sintbot 1.4.14 → 1.4.16

package/src/agent/modelwindows.js

@@ -1,6 +1,7 @@
 'use strict'
 
-// Console display only. Official limits and active executor windows are
+// Model metadata for console display and executor override validation.
+// Official limits and active executor windows are
 // separate values; neither changes the server-side capacity of a model.
 const fs = require('node:fs')
 const os = require('node:os')
@@ -38,7 +39,7 @@ function codexCatalogWindows(home = process.env.CODEX_HOME || path.join(os.homed
     const percent = model.effective_context_window_percent
     if (typeof id !== 'string' || !Number.isSafeInteger(full) || full <= 0 ||
         (percent != null && (!Number.isSafeInteger(percent) || percent < 1 || percent > 100))) continue
-    windows.set(id, { tokens: full, usableTokens: Math.floor(full * (percent || 100) / 100) })
+    windows.set(id, { maxTokens: Number.isSafeInteger(model.max_context_window) && model.max_context_window >= full ? model.max_context_window : full, tokens: full, usableTokens: Math.floor(full * (percent || 100) / 100) })
   }
   return windows
 }
@@ -49,7 +50,13 @@ function windowForProvider(provider, reported, codexWindows) {
   const gateway = provider.baseUrl || provider.env?.ANTHROPIC_BASE_URL
   const official = provider.runner === 'codex' ? OPENAI_API_WINDOWS.get(model)
     : gateway ? null : CLAUDE_WINDOWS.get(model)
-  // The catalog's context_window is the supported maximum. Runtime reports
+  // The catalog window is a default, not proof that an explicit override is active.
+  // With an override, only a real runtime sample can describe the active window.
+  if (provider.runner === 'codex' && provider.contextWindowTokens > 0) return {
+    tokens: official || null, source: official ? 'official' : 'unknown',
+    ...(Number.isSafeInteger(reported) && reported > 0 ? { activeTokens: reported } : {}),
+  }
+  // Runtime reports
   // may instead contain its effective (reserved) portion.
   if (catalog && (!Number.isSafeInteger(reported) || reported <= 0 ||
       reported === catalog.tokens || reported === catalog.usableTokens)) return {

package/src/agent/runner.js

@@ -9,6 +9,11 @@ const codexApp = require('./codexapp')
 const { routeBackend } = require('./privatecore')
 
 function runTurn(opts) {
+  // One-off console trials use the same model settings as group turns.
+  // Explicit turn values (including zero) remain authoritative.
+  const compact = Number(opts.autocompactTokens ?? opts.provider?.autocompactTokens) || 0
+  opts = { ...opts, autocompactTokens: compact > 0
+    ? Math.min(1_000_000, Math.max(100_000, Math.floor(compact))) : 0 }
   const route = routeBackend(opts && opts.provider && opts.provider.runner, opts && opts.codexApp, opts && opts.codexSteer, opts && opts.codexProjectDocFallback)
   if (route !== 'claude') {
     const codexOpts = { ...opts, bin: (opts.provider && opts.provider.bin) || 'codex' }

package/src/c2configcontrol.js

@@ -8,20 +8,24 @@ const { loadInstallationFromRaw, assertJournalScope, assertRunnerExecutable,
   MANIFEST, VALIDATORS, SUPPORTED_RUNNERS } = require('./c2install')
 const { C2DurableJournal } = require('./core/c2durablejournal')
 const { assertNoLegacyGroupState } = require('./c2migration')
+const { applyBrainChange } = require('./groupbrain')
 
 const GLOBAL_TASK_KEYS = ['agent', 'timezone', 'brand']
-const RESET_KEYS = ['provider', 'model', 'workdir', 'codexApp']
+// A group's model and depth (providerPrefs, legacy model) are not here: the
+// executors resume the same session with another model of the same backend.
+const RESET_KEYS = ['provider', 'workdir', 'codexApp']
 const EFFORT_ENV = 'CLAUDE_CODE_EFFORT_LEVEL'
 
-// What a group's session belongs to: backend, executable, endpoint, model and
-// the environment the backend starts with. Effort, reasoning effort, tool
-// quality, key, image support, visibility and order apply from the next turn.
-function sessionIdentity(provider, group) {
+// What a group's session belongs to: backend, executable, endpoint and the
+// environment the backend starts with. Model, depth, tool quality, key, image
+// support, visibility and order apply from the next turn in the same session:
+// both executors resume a session with another model of the same backend.
+function sessionIdentity(provider) {
   if (!provider || typeof provider !== 'object') return null
   const env = { ...(provider.env && typeof provider.env === 'object' ? provider.env : {}) }
   delete env[EFFORT_ENV]
-  return { runner: provider.runner, bin: provider.bin || '', baseUrl: provider.baseUrl || '',
-    model: group?.model || provider.model || '', env }
+  delete env.ANTHROPIC_MODEL
+  return { runner: provider.runner, bin: provider.bin || '', baseUrl: provider.baseUrl || '', env }
 }
 
