pi-ccswitch-auto-switch 0.3.10 → 0.3.12

package/README.md

@@ -13,7 +13,7 @@ The extension observes real Pi requests, records sanitized health signals, and
 - Endpoint circuit breakers for DNS, connection, server, and streaming failures.
 - Endpoint platform isolation: when several models on the same endpoint (same BaseURL/provider) fail within one round, the whole endpoint is isolated so sibling models from the same platform are not tried one by one.
 - Model-only isolation for missing models and incompatible parameters.
-- Learns model-family content-policy constraints from real failures (`glm-4.5` and `GLM-4.6`, for example, are both `glm`) and avoids the entire family during the current content-policy failover chain. Evidence is session-scoped: it is cleared at `session_start`, because a new session may handle tasks that are not content-sensitive, so the family becomes eligible again until this session observes its own content-policy rejection.
+- Learns model-family content-policy constraints from real failures (`glm-4.5` and `GLM-4.6`, for example, are both `glm`) and avoids the entire family during the current content-policy failover chain. Evidence lives only in the owning extension instance, is never written to shared health state, and is cleared at that instance’s `session_start`, because a new session may handle tasks that are not content-sensitive, so the family becomes eligible again until this session observes its own content-policy rejection.
 - Applies hard health, failure-domain, policy-family, input-modality, and context filters before ranking candidates by provider diversity, model equivalence, capability compatibility, and historical reliability.
   - Independent-provider semantics: a copied vendor (e.g. `my-provider-copy`) shares the BaseURL but is a distinct provider with its own endpoint key, so isolating one never blocks the other.
 - 90-second first-response and 120-second streaming-idle watchdogs.
@@ -39,6 +39,7 @@ All knobs below are optional and have sensible defaults:
 | --- | --- | --- | --- |
 | `PI_CODING_AGENT_DIR` | Extension state | `~/.pi/agent` | Where health state, logs, and failure reports are stored. Only relevant if you relocated your Pi agent directory; the extension follows Pi's own convention. |
 | `PI_BIN` | Headless runner only | `pi` on `PATH` | Must point to the real `pi` executable. Legacy self-references to `pi-ccswitch-run` or `ccswitch-run` are ignored with a warning and fall back to `pi`; other invalid commands remain configuration errors. |
+| `CCSWITCH_ROUND_LIMIT_MS` | Failover | `480000` (8 minutes) | Time limit for one failover round, in milliseconds. The window restarts on each successful switch; when exceeded, switching stops and the report lists every tried model with its last error. |
 | Model scope (`/model` etc.) | Failover candidates | Full registry | When Pi has an active model scope, failover only considers models inside that scope; otherwise the full registry is used. The status bar shows which source is active. |
 | `baseUrl` metadata | Endpoint isolation | provider key | Endpoint-level platform isolation groups models by `baseUrl` (provided by CC Switch `3.20+`). Without it, isolation degrades to provider-level grouping, which still works. |
 
@@ -159,6 +160,7 @@ CCSwitch therefore prechecks **before the request is sent**, instead of waiting
 
 - When user input carries images (`input` event with `images`), CCSwitch immediately switches to a healthy multimodal candidate (`input` explicitly includes `image`) before the request is processed, so the images are preserved;
 - When a tool execution returns images (e.g. the `read` tool loading an image file, whose result content includes `image` parts), CCSwitch also switches to a multimodal model before the next LLM call, so the tool-result images are not stripped;
+- Image requirements remain active for the entire failover round, including images returned by tools during retry verification and later fallback attempts;
 - Only models that **explicitly** support images (`input` includes `image`) are considered; models with missing metadata are never assumed to support images;
 - The switch reason is recorded as `modality` and counted in both the session and lifetime switch counters;
 - If no multimodal candidate is available, CCSwitch notifies the user and keeps the current model (Pi will still strip the image and add its notice).
@@ -167,7 +169,9 @@ The modality precheck applies only in interactive TUI/RPC sessions (the same sco
 
 ## Data and privacy
 
-Health state is stored in Pi's agent directory as `ccswitch-auto-switch-state.json`. The extension stores counters, timestamps, cooldowns, learned model-family policy constraints, and redacted/truncated error summaries. It does not access credentials, authorization headers, CC Switch's database, or Pi's `auth.json`.
+Health state is stored in Pi's agent directory as `ccswitch-auto-switch-state.json`. The extension stores counters, timestamps, cooldowns, and redacted/truncated error summaries. Model-family policy constraints stay in session memory. It does not access credentials, authorization headers, CC Switch's database, or Pi's `auth.json`.
+
+State schema 3 loads schema 2 health records and preserves their existing totals as a shared baseline. Per-writer counters merge independent increments without counting repeated merges twice. Older releases cannot read schema 3 and cannot be made safe by code in a newer process. **Do not run schema-2 and schema-3 releases together against the same directory.** Before upgrading: (1) stop every old Pi process and scheduled runner using the same `PI_CODING_AGENT_DIR`; (2) back up `ccswitch-auto-switch-state.json` while they are stopped; (3) upgrade every installation that uses that directory; (4) restart only the upgraded processes. A running current-version store refuses writes when it encounters an unsupported schema or observes a downgrade from 3 to 2, preserves the file, and logs the reason in `ccswitch-auto-switch.log`. This cannot undo damage already caused by old code; the stop/upgrade/restart sequence is required. Manual enable/disable operations use monotonic local timestamps; merge picks the newer operation, with disable winning an exact timestamp tie (including conflicting legacy values without timestamps). Reset barriers prevent stale snapshots from restoring cleared records. Counter metadata grows with the number of writer instances that record failures or switches.
 
 ## Development
 
@@ -177,7 +181,7 @@ npm run typecheck
 npm test
 ```
 
-Tests use Node's built-in test runner and cover the failure matrix, family-level policy avoidance, provider-first selection, input compatibility, cooldowns, state persistence, and Windows-compatible paths.
+TypeScript is an explicit development dependency. `npm test` enables Node’s native TypeScript stripping and runs all `health`, `integration`, `logic`, and `runner` suites on Node 22.19+. Tests use Node's built-in test runner and cover the failure matrix, family-level policy avoidance, provider-first selection, input compatibility, cooldowns, state persistence, and Windows-compatible paths.
