mslxdff 0.1.135 → 0.1.138

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mslxdff",
-  "version": "0.1.135",
+  "version": "0.1.138",
   "description": "测试项目，请勿使用。",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
     "docs:check": "node scripts/docs-check.js"
   },
   "engines": {
-    "node": ">=16"
+    "node": ">=18"
   },
   "files": [
     "bin/",

package/src/chat/gateway.js

@@ -138,7 +138,7 @@ export function createGatewayClient({
         }
         if (provider === "opencode" && rawModel.includes("/")) {
           const maybe = rawModel.split("/")[0];
-          if (["workbuddy", "clinebot", "sensenova", "openrouter", "generic"].includes(maybe)) provider = maybe;
+          if (["workbuddy", "cline", "sensenova", "openrouter", "generic"].includes(maybe)) provider = maybe;
         }
       } catch {}
       if (TRACE) {

package/src/chat/prompt.js

@@ -58,7 +58,7 @@ ${mini}
 - 需要执行命令时调用 run_command，需要看文件时调用 read_file，需要检查网络/服务可用性时调用 curl。
 - curl 简写：upstream(=上游 https://opencode.ai/zen/v1/models)、local/health(=本机 /health)、local/models(=本机 /v1/models)，也支持完整 http(s) URL；会自动补上游头、本机 token 与已配置供应商 key（直连 https://api.b.ai/v1/models 会自动带 bai 的 key，无需手动加头）。
 - 查“某供应商有哪些模型”**优先用 CLI 直查**：若上方“可用模型”已能回答，直接前缀过滤回答（如 workbuddy/ 即 workbuddy）；需实时拉取时调用 run_command: "-provider <id> models"（如 -provider workbuddy models）或 "-model list --provider <id>"，按 allowlist 过滤，--json 供脚本。**禁止**调 -provider <id> list（这是查配置，不是查模型！）。**错误示例**：workbuddy有哪些模型 → 调 -provider workbuddy list → 错。**正确**：-provider workbuddy models。禁止为此调用 -showtoken。
-- 严禁幻觉命令：mslxdff "hi" --model X / mslxdff --model X "hi" / mslxdff -chat --model X 都不存在，输出只会是 status 页。探活任意模型（含 clinebot/*、workbuddy/*、bai/*）必须用 curl POST http://localhost:8989/v1/chat/completions，body 为 {"model":"<前缀/模型>","messages":[{"role":"user","content":"hi"}],"stream":false}，成功 200 + x-mslxdff-via:local 即通；401 代表本机 token 陈旧需提示 mslxdff -stop && mslxdff；403 + x-mslxdff-allowlist:1 代表白名单未放行需 allowlist add。
+- 严禁幻觉命令：mslxdff "hi" --model X / mslxdff --model X "hi" / mslxdff -chat --model X 都不存在，输出只会是 status 页。探活任意模型（含 cline/*、workbuddy/*、bai/*）必须用 curl POST http://localhost:8989/v1/chat/completions，body 为 {"model":"<前缀/模型>","messages":[{"role":"user","content":"hi"}],"stream":false}，成功 200 + x-mslxdff-via:local 即通；401 代表本机 token 陈旧需提示 mslxdff -stop && mslxdff；403 + x-mslxdff-allowlist:1 代表白名单未放行需 allowlist add。
 - **禁止重复调用（最高优先级）**：同一 run_command/curl/read_file 在本轮只执行一次，重复会被工具侧 SKIPPED_DUP 拦截；查询类（-showtoken/-status/-provider list/-providers list/-model list/-group list/-log 等）**调用一次即答案**，拿到 OK 结果后必须**立即用中文直接回答用户**，禁止再发起任何工具调用。收到 SKIPPED_DUP 或“请直接回答/禁止再调用”提示时，必须 0 工具直接回答。
 - 禁止调用 -uninstall，包含即拒绝；-showtoken 仅在用户明确要求查看/调试本机 token 时才用，查模型/查供应商严禁调用。
 - 回复风格：简洁友好，执行前后用中文说明你在做什么。