 // Synchronous validation/application around one atomic configuration write.
@@ -134,8 +138,8 @@ function createC2ConfigControl({ installation, getBindings, getHeld = () => new
       // A model library or default change reaches every group that runs
       // the edited provider, even though its own settings stay the same.
       const providerMoved = !isDeepStrictEqual(
-        sessionIdentity(cfg.providers?.[effective(route.chatId, route.group, cfg)], route.group),
-        sessionIdentity(next.cfg.providers?.[effective(route.chatId, target.group, next.cfg)], target.group))
+        sessionIdentity(cfg.providers?.[effective(route.chatId, route.group, cfg)]),
+        sessionIdentity(next.cfg.providers?.[effective(route.chatId, target.group, next.cfg)]))
       if (heldGroups.has(route.chatId)) {
         // Edits elsewhere proceed; the held group keeps its exact settings.
         if (!isDeepStrictEqual(route.group, target.group)) {
@@ -272,18 +276,25 @@ function createC2ConfigControl({ installation, getBindings, getHeld = () => new
     return raw
   }
 
-  function switchGroupProvider(chatId, name) {
-    return writeConfig(raw => {
-      const group = raw.groups?.[chatId]
-      if (!group) throw new Error('Unknown group')
-      if (!cfg.providers?.[name]) throw new Error('Unknown model')
-      group.provider = name
-      // A pinned model id belongs to the previous provider.
-      delete group.model
+  // Backend · model · depth of one group (console, /model, model card). The
+  // writer validates, resets the session only when the backend changes, and
+  // goes live. Returns the change summary; throws on refusal.
+  function setGroupBrain(chatId, change = {}) {
+    let summary = null
+    writeConfig(raw => {
+      if (!raw.groups?.[chatId]) throw new Error('Unknown group')
+      const result = applyBrainChange(raw, chatId, change)
+      if (result.error) throw new Error({ 'unknown-provider': 'Unknown model',
+        'bad-model': 'Invalid model id', 'bad-effort': 'Invalid thinking depth' }[result.error] || 'Unknown group')
+      summary = result
     })
+    return summary
+  }
+  function switchGroupProvider(chatId, name) {
+    return setGroupBrain(chatId, { provider: name })
   }
 
-  return { validateConfig, beforeWrite, applyConfig, writeConfig, switchGroupProvider,
+  return { validateConfig, beforeWrite, applyConfig, writeConfig, switchGroupProvider, setGroupBrain,
     // Groups whose session the last applied write reset (for the console).
     appliedResets: () => [...appliedResets] }
 }

package/src/c2console.js

@@ -13,10 +13,11 @@ const READ_PATHS = ['/api/state', '/api/events', '/api/inbox', '/api/activity',
   '/api/plugins', '/api/design/styles', '/api/design/icons', '/api/fs/listdir',
   '/api/feishu/admin-candidates', '/api/feishu/org-users', '/api/feishu/resolve-contact',
   '/api/feishu/chats', '/api/feishu/chat-members', '/api/update', '/api/claude/models',
+  '/api/groups/model-options',
   START_PATH, CALLBACK_PATH]
 const WRITE_PATHS = ['/api/login', '/api/logout', '/api/logout/all',
   '/api/ui/network', '/api/ui/public-url', '/api/ui/update-settings', '/api/feishu/admins',
-  '/api/groups', '/api/groups/provider', '/api/fs/mkdir',
+  '/api/groups', '/api/groups/provider', '/api/groups/brain', '/api/fs/mkdir',
   '/api/groups/order', '/api/groups/policy', '/api/groups/redact',
   '/api/groups/codex-steer', '/api/groups/steer', '/api/groups/pause', '/api/groups/stop',
   // A fresh session only for an idle, settled group (same rule as /new).
@@ -38,9 +39,18 @@ const WRITE_PATHS = ['/api/login', '/api/logout', '/api/logout/all',
   // manages this exact entry (the updater refuses every other run mode).
   '/api/update/check', '/api/update/start', '/api/update/ignore']
 const SUPPORTED_RUNNERS = ['claude', 'codex']
-const { modelContext } = require('./modelcontext')
+const { groupBrain } = require('./core/brain')
+const { codexCatalogWindows, windowForProvider } = require('./agent/modelwindows')
 const { GROUP_COMMANDS } = require('./runtimefacts')
 