 
 ## License
 

package/README.zh-CN.md

@@ -12,7 +12,7 @@
 - 对认证、额度、账单和限流实施 Provider 优先熔断。
 - 对 DNS、连接、服务端和流中断实施端点熔断。
 - 模型不存在或参数不兼容时仅隔离该模型。
-- 内容审查失败会学习模型系列约束（例如 `glm-4.5`、`GLM-4.6` 同属 `glm`），在本轮内容审查故障转移中避开整个受限系列。该约束按 session 隔离：`session_start` 时清除，因为新 session 处理的任务不一定涉及审查内容，模型系列恢复可用，直到本 session 再次观察到内容审查拒绝。
+- 内容审查失败会学习模型系列约束（例如 `glm-4.5`、`GLM-4.6` 同属 `glm`），在本轮内容审查故障转移中避开整个受限系列。该约束仅保存在当前扩展实例的内存中，不写入共享健康状态；当前实例的 `session_start` 只清除自身约束，因为新 session 处理的任务不一定涉及审查内容，模型系列恢复可用，直到本 session 再次观察到内容审查拒绝。
 - 候选模型先经过健康、故障域、审查系列、输入模态和上下文窗口硬过滤，再按跨 Provider、模型等价性、能力兼容和历史稳定性排序。
 - 首响应 90 秒、流式停滞 120 秒看门狗。
 - 指数退避、`Retry-After` 支持和跨进程 half-open 单探针租约。
@@ -37,6 +37,7 @@
 | --- | --- | --- | --- |
 | `PI_CODING_AGENT_DIR` | 扩展状态 | `~/.pi/agent` | 健康状态、日志与失败报告的存放目录；仅在你迁移了 Pi agent 目录时需要，插件跟随 Pi 自身约定。 |
 | `PI_BIN` | 仅 headless runner | `PATH` 中的 `pi` | 必须指向真实 `pi` 可执行文件。历史自引用值 `pi-ccswitch-run` 或 `ccswitch-run` 会警告并降级到 `pi`；其他非法命令仍按配置错误处理。 |
+| `CCSWITCH_ROUND_LIMIT_MS` | 故障转移 | `480000`（8 分钟） | 本轮故障转移的时间限制（毫秒）。窗口从本轮开始或最后一次成功切换起算；超过后停止切换并报告已试模型及最后错误。 |
 | 模型 scope（`/model` 等） | 故障转移候选 | 全量注册表 | Pi 启用了 model scope 时，只在 scope 内模型间切换；否则使用全量注册表。状态栏会显示当前数据源。 |
 | `baseUrl` 元数据 | 端点隔离 | provider key | 端点级平台隔离按 `baseUrl` 分组模型（由 CC Switch `3.20+` 提供）；缺失时退化为 provider 级分组，仍然可用。 |
 
@@ -137,7 +138,7 @@ CCS v0.3.5 ✓70/131 · ⏳61 · ⛔0 · 🔄3 · provider/model-id
 | 内容审查/敏感拦截 | 当前模型 + 模型系列约束 | 模型冷却 2 分钟；系列约束按 session 隔离（`session_start` 时清除） |
 | 上下文溢出 | 仅本轮 | 无 |
 
-冷却时间会指数增长但有上限。发生内容审查时，插件只在审查故障转移链中避开已标记系列，普通限流、网络或模型配置故障仍可选择这些模型。上下文溢出时只会选择上下文窗口更大的模型；带图片的请求不会切到明确仅支持文本的模型。无法归类的异常按单模型故障处理并正常切换。用户主动取消是唯一不会触发故障转移的异常终止；看门狗取消会记录为超时。
+冷却时间会指数增长但有上限。发生内容审查时，插件只在审查故障转移链中避开已标记系列，普通限流、网络或模型配置故障仍可选择这些模型。上下文溢出时只会选择上下文窗口更大的模型；带图片的请求只选择显式声明支持 image 的模型。无法归类的异常按单模型故障处理并正常切换。用户主动取消是唯一不会触发故障转移的异常终止；看门狗取消会记录为超时。
 
 ### 模态预检（OCR / 图片请求自动切换多模态模型）
 
@@ -148,6 +149,7 @@ Pi 在把请求发给 Provider 时，会根据当前模型的 `input` 能力静
 - **用户输入带图片时**（`input` 事件含 `images`），如果当前模型不支持图片，立即切换到健康的多模态候选（`input` 明确含 `image`）再处理，图片被保留；
 - **工具执行返回图片时**（如 `read` 工具读取图片文件，工具结果含 `image` content），同样在下一轮 LLM 调用前切到多模态模型，确保图片不被剥除；
 - 候选只选**明确声明**支持图片的模型（`input` 含 `image`）；元数据缺失的模型不冒险选择；
+- 图片能力要求贯穿整个故障转移轮次，包括重试验证阶段工具返回图片以及此后的再次切换；
 - 切换原因记为 `modality`，计入本 session 切换数与累计切换；
 - 如果没有可用的多模态候选，则通知用户并保持原模型继续（Pi 会照常剥图并附带提示）。
 
@@ -155,17 +157,19 @@ Pi 在把请求发给 Provider 时，会根据当前模型的 `input` 能力静
 
 ## 数据与隐私
 
-健康状态保存在 Pi agent 目录的 `ccswitch-auto-switch-state.json`。其中只有计数、时间、冷却信息、模型系列审查约束和脱敏/截断的错误摘要；插件不会访问凭据、Authorization 请求头、CC Switch 数据库或 Pi 的 `auth.json`。
+健康状态保存在 Pi agent 目录的 `ccswitch-auto-switch-state.json`。其中只有计数、时间、冷却信息和脱敏/截断的错误摘要；模型系列审查约束只保存在 session 内存中；插件不会访问凭据、Authorization 请求头、CC Switch 数据库或 Pi 的 `auth.json`。
 
 ## 开发
 
+状态 schema 3 兼容加载 schema 2 的健康记录，将原有累计数保留为共同基线；每个写入实例独立计数，合并时不丢增量、不重复累计。旧版本无法读取 schema 3，新进程中的代码无法修复仍在运行的旧代码。**禁止 schema-2 与 schema-3 版本共用同一目录混跑。**升级时必须依次：① 退出所有使用同一 `PI_CODING_AGENT_DIR` 的旧 Pi 进程并停止相关定时 runner；② 在进程停止后备份 `ccswitch-auto-switch-state.json`；③ 升级使用该目录的所有安装；④ 仅启动升级后的进程。当前版本遇到不支持的 schema，或已观察到 schema 3 后又读到 schema 2 时，会拒绝写入、保留原文件，并在 `ccswitch-auto-switch.log` 记录原因。这不能撤销旧代码已经造成的破坏，因此必须执行上述停机升级步骤。人工启用/禁用按本地单调时间戳选择较新操作；时间戳完全相同时保守保留禁用（旧记录缺字段时也如此）。reset 标记阻止旧快照恢复已清除的记录。计数元数据随实际记录失败或切换的实例数增长。
+
 ```bash
 npm install
 npm run typecheck
 npm test
 ```
 
-测试使用 Node 内置测试运行器，覆盖失败分类矩阵、系列级审查避让、Provider 优先选择、输入兼容、冷却、状态持久化以及 Windows 路径。
+TypeScript 已显式列为开发依赖。`npm test` 开启 Node 原生 TypeScript 类型剥离，在 Node 22.19+ 上运行 `health`、`integration`、`logic`、`runner` 全部测试。测试使用 Node 内置测试运行器，覆盖失败分类矩阵、系列级审查避让、Provider 优先选择、输入兼容、冷却、状态持久化以及 Windows 路径。
 
 ## 许可证
 

package/candidates.ts

@@ -1,5 +1,5 @@
 import type { FailureClass, ModelRef, ScopedModel } from './types.ts'
-import { endpointKey, modelKey, type HealthState } from './health.ts'
+import { endpointKey, modelKey, platformKey, type HealthState } from './health.ts'
 
 export interface CandidateOptions {
   current?: ModelRef
@@ -90,7 +90,9 @@ export function chooseCandidate(models: ModelRef[], options: CandidateOptions):
   const current = options.current
   const candidates = models.filter(model => {
     if (options.tried.has(modelKey(model)) || blocked(model, options.health)) return false
-    if (options.avoidEndpoints?.has(endpointKey(model))) return false
+    // avoidEndpoints 同时支持 endpointKey（含 provider，旧语义）与 platformKey（仅 BaseURL）两种 key：
+    // 本轮隔离按平台（platformKey）归组，同平台的 provider 副本一并跳过
+    if (options.avoidEndpoints?.has(endpointKey(model)) || options.avoidEndpoints?.has(platformKey(model))) return false
     if (options.avoidFamilies?.has(modelFamily(model))) return false
     if (!supportsRequiredInputs(model, options.requiredInputs)) return false
     if (options.failureKind === 'context_overflow' && current && (model.contextWindow ?? 0) <= (current.contextWindow ?? 0)) return false
@@ -129,7 +131,9 @@ export function modelFamily(model: Pick<ModelRef, 'id' | 'name'>): string {
 }
 
 function supportsRequiredInputs(candidate: ModelRef, required: readonly string[] | undefined): boolean {
-  if (!required?.length || !candidate.input?.length) return true
+  if (!required?.length) return true
+  if (required.includes('image') && !candidate.input?.includes('image')) return false
+  if (!candidate.input?.length) return true
   return required.every(input => candidate.input!.includes(input))
 }
 

package/classify.ts

@@ -8,7 +8,9 @@ export interface Classification {
 }
 
 const content = /content[ _-]?(?:filter|policy|blocked|moderation)|sensitive|guardrail|policy[_ -]?violation|responsibleai|safety[_ -]?(?:policy|filter|violation)|security[_ -]?policy|moderation[_ -]?(?:blocked|failed)|blocked by.{0,20}(?:policy|safety|moderation)|data[_ -]?inspection[_ -]?failed|内容(?:审查|审核|安全|违规|被拦截)|安全审核|安全(?:策略|风控).{0,12}(?:阻断|拦截|拒绝)|审核(?:未通过|不通过|失败)|敏感(?:内容|词|信息)?|政治敏感|涉政|不合规|违反.{0,12}(?:安全|政策|规定)/i
-const quota = /quota|billing|insufficient.?balance|out of budget|usage.?limit|credit.?balance|monthly.?limit/i
