sintbot 1.4.15 → 1.4.17

package/docs/zh-CN/install.md

@@ -1,4 +1,4 @@
-# 安装 SintBot 1.4.15
+# 安装 SintBot 1.4.17
 
 [English](../install.md) · 简体中文
 
@@ -10,13 +10,47 @@
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-安装器会自动检查环境，把 `sintbot@1.4.15` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.15` 就可以继续。不需要 sudo。
+安装器会自动检查环境，把 `sintbot@1.4.17` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.17` 就可以继续。不需要 sudo。
 
 可选预览：在命令末尾加 `-s -- --dry-run`。要自定义安装位置，设置 `SINTBOT_INSTALL_DIR` 环境变量，并同步修改后面的可执行文件路径。
 
-## 2. 连接飞书
+## 2. 扫码接入（推荐）
 
-在 [飞书开放平台](https://open.feishu.cn/) 创建企业自建应用，启用机器人、接收和回复消息的权限，事件订阅选择长连接并订阅消息接收。发布应用后，把机器人加入要使用的群，取得每个群的 `oc_…` 群 ID。
+前提：手机飞书当前处于企业/团队身份；没有组织的个人身份扫不了，需先新建一个团队（免费）。扫码创建的应用归扫码人所在的组织，公司普通成员建了自己删不掉。
+
+```bash
+"$HOME/.local/share/sintbot/bin/sintbot" connect
+```
+
+终端先打印扫码链接，并打开一个本机页面显示二维码；用飞书扫码、在手机上确认。随后它依次：取得应用凭证（并打印应用 ID）→ 自检 → 放开通讯录范围与可用范围并发布版本 → 创建群并把你拉进去 → 新建项目目录 `~/Projects/sintbot`（含一个 `README.md`）→ 写入 `~/.sbot/config.json` → 初始化消息日志。每一步的结果都会打印。扫码一旦确认，应用就已在你的组织里创建；之后任一检查或建群失败都会在建目录、写配置之前停下，并给出带 `--app-id` 的重跑命令。
+
+- 凭证明文写在 `~/.sbot/config.json`（文件 0600、目录 0700）。要改回环境变量，把 `appId` / `appSecret` 改成 `"env:FEISHU_APP_ID"` / `"env:FEISHU_APP_SECRET"`，并在每次启动前导出这两个变量。
+- `--basic`：公司组织里的非管理员使用。不申请 `application:application:patch`，跳过放开范围与发布；之后请管理员在开放平台补这两步。
+- `--app-id cli_…`：复用已有应用（给它追加权限，不新建），用于中途停下后重跑或审核通过后继续。只在没有配置文件、或配置文件属于这个应用且还没绑定任何群时允许；已绑定群的配置不会被替换。
+- `--chat oc_…`：不自动建群，直接绑定你手动建好并拉入机器人的群（建群失败时的提示里会给出这条命令）。
+- `--workdir /绝对路径`：绑定一个已存在的目录，不新建；`--name` 换默认目录名；`--provider codex|claude` 指定执行器（本机只装了一个时自动选）；`--no-open` 只打印链接、不打开页面。
+- 已有飞书配置或服务正在运行时，`connect` 会拒绝执行。扫码会申请模型卡所需的卡片回调。`/model` 点选卡没有反应时，按第 4 节检查回调订阅。
+
+## 3. 首次启动
+
+`connect` 已经完成初始化，直接启动：
+
+```bash
+"$HOME/.local/share/sintbot/bin/sintbot" start --config "$HOME/.sbot/config.json" --ui
+```
+
+它会预检配置和执行器、连接飞书并打开本机控制台。保持终端开启。在群里发“读取项目 README 的第一行，只回复这一行”，并和 `~/Projects/sintbot/README.md` 对照。预检通过不代表飞书认证或消息送达已经验证。
+
+## 4. 手动接入（备选）
+
+扫码失败、管理员不放行，或者想自己管理应用时，走下面的手动路径；内容与之前的安装步骤相同。
+
+<details>
+<summary>展开手动步骤</summary>
+
+#### 4.1 创建应用
+
+在 [飞书开放平台](https://open.feishu.cn/) 创建企业自建应用，启用机器人、接收和回复消息的权限，事件订阅选择长连接并订阅消息接收；回调订阅同样选择长连接接收回调并订阅卡片回传交互（群里点选 `/model` 卡片要用）。发布应用后，把机器人加入要使用的群，取得每个群的 `oc_…` 群 ID。
 