+// What a group runs on one backend, for console rows: configured values only;
+// what the executor finally selected is reported by the run itself.
+function brainFields(group, name, provider, cfg) {
+  const b = groupBrain(group, name, provider, { defaultProvider: cfg.defaultProvider })
+  return { model: b.model, reasoningEffort: b.effort, groupModel: b.groupModel, groupEffort: b.groupEffort,
+    source: b.groupModel ? 'group' : b.defaultModel ? 'provider' : 'default', actualModel: null }
+}
+
 function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld = () => new Map(), activity = null, store = null,
   assertWriterLock, validateConfig, applyConfig, beforeWrite = () => true,
   appliedResets = () => [], now = Date.now,
@@ -222,8 +232,7 @@ function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld =
         ? { usedTokens: stats.ctx, windowTokens: null, measuredAt: null, quality: 'historical' } : null)
       return { chatId, name: group.name || chatId.slice(-8), project: path.basename(group.workdir || '') || '—',
         workdir: group.workdir || '', runner: provider.runner || 'claude',
-        ...modelContext(group, provider),
-        reasoningEffort: (provider.runner === 'codex' ? provider.reasoningEffort : provider.env?.CLAUDE_CODE_EFFORT_LEVEL) || '',
+        ...brainFields(group, providerName, provider, cfg),
         paused: !!group.paused, ...live.groups[chatId], context }
     })
     const rows = getActivity().filter(row => (!query.chatId || row.chatId === query.chatId) && (!query.status || row.status === query.status))
@@ -249,8 +258,13 @@ function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld =
       for (const group of state.groups || []) {
         const cfg = getConfig(), source = cfg.groups?.[group.chatId] || {}
         const provider = cfg.providers?.[group.effectiveProvider || source.provider || cfg.defaultProvider]
-        const model = modelContext(source, provider)
-        Object.assign(group, { configuredModel: model.model, modelSource: model.source, actualModel: model.actualModel })
+        const name = group.effectiveProvider || source.provider || cfg.defaultProvider
+        const fields = brainFields(source, name, provider, cfg)
+        Object.assign(group, { configuredModel: fields.model, modelSource: fields.source,
+          actualModel: null, brain: { provider: name, model: fields.model, effort: fields.reasoningEffort,
+            groupModel: fields.groupModel, groupEffort: fields.groupEffort },
+          providerPrefs: source.providerPrefs || null,
+          contextWindow: provider ? windowForProvider({ ...provider, model: fields.model }, null, codexCatalogWindows()) : null })
       }
       state.previews = (state.previews || []).filter(item => getConfig().groups?.[item.chatId])
       state.leftovers = { supported: false, rows: [], error: null }
@@ -290,6 +304,8 @@ function createC2Console(options = {}) {
     throw new TypeError('C2 console requires explicit installation paths')
   }
   const facade = createC2ConsoleFacade(options)
+  // The process-wide model list (also used by /model), when the service has one.
+  facade.modelCatalog = typeof options.modelCatalog === 'function' ? options.modelCatalog : null
   const ui = createUiServer({ configPath, host, log, getConnHealth, updater: options.updater || null,
     onHostChange: options.onHostChange,
     getLiveState: facade.getLiveState, control: facade.control, runtimePolicy: facade,

package/src/c2multigroupservice.js

@@ -39,7 +39,7 @@ function createC2MultiGroupService({ routes, assertWriterLock,
   createTransport, createBinding, onFatal = () => {}, closeCapacity = () => {},
   quarantine = null, stopTimeoutMs = 2_000, drainTimeoutMs = 12_000,
   createRecoveryAuthority = null, holds = new Map(), sharedFault = () => null,
-  ingressWaitMs = 60_000, now = Date.now, log = () => {} } = {}) {
+  ingressWaitMs = 60_000, onModelCard = null, now = Date.now, log = () => {} } = {}) {
   if (!Array.isArray(routes) || !routes.length ||
       new Set(routes.map(route => route.chatId)).size !== routes.length ||
       routes.some(route => !route || typeof route.chatId !== 'string' ||
@@ -392,6 +392,26 @@ function createC2MultiGroupService({ routes, assertWriterLock,
       throw error
     }
   }
+  // Taps on the /model card only. They write the configuration through the
+  // same validated writer as the console and never touch a journal, receipt
+  // or session; every other card callback stays unsupported. The return
+  // value is the platform's synchronous answer (toast and replacement card).
+  function cardAction(event) {
+    let value = event?.action?.value
+    if (typeof value === 'string') { try { value = JSON.parse(value) } catch { value = null } }
+    if (typeof onModelCard !== 'function' || !value || value.a !== 'mc' || !allowed(event?.chatId)) {
+      return unsupported('card action')(event)
+    }
+    if (maintenance) return { toast: { type: 'info', content: '正在升级，稍后再点' } }
+    if (suspended.has(event.chatId)) return { toast: { type: 'warning', content: '本群暂停处理中，请管理员处理后再改' } }
+    const binding = bindings.get(event.chatId)
+    if (!binding) return { ignored: true }
+    return Promise.resolve().then(() => onModelCard({ ...event, action: { ...event.action, value } }, binding))
+      .catch(error => {
+        log(`model card ${event.chatId}: ${error?.message || String(error)}`)
+        return { toast: { type: 'error', content: '没改成 —— 请稍后再试' } }
+      })
+  }
   function unsupported(source) {
     return event => {
       // An event without group identity cannot safely be attributed. It has
@@ -507,7 +527,7 @@ function createC2MultiGroupService({ routes, assertWriterLock,
       transportStarted = true
       await transport.platform.start(routeMessage, { onFatal: fatal,
         onRecall: recall, onReaction: unsupported('reaction'),
-        onCardAction: unsupported('card action'), onBoardUpdated: unsupported('board update') })
+        onCardAction: cardAction, onBoardUpdated: unsupported('board update') })
       held()
       if (stopPromise) throw new Error('C2 service stopped during connection')
       return { groups: bindings.size, connected: true, ...(suspended.size ? { held: heldGroups() } : {}) }