package/src/chat/terminal.js

@@ -96,7 +96,7 @@ export function handleSlash(line, ctx) {
     const id = arg;
     if (id.includes("/")) {
       console.log(`\x1b[31m[拒绝] ${id} 带供应商前缀 — -chat 只支持 opencode 上游模型（裸 id，直连 opencode.ai 免费池）\x1b[0m`);
-      console.log(`\x1b[90m其他供应商（deepseek/ workbuddy/ clinebot/ 等）请走网关：mslxdff -model set <id> 或 curl 本机 /v1/chat/completions\x1b[0m`);
+      console.log(`\x1b[90m其他供应商（deepseek/ workbuddy/ cline/ 等）请走网关：mslxdff -model set <id> 或 curl 本机 /v1/chat/completions\x1b[0m`);
       return { handled: true };
     }
     if (!isFreeModel(id) || !freePoolNow().includes(id)) {

package/src/chat-pipeline/serial-trial.js

@@ -9,7 +9,13 @@ import { handlePeerRelay } from "../routes/chat/peer-handler.js";
 import { handleBroadbandRelay } from "../routes/chat/broadband-handler.js";
 import { handleViaRoute } from "../routes/chat/via-route-handler.js";
 import { handleExhaustedLocal, handleExhaustedAll } from "../routes/chat/exhausted-handler.js";
-import { shouldUseGroupForModel, isHardLocalOnly } from "../state/schemas/use-group.js";
+import { shouldUseGroupForModel, isHardLocalOnly, isKeyProviderDirectOnly } from "../state/schemas/use-group.js";
+
+function groupSkipReason(model) {
+  if (isHardLocalOnly(model)) return "provider local-only（禁组员，仅本机直连）";
+  if (isKeyProviderDirectOnly(model)) return "key provider default direct（仅本机直连，MSLXDFF_USE_GROUP_KEYS=1 可开组员）";
+  return "useGroup=off";
+}
 
 /**
  * 串行 trial — 从 engine.js 抽出的第二段：via-route 单路径 → 串行 trial →
@@ -43,6 +49,8 @@ export async function runSerialTrial(ctx, deps = {}) {
     } catch (e) {
       evt("via-route-exception", { reqId, model: requested, error: errMsg(e) });
     }
+  } else if (!useAuto && requested && requested.includes("/") && canForwardPeers && !lockModel && peers) {
+    evt("group-skip", { reqId, model: requested, reason: `${groupSkipReason(requested)} (via-route)` });
   }
 
   let lastErr = viaRouteLastErr;
@@ -143,7 +151,7 @@ export async function runSerialTrial(ctx, deps = {}) {
     }
     if (canForwardPeers) {
       if (!shouldUseGroupForModel(model)) {
-        evt("group-skip", { reqId, model, reason: isHardLocalOnly(model) ? "provider local-only（禁组员，仅本机直连）" : "useGroup=off (peer)" });
+        evt("group-skip", { reqId, model, reason: `${groupSkipReason(model)} (peer)` });
       } else {
         const pr = await peerRelay({ model, body, lastErr, requested, useAuto, lockModel, auto, peers, handlerCtx, evt, logCall, mark, perf0, stages, startedAt, plugins, res });
         if (pr.handled) return { done: true };
@@ -152,7 +160,7 @@ export async function runSerialTrial(ctx, deps = {}) {
     }
     if (groups) {
       if (!shouldUseGroupForModel(model)) {
-        evt("group-skip", { reqId, model, reason: isHardLocalOnly(model) ? "provider local-only（禁组员，仅本机直连）" : "useGroup=off (broadband)" });
+        evt("group-skip", { reqId, model, reason: `${groupSkipReason(model)} (broadband)` });
       } else {
         const br = await broadbandRelay({ model, body, hops, lastErr, requested, useAuto, lockModel, auto, groups, token, bus, logs, handlerCtx, evt, mark, perf0, stages, res, startedAt, plugins });
         if (br.handled) return { done: true };

package/src/cli/commands/model/list-providers.js

@@ -8,7 +8,7 @@ export async function renderOtherProviders({ pickedIds, ids, fullAliases }) {
   try { _la2(); } catch {}
   const configs = loadProviderConfigs();
   const otherIds = Object.keys(configs).filter((k) => String(k).toLowerCase() !== "opencode");
-  const order2 = ["workbuddy", "clinebot", "openrouter", "bai"];
+  const order2 = ["workbuddy", "cline", "openrouter", "bai"];
   otherIds.sort((a, b) => {
     const ia = order2.indexOf(a), ib = order2.indexOf(b);
     if (ia !== -1 || ib !== -1) {

package/src/cli/commands/model/list-render.js

@@ -57,7 +57,7 @@ export function renderFreeList({ ids, at, pickedIds, sortedProvs, groups, aliasM
   }
 }
 