+// 配额/余额类失败（scope provider）。含中文供应商报错：用户积分不足、余额不足、欠费等，
+// 这些通常不携带英文关键词，漏分类会落入 unknown（仅 2min 模型级冷却），导致死 provider 每轮重试。
+const quota = /quota|billing|insufficient.?balance|out of budget|usage.?limit|credit.?balance|balance.{0,12}(?:exhausted|insufficient|depleted)|credits|monthly.?limit|积分不足|余额不足|欠费|请充值|额度.{0,6}(?:用完|耗尽|不足|已用)|无可用额度/i
 const context = /context.?window|context.?length|too many tokens|prompt is too long|input is too long|token limit/i
 const transport = /dns|enotfound|eai_again|econn(?:reset|refused|aborted)|epipe|socket|connection|network|fetch failed|tls|certificate|timed? ?out|timeout|stream ended|terminated|websocket|und_err/i
 const overloaded = /overload|server busy|service unavailable|temporarily unavailable|capacity|upstream|bad gateway/i
@@ -25,6 +27,7 @@ export function classifyFailure(observation: FailureObservation): Classification
   if (status === 413) return { kind: 'context_overflow', roundOnly: true }
   if (status === 429) return { kind: 'rate_limit', scope: 'provider', roundOnly: false, retryAfterMs: observation.retryAfterMs }
   if (status === 402) return { kind: 'quota', scope: 'provider', roundOnly: false }
+  if (status === 403 && quota.test(text)) return { kind: 'quota', scope: 'provider', roundOnly: false }
   if (status === 401 || status === 403) return { kind: 'auth', scope: 'provider', roundOnly: false }
   if (quota.test(text)) return { kind: 'quota', scope: 'provider', roundOnly: false }
   if (status === 408) return { kind: 'timeout', scope: 'endpoint', roundOnly: false }

package/health.ts

@@ -15,12 +15,15 @@ const MAX_LOG_BYTES = 512 * 1024
 export interface HealthRecord {
   consecutiveFailures: number
   totalFailures: number
+  /** Per-writer grow-only counters; legacy totals form one shared baseline. */
+  failureCounts?: Record<string, number>
   lastFailureAt?: number
   lastSuccessAt?: number
   cooldownUntil?: number
   lastClass?: FailureClass
   lastError?: string
   disabled?: boolean
+  disabledUpdatedAt?: number
   leaseUntil?: number
 }
 
@@ -33,18 +36,22 @@ export interface ContentPolicyConstraint {
 }
 
 export interface HealthState {
-  schemaVersion: 2
+  schemaVersion: 2 | 3
   updatedAt: number
+  /** Reset barriers prevent older snapshots from resurrecting cleared history. */
+  resetAt?: number
+  modelResetAt?: Record<string, number>
   models: Record<string, HealthRecord>
   providers: Record<string, HealthRecord>
   endpoints: Record<string, HealthRecord>
   /**
-   * 已从真实失败中学到的模型系列内容审查约束。它不会影响普通故障选模，只在本轮已经
-   * 发生 content_policy 失败时用于避开同类系列。
+   * Legacy schema-2 field: ignored on load and removed on the next write.
+   * Active policy constraints live only in the owning HealthStore instance.
    */
   contentPolicyFamilies?: Record<string, ContentPolicyConstraint>
   /** 累计成功切换次数（跨 session 持久化，用于衡量扩展有效程度） */
   switches?: number
+  switchCounts?: Record<string, number>
   /** 最近成功切换日志（有限条，环形保留） */
   switchLog?: Array<{
     at: number
@@ -67,6 +74,16 @@ export function endpointKey(model: ModelRef): string {
   return createHash('sha256').update(`${model.provider}\0${source}`).digest('hex').slice(0, 20)
 }
 
+/**
+ * 同平台标识：仅按 BaseURL 归组（不含 provider 名）。b-ai / b-ai-copy / b-ai-copy-copy 这类
+ * 同一上游平台的多个 provider 副本会得到相同 key，用于本轮内同平台隔离。
+ * 注意：与 endpointKey（含 provider，用于跨轮健康台账）刻意不同——不同的 API key
+ * 有独立的配额/限流，跨轮冷却不应互相波及。
+ */
+export function platformKey(model: ModelRef): string {
+  return model.baseUrl ? safeEndpoint(model.baseUrl) : `provider:${model.provider}`
+}
+
 function safeEndpoint(value: string): string {
   try {
     const url = new URL(value)
@@ -77,7 +94,7 @@ function safeEndpoint(value: string): string {
 }
 
 function blank(): HealthState {
-  return { schemaVersion: 2, updatedAt: Date.now(), models: {}, providers: {}, endpoints: {}, contentPolicyFamilies: {}, switches: 0, switchLog: [] }
+  return { schemaVersion: 3, updatedAt: Date.now(), models: {}, providers: {}, endpoints: {}, switches: 0, switchLog: [] }
 }
 
 function redact(text: string | undefined): string | undefined {
@@ -103,30 +120,29 @@ export class HealthStore {
   readonly dir: string
   private state: HealthState = blank()
   private dirty = false
-  private replaceOnFlush = false
-  private resetModels = new Set<string>()
-  /** 合并磁盘状态后仍需强制清空的审查约束（session 边界） */
-  private clearContentPolicyOnFlush = false
+  private readonly writer = randomUUID()
+  private manualClock = 0
+  private writeBlocked = false
+  private observedSchema3 = false
+  private constraints: Record<string, ContentPolicyConstraint> = {}
 
   constructor(dir = agentDir()) { this.dir = dir }
   get file(): string { return join(this.dir, STATE_FILE) }
   get snapshot(): HealthState { return structuredClone(this.state) }
+  get policyConstraints(): Record<string, ContentPolicyConstraint> { return structuredClone(this.constraints) }
 
   async load(): Promise<void> {
     await mkdir(this.dir, { recursive: true })
     try {
-      if (existsSync(this.file)) {
-        const parsed = JSON.parse(await readFile(this.file, 'utf8')) as HealthState
-        if (parsed.schemaVersion !== 2 || !parsed.models || !parsed.providers || !parsed.endpoints) throw new Error('unsupported state schema')
-        this.state = parsed
-      } else {
-        await this.migrateLegacy()
-      }
-    } catch {
-      if (existsSync(this.file)) await rename(this.file, `${this.file}.corrupt-${Date.now()}`).catch(() => {})
-      this.state = blank()
-      this.dirty = true
-      await this.flush()
+      this.state = await this.readDisk()
+      this.writeBlocked = false
+      delete this.state.contentPolicyFamilies
+      if (!existsSync(this.file)) await this.migrateLegacy()
+    } catch (error) {
+      // Unknown/newer formats are not corruption. Keep the original in place
+      // and fail closed until an explicit successful reload repairs the state.
