mslxdff 0.1.135 → 0.1.138

package/src/providers/workbuddy/account-store.js

@@ -1,17 +1,83 @@
 // WorkBuddy 账号落盘单一源：auths/workbuddy-<uid>.json（0600 tmp+rename）+ state.json keys/auths 按 uid 去重。
 // token-auto / device-login / 刷新（服务端 saveFn 与 CLI 定时任务）共用同一实现，安全细节只维护一份。
 // Note: 刷新落盘只走 applyTokenRefresh，别再各自内联一套 — 见 .agents/notes/implemented/architecture/2026-09-17-workbuddy-persist-single-seam.md
-import { writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync } from "node:fs";
+// Note: 凭据目录别再用 cwd 兜底 — 见 .agents/notes/implemented/architecture/2026-09-20-workbuddy-authdir-follows-state.md
+import { writeFileSync, mkdirSync, existsSync, renameSync, unlinkSync, readdirSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { tmpdir } from "node:os";
-import { isTestEnv } from "../../state/store.js";
+import { isTestEnv, defaultStateFile } from "../../state/store.js";
+
+// 凭据目录单一真相：跟着「账本」（state 文件）走 —— 默认 ~/.config/mslxdff/auths。
+// 旧实现末尾兜底 `join(process.cwd(), "auths")`：在任意目录里起服务就把企业长效
+// refreshToken 写进那个目录，而 .gitignore 只管自己所在的仓库 → 凭据落到不受保护的目录
+// （本机实测：两个真实账号因此分居 `~/.config/mslxdff/auths` 与 `项目根/auths` 两处）。已修。
+// 纯策略：写入目录的唯一目标（explicit > 测试隔离 > 「跟账本走」＝ state 文件同目录/auths）。
+// 抽成纯函数是为了可测 —— `node --test` 下 isTestEnv() 恒真，环境态没法在测试里翻面。
+export function authDirFor({ explicit = "", testEnv = false, stateFile } = {}) {
+  if (explicit) return explicit;
+  if (testEnv) return join(tmpdir(), "mslxdff-test-auths");
+  return join(dirname(stateFile), "auths");
+}
 
 export function resolveAuthDir() {
-  if (process.env.WORKBUDDY_AUTH_DIR) return process.env.WORKBUDDY_AUTH_DIR;
-  const sf = process.env.MSLXDFF_STATE_FILE || "";
-  if (sf.includes("mslxdff-test") || isTestEnv()) return join(tmpdir(), "mslxdff-test-auths");
-  if (sf && sf.includes("mslxdff-")) return join(dirname(sf), "auths");
-  return join(process.cwd(), "auths");
+  return authDirFor({
+    explicit: process.env.WORKBUDDY_AUTH_DIR || "",
+    testEnv: isTestEnv(),
+    stateFile: defaultStateFile(),
+  });
+}
+
+// 纯策略：算出读取候选目录（主位置优先，历史 cwd/auths 只读兜底，相同则去重）。
+// 抽成纯函数是为了可测 —— `node --test` 下 isTestEnv() 恒真，环境态没法在测试里翻面。
+export function authDirCandidates({ primary, explicit = "", testEnv = false, cwdDir = "" } = {}) {
+  const dirs = [primary];
+  if (!explicit && !testEnv && cwdDir && cwdDir !== primary) dirs.push(cwdDir);
+  return dirs;
+}
+
+// 读取候选（迁移期兼容）：主位置优先，历史 `cwd()/auths` 只读兜底。
+// 显式 WORKBUDDY_AUTH_DIR 或测试环境不兜底：既避免测试扫到真实目录，也避免重新引入 cwd 依赖。
+export function resolveAuthDirs() {
+  return authDirCandidates({
+    primary: resolveAuthDir(),
+    explicit: process.env.WORKBUDDY_AUTH_DIR || "",
+    testEnv: isTestEnv(),
+    cwdDir: join(process.cwd(), "auths"),
+  });
+}
+
+// 按 uid 定位账号文件（主位置优先，旧位置兜底）；找不到返回 null。
+export function findAccountFile(uid) {
+  for (const dir of resolveAuthDirs()) {
+    const fp = join(dir, `workbuddy-${uid}.json`);
+    if (existsSync(fp)) return fp;
+  }
+  return null;
+}
+
+// 扫描账号文件（主位置先扫，同 uid 以主位置为准），返回已校验的凭证行。
+// 读取侧单一真相：provider 构造、CLI 账号加载、token-auto 都走这里，别再各自 readdir 一套。
+export function listAccountDocs({ dirs } = {}) {
+  const out = [];
+  const seen = new Set();
+  for (const dir of dirs || resolveAuthDirs()) {
+    let files = [];
+    try {
+      if (!existsSync(dir)) continue;
+      files = readdirSync(dir).filter((f) => f.startsWith("workbuddy-") && f.endsWith(".json"));
+    } catch { continue; }
+    for (const f of files) {
+      try {
+        const doc = JSON.parse(readFileSync(join(dir, f), "utf8"));
+        const uid = doc?.account?.uid;
+        if (!uid || !doc?.auth?.accessToken) continue;
+        if (seen.has(String(uid))) continue;
+        seen.add(String(uid));
+        out.push({ uid: String(uid), file: join(dir, f), dir, doc });
+      } catch {}
+    }
+  }
+  return out;
 }
 