 在 macOS 默认终端中输入应用凭据（密钥输入时不显示）：
 
@@ -29,7 +63,7 @@ export FEISHU_APP_ID FEISHU_APP_SECRET
 
 不要把密钥发进群或提交到仓库。后续步骤都在这个终端里做；新开终端时需要重新设置这两个变量。
 
-## 3. 绑定项目
+#### 4.2 手写配置
 
 用 `mkdir -p ~/.sbot && chmod 700 ~/.sbot` 创建私有配置目录，再创建 `~/.sbot/config.json`。把群 ID 和项目绝对路径换成你自己的，项目目录必须已经存在。下面的示例绑定两个群：一个用 Codex，一个用 Claude Code。只有一个群时删掉另一项即可。
 
@@ -69,9 +103,9 @@ export FEISHU_APP_ID FEISHU_APP_SECRET
 - 要固定 Claude 型号，可在 `providers.claude` 里加 `"model"`；不写就用这台机器上 Claude Code 的默认模型。
 - 同时运行的任务默认最多 2 个，可在顶层加 `"agent": { "maxConcurrent": 4 }` 调整（1–32）。
 
-## 4. 首次启动
+#### 4.3 初始化并启动
 
-在刚才的终端里一次复制执行：
+在刚才的终端里一次复制执行（手动路径需要自己执行 `init`）：
 
 ```bash
 SINTBOT="$HOME/.local/share/sintbot/bin/sintbot"
@@ -84,6 +118,8 @@ SINTBOT="$HOME/.local/share/sintbot/bin/sintbot"
 
 在群里发“读取项目 README 的第一行，只回复这一行”，并和本地文件对照。预检通过不代表飞书认证或消息送达已经验证。
 
+</details>
+
 ## 5. 在群里使用
 
 直接发文字就是给它派任务。回复以卡片呈现：模型开始输出时出现；25 秒还没有输出也会先出现。运行中卡片显示已跑多久、正在做什么和已完成的步骤，结束后这些步骤收进「过程」折叠区。
@@ -94,7 +130,7 @@ SINTBOT="$HOME/.local/share/sintbot/bin/sintbot"
 | `/skip` | 只放弃当前任务，排队的接着处理，之前的对话保留 |
 | `/stop` | 停止当前任务，连同排队的一起取消；之前的对话保留 |
 | `/new` | 忘掉之前的对话，开始新的一段（只在本群空闲时生效） |
-| `/model` | 查看可选模型；`/model 名字` 切换（只在本群空闲时生效，切换后开始新的一段对话） |
+| `/model` | 打开点选卡，选后端、型号和思考深度后点「确认更新」；也可直接发 `/model high`、`/model 型号`、`/model 后端`。换型号或调深度接着当前对话，换后端开始新的一段对话；只在本群空闲时生效 |
 | `/hud` | 当前模型的额度与本段对话的用量 |
 | `/issue 一句话` | 记下问题反馈，在控制台概览里查看和标记处理 |
 | `/help` | 查看可用命令，以及本群的项目和模型 |
@@ -107,7 +143,7 @@ Codex 和 Claude Code 的忙时跟进默认开启；`steer:false` 改为排队
 
 ## 6. 控制台
 
-模型卡区分设置值与运行回报，容量依据可在「容量与运行信息」中查看。Codex 上下文窗口和各模型自动压缩都只提供「执行器默认 / 自定义」，仅自定义时显示数值输入；从下轮生效，保留当前会话。Codex 自定义窗口不能超过已知目录上限。压缩值对 Codex 表示阈值，对 Claude Code 表示窗口，实际可能提前触发。旧配置中的全局压缩值会转换为原有各模型的独立值，已有逐模型设置优先；新模型默认交给执行器，不继续继承旧全局值。读取不改磁盘，下一次正常保存配置时写入转换结果。
+型号与思考深度按群选：在「群 · 项目」卡的「模型」行选后端和型号，下一行选深度，清单取自本机 Codex / Claude Code 的实时数据；订阅登录的模型卡上不再设型号和深度，第三方端点的型号仍在模型卡上设置。升级后，模型卡上原有的型号和深度会自动写进各群，生效值不变、会话不重置，改前备份配置。模型卡区分设置值与运行回报，容量依据可在「容量与运行信息」中查看。Codex 上下文窗口和各模型自动压缩都只提供「执行器默认 / 自定义」，仅自定义时显示数值输入；从下轮生效，保留当前会话。Codex 自定义窗口不能超过已知目录上限。压缩值对 Codex 表示阈值，对 Claude Code 表示窗口，实际可能提前触发。旧配置中的全局压缩值会转换为原有各模型的独立值，已有逐模型设置优先；新模型默认交给执行器，不继续继承旧全局值。读取不改磁盘，下一次正常保存配置时写入转换结果。
 
 概览合并群项目与并发信息，每行显示执行器、状态与耗时、项目目录、模型和配置的思考深度、最近上报的上下文用量。选择群后查看对应任务，展开任务查看工具、回复和用量。上下文是当前会话采样，不是累计消耗；容量未知或历史采样会明确标注。群行图标按当前状态提供插话、停止与新会话操作。
 
@@ -123,7 +159,7 @@ Codex 和 Claude Code 的忙时跟进默认开启；`steer:false` 改为排队
 
 ## 停止与重启
 
-按 Ctrl-C 并等待退出。确认飞书环境变量已设置，再执行：
+按 Ctrl-C 并等待退出。配置里用的是 `env:` 引用时，先确认环境变量已设置，再执行：
 