+      this.writeBlocked = true
+      await this.log(`health state load refused: ${String(error)}`)
     }
   }
 
@@ -153,6 +169,7 @@ export class HealthStore {
     const failures = previous.consecutiveFailures + 1
     bucket[key] = {
       ...previous, consecutiveFailures: failures, totalFailures: previous.totalFailures + 1,
+      failureCounts: incrementCounts(previous.failureCounts, previous.totalFailures, this.writer),
       lastFailureAt: Date.now(), cooldownUntil: Date.now() + cooldownMs(kind, failures, retryAfterMs),
       lastClass: kind, lastError: redact(message), leaseUntil: undefined,
     }
@@ -165,7 +182,7 @@ export class HealthStore {
    * 本 session 内再次观察到同系列审查会增加证据计数并刷新时间戳。
    */
   recordContentPolicyConstraint(family: string, model: ModelRef, message?: string): void {
-    const constraints = this.state.contentPolicyFamilies ??= {}
+    const constraints = this.constraints
     const previous = constraints[family]
     const now = Date.now()
     constraints[family] = {
@@ -175,7 +192,6 @@ export class HealthStore {
       lastModel: modelKey(model),
       lastError: redact(message),
     }
-    this.touch()
   }
 
   recordSuccess(model: ModelRef): void {
@@ -190,6 +206,7 @@ export class HealthStore {
    * 用于衡量扩展有效程度，并在 /ccswitch status 面板展示。
    */
   recordSwitch(from: string, to: string, reason?: string): void {
+    this.state.switchCounts = incrementCounts(this.state.switchCounts, this.state.switches ?? 0, this.writer)
     this.state.switches = (this.state.switches ?? 0) + 1
     const log = this.state.switchLog ?? []
     log.push({ at: Date.now(), from, to, reason })
@@ -205,35 +222,53 @@ export class HealthStore {
 
   disable(key: string, disabled: boolean): void {
     const old = this.state.models[key] ?? { consecutiveFailures: 0, totalFailures: 0 }
-    this.state.models[key] = { ...old, disabled }
+    this.state.models[key] = { ...old, disabled, disabledUpdatedAt: this.manualVersion() }
     this.touch()
   }
 
-  reactivate(model: ModelRef): void {
-    const key = modelKey(model)
-    for (const [scope, id] of [['model', key], ['provider', model.provider], ['endpoint', endpointKey(model)]] as const) {
-      const old = this.bucket(scope)[id]
-      if (old) this.bucket(scope)[id] = { ...old, disabled: false, cooldownUntil: undefined, leaseUntil: undefined, lastSuccessAt: Date.now(), consecutiveFailures: 0 }
-    }
-    this.touch()
+  async reactivate(model: ModelRef): Promise<boolean> {
+    return this.reactivateAtomically(model)
   }
 
-  reactivateAll(): void {
-    const now = Date.now()
-    for (const bucket of [this.state.models, this.state.providers, this.state.endpoints]) {
-      for (const [key, old] of Object.entries(bucket)) bucket[key] = { ...old, disabled: false, cooldownUntil: undefined, leaseUntil: undefined, lastSuccessAt: now, consecutiveFailures: 0 }
+  async reactivateAll(): Promise<boolean> {
+    return this.reactivateAtomically()
+  }
+
+  private async reactivateAtomically(model?: ModelRef): Promise<boolean> {
+    try {
+      if (this.writeBlocked) throw new Error('health state writes are blocked; reload a supported state first')
+      return await this.withLock(async () => {
+        this.state = mergeState(await this.readDisk(), this.state)
+        const disabledUpdatedAt = this.manualVersion()
+        const targets: Array<[HealthScope, string]> = model
+          ? [['model', modelKey(model)], ['provider', model.provider], ['endpoint', endpointKey(model)]]
+          : (['model', 'provider', 'endpoint'] as const).flatMap(scope => Object.keys(this.bucket(scope)).map(key => [scope, key] as [HealthScope, string]))
+        for (const [scope, key] of targets) {
+          const old = this.bucket(scope)[key]
+          if (!old) continue
+          this.bucket(scope)[key] = { ...old, disabled: false, disabledUpdatedAt,
+            cooldownUntil: undefined, leaseUntil: undefined, consecutiveFailures: 0,
+            lastSuccessAt: Math.max(Date.now(), (old.lastFailureAt ?? 0) + 1) }
+        }
+        this.touch()
+        await this.commit()
+        return true
+      })
+    } catch (error) {
+      await this.log(`reactivation refused: ${String(error)}`)
+      return false
     }
-    this.touch()
   }
 
   reset(target: string | 'all'): void {
+    const resetAt = this.manualVersion()
     if (target === 'all') {
-      this.state = blank()
-      this.replaceOnFlush = true
-      this.resetModels.clear()
+      this.clearContentPolicyConstraints()
+      this.state = { ...blank(), resetAt }
     } else {
       delete this.state.models[target]
-      this.resetModels.add(target)
+      const resets = this.state.modelResetAt ??= {}
+      resets[target] = resetAt
     }
     this.touch()
   }
@@ -243,40 +278,44 @@ export class HealthStore {
    * 对审查内容敏感，因此不在 session 间继承审查约束。
    */
   clearContentPolicyConstraints(): void {
-    this.state.contentPolicyFamilies = {}
-    this.clearContentPolicyOnFlush = true
-    this.touch()
+    this.constraints = {}
   }
 
   isBlocked(model: ModelRef, now = Date.now()): boolean {
+    if (this.writeBlocked) return true
     return [this.state.models[modelKey(model)], this.state.providers[model.provider], this.state.endpoints[endpointKey(model)]]
       .some(record => Boolean(record?.disabled || (record?.cooldownUntil && record.cooldownUntil > now) || (record?.leaseUntil && record.leaseUntil > now)))
   }
 
-  async claimProvider(model: ModelRef): Promise<boolean> {
-    const key = model.provider
-    let claimed = true
+  async claimCandidate(model: ModelRef): Promise<boolean> {
+    if (this.writeBlocked) return false
+    let claimed = false
     await this.withLock(async () => {
-      if (!this.replaceOnFlush) this.state = mergeState(await this.readDisk(), this.state)
-      const record = this.state.providers[key]
-      if (!record || !(record.cooldownUntil && record.cooldownUntil <= Date.now())) return
-      if (record.leaseUntil && record.leaseUntil > Date.now()) { claimed = false; return }
-      record.leaseUntil = Date.now() + 2 * 60_000
-      this.touch()
-      await this.commit()
-    }).catch(() => { claimed = false })
+      const disk = await this.readDisk()
+      this.state = mergeState(disk, this.state)
+      const records = (state: HealthState) => [state.models[modelKey(model)], state.providers[model.provider], state.endpoints[endpointKey(model)]]
+      const now = Date.now()
+      // Check disk as well: a stale local disabled flag must never override a
+      // disable written by another process before this atomic claim.
+      if ([...records(disk), ...records(this.state)].some(record => record?.disabled || (record?.cooldownUntil ?? 0) > now || (record?.leaseUntil ?? 0) > now)) return
+      const expired = records(this.state).filter(record => record?.cooldownUntil !== undefined && record.cooldownUntil <= now)
+      if (expired.length) {
+        for (const record of expired) record!.leaseUntil = now + 2 * 60_000
+        this.touch()
+        await this.commit()
+      }
+      claimed = true
+    }).catch(async error => { claimed = false; await this.log(`candidate claim refused: ${String(error)}`) })
     return claimed
   }
 
   async flush(): Promise<void> {
-    if (!this.dirty) return
+    if (!this.dirty || this.writeBlocked) return
     await this.withLock(async () => {
-      if (!this.replaceOnFlush) this.state = mergeState(await this.readDisk(), this.state)
-      for (const key of this.resetModels) delete this.state.models[key]
-      // 必须在 merge 之后再清空：磁盘上残留的旧 session 约束不能因合并而重新出现
-      if (this.clearContentPolicyOnFlush) this.state.contentPolicyFamilies = {}
+      // Even reset-all must validate the on-disk schema before writing.