 function jwtExp(token) {

package/src/providers/workbuddy/chat.js

@@ -102,7 +102,7 @@ export function createChatService({
 
   // SDK 通道（缺省启用）：缺省底层走 @ai-sdk/openai-compatible，`legacy`/关闭词
   // （局部 MSLXDFF_WORKBUDDY_SDK，未设则继承全局 MSLXDFF_UPSTREAM_ENGINE）回退原生 transport；
-  // 不可用（Node16/未安装）自动回退并告警一次。上层轮换/刷新/reshape 全链复用。
+  // 不可用（未安装）自动回退并告警一次。上层轮换/刷新/reshape 全链复用。
   // Note: 为什么默认 SDK、翻译层代价与回退语义 — 见 .agents/notes/implemented/feature/2026-09-12-workbuddy-sdk-channel.md
   // 上游非标字段（thinking / reasoning_effort / reasoning_content / tool_choice 字符串）不依赖 SDK 白名单：
   // payload.js 前置语义改写 + AI SDK providerOptions 透传（非白名单 key 原样 spread 进 body，2.0.41 实测）。

package/src/providers/workbuddy/index.js

@@ -1,11 +1,9 @@
 import { createKeyRing } from "../keyring.js";
 import { loadProviderKeys, loadProviderAuths, loadProviderBaseUrl, WORKBUDDY_DEFAULT_BASE_URL, loadProviderModelsPath, loadProviderChatPath } from "../../state.js";
-import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { compatFetch } from "../../compat.js";
-import { join } from "node:path";
 import { envInt, joinUrl, getUndici, createAgent } from "../base.js";
 import { createAuthService, isAuthError, isInsufficientStatus, decodeJwtExp } from "./auth.js";
-import { applyTokenRefresh, resolveAuthDir } from "./account-store.js";
+import { applyTokenRefresh, listAccountDocs } from "./account-store.js";
 import { createChatService } from "./chat.js";
 import { createModelsService } from "./models.js";
 import { createBalanceCache, getCachedBalance as defaultGetCached, setCachedBalance as defaultSetCached } from "./balance.js";
@@ -61,24 +59,16 @@ export function createWorkbuddyProvider({
   let authList = Array.isArray(auths) && auths.length ? auths : authsFromState;
 
   if (!authList.length && !keys.length) {
+    // 账号目录读取统一走 listAccountDocs：主位置（跟 state 走）优先，旧 cwd/auths 只读兜底
     try {
-      const authDir = resolveAuthDir();
-      if (existsSync(authDir)) {
-        const files = readdirSync(authDir).filter((f) => f.startsWith("workbuddy-") && f.endsWith(".json"));
-        for (const f of files) {
-          try {
-            const j = JSON.parse(readFileSync(join(authDir, f), "utf8"));
-            if (j?.auth?.accessToken && j?.account?.uid) {
-              if (!keys.includes(j.auth.accessToken)) keys.push(j.auth.accessToken);
-              authList.push({
-                uid: j.account.uid,
-                domain: j.auth.domain || "www.codebuddy.cn",
-                enterpriseId: j.account.enterpriseId || "",
-                refreshToken: j.auth.refreshToken || "",
-              });
-            }
-          } catch {}
-        }
+      for (const { uid, doc } of listAccountDocs()) {
+        if (!keys.includes(doc.auth.accessToken)) keys.push(doc.auth.accessToken);
+        authList.push({
+          uid,
+          domain: doc.auth.domain || "www.codebuddy.cn",
+          enterpriseId: doc.account.enterpriseId || "",
+          refreshToken: doc.auth.refreshToken || "",
+        });
       }
     } catch {}
   }