package/src/config.js

@@ -25,14 +25,9 @@ const DEFAULTS = {
   // runs fully locked down (dontAsk ⇒ read-only safe set only), which is fail-closed.
   // maxTurnTimeMins defaults to 30: an uncapped runaway turn would
   // hold a concurrency slot and the group lock forever. 0 = explicitly off.
-  // autocompactTokens:传给 Claude --autocompact 的是压缩窗口,传给 Codex
-  // model_auto_compact_token_limit 的是请求阈值;两者均可能早于设置值触发。
-  // 多天连跑的群会话历史只增不减(2026-08-09 实测 4 天涨到
-  // 96 万 token 且两家 CLI 默认都没触发任何压缩),不设上限 = 每轮驮全量历史 + 闲置后整段重写缓存。
-  // 0 = 不指定 SintBot 阈值,交还 CLI 默认压缩行为。
   // ackDelayMs:收到真人消息后迟迟没动静,先回一声「已收到」的等待毫秒数(0 = 不发;
   // engine 侧另有 == null ? 25s 兜底,直构 Engine 不经本层合并也不失默认)。
-  agent: { bin: 'claude', permissionMode: 'dontAsk', maxTurnTimeMins: 30, maxConcurrent: 2, autocompactTokens: 400_000, ackDelayMs: 25_000 },
+  agent: { bin: 'claude', permissionMode: 'dontAsk', maxTurnTimeMins: 30, maxConcurrent: 2, ackDelayMs: 25_000 },
   // 时间口径(IANA 时区名):群内一切时间表述/消息时间戳/spawn 出去的 TZ 都按它,
   // 默认北京时间 —— 主机系统时区不参与(海外主机部署照样说北京时间)。
   timezone: DEFAULT_TZ,
@@ -87,6 +82,21 @@ function loadConfig(explicit) {
   return normalizeConfig(user, p)
 }
 
+// Collapse an explicit legacy global compression value into model settings at
+// the configuration boundary. Read-only until an authorized config write;
+// preserve per-model overrides, secret references, and every unrelated field.
+function migrateModelSettings(raw) {
+  if (!raw?.agent || !Object.hasOwn(raw.agent, 'autocompactTokens')) return raw
+  const n = Number(raw.agent.autocompactTokens) || 0
+  const compact = n > 0 ? Math.min(1_000_000, Math.max(100_000, Math.floor(n))) : 0
+  const agent = { ...raw.agent }
+  delete agent.autocompactTokens
+  const providers = Object.fromEntries(Object.entries({ ...DEFAULTS.providers, ...(raw.providers || {}) })
+    .map(([name, provider]) => [name, provider && typeof provider === 'object'
+      ? { ...provider, autocompactTokens: provider.autocompactTokens ?? compact } : provider]))
+  return { ...raw, agent, providers }
+}
+
 // The console validates proposed JSON before replacing the live file. Keep
 // normalization identical to disk loading without mutating the proposed object
 // or changing the live redaction registry during validation.
@@ -94,7 +104,7 @@ function normalizeConfig(raw, p = null, { registerSecrets = true } = {}) {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
     throw new TypeError('Configuration must be a JSON object')
   }
-  const user = JSON.parse(JSON.stringify(raw))
+  const user = migrateModelSettings(JSON.parse(JSON.stringify(raw)))
   const cfg = {
     agent: { ...DEFAULTS.agent, ...(user.agent || {}) },
     timezone: normalizeTz(user.timezone || DEFAULTS.timezone), // 写错回退默认,不漂到主机时区
@@ -293,4 +303,4 @@ function chatPlatform(cfg, chatId) {
   return live.length === 1 ? live[0] : null
 }
 
-module.exports = { loadConfig, normalizeConfig, findConfigPath, defaultConfigPath, DEFAULTS, applyProxyEnv, deriveNoProxy, resolveSecret, platformsConfigured, inferChatPlatform, normalizeGroupPlatforms, chatPlatform, PLATFORMS }
+module.exports = { loadConfig, normalizeConfig, migrateModelSettings, findConfigPath, defaultConfigPath, DEFAULTS, applyProxyEnv, deriveNoProxy, resolveSecret, platformsConfigured, inferChatPlatform, normalizeGroupPlatforms, chatPlatform, PLATFORMS }