+      this.state = mergeState(await this.readDisk(), this.state)
       await this.commit()
-    }).catch(() => {})
+    }).catch(async error => { await this.log(`health state flush refused: ${String(error)}`) })
   }
 
   async log(line: string): Promise<void> {
@@ -300,20 +339,39 @@ export class HealthStore {
   private touch(): void { this.dirty = true }
   private async readDisk(): Promise<HealthState> {
     try {
-      if (!existsSync(this.file)) return blank()
-      const parsed = JSON.parse(await readFile(this.file, 'utf8')) as HealthState
-      return parsed.schemaVersion === 2 ? parsed : blank()
-    } catch { return blank() }
+      let raw: string
+      try { raw = await readFile(this.file, 'utf8') }
+      catch (error: any) { if (error?.code === 'ENOENT') return blank(); throw error }
+      const parsed = JSON.parse(raw) as HealthState
+      if (!parsed || (parsed.schemaVersion !== 2 && parsed.schemaVersion !== 3)) throw new Error(`unsupported state schema: ${parsed?.schemaVersion}`)
+      if (this.observedSchema3 && parsed.schemaVersion === 2) throw new Error('unsupported state schema downgrade: 3 -> 2; stop all old Pi processes')
+      if (!parsed.models || !parsed.providers || !parsed.endpoints) throw new Error('invalid health state buckets')
+      this.observedSchema3 ||= parsed.schemaVersion === 3
+      return parsed
+    } catch (error) {
+      this.writeBlocked = true
+      throw error
+    }
+  }
+
+  private manualVersion(): number {
+    const records = [...Object.values(this.state.models), ...Object.values(this.state.providers), ...Object.values(this.state.endpoints)]
+    this.manualClock = Math.max(Date.now(), this.manualClock + 1, (this.state.resetAt ?? 0) + 1,
+      ...Object.values(this.state.modelResetAt ?? {}).map(at => at + 1),
+      ...records.map(record => (record.disabledUpdatedAt ?? 0) + 1))
+    return this.manualClock
   }
+
   private async commit(): Promise<void> {
+    if (this.writeBlocked) throw new Error("health state writes are blocked; reload a supported state first")
+    this.state.schemaVersion = 3
+    delete this.state.contentPolicyFamilies
     this.state.updatedAt = Date.now()
     const temp = `${this.file}.tmp-${process.pid}-${randomUUID()}`
     await writeFile(temp, JSON.stringify(this.state, null, 2), 'utf8')
     await rename(temp, this.file)
+    this.observedSchema3 = true
     this.dirty = false
-    this.replaceOnFlush = false
-    this.resetModels.clear()
-    this.clearContentPolicyOnFlush = false
   }
   private bucket(scope: HealthScope): Record<string, HealthRecord> {
     return scope === 'model' ? this.state.models : scope === 'provider' ? this.state.providers : this.state.endpoints
@@ -341,10 +399,15 @@ function mergeRecord(a: HealthRecord | undefined, b: HealthRecord | undefined):
   const lastFailureAt = Math.max(a.lastFailureAt ?? 0, b.lastFailureAt ?? 0)
   const lastSuccessAt = Math.max(a.lastSuccessAt ?? 0, b.lastSuccessAt ?? 0)
   const successWins = lastSuccessAt > lastFailureAt
+  const failureCounts = mergeCounts(a.failureCounts, a.totalFailures, b.failureCounts, b.totalFailures)
   return {
     ...newest,
-    totalFailures: Math.max(a.totalFailures, b.totalFailures),
-    disabled: b.disabled ?? a.disabled,
+    totalFailures: sumCounts(failureCounts),
+    failureCounts,
+    disabled: (a.disabledUpdatedAt ?? 0) === (b.disabledUpdatedAt ?? 0)
+      ? (a.disabled === true || b.disabled === true ? true : b.disabled ?? a.disabled)
+      : (a.disabledUpdatedAt ?? 0) > (b.disabledUpdatedAt ?? 0) ? a.disabled : b.disabled,
+    disabledUpdatedAt: Math.max(a.disabledUpdatedAt ?? 0, b.disabledUpdatedAt ?? 0) || undefined,
     lastFailureAt: lastFailureAt || undefined,
     lastSuccessAt: lastSuccessAt || undefined,
     consecutiveFailures: successWins ? 0 : Math.max(a.consecutiveFailures, b.consecutiveFailures),
@@ -363,26 +426,59 @@ function mergeBucket(a: Record<string, HealthRecord>, b: Record<string, HealthRe
 }
 
 function mergeState(a: HealthState, b: HealthState): HealthState {
-  const switches = Math.max(a.switches ?? 0, b.switches ?? 0)
+  const resetAt = Math.max(a.resetAt ?? 0, b.resetAt ?? 0)
+  a = afterGlobalReset(a, resetAt)
+  b = afterGlobalReset(b, resetAt)
+  const modelResetAt = { ...a.modelResetAt }
+  for (const [key, at] of Object.entries(b.modelResetAt ?? {})) modelResetAt[key] = Math.max(modelResetAt[key] ?? 0, at)
+  const models = mergeBucket(a.models, b.models)
+  for (const [key, at] of Object.entries(modelResetAt)) {
+    const record = mergeRecord(afterReset(a.models[key], a.modelResetAt?.[key] ?? 0, at), afterReset(b.models[key], b.modelResetAt?.[key] ?? 0, at))
+    if (record) models[key] = record
+    else delete models[key]
+  }
+  const switchCounts = mergeCounts(a.switchCounts, a.switches ?? 0, b.switchCounts, b.switches ?? 0)
+  const switches = sumCounts(switchCounts)
   // 取最近更新的 switchLog（按 at 去倒序合并，保留最新 20 条）
   const log = [...(a.switchLog ?? []), ...(b.switchLog ?? [])]
     .sort((x, y) => y.at - x.at)
     .filter((entry, index, all) => index === 0 || all[index - 1].at !== entry.at || all[index - 1].from !== entry.from || all[index - 1].to !== entry.to)
     .slice(0, 20)
-  const contentPolicyFamilies: Record<string, ContentPolicyConstraint> = {}
-  for (const family of new Set([...Object.keys(a.contentPolicyFamilies ?? {}), ...Object.keys(b.contentPolicyFamilies ?? {})])) {
-    const left = a.contentPolicyFamilies?.[family]
-    const right = b.contentPolicyFamilies?.[family]
-    if (!left) contentPolicyFamilies[family] = right!
-    else if (!right) contentPolicyFamilies[family] = left
-    else {
-      const newest = right.lastObservedAt >= left.lastObservedAt ? right : left
-      contentPolicyFamilies[family] = {
-        ...newest,
-        observations: Math.max(left.observations, right.observations),
-        avoidUntil: Math.max(left.avoidUntil, right.avoidUntil),
-      }
+  return { schemaVersion: 3, resetAt: resetAt || undefined, modelResetAt, updatedAt: Math.max(a.updatedAt ?? 0, b.updatedAt ?? 0), models, providers: mergeBucket(a.providers ?? {}, b.providers ?? {}), endpoints: mergeBucket(a.endpoints ?? {}, b.endpoints ?? {}), switchCounts, switches, switchLog: log }
+}
+
+// Each store increments only its own component. Merging the same state twice is
+// idempotent; independent increments add without inflating the backoff streak.
+function mergeCounts(a: Record<string, number> | undefined, aTotal: number, b: Record<string, number> | undefined, bTotal: number): Record<string, number> {
+  const left = a ?? { legacy: aTotal }, right = b ?? { legacy: bTotal }
+  const result = { ...left }
+  for (const [writer, count] of Object.entries(right)) result[writer] = Math.max(result[writer] ?? 0, count)
+  return result
+}
+function incrementCounts(counts: Record<string, number> | undefined, total: number, writer: string): Record<string, number> {
+  const next = { ...(counts ?? { legacy: total }) }
+  next[writer] = (next[writer] ?? 0) + 1
+  return next
+}
+function sumCounts(counts: Record<string, number>): number {
+  return Object.values(counts).reduce((sum, count) => sum + count, 0)
+}
+
+function afterReset(record: HealthRecord | undefined, sourceResetAt: number, resetAt: number): HealthRecord | undefined {
+  if (sourceResetAt >= resetAt || !record) return record
+  // A manual operation newer than the reset survives, but old health history
+  // does not. Legacy records have timestamp zero and cannot beat a reset.