package/src/readline-compat.js

@@ -1,8 +1,9 @@
-// readline 兼容层：`node:readline/promises` 需要 Node 17+，老 Node（如 VPS 的 16）
-// 会 `ERR_UNKNOWN_BUILTIN_MODULE` 直接崩在 import 期，连人话报错都来不及打。
-// 这里只用回调版 `node:readline`（Node 12+ 全有），把 `question` 包成 Promise；
-// `prompt()/close()/for await` 回调版原生即有，对我们用到的部分行为一致。
+// readline 统一走回调版 `node:readline`（question 包成 Promise），
+// 顺带给 -chat 一个人话版本门（项目要求 Node >=18，ADR-0024）。
+// 保留理由：回调版在 18+ 行为一致且无 import 期风险（`node:readline/promises`
+// 若被误用于旧运行时会直接 ERR_UNKNOWN_BUILTIN_MODULE，连报错都来不及打）。
 import readline from "node:readline";
+import { MIN_NODE_MAJOR, nodeMajor } from "./compat.js";
 
 export function createInterface(opts) {
   const rl = readline.createInterface(opts);
@@ -11,13 +12,11 @@ export function createInterface(opts) {
   return rl;
 }
 
-export function nodeMajor() {
-  return Number(String(process.versions?.node || "0").split(".")[0]) || 0;
-}
+export { nodeMajor };
 
-// -chat 依赖 fetch（<18 由 src/compat.js 用 undici polyfill），低于 engines 下限
-// 直接给一句人话。返回 true=通过，false=已打印升级指引。
-export function assertChatNode({ min = 16 } = {}) {
+// -chat 版本门：项目要求 Node >=18（ADR-0024），不满足直接给人话 + 升级指引。
+// 返回 true=通过，false=已打印升级指引。
+export function assertChatNode({ min = MIN_NODE_MAJOR } = {}) {
   const major = nodeMajor();
   if (major >= min) return true;
   console.error(`Node 版本过旧（当前 v${process.versions.node}），-chat 需要 Node ${min}+（推荐 20+）。`);

package/src/routes/models-route.js

@@ -1,6 +1,7 @@
 import { json, errMsg } from "./helpers.js";
 import { runHook } from "../plugins.js";
 import { isModelAllowed } from "../state.js";
+import { mergeModelsList } from "../model-capabilities/merge.js";
 import { globalCapabilities } from "../model-capabilities/index.js";
 
 // Codex 自定义 provider 拉目录要顶层 `models` 数组（codex-rs endpoint/models.rs 解 ModelsResponse{models}），
@@ -14,12 +15,21 @@ export function isCodexModelsCaller(req) {
   return /(^|&)client_version=/.test(q);
 }
 
-export async function modelsHandler({ req, res, models, plugins }) {
+export async function modelsHandler({ req, res, models, plugins, capabilities, wbSource }) {
   if (!models) return json(res, 501, { error: "Models service not configured" });
   const codex = isCodexModelsCaller(req);
   const withCodex = (out) => (codex && out && typeof out === "object" ? { ...out, models: [] } : out);
   try {
     let data = await models.get();
+    // ADR-0022：默认把能力富化进每条条目（capabilities 子对象）；?raw=1 逃生门回原始形状，
+    // codex 调用者保持原始 + 顶层空 models:[]（富化白做）。best-effort，失败原样返回。
+    const qs = String(req?.url || "").split("?")[1] || "";
+    const rawMode = /(^|&)raw=1(&|$)/.test(qs);
+    if (!codex && !rawMode) {
+      try {
+        data = await mergeModelsList(data, { capsSvc: capabilities, wbSource });
+      } catch { /* 富化失败不阻塞 /models */ }
+    }
     // 插件 hook：models:list — 返回数组可替换对外模型列表（{object:"list",data:[...]} 或纯 id 数组）
     if (plugins?.length) {
       const ml = await runHook(plugins, "models:list", { data });