-/** 按供应商分组 + 排序（opencode/workbuddy/clinebot/openrouter 优先） */
+/** 按供应商分组 + 排序（opencode/workbuddy/cline/openrouter 优先） */
 export function groupByProvider(ids) {
   const groups = {};
   for (const id of ids) {
@@ -65,7 +65,7 @@ export function groupByProvider(ids) {
     if (!groups[prov]) groups[prov] = [];
     groups[prov].push(id);
   }
-  const order = ["opencode", "workbuddy", "clinebot", "openrouter"];
+  const order = ["opencode", "workbuddy", "cline", "openrouter"];
   const sortedProvs = Object.keys(groups).sort((a, b) => {
     const ia = order.indexOf(a), ib = order.indexOf(b);
     if (ia !== -1 || ib !== -1) {

package/src/cli/commands/provider/add.js

@@ -69,7 +69,8 @@ export async function handleProviderAdd(id, sub, rest) {
     try {
       const { writeFileSync, mkdirSync } = await import("node:fs");
       const { join } = await import("node:path");
-      const dir = process.env.WORKBUDDY_AUTH_DIR || join(process.cwd(), "auths");
+      const { resolveAuthDir } = await import("../../providers/workbuddy/account-store.js");
+      const dir = resolveAuthDir();
       mkdirSync(dir, { recursive: true });
       const fp = join(dir, `workbuddy-${uid}.json`);
       const doc = { account: { uid, enterpriseId: "", nickname: "" }, auth: { accessToken: token, refreshToken: "", expiresAt: Math.floor(Date.now()/1000)+3600, domain: "www.codebuddy.cn" } };

package/src/cli/commands/provider/bench-via.js

@@ -120,7 +120,7 @@ export async function handleVia({ providerId, opts, fetchImpl, loadConfigs, load
       for (const k of Object.keys(raw.providerConfigs || {})) if (!targetIds.includes(k) && (loadAllowed(k) || []).length) targetIds.push(k);
       for (const k of Object.keys(raw.providerKeys || {})) if (!targetIds.includes(k) && (loadAllowed(k) || []).length) targetIds.push(k);
     } catch {}
-    if (!targetIds.length) targetIds = ["openrouter", "workbuddy", "clinebot"].filter((p) => (loadAllowed(p) || []).length);
+    if (!targetIds.length) targetIds = ["openrouter", "workbuddy", "cline"].filter((p) => (loadAllowed(p) || []).length);
     // opencode 默认 allowAny 但 allowlist 常空：有裸 picks 且确认包含 opencode 时纳入
     if (includeOpencode && !targetIds.includes("opencode") && picks.some((p) => !String(p).includes("/") || String(p).toLowerCase().startsWith("opencode/"))) {
       targetIds.push("opencode");