+  if ((record.disabledUpdatedAt ?? 0) > resetAt) return { consecutiveFailures: 0, totalFailures: 0, disabled: record.disabled, disabledUpdatedAt: record.disabledUpdatedAt }
+  return undefined
+}
+function afterGlobalReset(state: HealthState, resetAt: number): HealthState {
+  if ((state.resetAt ?? 0) >= resetAt) return state
+  const clean = { ...blank(), resetAt }
+  for (const scope of ['models', 'providers', 'endpoints'] as const) {
+    for (const [key, record] of Object.entries(state[scope])) {
+      const kept = afterReset(record, state.resetAt ?? 0, resetAt)
+      if (kept) clean[scope][key] = kept
     }
   }
-  return { schemaVersion: 2, updatedAt: Math.max(a.updatedAt ?? 0, b.updatedAt ?? 0), models: mergeBucket(a.models ?? {}, b.models ?? {}), providers: mergeBucket(a.providers ?? {}, b.providers ?? {}), endpoints: mergeBucket(a.endpoints ?? {}, b.endpoints ?? {}), contentPolicyFamilies, switches, switchLog: log }
+  return clean
 }

package/index.ts

@@ -6,13 +6,18 @@ import { fileURLToPath } from 'node:url'
 import type { ExtensionAPI, ExtensionContext, FailureObservation, ModelRef } from './types.ts'
 import { classifyFailure, parseRetryAfter } from './classify.ts'
 import { candidateSnapshot, effectiveCandidates, chooseCandidate, multimodalCandidates, modelFamily, summarizeCandidateHealth } from './candidates.ts'
-import { HealthStore, endpointKey, modelKey, type HealthState } from './health.ts'
+import { HealthStore, endpointKey, modelKey, platformKey, type ContentPolicyConstraint } from './health.ts'
 
 const FIRST_RESPONSE_TIMEOUT = 90_000
 const STREAM_IDLE_TIMEOUT = 120_000
-const ROUND_LIMIT = 8 * 60_000
+/** 本轮时间限制默认值；可用 CCSWITCH_ROUND_LIMIT_MS 覆盖（毫秒）。 */
+const ROUND_LIMIT_DEFAULT = 8 * 60_000
+const roundLimitMs = (): number => {
+  const override = Number(process.env.CCSWITCH_ROUND_LIMIT_MS)
+  return Number.isFinite(override) && override > 0 ? override : ROUND_LIMIT_DEFAULT
+}
 const RPC_PROTOCOL_VERSION = 1
-const EXTENSION_VERSION = '0.3.10'
+const EXTENSION_VERSION = '0.3.12'
 // 同端点（BaseURL 相同）连续失败达到该次数即隔离该端点，避免同一个平台的多个模型逐个试错耗尽本轮切换
 const ENDPOINT_FAIL_THRESHOLD = 3
 
@@ -28,6 +33,8 @@ interface Round {
   startedAt: number
   text: string
   images?: Array<Record<string, unknown>>
+  needsImage: boolean
+  modalitySwitch?: Promise<void>
   tried: Set<string>
   attempts: number
   hadTool: boolean
@@ -38,16 +45,18 @@ interface Round {
   observation?: FailureObservation
   model?: ModelRef
   endpointFails?: EndpointFailTracker
-  /** 本轮内容审查故障转移中必须避开的模型系列（包含持久化学到的约束）。 */
+  /** 本轮内容审查故障转移中必须避开的模型系列（包含本 session 学到的约束）。 */
   avoidFamilies?: Set<string>
   /** 本轮内最后一次成功切换的时间；用于刷新 ROUND_LIMIT 窗口，避免供应商内部重试耗时导致误判“超过本轮时间限制” */
   lastSwitchAt?: number
+  /** 本轮内每个已试模型的最后错误消息（key 为 modelKey），用于 exhaust 报告 */
+  errors: Map<string, string>
 }
 
 function key(model: ModelRef | undefined): string | undefined { return model && modelKey(model) }
 function canRetry(ctx: ExtensionContext): boolean { return ctx.mode === 'tui' || ctx.mode === 'rpc' }
-function activePolicyFamilies(state: HealthState, now = Date.now()): Set<string> {
-  return new Set(Object.entries(state.contentPolicyFamilies ?? {})
+function activePolicyFamilies(constraints: Record<string, ContentPolicyConstraint>, now = Date.now()): Set<string> {
+  return new Set(Object.entries(constraints)
     .filter(([, record]) => record.avoidUntil > now)
     .map(([family]) => family))
 }
@@ -79,6 +88,15 @@ export default function (pi: ExtensionAPI) {
   let lastStatus: { status?: number, retryAfterMs?: number } = {}
   // 本次 pi session 内成功切换的模型数量（用于衡量插件的有效程度）
   let sessionSwitches = 0
+  // pi.setModel() 内部会 emit model_select 事件（pi core 源码 _emitModelSelect(model, previous, "set")）。
+  // 扩展自己触发的切换必须标记 selfSwitching，否则 model_select 处理器会清空本轮故障转移状态
+  // （tried/attempts/endpointFails），导致：a) exhaust 报告“已尝试”为空；b) 端点隔离被清零后
+  // 同平台候选被逐个重试，烧光 ROUND_LIMIT → “超过本轮时间限制”。
+  let selfSwitching = false
+  const setModelInternally = async (model: ModelRef): Promise<boolean> => {
+    selfSwitching = true
+    try { return await pi.setModel(model) } catch { return false } finally { selfSwitching = false }
+  }
 
   const clearWatchdog = () => { if (timer) clearTimeout(timer); timer = undefined }
   const armWatchdog = (ctx: ExtensionContext, ms: number, roundId: number) => {
@@ -138,7 +156,7 @@ export default function (pi: ExtensionAPI) {
     const candidates = snapshot.models
     const counts = summarizeCandidateHealth(candidates, state)
     const now = Date.now()
-    const policyFamilies = activePolicyFamilies(state, now)
+    const policyFamilies = activePolicyFamilies(health.policyConstraints, now)
     const rows = candidates.slice(0, 10).map(model => {
       const modelRecord = state.models[modelKey(model)]
       const records = [modelRecord, state.providers[model.provider], state.endpoints[endpointKey(model)]]
@@ -163,7 +181,11 @@ export default function (pi: ExtensionAPI) {
     const policySummary = policyFamilies.size ? [...policyFamilies].join(', ') : '无'
     const action = await ctx.ui.select(`CCSwitch 健康面板\n当前：${key(ctx.model) ?? '无'}\n${scopeLabel} · 唯一模型：${counts.total} · 健康：${counts.healthy} · 自动冷却：${counts.cooling} · 手动禁用：${counts.disabled}\n熔断记录：${counts.breakerRecords} · 审查约束系列：${policySummary}\n${switchSummary}${switchPanel}\n${rows.join('\n') || '没有可用模型'}`, ['刷新', '重新激活当前模型', '禁用当前模型', '重置当前模型历史', '关闭'])
     if (action === '刷新') await refresh(ctx)
-    if (action === '重新激活当前模型' && ctx.model) { health.reactivate(ctx.model); await health.flush(); status(ctx); notify(ctx, '已重新激活当前模型') }
+    if (action === '重新激活当前模型' && ctx.model) {
+      const restored = await health.reactivate(ctx.model)
+      status(ctx)
+      notify(ctx, restored ? '已重新激活当前模型' : '重新激活失败，健康状态未确认保存；请查看 ccswitch-auto-switch.log', restored ? 'info' : 'error')
+    }
     if (action === '禁用当前模型' && ctx.model) { health.disable(modelKey(ctx.model), true); await health.flush(); status(ctx); notify(ctx, '已禁用当前模型', 'warning') }
     if (action === '重置当前模型历史' && ctx.model) {
       const ok = !ctx.ui.confirm || await ctx.ui.confirm('重置健康历史', `删除 ${modelKey(ctx.model)} 的记录？`)
@@ -175,10 +197,13 @@ export default function (pi: ExtensionAPI) {
     round.phase = 'exhausted'
     clearWatchdog()
     ctx.ui.setWorkingMessage()
-    await health.report(`# CCSwitch 自动故障转移失败\n\n时间：${new Date().toISOString()}\n原因：${reason}\n\n已尝试：\n${[...round.tried].map(item => `- ${item}`).join('\n')}\n\n可使用 /ccswitch status 查看状态，/ccswitch reactivate <provider/model> 重新激活。`)
+    // 报告列出本轮每个已试模型及其最后错误，便于直接定位是哪个 provider/模型、什么原因
+    const triedLines = [...round.tried].map(item => {
+      const error = round!.errors.get(item)
+      return error ? `- ${item} — ${error}` : `- ${item}`
+    })
+    await health.report(`# CCSwitch 自动故障转移失败\n\n时间：${new Date().toISOString()}\n原因：${reason}\n\n已尝试：\n${triedLines.join('\n')}\n\n可使用 /ccswitch status 查看状态，/ccswitch reactivate <provider/model|all> 重新激活。`)
     await health.log(`round exhausted: ${reason}; tried=${[...round.tried].join(',')}`)
-    // RPC runner relies on an explicit terminal signal instead of guessing from
-    // agent_settled. Keep this RPC-only so ordinary TUI transcripts stay quiet.