package/src/runtime/providers-setup.js

@@ -19,6 +19,15 @@ import { errMsg } from "../cli/util.js";
  * 无参（读 env/state 自身），返回 ctx 由门面接力 server-lifecycle。
  */
 export async function setupProviders() {
+  // 供应商 id 统一（旧 cline id → cline）：必须在实例化任何 provider 之前跑；幂等，失败不阻断启动
+  try {
+    const { runStateMigrations } = await import("../state/migrations.js");
+    const mig = await runStateMigrations({ file: defaultStateFile() });
+    if (mig.applied.length) console.log(`state migrations applied: ${mig.applied.join(", ")}`);
+    for (const e of mig.errors) console.log(`state migration failed: ${e.id} — ${e.error}`);
+  } catch (err) {
+    console.log(`state migrations failed: ${errMsg(err)}`);
+  }
   const { token, created } = await loadToken();
   const pkgRoot2 = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
   const pluginDirs = resolvePluginDirs({ pkgRoot: pkgRoot2 });

package/src/runtime/server-lifecycle.js

@@ -123,10 +123,10 @@ export async function startServerLifecycle({ VERSION, token, created, upstream,
       else if (r.ok) console.log(`[preheat] opencode models ok ${r.status} ${r.ms}ms`);
       else console.log(`[preheat] opencode models failed ${r.error || r.status || ""} ${r.ms || 0}ms`);
     }).catch(() => {});
-    // clinebot free 目录自检（独立于 opencode 连接预热：dispatcher.preheat 只做默认供应商）
+    // cline free 目录自检（独立于 opencode 连接预热：dispatcher.preheat 只做默认供应商）
     // 见 .agents/notes/implemented/simplification/2026-09-16-preheat-opencode-only.md
     try {
-      const cline = upstream?.byId?.get?.("clinebot") ?? upstream?.byId?.get?.("cline");
+      const cline = upstream?.byId?.get?.("cline");
       if (cline?.checkFreeUpdates) void cline.checkFreeUpdates().catch(() => {});
     } catch {}
   }, 100).unref?.();