package/src/cli/commands/provider/cline-free.js

@@ -0,0 +1,94 @@
+/**
+ * mslxdff -provider cline free [sync] [--yes] [--json] [--keep-extra]
+ * 只读：直查上游免费目录（公开接口，无凭据）并与当前 allowlist 求差；只有 `free sync --yes` 才写 allowlist。
+ * allowlist 存裸 id（不带 cline/ 前缀），与 normalizeAllowedModel 语义一致；落盘走 saveProviderAllowedModels 保留 keys/baseUrl。
+ */
+import { normalizeProviderId } from "../../../providers/model-id.js";
+import { fetchFreeCatalog, FALLBACK_FREE, FREE_CATALOG_PATH } from "../../../providers/cline/free-catalog.js";
+
+/** 上游不可达时退回内置兜底目录（标注 source=fallback，供人判断是否该落盘） */
+async function loadCatalog() {
+  const cat = await fetchFreeCatalog({});
+  if (cat.ok) return { ...cat, source: "upstream" };
+  return {
+    ...cat,
+    source: "fallback",
+    models: FALLBACK_FREE.map((m) => ({ ...m })),
+    ids: FALLBACK_FREE.map((m) => m.id),
+  };
+}
+
+function computeNext(current, freeIds, keepExtra) {
+  const next = keepExtra ? [...new Set([...current, ...freeIds])] : [...freeIds];
+  return {
+    next,
+    added: next.filter((m) => !current.includes(m)),
+    removed: current.filter((m) => !next.includes(m)),
+    kept: next.filter((m) => current.includes(m)),
+  };
+}
+
+function renderList(cat, current, next, plan) {
+  console.log(`cline free 目录（GET ${FREE_CATALOG_PATH} → free）：${cat.ids.length} 个${cat.source === "fallback" ? "（内置兜底，上游不可达）" : ""}`);
+  const w = Math.max(20, ...cat.ids.map((s) => s.length)) + 2;
+  for (const m of cat.models) console.log(`   + ${String(m.id).padEnd(w)}${m.name && m.name !== m.id ? m.name : ""}`);
+  console.log(`当前 allowlist：${current.length} 个`);
+  for (const id of current) console.log(`   ${next.includes(id) ? "✓" : "-"} ${id}${next.includes(id) ? "" : "          （不在 free 目录）"}`);
+  console.log(`结果：allowlist ${current.length} → ${next.length}（+${plan.added.length} 新增 / -${plan.removed.length} 移除 / ${plan.kept.length} 保留）`);
+}
+
+export async function handleClineFree(id, sub, rest = [], args = []) {
+  if (normalizeProviderId(id) !== "cline") return false;
+  if (String(sub || "").toLowerCase() !== "free") return false;
+  const isSync = String(rest[1] || "").toLowerCase() === "sync";
+  const wantsJson = args.includes("--json") || args.includes("-json");
+  const yes = args.includes("--yes") || args.includes("-y");
+  const keepExtra = args.includes("--keep-extra");
+
+  const { loadProviderAllowedModels, saveProviderAllowedModels } = await import("../../../state.js");
+  const cat = await loadCatalog();
+  const current = loadProviderAllowedModels("cline");
+  const plan = computeNext(current, cat.ids, keepExtra);
+  const dryRun = !(isSync && yes);
+  let written = [];
+  if (isSync && !dryRun) {
+    try {
+      written = saveProviderAllowedModels("cline", plan.next);
+    } catch (e) {
+      console.error(`❌ 写入 allowlist 失败: ${String(e?.message || e)}`);
+      process.exit(1);
+    }
+  }
+  const warning = cat.source === "fallback" ? `上游目录不可达（${cat.error || cat.status}），使用内置兜底目录，可能过期` : null;
+
+  if (wantsJson) {
+    console.log(JSON.stringify({
+      provider: "cline",
+      mode: isSync ? "sync" : "list",
+      source: cat.source,
+      url: cat.url,
+      free: cat.ids,
+      current,
+      next: plan.next,
+      added: plan.added,
+      removed: plan.removed,
+      kept: plan.kept,
+      dryRun,
+      written,
+      ...(warning ? { warning } : {}),
+    }, null, 2));
+    process.exit(0);
+  }
+
+  if (warning) console.error(`⚠️  ${warning}`);
+  renderList(cat, current, plan.next, plan);
+  if (!isSync) {
+    console.log(`\n预览（只读）。一键同步：mslxdff -provider cline free sync --yes   ·   只增不删：加 --keep-extra`);
+  } else if (dryRun) {
+    console.log(`\n预览模式，未写入。执行：mslxdff -provider cline free sync --yes${keepExtra ? " --keep-extra" : ""}`);
+  } else {
+    console.log(`\n✅ 已写入 allowlist：${written.length} 个（providerConfigs.cline.allowedModels）`);
+    console.log(`   生效：mslxdff -restart（daemon 的 /v1/models 聚合有 10 分钟缓存，重启即刷新）`);
+  }
+  process.exit(0);
+}

package/src/cli/commands/provider/cline-login.js

@@ -1,7 +1,8 @@
 import { compatFetch, getUndici, timeoutSignal } from "../../../compat.js";
+import { normalizeProviderId } from "../../../providers/model-id.js";
 export async function handleClineLogin(id, sub) {
   if (sub !== "login" && sub !== "auth" && sub !== "oauth") return false;
-  if (id !== "cline" && id !== "clinebot" && id !== "cline-bot") return false;
+  if (normalizeProviderId(id) !== "cline") return false;
 