     if (ctx.mode === 'rpc') {
       const lastFailure = round.observation ? classifyFailure(round.observation).kind : undefined
       try {
@@ -190,23 +215,30 @@ export default function (pi: ExtensionAPI) {
           model: key(round.model),
           attempts: round.attempts,
           tried: [...round.tried],
+          errors: Object.fromEntries(round.errors),
           sessionSwitches,
         })
       } catch { /* reporting must not prevent the regular exhausted path */ }
     }
-    notify(ctx, `CCSwitch：自动切换停止（${reason}），请用 /ccswitch 查看详情`, 'error')
+    const currentKey = key(round.model)
+    const currentError = currentKey ? round.errors.get(currentKey) : undefined
+    notify(ctx, `CCSwitch：自动切换停止（${reason}）${currentError ? `；当前 ${currentKey}：${currentError}` : ''}，请用 /ccswitch 查看详情`, 'error')
     status(ctx)
   }
   /**
    * 模态预检主动切换：当前模型不支持图片但本轮输入/工具结果带图时，
    * 主动切到一个健康的多模态候选（不等失败）。无候选时通知并保持原模型。
    */
-  const proactiveModalitySwitch = async (ctx: ExtensionContext, round: Round): Promise<void> => {
+  const performModalitySwitch = async (ctx: ExtensionContext, round: Round): Promise<void> => {
     const current = round.model ?? ctx.model
-    if (!current || !canRetry(ctx) || round.phase !== 'monitoring') return
+    if (!current || !canRetry(ctx) || !['monitoring', 'verifying'].includes(round.phase)) return
     if (current.input?.includes('image')) return
     const candidates = effectiveCandidates(ctx.scopedModels, ctx.modelRegistry.getAvailable())
-    const next = multimodalCandidates(candidates, current, health.snapshot)[0]
+    let next: ModelRef | undefined
+    for (const candidate of multimodalCandidates(candidates, current, health.snapshot)) {
+      if (round.tried.has(modelKey(candidate)) || round.avoidFamilies?.has(modelFamily(candidate)) || round.endpointFails?.isolated.has(platformKey(candidate))) continue
+      if (await health.claimCandidate(candidate)) { next = candidate; break }
+    }
     if (!next) {
       await health.log(`modality precheck: no multimodal candidate, staying on ${modelKey(current)}`)
       notify(ctx, 'CCSwitch：当前模型不支持图片，且没有可用的多模态候选模型，已保持原模型', 'warning')
@@ -214,7 +246,7 @@ export default function (pi: ExtensionAPI) {
       return
     }
     const previousModel = current
-    const set = await pi.setModel(next).catch(() => false)
+    const set = await setModelInternally(next)
     if (!set) {
       await health.log(`modality precheck: Pi refused model selection ${modelKey(next)}`)
       notify(ctx, `CCSwitch：多模态候选 ${modelKey(next)} 切换失败，已保持原模型`, 'warning')
@@ -241,32 +273,45 @@ export default function (pi: ExtensionAPI) {
     status(ctx)
   }
 
+  const proactiveModalitySwitch = (ctx: ExtensionContext, target: Round): Promise<void> => {
+    // Concurrent tool completions await the same switch before returning to Pi.
+    if (!target.modalitySwitch) {
+      target.modalitySwitch = performModalitySwitch(ctx, target).finally(() => { target.modalitySwitch = undefined })
+    }
+    return target.modalitySwitch
+  }
+
   const failover = async (ctx: ExtensionContext) => {
     if (!round || !round.observation || !round.model || !canRetry(ctx)) return
-    // 窗口从上一次成功切换（或本轮开始）起算：供应商内部重试耗时不应消耗整轮限额
-    const windowStart = Math.max(round.startedAt, round.lastSwitchAt ?? 0)
-    if (Date.now() - windowStart >= ROUND_LIMIT) return exhaust(ctx, '超过本轮时间限制')
     const classification = classifyFailure(round.observation)
     if (round.observation.aborted && !round.observation.watchdog) { round.phase = 'idle'; clearWatchdog(); status(ctx); return }
     round.phase = 'switching'
-    round.tried.add(modelKey(round.model))
-    // 跟踪同端点失败：BaseURL 相同的模型同属一个端点平台，连续失败到阈值后隔离整个端点，
-    // 避免同一平台下的多个模型逐个试错（它们往往共享同一故障根源）
+    const failedKey = modelKey(round.model)
+    round.tried.add(failedKey)
+    round.errors.set(failedKey, round.observation.message ?? classification.kind)
+    // 跟踪同平台失败：按 BaseURL 归组（platformKey 不含 provider 名），同一平台下的多个
+    // provider/模型逐个试错会共享同一故障根源，连续失败到阈值后隔离整个平台，
+    // 避免它们烧光本轮切换时间（每个候选最多占用 FIRST_RESPONSE_TIMEOUT）
     const failTracker = round.endpointFails ??= { failed: new Map(), isolated: new Set() }
-    const ep = endpointKey(round.model)
-    const epFails = (failTracker.failed.get(ep) ?? 0) + 1
-    failTracker.failed.set(ep, epFails)
-    if (epFails >= ENDPOINT_FAIL_THRESHOLD) {
-      failTracker.isolated.add(ep)
-      await health.log(`endpoint ${ep} failed ${epFails} times this round, isolating endpoint`)
+    const platform = platformKey(round.model)
+    const platformFails = (failTracker.failed.get(platform) ?? 0) + 1
+    failTracker.failed.set(platform, platformFails)
+    if (platformFails >= ENDPOINT_FAIL_THRESHOLD) {
+      failTracker.isolated.add(platform)
+      await health.log(`platform ${platform} failed ${platformFails} times this round, isolating platform`)
     }
     if (classification.kind === 'content_policy') {
       health.recordContentPolicyConstraint(modelFamily(round.model), round.model, round.observation.message)
       round.avoidFamilies ??= new Set()
-      for (const family of activePolicyFamilies(health.snapshot)) round.avoidFamilies.add(family)
+      for (const family of activePolicyFamilies(health.policyConstraints)) round.avoidFamilies.add(family)
     }
-    if (!classification.roundOnly && classification.scope) health.recordFailure(classification.scope, classification.scope === 'model' ? modelKey(round.model) : classification.scope === 'provider' ? round.model.provider : endpointKey(round.model), classification.kind, round.observation.message, classification.retryAfterMs)
+    // 失败必须先落台账再做时限判断：否则本轮最后一次失败不会进健康状态（无冷却），
+    // 下一轮还会重试同一个刚失败的模型/provider
+    if (!classification.roundOnly && classification.scope) health.recordFailure(classification.scope, classification.scope === 'model' ? failedKey : classification.scope === 'provider' ? round.model.provider : endpointKey(round.model), classification.kind, round.observation.message, classification.retryAfterMs)
     await health.flush()
+    // 窗口从上一次成功切换（或本轮开始）起算：供应商内部重试耗时不应消耗整轮限额
+    const windowStart = Math.max(round.startedAt, round.lastSwitchAt ?? 0)
+    if (Date.now() - windowStart >= roundLimitMs()) return exhaust(ctx, '超过本轮时间限制')
     await refresh(ctx)
     const candidates = effectiveCandidates(ctx.scopedModels, ctx.modelRegistry.getAvailable())
     const candidateOptions = () => ({
@@ -276,15 +321,15 @@ export default function (pi: ExtensionAPI) {
       health: health.snapshot,