package/src/state/migrations/cline-unify.js

@@ -0,0 +1,94 @@
+/**
+ * 幂等状态迁移：把遗留 id 的 cline 配置合并进 `cline` 并删除旧键（供应商 id 统一）。
+ * 见 .scratch/cline-unify/SPEC.md §4.5；语义：keys 去重 + 剔除 sk_ 旧式 key、allowlist 求并、baseUrl 收敛为根。
+ * 绝不触碰 modelPicks / modelErrors / modelLatencies（旧 clinebot/* 键交给既有 prune --orphans）。
+ */
+import { chmodSync, copyFileSync, existsSync } from "node:fs";
+import { defaultStateFile, readState, writeStateImmediate } from "../store.js";
+import { normalizeAllowedModel, normalizeEndpointPath } from "../provider-config.js";
+import { appendEvent } from "../../logs.js";
+
+export const CLINE_DEFAULT_BASE_URL = "https://api.cline.bot";
+export const LEGACY_CLINE_IDS = ["clinebot", "cline-bot"];
+
+/**
+ * cline 的 chat URL = `baseUrl` + `loadProviderChatPath()`；而 loadProviderChatPath 缺省**恒**返回
+ * `/chat/completions`（src/providers/cline/index.js 里那个按 `/api/v1` 智能兜底的 defaultChat 是死代码，
+ * 永远轮不到它生效）。所以 baseUrl 必须自带 `/api/v1`，否则会拼成 `https://api.cline.bot/chat/completions`
+ * → 上游 404（2026-09-20 端到端实测）。只对 cline 官方域补全，自定义/代理 baseUrl 不做猜测。
+ */
+export function normalizeClineBaseUrl(u) {
+  const s = String(u || "").trim().replace(/\/+$/, "");
+  if (!s) return `${CLINE_DEFAULT_BASE_URL}/api/v1`;
+  if (/\/api\/v1$/i.test(s)) return s;
+  if (/^https?:\/\/api\.cline\.bot$/i.test(s)) return `${s}/api/v1`;
+  return s;
+}
+
+function uniq(list) { return [...new Set(list)]; }
+function strList(v) { return Array.isArray(v) ? v.map((x) => String(x || "").trim()).filter(Boolean) : []; }
+// sk_ 旧式 API key（D3：cline 只认 refreshToken，数据层剔除）
+function isLegacySkKey(k) { return /^sk[-_]/i.test(k); }
+
+/** 合并后的 cline 配置：只重建 cline 自己的字段，不吸收旧 id 的 allowAnyModels（避免意外放宽安全默认） */
+function mergeConfig(cl, bot) {
+  const next = {
+    baseUrl: normalizeClineBaseUrl(cl.baseUrl || bot.baseUrl),
+    keys: uniq([...strList(cl.keys), ...strList(bot.keys)]).filter((k) => !isLegacySkKey(k)),
+    allowedModels: uniq([...strList(cl.allowedModels), ...strList(bot.allowedModels)]
+      .map((m) => normalizeAllowedModel(m, "cline")).filter(Boolean)),
+  };
+  if (Array.isArray(cl.auths) && cl.auths.length) next.auths = cl.auths;
+  if (typeof cl.allowAnyModels === "boolean") next.allowAnyModels = cl.allowAnyModels;
+  const modelsPath = normalizeEndpointPath(cl.modelsPath || bot.modelsPath || "");
+  if (modelsPath) next.modelsPath = modelsPath;
+  const chatPath = normalizeEndpointPath(cl.chatPath || bot.chatPath || "");
+  if (chatPath) next.chatPath = chatPath;
+  return next;
+}
+
+/** 备份到同目录 state.json.bak-<ISO时间戳>，权限收紧 0600（含凭据，绝不外泄） */
+function backupState(file, now = new Date()) {
+  const stamp = now.toISOString().replace(/[:.]/g, "-");
+  const target = `${file}.bak-${stamp}`;
+  copyFileSync(file, target);
+  try { chmodSync(target, 0o600); } catch {}
+  return target;
+}
+
+/**
+ * @param {{file?:string, dryRun?:boolean, backup?:boolean}} opts
+ * @returns {{applied:boolean, changed:boolean, reason?:string, before?:object, after?:object, backup?:string}}
+ *   `applied` 仅在真正落盘时为 true；before/after 只含计数，绝不含凭据明文。
+ */
+export function clineUnifyMigration({ file = defaultStateFile(), dryRun = false, backup = true } = {}) {
+  const configs = readState(file).providerConfigs || {};
+  const legacyId = LEGACY_CLINE_IDS.find((pid) => configs[pid] && typeof configs[pid] === "object");
+  if (!legacyId) return { applied: false, changed: false, reason: "no legacy cline id" };
+  const bot = configs[legacyId];
+  const cl = configs.cline && typeof configs.cline === "object" ? configs.cline : {};
+  const next = mergeConfig(cl, bot);
+  const before = {
+    keys: strList(cl.keys).length + strList(bot.keys).length,
+    allowedModels: uniq([...strList(cl.allowedModels), ...strList(bot.allowedModels)]).length,
+  };
+  const after = { keys: next.keys.length, allowedModels: next.allowedModels.length };
+  if (dryRun) return { applied: false, changed: true, reason: "dry-run", before, after };
+  let backupPath = null;
+  if (backup) {
+    try { if (existsSync(file)) backupPath = backupState(file); } catch {}
+  }
+  const merged = { ...configs, cline: next };
+  for (const pid of LEGACY_CLINE_IDS) delete merged[pid];
+  writeStateImmediate(file, { providerConfigs: merged });
+  try {
+    appendEvent({
+      type: "cline-unify-migrated",
+      from: legacyId,
+      keys: after.keys,
+      allowedModels: after.allowedModels,
+      backup: backupPath ? backupPath.replace(/\\/g, "/").split("/").pop() : null,
+    });
+  } catch {}
+  return { applied: true, changed: true, reason: `merged ${legacyId}`, before, after, ...(backupPath ? { backup: backupPath } : {}) };
+}