 ```bash
 "$HOME/.local/share/sintbot/bin/sintbot" start --config "$HOME/.sbot/config.json" --ui

package/install.sh

@@ -2,7 +2,7 @@
 # The function is parsed in full before installation starts, including when piped.
 sintbot_install() (
   set -eu
-  version=1.4.15
+  version=1.4.17
   prefix="${SINTBOT_INSTALL_DIR:-$HOME/.local/share/sintbot}"
   fail() { printf 'SintBot: %s\n' "$*" >&2; exit 1; }
   case "${1:-}" in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sintbot",
-  "version": "1.4.15",
+  "version": "1.4.17",
   "private": false,
   "description": "Drive your Mac projects from Feishu groups with Codex or Claude Code, using a built-in agent core.",
   "bin": {
@@ -51,8 +51,9 @@
     "src/agent/codexapp.js",
     "src/agent/codexcode.js",
     "src/agent/codexstatus.js",
-    "src/agent/modelwindows.js",
+    "src/agent/envconflicts.js",
     "src/agent/errtag.js",
+    "src/agent/modelwindows.js",
     "src/agent/privatecore.js",
     "src/agent/privatecore.wasm",
     "src/agent/runner.js",
@@ -69,8 +70,10 @@
     "src/c2upgradeswitch.js",
     "src/cdp.js",
     "src/config.js",
+    "src/connect.js",
     "src/consolesay.js",
     "src/consoletrials.js",
+    "src/core/brain.js",
     "src/core/c2cardeffectbridge.js",
     "src/core/c2cardterminalpath.js",
     "src/core/c2durableingress.js",
@@ -104,6 +107,8 @@
     "src/core/issues.js",
     "src/core/ledger.js",
     "src/core/mdtable.js",
+    "src/core/modelcmd.js",
+    "src/core/modelname.js",
     "src/core/proxy.js",
     "src/core/redact.js",
     "src/core/store.js",
@@ -114,10 +119,12 @@
     "src/design.js",
     "src/feishucli.js",
     "src/gitrepo.js",
+    "src/groupbrain.js",
     "src/leftover.js",
-    "src/modelcontext.js",
+    "src/modelcatalog.js",
     "src/platform/board.js",
     "src/platform/feishu.js",
+    "src/platform/modelcard.js",
     "src/platform/multi.js",
     "src/platform/noticecard.js",
     "src/platform/noticesend.js",