   const CLIENT_ID = "client_01K3A541FN8TA3EPPHTD2325AR";
   const WORKOS_DEVICE = "https://api.workos.com/user_management/authorize/device";
@@ -97,7 +98,7 @@ export async function handleClineLogin(id, sub) {
     }
   }
   if (!workos) {
-    console.error("\n❌ 授权超时，请重新运行 mslxdff -provider clinebot login");
+    console.error("\n❌ 授权超时，请重新运行 mslxdff -provider cline login");
     process.exit(1);
   }
   console.log("\n✅ WorkOS 授权成功！\n🔗 用 WorkOS token 在 Cline 注册...");
@@ -117,28 +118,32 @@ export async function handleClineLogin(id, sub) {
   console.log("=".repeat(60));
   console.log(`✅ 登录成功! 账号: ${email}`);
   console.log(`🔑 refreshToken: ${rt.slice(0, 8)}…${rt.slice(-8)} (${rt.length} 字符)`);
-  // 落盘到 state（同时写 cline 与 clinebot 两个 id，兼容）
-  const { loadProviderKeys, saveProviderConfig, loadProviderConfig } = await import("../../../state.js");
-  for (const pid of ["cline", "clinebot"]) {
-    try {
-      const cur = loadProviderKeys(pid);
-      if (cur.includes(rt)) {
-        console.log(`   ℹ️ ${pid} 已存在相同 token，跳过`);
-        continue;
-      }
+  // 落盘到 state（供应商 id 恒为 cline；写盘前先跑一次性迁移，保证老用户不会再写出 clinebot）
+  const { defaultStateFile, loadProviderKeys, saveProviderConfig, loadProviderConfig } = await import("../../../state.js");
+  try {
+    const { runStateMigrations } = await import("../../../state/migrations.js");
+    const mig = await runStateMigrations({ file: defaultStateFile() });
+    if (mig.applied.length) console.log(`   ℹ️ 已合并遗留供应商配置: ${mig.applied.join(", ")}`);
+  } catch {}
+  try {
+    const pid = "cline";
+    const cur = loadProviderKeys(pid);
+    if (cur.includes(rt)) {
+      console.log(`   ℹ️ ${pid} 已存在相同 token，跳过`);
+    } else {
       const cfg = loadProviderConfig(pid) || { baseUrl: "", keys: [] };
       const nextKeys = [...new Set([...(cfg.keys || cur), rt].filter(Boolean))];
       saveProviderConfig(pid, { baseUrl: cfg.baseUrl || "https://api.cline.bot", keys: nextKeys });
       console.log(`   ✅ 已写入 ${pid}（现 ${nextKeys.length} 个账号）`);
-    } catch (e) {
-      console.log(`   ⚠️ 写入 ${pid} 失败: ${e.message}`);
     }
+  } catch (e) {
+    console.log(`   ⚠️ 写入 cline 失败: ${e.message}`);
   }
   console.log("=".repeat(60));
   console.log("\n下一步：");
   console.log("  mslxdff -restart                         重启网关使新账号生效");
-  console.log("  mslxdff -provider clinebot bench --json  测速 deepseek 是否 200");
+  console.log("  mslxdff -provider cline bench --json     测速 deepseek 是否 200");
   console.log("  mslxdff -chat                             直接对话，模型选 deepseek/deepseek-v4-flash");
-  console.log("\n多账号：重复 `mslxdff -provider clinebot login` 追加，二号自动做后备");
+  console.log("\n多账号：重复 `mslxdff -provider cline login` 追加，二号自动做后备");
   process.exit(0);
 }

package/src/cli/commands/provider/index.js

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { normalizeProviderId } from "../../../providers/model-id.js";
 import { defaultStateFile } from "../../../state.js";
 
 export async function handleProviders(args) {
@@ -74,6 +75,27 @@ export async function handleProvider(args) {
   if (await handleProviderModels(id, sub, args, rest)) return true;
   const { handleProviderBench } = await import("./bench.js");
   if (await handleProviderBench(id, sub, rest, args)) return true;
+  const { handleClineFree } = await import("./cline-free.js");
+  if (await handleClineFree(id, sub, rest, args)) return true;
+  if (normalizeProviderId(id) === "cline" && sub === "migrate") {
+    const { runStateMigrations } = await import("../../../state/migrations.js");
+    const dryRun = args.includes("--dry-run") || args.includes("--dryrun");
+    const r = await runStateMigrations({ dryRun });
+    const d = r.details["cline-unify"] || {};
+    if (r.errors.length) console.error(`❌ 迁移失败: ${r.errors.map((e) => `${e.id}: ${e.error}`).join("; ")}`);
+    if (dryRun) {
+      console.log(d.changed
+        ? `cline migrate 干跑：将合并遗留 cline id 配置（keys ${d.before.keys} → ${d.after.keys} / allowlist ${d.before.allowedModels} → ${d.after.allowedModels}），未写入`
+        : "cline migrate 干跑：无需迁移（未发现 providerConfigs.clinebot / cline-bot）");
+    } else if (d.applied) {
+      console.log(`✅ cline migrate 完成：keys ${d.before.keys} → ${d.after.keys} / allowlist ${d.before.allowedModels} → ${d.after.allowedModels}`);
+      if (d.backup) console.log(`   备份：${d.backup}`);
+      console.log("   生效：mslxdff -restart");
+    } else {
+      console.log("cline migrate：无需迁移（未发现 providerConfigs.clinebot / cline-bot）");
+    }
+    process.exit(r.errors.length ? 1 : 0);
+  }
   const { handleProviderKeys } = await import("./keys.js");
   await handleProviderKeys(id, sub, rest, args);
   return true;