package/src/core/brain.js

@@ -0,0 +1,117 @@
+'use strict'
+// Which model and thinking depth a group uses on one model card (backend).
+// This is the single resolver: runner input, card footer, /help · /model ·
+// /status, the agent manifest, the console and the activity rows all call it.
+//
+// Storage: groups[chatId].providerPrefs = { "<card name>": { model?, effort? } },
+// kept per backend. A group that moves between backends keeps each backend's
+// own choice: a model id from one backend is never passed to another, and
+// switching back does not silently fall back to something else.
+// A missing entry means "not chosen": the executor picks its own default.
+// Legacy groups[chatId].model belongs only to the backend the group was on
+// when it was written (group.provider, else defaultProvider).
+//
+// Only shapes are validated, never an allow list: model ids and depth names
+// evolve upstream, and values travel as argv/env entries without a shell.
+// A bad shape is treated as unset instead of failing the turn.
+
+const MODEL_RE = /^[\w.\-[\]:/]{1,80}$/
+const EFFORT_RE = /^[a-z]{2,16}$/
+
+const isModel = (s) => typeof s === 'string' && MODEL_RE.test(s)
+const isEffort = (s) => typeof s === 'string' && EFFORT_RE.test(s)
+
+// Legacy card-level values. Subscription cards no longer carry them after the
+// one-time migration; a third-party endpoint keeps its model as connection
+// configuration (it has no model list to choose from).
+function defaultModel(provider) {
+  const p = provider || {}
+  return p.model || (p.runner !== 'codex' && p.env && p.env.ANTHROPIC_MODEL) || ''
+}
+
+function defaultEffort(provider) {
+  const p = provider || {}
+  return (p.runner === 'codex' ? p.reasoningEffort : p.env && p.env.CLAUDE_CODE_EFFORT_LEVEL) || ''
+}
+
+// One entry → valid fields only; nothing valid ⇒ null.
+function cleanPref(x) {
+  if (!x || typeof x !== 'object' || Array.isArray(x)) return null
+  const o = {}
+  if (isModel(x.model)) o.model = x.model
+  if (isEffort(x.effort)) o.effort = x.effort
+  return Object.keys(o).length ? o : null
+}
+
+// Whole table: drop bad shapes, empty entries and (when known is given)
+// entries for cards that do not exist. An empty table becomes undefined.
+function normalizePrefs(prefs, known) {
+  if (!prefs || typeof prefs !== 'object' || Array.isArray(prefs)) return undefined
+  const out = {}
+  for (const [name, v] of Object.entries(prefs)) {
+    if (!/^[\w.-]+$/.test(name)) continue
+    if (known && !Object.prototype.hasOwnProperty.call(known, name)) continue
+    const c = cleanPref(v)
+    if (c) out[name] = c
+  }
+  return Object.keys(out).length ? out : undefined
+}
+
+/**
+ * @param group     groups[chatId] (may be empty)
+ * @param name      the card actually running this turn
+ * @param provider  cfg.providers[name]
+ * @param opts.defaultProvider top-level defaultProvider, only used to decide
+ *   which backend a legacy group.model belongs to
+ * @returns {{ model, effort, groupModel, groupEffort, defaultModel, defaultEffort }}
+ *   model / effort are effective values ('' = executor default);
+ *   groupX are the group's own choices ('' = not chosen).
+ */
+function groupBrain(group, name, provider, { defaultProvider = '' } = {}) {
+  const g = group || {}
+  const pref = cleanPref(g.providerPrefs && typeof g.providerPrefs === 'object' ? g.providerPrefs[name] : null) || {}
+  const home = g.provider || defaultProvider || ''
+  const legacy = (!pref.model && isModel(g.model) && (!home || home === name)) ? g.model : ''
+  const groupModel = pref.model || legacy
+  const groupEffort = pref.effort || ''
+  const dm = defaultModel(provider)
+  const de = defaultEffort(provider)
+  return { model: groupModel || dm, effort: groupEffort || de, groupModel, groupEffort, defaultModel: dm, defaultEffort: de }
+}
+
+// Move legacy group.model under the backend it belonged to (mutates the raw
+// group). Every writer that changes group.provider calls this first, so the
+// legacy id never attaches itself to the new backend. Returns whether it changed.
+function migrateLegacyModel(g, defaultProvider) {
+  if (!g || typeof g !== 'object' || g.model === undefined) return false
+  const home = g.provider || defaultProvider || ''
+  if (home && isModel(g.model)) {
+    const prefs = (g.providerPrefs && typeof g.providerPrefs === 'object' && !Array.isArray(g.providerPrefs)) ? g.providerPrefs : {}
+    const cur = cleanPref(prefs[home]) || {}
+    if (!cur.model) prefs[home] = { ...cur, model: g.model }
+    g.providerPrefs = prefs
+  }
+  delete g.model
+  return true
+}
+
+// Active groups whose current backend lacks a choice (doctor and console use
+// the same rule). A subscription card without a model and any card without a
+// depth are listed. Paused groups are skipped.
+// Returns [{ chatId, name, provider, lack: ['model' | 'effort'] }].
+function missingPicks(cfg) {
+  const out = []
+  const provs = (cfg && cfg.providers) || {}
+  for (const [id, g] of Object.entries((cfg && cfg.groups) || {})) {
+    if (!g || typeof g !== 'object' || id === 'oc_example_chat_id' || g.paused === true) continue
+    const pn = g.provider || cfg.defaultProvider
+    const pv = provs[pn]
+    if (!pv) continue
+    const b = groupBrain(g, pn, pv, { defaultProvider: cfg.defaultProvider })
+    const lack = [!b.model && !pv.baseUrl ? 'model' : '', !b.effort ? 'effort' : ''].filter(Boolean)
+    if (lack.length) out.push({ chatId: id, name: g.name || '', provider: pn, lack })
+  }
+  return out
+}
+
+module.exports = { groupBrain, normalizePrefs, cleanPref, migrateLegacyModel, missingPicks, defaultModel, defaultEffort, isModel, isEffort, MODEL_RE, EFFORT_RE }

package/src/core/c2inputrejection.js

@@ -7,16 +7,20 @@
 const CODE = 'C2_V2_INPUT_REJECTED'
 const FEISHU_MESSAGE_ID = /^om_[A-Za-z0-9_-]{1,124}$/
 
