xxx → 还原后取 head）、裸 id（归 opencode）。
+// oc/ 别名归一到 opencode（与 splitModelId 一致：别名表小写 key，先小写再归一）。
+export function providerHeadOf(model) {
+  let s = String(model || "").trim();
+  if (!s) return "";
+  try {
+    const aliased = getModelAlias(s);
+    if (aliased) s = aliased;
+  } catch {}
+  const slash = s.indexOf("/");
+  if (slash > 0) {
+    try {
+      const head = normalizeProviderId(s.slice(0, slash).toLowerCase());
+      return String(head || "").toLowerCase();
+    } catch {
+      return s.slice(0, slash).toLowerCase();
+    }
+  }
+  return DEFAULT_PROVIDER;
+}
+
 // 全局开关：off 则所有供应商都不走组员网络（via-route/hedge/peer/broadband 全禁），仅本机直连
-// workbuddy 硬禁组员（ADR-0015 local-only）：本机账号绑定（auths/workbuddy-*.json + uid），
+// workbuddy/cline 系硬禁组员（ADR-0015 local-only）：本机账号绑定（workbuddy auths/*.json + uid / cline refreshToken），
 // 组员没有该账号转过去也用不了，且本地直连最快——无论全局开关一律仅本机直连。
-// model 兼容 canonical（workbuddy/xxx）与 dash（workbuddy-xxx）两种形态。
+// model 兼容 canonical（workbuddy/xxx、clinebot/xxx）与 dash（workbuddy-xxx、cline-xxx）两种形态。
 export function isHardLocalOnly(model) {
-  const s = String(model || "").trim().toLowerCase();
-  const slash = s.indexOf("/");
-  const head = slash > 0 ? s.slice(0, slash) : s.split("-")[0];
+  const head = providerHeadOf(model);
+  if (!head) return false;
   try {
     return classifyProvider(head) === "local-only";
   } catch {
-    return head === "workbuddy";
+    return head === "workbuddy" || head === "cline" || head === "clinebot";
   }
 }
 
+// key 供应商默认直连（ADR-0023）：opencode（quota-pool，裸 id/oc 前缀）沿用全局开关；
+// 其余带前缀的一律仅本机直连，除非 MSLXDFF_USE_GROUP_KEYS=1 显式开回。
+export function isKeyProviderDirectOnly(model) {
+  const head = providerHeadOf(model);
+  if (!head || head === "opencode") return false;
+  if (isHardLocalOnly(model)) return true;
+  if (getUseGroupKeysEnv()) return false;
+  return true;
+}
+
 export function shouldUseGroupForModel(model, { file = defaultStateFile() } = {}) {
   if (isHardLocalOnly(model)) return false;
+  if (isKeyProviderDirectOnly(model)) return false;
   return getEffectiveUseGroup({ file });
 }
 

package/src/upstream-probe/rotate.js

@@ -7,7 +7,7 @@ import { errMsg } from "../cli/util.js";
 
 export const PROBE_DELAY_MS = Number(process.env.MSLXDFF_BENCH_DELAY_MS || 120) || 0;
 
-// 从 providerConfigs 收集探针目标：local-only(workbuddy)/quota-pool(opencode) 排除，无 baseUrl 跳过
+// 从 providerConfigs 收集探针目标：local-only(workbuddy/cline系)/quota-pool(opencode) 排除，无 baseUrl 跳过
 export function probeTargetsFromState({ loadProviderConfigs, loadProviderKeys, loadProviderBaseUrl } = {}) {
   const out = [];
   const ids = new Set(Object.keys(loadProviderConfigs?.() || {}));