package/src/agent/claudecode.js

@@ -55,7 +55,7 @@ function durableToolResults(ev) {
 // replaces provider.baseUrl for ANTHROPIC_BASE_URL — used to point `claude` at
 // the local vision strip-proxy for text-only providers. The auth
 // token is unchanged: the proxy forwards it verbatim to the real upstream.
-function buildEnv(provider = {}, baseUrlOverride, extraEnv) {
+function buildEnv(provider = {}, baseUrlOverride, extraEnv, effort = '') {
   const env = { ...process.env }
 
   // The spawn env is defined ENTIRELY by the provider:
@@ -83,6 +83,8 @@ function buildEnv(provider = {}, baseUrlOverride, extraEnv) {
   delete env.CLAUDECODE
 
   if (provider.env) Object.assign(env, provider.env)
+  // The group's own thinking depth wins over a card-level value.
+  if (effort) env.CLAUDE_CODE_EFFORT_LEVEL = effort
   // Engine-injected non-provider context (e.g. SBOT_CHAT_ID for the feishu base skill).
   // Applied last but namespaced (SBOT_*), so it never collides with provider ANTHROPIC_* env.
   if (extraEnv) Object.assign(env, extraEnv)
@@ -137,6 +139,7 @@ function runTurn({
   prompt,
   provider = {},
   model,
+  effort = '',
   workdir,
   sessionId,
   permissionMode,
@@ -238,7 +241,7 @@ function runTurn({
       const { file, spawnArgs, fallback } = resolveSpawn(bin, args)
       if (fallback) log(`配置的 agent 路径 '${bin}' 不存在,本轮改用 ${fallback} —— 请把配置改回正确路径`) // 兜底只救急,配置仍是错的
       const child = spawnFn(file, spawnArgs, {
-        env: buildEnv(provider, baseUrlOverride, extraEnv),
+        env: buildEnv(provider, baseUrlOverride, extraEnv, effort),
         cwd: workdir || process.cwd(),
         stdio: ['pipe', 'pipe', 'pipe'],
         windowsHide: true,

package/src/agent/claudemodels.js

@@ -17,15 +17,16 @@ const fs = require('node:fs')
 const os = require('node:os')
 const path = require('node:path')
 
-// 当前主力档 + 上一代 Opus。刻意不铺满历史版本 —— 它是挑选快捷方式,不是权威清单;
-// 4.8 留着是因为它仍在服务且额度池与 Opus 5 分开(operator 点名要能选,2026-08-05)。
-// ⚠ id 是不带日期后缀的固定串(`claude-opus-4-8`,不是 `claude-opus-4-8-2026xxxx`)。
+// Fallback candidates, used only when the live list from the CLI handshake
+// has never been obtained. Names follow core/modelname.js display names.
+// Ids carry no date suffix and use hyphens for versions (claude-opus-5-5).
 const BUILTIN = [
   { id: '', name: '默认(跟随 Claude Code)', note: '推荐 · 不指定型号' },
-  { id: 'claude-opus-5', name: 'Claude Opus 5', note: '最强 · 复杂改码 / 长链路' },
-  { id: 'claude-opus-4-8', name: 'Claude Opus 4.8', note: '上一代 Opus · 额度池独立' },
-  { id: 'claude-sonnet-5', name: 'Claude Sonnet 5', note: '速度与智能平衡' },
-  { id: 'claude-haiku-4-5', name: 'Claude Haiku 4.5', note: '最快最省 · 简单任务' },
+  { id: 'claude-opus-5-5', name: 'Opus 5.5', note: '最新 Opus · 复杂改码 / 长链路' },
+  { id: 'claude-opus-5', name: 'Opus 5', note: '上一代 Opus' },
+  { id: 'claude-sonnet-5-5', name: 'Sonnet 5.5', note: '速度与智能平衡' },
+  { id: 'claude-haiku-5-5', name: 'Haiku 5.5', note: '最快最省 · 简单任务' },
+  { id: 'claude-opus-4-8', name: 'Opus 4.8', note: '更早一代 Opus · 额度池独立' },
 ]
 