-function rejectC2Input(message, { reason, notice = null } = {}) {
+function rejectC2Input(message, { reason, notice = null, card = null } = {}) {
   if (typeof message !== 'string' || !message ||
       typeof reason !== 'string' || !/^[a-z][a-z-]{0,40}$/.test(reason) ||
-      notice !== null && (typeof notice !== 'string' || !notice)) {
+      notice !== null && (typeof notice !== 'string' || !notice) ||
+      card !== null && (typeof card !== 'object' || Array.isArray(card))) {
     throw new TypeError('C2 input rejection needs a message, reason and optional notice')
   }
   const error = new Error(message)
   error.code = CODE
   error.reason = reason
   error.notice = notice
+  // An optional interactive card (the /model card) sent instead of the text;
+  // the text stays the fallback when the card is not confirmed.
+  if (card) error.card = card
   return error
 }
 
@@ -33,10 +37,19 @@ async function answerC2InputRejection({ error, msg, platform, log = () => {} } =
   if (error.notice && typeof platform?.replyOnce === 'function' &&
       typeof msg?.chatId === 'string' && target?.chatId === msg.chatId &&
       FEISHU_MESSAGE_ID.test(target?.messageId || '')) {
-    try {
-      const response = await platform.replyOnce(target, error.notice)
-      notified = response?.code === 0
-    } catch {}
+    if (error.card && typeof platform.replyCardOnce === 'function') {
+      try {
+        const response = await platform.replyCardOnce(target, error.card)
+        notified = response?.code === 0
+      } catch {}
+      if (!notified) log(`input rejection card not confirmed (${error.reason}); sending text`)
+    }
+    if (!notified) {
+      try {
+        const response = await platform.replyOnce(target, error.notice)
+        notified = response?.code === 0
+      } catch {}
+    }
     if (!notified) log(`input rejection notice not confirmed (${error.reason})`)
   }
   return Object.freeze({ rejected: true, reason: error.reason, notified })

package/src/core/c2runnerinput.js

@@ -6,7 +6,7 @@ const { followupEnabled } = require('../agent/privatecore')
 // process-local arguments. It neither starts a child nor persists text,
 // credentials, callback handles, or environment values.
 function prepareC2RunnerInput({ prompt, appendSystemPrompt, msg, group, provider,
-  config, sessionId = null, signal, extraEnv, onTurnAccepted, onSpawnFailed, onDurableEvent,
+  config, brain = null, sessionId = null, signal, extraEnv, onTurnAccepted, onSpawnFailed, onDurableEvent,
   onEvent = () => {}, onSteerReady, onSteerLanded, log = () => {} } = {}) {
   if (typeof prompt !== 'string' || !prompt ||
       typeof appendSystemPrompt !== 'string' || !appendSystemPrompt ||
@@ -14,6 +14,8 @@ function prepareC2RunnerInput({ prompt, appendSystemPrompt, msg, group, provider
       !group || typeof group.workdir !== 'string' || !group.workdir ||
       !provider || !['claude', 'codex'].includes(provider.runner) ||
       !config || !config.agent || typeof config.agent !== 'object' ||
+      (brain !== null && (typeof brain !== 'object' || typeof brain.model !== 'string' ||
+        typeof brain.effort !== 'string')) ||
       (sessionId !== null && (typeof sessionId !== 'string' || !sessionId)) ||
       !signal || typeof signal.aborted !== 'boolean' ||
       !extraEnv || typeof extraEnv !== 'object' || Array.isArray(extraEnv) ||
@@ -34,9 +36,9 @@ function prepareC2RunnerInput({ prompt, appendSystemPrompt, msg, group, provider
         typeof onSteerLanded !== 'function'))) {
     throw new TypeError('C2 follow-up needs durable control callbacks')
   }
-  // A model card can override the old global setting. Missing means legacy
-  // configs keep their previous behavior; explicit zero delegates to the CLI.
-  const rawCompact = Number(provider.autocompactTokens ?? config.agent.autocompactTokens) || 0
+  // Model settings are resolved once at the configuration boundary.
+  // Missing or zero leaves compaction to the executor.
+  const rawCompact = Number(provider.autocompactTokens) || 0
   const autocompactTokens = rawCompact > 0
     ? Math.min(1_000_000, Math.max(100_000, Math.floor(rawCompact))) : 0
   return {
@@ -47,7 +49,10 @@ function prepareC2RunnerInput({ prompt, appendSystemPrompt, msg, group, provider
     steer: !isCodex && enabled,
     codexProjectDocFallback: isCodex && group.codexProjectDocFallback === true,
     onSteerReady, onSteerLanded,
-    model: group.model,
+    // The group's model and depth on this backend (core/brain.js); empty
+    // leaves the choice to the executor.
+    model: brain ? brain.model || undefined : group.model,
+    effort: brain ? brain.effort : '',
     workdir: group.workdir,
     sessionId,
     permissionMode: group.permissionMode || 'dontAsk',