package/src/cli/commands/provider/models.js

@@ -1,9 +1,12 @@
 import { join } from "node:path";
 import { defaultStateFile } from "../../../state.js";
 import { logDir } from "../../../logs.js";
+import { normalizeProviderId } from "../../../providers/model-id.js";
 
 export async function handleProviderModels(id, sub, args, rest) {
   if (!(sub === "models" || sub === "show-models" || sub === "list-models" || sub === "ls")) return false;
+  // 供应商 id 归一（clinebot/cline-bot → cline）：老脚本 `-provider clinebot models` 仍走 cline 直查
+  id = normalizeProviderId(id);
   const { loadProviderConfig, loadProviderKeys, isModelAllowed } = await import("../../../state.js");
   const wantsJson = args.includes("--json") || args.includes("-json");
   const cfg = loadProviderConfig(id);
@@ -34,7 +37,7 @@ export async function handleProviderModels(id, sub, args, rest) {
     let provider;
     if (id === "workbuddy") {
       provider = createWorkbuddyProvider({ baseUrl, apiKeys: keys, auths, file: defaultStateFile() });
-    } else if (id === "cline" || id === "clinebot") {
+    } else if (id === "cline") {
       // 与聚合目录同源：recommended-models 的 free（generic 的 /api/v1/models 是全量目录，含大量不可用条目）
       const { createClineProvider } = await import("../../../providers/cline.js");
       provider = createClineProvider({ id, baseUrl: baseUrl || undefined, apiKeys: keys, file: defaultStateFile() });

package/src/cli/commands/provider/workbuddy-login.js

@@ -1,5 +1,5 @@
 import { compatFetch, timeoutSignal } from "../../../compat.js";
-// mslxdff -provider workbuddy login — WorkBuddy 官方设备授权流（对标 clinebot login）。
+// mslxdff -provider workbuddy login — WorkBuddy 官方设备授权流（对标 cline login）。
 // 学自 Sliverkiss/workbuddy2api（cmd/login）：POST /v2/plugin/auth/state 拿 state+authUrl →
 // 浏览器登录 → GET /v2/plugin/auth/token?state= 轮询 → GET /v2/plugin/login/account?state= 拿 uid。
 // 不走 whistle/MITM，不依赖 codebuddy CLI，自然支持多账号追加。

package/src/cli/commands/use-group.js

@@ -1,4 +1,4 @@
-import { loadUseGroup, saveUseGroup, getEffectiveUseGroup, getUseGroupEnv } from "../../state/schemas/use-group.js";
+import { loadUseGroup, saveUseGroup, getEffectiveUseGroup, getUseGroupEnv, getUseGroupKeysEnv } from "../../state/schemas/use-group.js";
 import { argValue } from "../policy.js";
 
 function parseInput(v) {
@@ -26,15 +26,18 @@ export async function handleUseGroup(args) {
   const envVal = getUseGroupEnv();
   const effective = getEffectiveUseGroup();
   const stored = loadUseGroup();
+  const keysEnv = getUseGroupKeysEnv();
 
   if (raw === null || raw === undefined || raw === "") {
     // 查询模式
-    console.log(`use-group: ${effective ? "on" : "off"} (effective)`);
+    console.log(`use-group: ${effective ? "on" : "off"} (effective, 仅 opencode 免费池)`);
     console.log(`  stored: ${stored ? "on" : "off"} (state.json useGroup)`);
     if (envVal !== null) console.log(`  env MSLXDFF_USE_GROUP=${envVal ? "on" : "off"} (overrides stored)`);
+    console.log(`  keys: ${keysEnv ? "on" : "off"} (env MSLXDFF_USE_GROUP_KEYS, 默认 off: 带 key 上游恒直连)`);
     console.log(`  default: on`);
-    console.log(`  usage: mslxdff -use-group on|off  (本机失败时是否走组员网络，默认 on)`);
+    console.log(`  usage: mslxdff -use-group on|off  (opencode 失败时是否走组员网络，默认 on)`);
     console.log(`  env:   MSLXDFF_USE_GROUP=0|1  (优先级高于 state)`);
+    console.log(`  env:   MSLXDFF_USE_GROUP_KEYS=1  (把 key 供应商开回组员，cline/workbuddy 仍硬禁)`);
     process.exit(0);
   }
 