       avoidEndpoints: failTracker.isolated,
       avoidFamilies: round!.avoidFamilies,
-      requiredInputs: round!.images?.length ? ['text', 'image'] : ['text'],
+      requiredInputs: round!.needsImage ? ['text', 'image'] : ['text'],
     })
     let next = chooseCandidate(candidates, candidateOptions())
     while (next) {
-      if (!await health.claimProvider(next)) { round.tried.add(modelKey(next)); next = chooseCandidate(candidates, candidateOptions()); continue }
+      if (!await health.claimCandidate(next)) { round.tried.add(modelKey(next)); next = chooseCandidate(candidates, candidateOptions()); continue }
       round.attempts++
       ctx.ui.setWorkingMessage(`模型异常，正在切换到 ${modelKey(next)}…`)
       const previousModel = round.model
-      const set = await pi.setModel(next).catch(() => false)
+      const set = await setModelInternally(next)
       if (!set) {
         health.recordFailure('model', modelKey(next), 'model_config', 'Pi refused model selection')
         round.tried.add(modelKey(next)); await health.flush()
@@ -344,14 +389,20 @@ export default function (pi: ExtensionAPI) {
     if (event.source === 'extension') return { action: 'continue' }
     clearWatchdog()
     lastStatus = {}
-    round = { id: (round?.id ?? 0) + 1, phase: 'monitoring', startedAt: Date.now(), text: event.text, images: event.images, tried: new Set(), attempts: 0, hadTool: false, inTool: false, hadOutput: false, watchdog: false, cleanRetry: false, model: ctx.model, endpointFails: undefined, avoidFamilies: undefined }
+    round = { id: (round?.id ?? 0) + 1, phase: 'monitoring', startedAt: Date.now(), text: event.text, images: event.images, needsImage: Boolean(event.images?.length), tried: new Set(), attempts: 0, hadTool: false, inTool: false, hadOutput: false, watchdog: false, cleanRetry: false, model: ctx.model, endpointFails: undefined, avoidFamilies: undefined, errors: new Map() }
     status(ctx)
     // 模态预检：输入带图片但当前模型不支持图片（非多模态）→ 主动切换到多模态模型，
     // 避免 Pi 静默剥图后模型只回答“看不到图片”（此类情况不会触发 failover）。
     if (event.images?.length && round.phase === 'monitoring') await proactiveModalitySwitch(ctx, round)
     return { action: 'continue' }
   })
-  pi.on('before_provider_request', (_event, ctx) => { lastStatus = {}; if (round) { round.inTool = false; armWatchdog(ctx, FIRST_RESPONSE_TIMEOUT, round.id) } })
+  pi.on('before_provider_request', (_event, ctx) => {
+    lastStatus = {}
+    if (round) {
+      round.inTool = false
+      armWatchdog(ctx, FIRST_RESPONSE_TIMEOUT, round.id)
+    }
+  })
   pi.on('after_provider_response', (event, ctx) => {
     lastStatus = { status: event.status, retryAfterMs: parseRetryAfter(event.headers?.['retry-after']) }
     if (round && event.status >= 200 && event.status < 300) armWatchdog(ctx, STREAM_IDLE_TIMEOUT, round.id)
@@ -374,7 +425,10 @@ export default function (pi: ExtensionAPI) {
     round.inTool = false
     // 工具结果含图片（如 read 图片文件）且当前模型不支持 → 主动切换多模态模型，
     // 确保下一轮 LLM 调用使用新模型，工具结果中的图片不被 Pi 静默剥除。
-    if (round.phase === 'monitoring' && resultContainsImage(_event.result)) await proactiveModalitySwitch(ctx, round)
+    if (resultContainsImage(_event.result)) {
+      round.needsImage = true
+      await proactiveModalitySwitch(ctx, round)
+    }
   })
   pi.on('turn_end', async (event, ctx) => {
     const message = event.message
@@ -423,6 +477,11 @@ export default function (pi: ExtensionAPI) {
     await failover(ctx)
   })
   pi.on('model_select', (event, ctx) => {
+    // pi.setModel() 内部也会发出 model_select（pi core _emitModelSelect(source="set")）。
+    // 本扩展自己触发的切换绝不能清空本轮故障转移状态（tried/attempts/endpointFails/errors），
+    // 否则：a) exhaust 报告“已尝试”为空，用户看不到哪些 provider/model 失败过；
+    // b) 同平台隔离被清零后，同平台候选被逐个重试烧光时限 → “超过本轮时间限制”。
+    if (selfSwitching) return
     // 用户手动切换模型（TUI 模型选择器 / /model / 方向键循环）。让 ccs 跟随：
     // 更新“当前模型”并重置本轮故障转移状态，否则 round.model 停留在上一轮使用的模型，
     // 导致状态栏与后续 failover 都滞后于实际选择，直到下次 input 才偶尔纠正。
@@ -451,9 +510,11 @@ export default function (pi: ExtensionAPI) {
     if (!target && verb !== 'reset') { notify(ctx, '请指定 provider/model 或 all', 'warning'); return }
     if (verb === 'disable' && target) { health.disable(target, true); await health.flush(); status(ctx); return }
     if (verb === 'reactivate' && target) {
-      if (target === 'all') health.reactivateAll()
-      else { const [provider, ...rest] = target.split('/'); health.reactivate({ provider, id: rest.join('/') }) }
-      await health.flush(); status(ctx); return
+      const [provider, ...rest] = target.split('/')
+      const restored = await (target === 'all' ? health.reactivateAll() : health.reactivate({ provider, id: rest.join('/') }))
+      status(ctx)
+      notify(ctx, restored ? '已重新激活' : '重新激活失败，健康状态未确认保存；请查看 ccswitch-auto-switch.log', restored ? 'info' : 'error')
+      return
     }
     if (verb === 'reset' && target) {
       const ok = !ctx.ui.confirm || await ctx.ui.confirm('重置健康历史', `删除 ${target} 的健康记录？`)
@@ -467,7 +528,7 @@ export default function (pi: ExtensionAPI) {
     const snapshot = candidateSnapshot(ctx.scopedModels, ctx.modelRegistry.getAvailable())
     const counts = summarizeCandidateHealth(snapshot.models, health.snapshot)
     const state = health.snapshot
-    const policyFamilies = activePolicyFamilies(state)
+    const policyFamilies = activePolicyFamilies(health.policyConstraints)
     const source = snapshot.source === 'scoped' ? `Pi scope ${snapshot.sourceEntries} 条` : `Pi 注册表 ${snapshot.sourceEntries} 条`
     notify(ctx, `CCSwitch 自检：${source} · 唯一模型 ${counts.total} · 健康 ${counts.healthy} · 自动冷却 ${counts.cooling} · 手动禁用 ${counts.disabled} · 熔断记录 ${counts.breakerRecords} · 审查约束系列 ${policyFamilies.size} · 本session切换 ${sessionSwitches} · 累计切换 ${state.switches ?? 0}`, counts.total ? 'info' : 'warning')
   }})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-ccswitch-auto-switch",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "description": "Provider-first automatic model failover extension for Pi and CC Switch",
   "license": "MIT",
   "keywords": [
@@ -39,10 +39,11 @@
     "node": ">=22.19.0"
   },
   "scripts": {
-    "test": "node --test test/*.test.ts test/*.test.mjs",
+    "test": "node --experimental-strip-types --test test/*.test.ts test/*.test.mjs",
     "typecheck": "tsc --noEmit --allowImportingTsExtensions --module nodenext --moduleResolution nodenext --target es2022 --skipLibCheck *.ts"
   },
   "devDependencies": {
-    "@types/node": "^22.19.19"
+    "@types/node": "^22.19.19",
+    "typescript": "~5.9.3"
   }
 }