package/src/state/migrations.js

@@ -0,0 +1,33 @@
+/**
+ * 状态迁移运行器：按注册顺序执行（每个迁移自身幂等），供 daemon bootstrap
+ * （src/runtime/providers-setup.js，实例化任何 provider 之前）与 CLI 单点调用。
+ * 失败只收集不抛出：迁移不该拖垮 daemon 启动。
+ */
+import { defaultStateFile } from "./store.js";
+import { clineUnifyMigration } from "./migrations/cline-unify.js";
+
+export const STATE_MIGRATIONS = [
+  { id: "cline-unify", run: (opts) => clineUnifyMigration(opts) },
+];
+
+/**
+ * @param {{file?:string, dryRun?:boolean, backup?:boolean}} opts
+ * @returns {Promise<{applied:string[], skipped:string[], errors:object[], details:object}>}
+ */
+export async function runStateMigrations({ file = defaultStateFile(), dryRun = false, backup = true } = {}) {
+  const applied = [];
+  const skipped = [];
+  const errors = [];
+  const details = {};
+  for (const m of STATE_MIGRATIONS) {
+    try {
+      const r = await m.run({ file, dryRun, backup });
+      details[m.id] = r;
+      if (r?.applied) applied.push(m.id);
+      else skipped.push(m.id);
+    } catch (err) {
+      errors.push({ id: m.id, error: String(err?.message || err) });
+    }
+  }
+  return { applied, skipped, errors, details };
+}

package/src/state/schemas/token.js

@@ -1,13 +1,17 @@
-import { mkdirSync, readFileSync, writeFileSync, existsSync, statSync } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync, existsSync, statSync, chmodSync } from "node:fs";
 import { dirname } from "node:path";
 import { defaultStateFile, tokenFile, generateToken, readState, writeStateImmediate, getEntry } from "../store.js";
 import { fmtShanghaiYMDHMS } from "../../time.js";
 
+// 主 Bearer token 镜像落盘：0600 + 显式 chmod。
+// 注意 writeFileSync 的 mode 只在“新建文件”时生效，已存在的文件权限不会被它改；
+// 升级前生成的老文件会永远停在 0644（同机其他用户可读），所以必须再 chmod 一次兜住。
 function syncTokenFile(token, file) {
   try {
     const tf = tokenFile(file);
     mkdirSync(dirname(tf), { recursive: true });
-    writeFileSync(tf, String(token || "").trim() + "\n", "utf8");
+    writeFileSync(tf, String(token || "").trim() + "\n", { encoding: "utf8", mode: 0o600 });
+    try { chmodSync(tf, 0o600); } catch {}
   } catch {}
 }
 

package/src/state/schemas/use-group.js

@@ -1,5 +1,6 @@
 import { defaultStateFile, readState, writeStateImmediate } from "../store.js";
 import { classifyProvider } from "../../providers/classify.js";
+import { getModelAlias, normalizeProviderId, DEFAULT_PROVIDER } from "../../providers/model-id.js";
 
 function parseBool(v) {
   if (typeof v === "boolean") return v;
@@ -36,23 +37,63 @@ export function getEffectiveUseGroup({ file = defaultStateFile() } = {}) {
   return loadUseGroup({ file });
 }
 
+// key 供应商组员开关：默认 off（仅 opencode 免费池走 peer 兜底，其他带 key 上游恒直连）。
+// MSLXDFF_USE_GROUP_KEYS=1/on 可显式开回来（调试/弱网应急）；同样受全局 off 约束。
+export function getUseGroupKeysEnv() {
+  const raw = process.env.MSLXDFF_USE_GROUP_KEYS;
+  if (raw === undefined || raw === null || raw === "") return false;
+  return parseBool(raw) === true;
+}
+
+// 取模型对应的供应商 head：兼容 canonical（workbuddy/xxx、cline/xxx）、
+// dash 别名（cline-xxx → 还原后取 head）、裸 id（归 opencode）。
+// oc/ 别名归一到 opencode（与 splitModelId 一致：别名表小写 key，先小写再归一）。
+export function providerHeadOf(model) {
+  let s = String(model || "").trim();
+  if (!s) return "";
+  try {
+    const aliased = getModelAlias(s);
+    if (aliased) s = aliased;
+  } catch {}
+  const slash = s.indexOf("/");
+  if (slash > 0) {
+    try {
+      const head = normalizeProviderId(s.slice(0, slash).toLowerCase());
+      return String(head || "").toLowerCase();
+    } catch {
+      return s.slice(0, slash).toLowerCase();
+    }
+  }
+  return DEFAULT_PROVIDER;
+}
+
 // 全局开关：off 则所有供应商都不走组员网络（via-route/hedge/peer/broadband 全禁），仅本机直连
-// workbuddy 硬禁组员（ADR-0015 local-only）：本机账号绑定（auths/workbuddy-*.json + uid），
+// workbuddy/cline 系硬禁组员（ADR-0015 local-only）：本机账号绑定（workbuddy auths/*.json + uid / cline refreshToken），
 // 组员没有该账号转过去也用不了，且本地直连最快——无论全局开关一律仅本机直连。
-// model 兼容 canonical（workbuddy/xxx）与 dash（workbuddy-xxx）两种形态。
+// model 兼容 canonical（workbuddy/xxx、cline/xxx）与 dash（workbuddy-xxx、cline-xxx）两种形态。
 export function isHardLocalOnly(model) {
-  const s = String(model || "").trim().toLowerCase();
-  const slash = s.indexOf("/");
-  const head = slash > 0 ? s.slice(0, slash) : s.split("-")[0];
+  const head = providerHeadOf(model);
+  if (!head) return false;
   try {
     return classifyProvider(head) === "local-only";
   } catch {
-    return head === "workbuddy";
+    return head === "workbuddy" || head === "cline";
   }
 }
 