@@ -50,7 +53,8 @@ export async function handleUseGroup(args) {
 
   saveUseGroup(parsed);
   console.log(`use-group set to ${parsed ? "on" : "off"} (stored in state.json)`);
-  console.log(`  ${parsed ? "允许" : "不再允许"}走组员网络（via-route/hedge/peer/broadband，全部供应商）`);
+  console.log(`  ${parsed ? "允许 opencode" : "opencode 也不再"}走组员网络（via-route/hedge/peer/broadband）`);
+  console.log(`  带 key 上游默认恒直连（不受本开关影响，MSLXDFF_USE_GROUP_KEYS=1 可开回，cline/workbuddy 仍硬禁）`);
   if (!parsed) console.log(`  提示：所有请求将仅在本机重试，不再走组员中继`);
   process.exit(0);
 }

package/src/cli/commands/workbuddy.js

@@ -126,12 +126,15 @@ export async function handleWorkbuddy(args) {
     auths.splice(rmIdx,1); keys.splice(rmIdx,1);
     saveProviderConfig("workbuddy", { baseUrl: cfg.baseUrl||"https://copilot.tencent.com", keys, auths });
     if (!keep) {
+      // 旧实现只删 cwd/auths 那一份，留下的旧副本会被读取兜底"复活"账号 → 扫所有候选目录
       try {
         const { existsSync, unlinkSync } = await import("node:fs");
         const { join } = await import("node:path");
-        const dir = process.env.WORKBUDDY_AUTH_DIR || join(process.cwd(), "auths");
-        const fp = join(dir, `workbuddy-${uid}.json`);
-        if (existsSync(fp)) { unlinkSync(fp); console.log(`removed file ${fp}`); }
+        const { resolveAuthDirs } = await import("../../providers/workbuddy/account-store.js");
+        for (const dir of resolveAuthDirs()) {
+          const fp = join(dir, `workbuddy-${uid}.json`);
+          if (existsSync(fp)) { unlinkSync(fp); console.log(`removed file ${fp}`); }
+        }
       } catch {}
     }
     try { const { getBalanceCache } = await import("../../providers/workbuddy-balance.js"); getBalanceCache().delete(uid); } catch {}
@@ -155,24 +158,14 @@ async function loadWorkbuddyAccounts() {
   })).filter((it) => it.uid && it.key);
   if (items.length) return items;
   try {
-    const { readdirSync, readFileSync, existsSync } = await import("node:fs");
-    const { join } = await import("node:path");
-    const { resolveAuthDir } = await import("../../providers/workbuddy/account-store.js");
-    const dir = resolveAuthDir();
-    if (existsSync(dir)) {
-      for (const f of readdirSync(dir).filter((x) => x.startsWith("workbuddy-") && x.endsWith(".json"))) {
-        try {
-          const j = JSON.parse(readFileSync(join(dir, f), "utf8"));
-          if (j?.account?.uid && j?.auth?.accessToken) {
-            const domain = j.auth.domain || "www.codebuddy.cn";
-            items.push({
-              uid: j.account.uid, domain, enterpriseId: j.account.enterpriseId || "",
-              key: j.auth.accessToken,
-              auth: { uid: j.account.uid, domain, enterpriseId: j.account.enterpriseId || "", refreshToken: j.auth.refreshToken || "" },
-            });
-          }
-        } catch {}
-      }
+    const { listAccountDocs } = await import("../../providers/workbuddy/account-store.js");
+    for (const { uid, doc } of listAccountDocs()) {
+      const domain = doc.auth.domain || "www.codebuddy.cn";
+      items.push({
+        uid, domain, enterpriseId: doc.account.enterpriseId || "",
+        key: doc.auth.accessToken,
+        auth: { uid, domain, enterpriseId: doc.account.enterpriseId || "", refreshToken: doc.auth.refreshToken || "" },
+      });
     }
   } catch {}
   return items;

package/src/cli/index.js

@@ -1,12 +1,15 @@
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
+import { assertMinNode } from "../compat.js";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const VERSION = JSON.parse(readFileSync(join(__dirname, "..", "..", "package.json"), "utf8")).version;
 