package/src/core/modelcmd.js

@@ -0,0 +1,132 @@
+'use strict'
+// 群命令 /model 的词法。纯函数 —— core 不认 runner 名:哪家有什么型号 / 深度,由 bin 注入的
+// modelCatalog 给出形状 { ok, models: [{ id, efforts? }] | null, aliases: [], efforts: [] }(models 为 null = 这家
+// 没有可选清单,型号只能在后台改)。
+//
+// 写法:`/model` 后面的每个词各自**精确**匹配一类(大小写不敏感,顺序随意,每类最多一个):
+//   后端(模型卡名)· 深度(档位名)· 型号(目标后端清单里的 id 或别名)。
+//   没有「默认」可回(模型卡上不再有默认型号 / 深度,⇒「默认 / default」不再是重置词,当认不出的词整条拒绝。
+// ⚠ **不做模糊匹配**(口径):认不出一个词就整条拒绝、一项都不改 —— 换错模型 = 换了花的钱,
+//   宁可让人重发一条也不猜;此前「只认第一个词、后面的悄悄扔掉」正是要修的坑(`/model claude sonnet` 丢了 sonnet)。
+// 型号可以照显示名打:`/model opus-5.5` · `/model Opus 5.5` · `/model claude-opus-5-5` · `/model GPT-6.1 Terra` 是对应的同一个 ——
+//   比对键见 core/modelname.js modelKey(大小写、claude- 前缀、点 / 连字符 / 空格不算),仍是拿清单**逐个精确比对**;
+//   两个清单项归一后撞了键 ⇒ 当认不出(不替人挑)。「Opus 5.5」被空格拆成两个词:一个词后面紧跟纯版本号(5.5 / 4.8)
+//   或变体((1M) / [1m])就并回一个词。
+
+const { modelKey } = require('./modelname')
+
+// 识别为「深度」这一类的词(能不能用再按目标后端 / 型号查)。Claude Code 的五档 + Codex 服务端认的两档低档。
+const EFFORT_WORDS = ['none', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max']
+const VERSION_RE = /^\d+(?:[.-]\d+)*$/
+const VARIANT_RE = /^[[(][a-z0-9]+[\])]$/i
+
+// 「Opus 5.5 (1M)」「GPT-6.1 Terra」这类被空格拆开的显示名并回一个词:字母结尾 + 纯版本号 · 数字结尾 + 变体 ·
+// 数字结尾 + 纯字母词(Codex 官方名称「GPT-6.1 Terra」照着打被拆成两个词、整条拒绝)。
+// 只在型号类的词之间并:后端名 / 深度词不并、也不被并(`/model gpt-6-luna low` 的 low 仍是深度)。
+function joinVersionWords(words, isOther) {
+  const out = []
+  for (const raw of words || []) {
+    const w = String(raw || '').trim()
+    if (!w) continue
+    const prev = out[out.length - 1]
+    const glue = prev !== undefined && !isOther(prev) && !isOther(w) && (
+      VERSION_RE.test(w) ? /[a-z]$/i.test(prev)
+        : VARIANT_RE.test(w) ? /\d$/.test(prev)
+          : /^[a-z]+$/i.test(w) && /\d$/.test(prev))
+    if (glue) out[out.length - 1] = prev + ' ' + w
+    else out.push(w)
+  }
+  return out
+}
+
+/**
+ * @param words          命令后面的词
+ * @param providerNames  群里可选的模型卡名(没隐藏的)
+ * @returns {{ provider?, model?, models?, effort? } | { error: { kind: 'dup', what, a, b } }}
+ *   model 原样保留大小写(查清单时再归一成清单里的写法);型号类写了不止一个 ⇒ models(调用方先逐个认,再判重)
+ */
+function parseModelWords(words, providerNames = []) {
+  const names = new Map(providerNames.map((n) => [String(n).toLowerCase(), n]))
+  const out = {}
+  const isOther = (w) => { const lw = w.toLowerCase(); return names.has(lw) || EFFORT_WORDS.includes(lw) }
+  for (const w of joinVersionWords(words, isOther)) {
+    const lw = w.toLowerCase()
+    if (names.has(lw)) {
+      const n = names.get(lw)
+      if (out.provider && out.provider !== n) return { error: { kind: 'dup', what: '后端', a: out.provider, b: n } }
+      out.provider = n
+    } else if (EFFORT_WORDS.includes(lw)) {
+      if (out.effort && out.effort !== lw) return { error: { kind: 'dup', what: '深度', a: out.effort, b: lw } }
+      out.effort = lw
+    } else {
+      // 型号这一类先都收下,由调用方按清单逐个认:两个词里有认不出的 ⇒ 报「认不出」(多半是打错 / 隐藏的后端名),
+      // 都认得出才报「一次只能选一个型号」—— 否则 `/model claude sonnet`(claude 被隐藏)会得到一句莫名其妙的「写了两个型号」
+      const ws = out.models || (out.models = [])
+      if (!ws.some((x) => x.toLowerCase() === lw)) ws.push(w)
+    }
+  }
+  if (out.models && out.models.length === 1) { out.model = out.models[0]; delete out.models }