+// key 供应商默认直连（ADR-0023）：opencode（quota-pool，裸 id/oc 前缀）沿用全局开关；
+// 其余带前缀的一律仅本机直连，除非 MSLXDFF_USE_GROUP_KEYS=1 显式开回。
+export function isKeyProviderDirectOnly(model) {
+  const head = providerHeadOf(model);
+  if (!head || head === "opencode") return false;
+  if (isHardLocalOnly(model)) return true;
+  if (getUseGroupKeysEnv()) return false;
+  return true;
+}
+
 export function shouldUseGroupForModel(model, { file = defaultStateFile() } = {}) {
   if (isHardLocalOnly(model)) return false;
+  if (isKeyProviderDirectOnly(model)) return false;
   return getEffectiveUseGroup({ file });
 }
 

package/src/sync-workbuddy.js

@@ -119,7 +119,7 @@ export async function syncToWorkbuddy({ id, token, port, file, keep } = {}) {
     if (arr[idx].useCustomProtocol === undefined) arr[idx].useCustomProtocol = false;
     action = "updated";
   } else {
-    // 检查归一化 id 是否与已有条目冲突（如已存在 clinebot-z-ai-glm-5.3-flash 但不是本地 URL）
+    // 检查归一化 id 是否与已有条目冲突（如已存在 cline-z-ai-glm-5.3-flash 但不是本地 URL）
     const conflict = arr.findIndex((m) => m && m.id === wbId);
     if (conflict >= 0) {
       // 已有同名条目且非我们写的，跳过不覆盖

package/src/upstream-engine/index.js

@@ -1,4 +1,4 @@
-// 上游引擎选择（ADR-0017）：sdk=AI SDK wire 层（缺省），legacy=原实现（显式/Node16 回退）。
+// 上游引擎选择（ADR-0017）：sdk=AI SDK wire 层（缺省），legacy=原实现（显式指定或 SDK 装载失败回退）。
 // Note: 缺省即 sdk；chat 类走 /chat/completions（@ai-sdk/openai-compatible），
 // responses 类（muse-spark*）走 /responses（@ai-sdk/openai）；非流式与 anon 重试委派 legacy，
 // SDK 不可用自动回退并告警一次 — 见 .scratch/ai-sdk-upstream/{SPEC.md,SPEC-p4-turnon.md,SPEC-p3-responses.md} 与 docs/adr/0017

package/src/upstream-probe/rotate.js

@@ -7,7 +7,7 @@ import { errMsg } from "../cli/util.js";
 
 export const PROBE_DELAY_MS = Number(process.env.MSLXDFF_BENCH_DELAY_MS || 120) || 0;
 
-// 从 providerConfigs 收集探针目标：local-only(workbuddy)/quota-pool(opencode) 排除，无 baseUrl 跳过
+// 从 providerConfigs 收集探针目标：local-only(workbuddy/cline系)/quota-pool(opencode) 排除，无 baseUrl 跳过
 export function probeTargetsFromState({ loadProviderConfigs, loadProviderKeys, loadProviderBaseUrl } = {}) {
   const out = [];
   const ids = new Set(Object.keys(loadProviderConfigs?.() || {}));