 // deep CLI entry — single inlet: run(args) — hides all command branching inside
 export async function run(args = process.argv.slice(2)) {
+  // 运行环境门（强制）：项目要求 Node >=18（ADR-0024），不满足则人话退出
+  if (!assertMinNode()) process.exit(1);
   const { handleHelp, handleUpdate, handleRefreshToken, handleShowToken, handleUninstall, handleLog, handlePlugins, handleChat, handleStatus, handleFree, handleAutostart } = await import("./commands/system.js");
   if (await handleHelp(args, VERSION)) return;
   if (await handleUpdate(args, VERSION)) return;

package/src/compat.js

@@ -1,8 +1,8 @@
-// 老 Node 兼容层（engines >=16）：Node 16 缺 globalThis.fetch（18+）、
-// AbortSignal.timeout（17.3+）、structuredClone（17+）；裸全局 crypto 是
-// WebCrypto，其 randomUUID 要 19+，只有 node:crypto 的 14.17+ 可用。
-// undici 8 需 Node 22+，依赖已锁 5.x（老 Node 可跑，API 兼容我们用到的面）。
-// 统一从这里取，源码里勿直接用这些全局。
+// 运行时兼容层（项目要求 Node >=18，见 ADR-0024；源码里勿直接用裸 fetch/globalThis.fetch）。
+// 仍保留本层的原因：① undici 是显式依赖（Agent 连接池/keep-alive 要用），
+// 各家 fetch 实现统一从这里取，避免 globalThis.fetch 与 undici.fetch 混用；
+// ② AbortSignal.timeout/structuredClone 在 18+ 已原生，这里的兜底只为可读报错，
+// 不再承诺 <18 可用（<18 请走 assertMinNode 的人话提示）。
 import { randomUUID } from "node:crypto";
 
 let _undici = null;
@@ -33,3 +33,21 @@ export function clone(v) {
 }
 
 export const uuid = () => randomUUID();
+
+// ---- 运行环境门（强制）：项目要求 Node >=18（ADR-0024）----
+// Node <18 缺 Response/Headers/ReadableStream/TransformStream 等 Web 全局，
+// 上游适配层有 29 处裸用，跑起来必 ReferenceError；与其半途炸掉，不如入口给人话。
+export const MIN_NODE_MAJOR = 18;
+
+export function nodeMajor() {
+  return Number(String(process.versions?.node || "0").split(".")[0]) || 0;
+}
+
+export function assertMinNode({ min = MIN_NODE_MAJOR, label = "mslxdff" } = {}) {
+  const major = nodeMajor();
+  if (major >= min) return true;
+  console.error(`[运行环境不满足] ${label} 需要 Node ${min}+，当前 v${process.versions.node}。`);
+  console.error("原因：Node <18 没有 Response/Headers/ReadableStream 等全局对象，上游转发必然失败。");
+  console.error("升级方式：nvm install 20 && nvm use 20，或到 https://nodejs.org/ 装 LTS（推荐 20/22）。");
+  return false;
+}

package/src/model-capabilities/index.js

@@ -117,8 +117,22 @@ export function createCapabilitiesService({
   function providers() {
     return [...capsIndex.keys()].sort();
   }
-
-  return { ready, get, list, providers, npmIndex: () => new Map(npmIndex) };
+  // readyWarm：仅用内存/磁盘缓存热身，绝不网络请求。/models 富化用它避免冷启动阻塞；
+  // 冷缓存时后台拉新（不 await），下次请求即富化。
+  async function readyWarm() {
+    const t = now();
+    if (raw && t - loadedAt < ttl) return true;
+    const disk = readCache();
+    if (disk) {
+      raw = disk;
+      capsIndex = buildIndex(disk);
+      loadedAt = t;
+      return true;
+    }
+    ready().catch(() => {}); // 后台拉新，失败静默（/models 原样降级）
+    return false;
+  }
+  return { ready, readyWarm, get, list, providers, npmIndex: () => new Map(npmIndex) };
 }
 
 // 模块级单例：HTTP handler 懒加载，测试 _reset 后注入
@@ -128,7 +142,6 @@ export function globalCapabilities() {
   return _global;
 }
 export function _resetGlobalCapabilities() { _global = null; }
-
 // 缓存落盘位置：MSLXDFF_MODELS_DEV_CACHE 覆盖 > ~/.config/mslxdff/models-dev.json（与 state 同目录）
 function defaultCacheFile() {
   const override = process.env.MSLXDFF_MODELS_DEV_CACHE;