+  return out
+}
+
+// 词 → 清单里的规范写法(id 或别名);认不出 ⇒ null。先原样比(大小写不敏感),再按比对键比 —— 键撞了不止一项 ⇒ null(不替人挑)。
+// 实时清单带 aliasOf(opus → claude-opus-5-5)⇒ 别名认成它此刻指向的**具体型号**存下(钉住,CLI 升级不悄悄换代);
+//   官方显示名(「GPT-6.1 Terra」)也参与比对键 —— 照卡上 / 控制台看到的名字打就认。
+function resolveModel(word, cat) {
+  if (!word || !cat) return null
+  const lw = String(word).toLowerCase()
+  const models = (cat.models || []).map((m) => ({ id: String(m.id), name: m.name ? String(m.name) : '' }))
+  const ids = [...models.map((m) => m.id), ...(cat.aliases || []).map(String)]
+  const hit = ids.find((x) => x.toLowerCase() === lw)
+  if (hit) return hit
+  const aliasOf = cat.aliasOf && typeof cat.aliasOf === 'object' ? cat.aliasOf : {} // 别名走下面的比对键(大小写不敏感,与原样比等价)
+  const k = modelKey(word)
+  if (!k) return null
+  const keyed = new Set(ids.filter((x) => modelKey(x) === k))
+  for (const m of models) if (m.name && modelKey(m.name) === k) keyed.add(m.id)
+  for (const a of Object.keys(aliasOf)) if (modelKey(a) === k && ids.includes(aliasOf[a])) keyed.add(aliasOf[a])
+  return keyed.size === 1 ? [...keyed][0] : null
+}
+
+// 这家(某型号下)能选的深度:清单里该型号自带档位就用它的,否则用这家的通用档位
+function effortsFor(cat, modelId) {
+  const m = cat && modelId ? (cat.models || []).find((x) => x.id === modelId) : null
+  return (m && Array.isArray(m.efforts) && m.efforts.length) ? m.efforts : ((cat && cat.efforts) || [])
+}
+
+// 群里列给人看的型号:别名在前(短、好打),再列完整 id
+function modelChoices(cat) {
+  if (!cat || !Array.isArray(cat.models)) return []
+  return [...(cat.aliases || []), ...cat.models.map((m) => m.id)]
+}
+
+// 某型号的推荐深度:清单里它自带默认档(Codex defaultReasoningEffort)就用它的;否则这家的推荐档
+// (cat.recommended.effort,Claude 系 xhigh);都不在这型号可选的档里 ⇒ high ⇒ 第一档。没有清单 ⇒ ''。
+function recommendEffort(cat, modelId) {
+  if (!cat) return ''
+  const list = effortsFor(cat, modelId)
+  const m = modelId && Array.isArray(cat.models) ? cat.models.find((x) => x.id === modelId) : null
+  for (const e of [m && m.defEffort, cat.recommended && cat.recommended.effort, 'high']) if (e && list.includes(e)) return e
+  return list[0] || ''
+}
+
+// 补齐本群在目标后端上缺的选择(;群里 /model、模型卡、控制台群卡同一份)。没有「默认」之后,缺项不再静静跟随模型卡:
+//   换后端且那一家**实际生效的**型号是空的(没选过、也没有迁移前遗留的卡上默认;第三方除外)⇒ 推荐型号;
+//   换后端 / 换型号时实际生效的深度是空的、或新型号没有这一档 ⇒ 这型号的推荐档。
+//   只调深度不补型号(补了就换脑、开新对话,与「只调深度接着聊」冲突)。返回 { model, effort, filled: ['型号','深度'] }。
+function fillPicks({ switching = false, model, effort, currentModel = '', currentEffort = '', third = false, cat = null } = {}) {
+  const filled = []
+  const rec = cat && cat.ok !== false && cat.recommended ? cat.recommended : null
+  if (switching && model === undefined && !currentModel && !third && rec && rec.model) { model = rec.model; filled.push('型号') }
+  const next = model === undefined ? currentModel : model
+  if (effort === undefined && cat && cat.ok !== false && (switching || model !== undefined)) {
+    const effs = effortsFor(cat, next)
+    if (!currentEffort || (effs.length && !effs.includes(currentEffort))) {
+      const e = recommendEffort(cat, next)
+      if (e && e !== currentEffort) { effort = e; if (!currentEffort) filled.push('深度') }
+    }
+  }
+  return { model, effort, filled }
+}
+
+module.exports = { parseModelWords, resolveModel, effortsFor, modelChoices, recommendEffort, fillPicks, EFFORT_WORDS }