 // CLI 登录后写在 ~/.claude.json 的账号额外可选模型(本机这台是 Fable 5)。
@@ -57,4 +58,74 @@ function listModels({ loggedIn, home } = {}) {
   return { loggedIn: true, models: mergeModels(extra), source: extra.length ? 'account' : 'builtin' }
 }
 
-module.exports = { listModels, mergeModels, parseExtraModels, readExtraModels, BUILTIN }
+// Live list: Claude Code's own initialize handshake. Start
+// `claude -p --input-format stream-json --output-format stream-json`, send one
+// control_request { subtype: 'initialize' }; the response's models are the
+// CLI's /model menu for this machine and account: official display names,
+// descriptions and the depths each model supports. No question is asked and
+// no turn starts, so no quota is used, and the login token is never read.
+// Only for subscription cards: endpoint/model variables are removed first so a
+// third-party endpoint exported in the service shell cannot redirect it.
+// Unavailable (signed out, CLI too old, timeout) ⇒ null; callers then use the
+// last saved list or the built-in candidates.
+function parseInitModels(models) {
+  if (!Array.isArray(models)) return null
+  const out = [], aliasOf = {}
+  let recommended = ''
+  const seen = new Set()
+  for (const m of models) {
+    if (!m || typeof m.value !== 'string' || !m.value) continue
+    const id = typeof m.resolvedModel === 'string' && m.resolvedModel ? m.resolvedModel : m.value
+    if (m.value === 'default') { recommended = id; continue }
+    // An alias (opus → claude-opus-5-5) is stored as the concrete model, so a
+    // later CLI upgrade does not silently move the group to another generation.
+    if (m.value !== id) aliasOf[m.value] = id
+    if (seen.has(id)) continue
+    seen.add(id)
+    const efforts = Array.isArray(m.supportedEffortLevels) ? m.supportedEffortLevels.filter((e) => typeof e === 'string') : []
+    out.push({ id, name: String(m.displayName || '').trim() || id, note: String(m.description || '').slice(0, 60), efforts, effort: m.supportsEffort !== false })
+  }
+  if (!out.length) return null
+  return { models: out, aliasOf, recommended: recommended || out[0].id }
+}
+
+function probeModels(bin = 'claude', { timeoutMs = 20000, cwd = os.tmpdir(), spawnFn = null } = {}) {
+  return new Promise((resolve) => {
+    const spawn = spawnFn || require('node:child_process').spawn
+    const { resolveSpawn } = require('./winexec')
+    const env = { ...process.env }
+    delete env.ANTHROPIC_BASE_URL; delete env.ANTHROPIC_AUTH_TOKEN; delete env.ANTHROPIC_MODEL; delete env.CLAUDECODE
+    let child, buf = '', settled = false, timer = null
+    const done = (v) => {
+      if (settled) return
+      settled = true
+      clearTimeout(timer)
+      try { child.stdin.end() } catch {}
+      try { child.kill() } catch {}
+      resolve(v)
+    }
+    try {
+      const { file, spawnArgs } = resolveSpawn(bin, ['-p', '--input-format', 'stream-json', '--output-format', 'stream-json', '--verbose'])
+      child = spawn(file, spawnArgs, { cwd, env, stdio: ['pipe', 'pipe', 'ignore'], windowsHide: true })
+    } catch { return resolve(null) }
+    timer = setTimeout(() => done(null), timeoutMs)
+    if (timer.unref) timer.unref()
+    child.on('error', () => done(null))
+    child.on('close', () => done(null))
+    child.stdout.on('data', (d) => {
+      buf += d.toString('utf8')
+      let i
+      while ((i = buf.indexOf('\n')) >= 0) {
+        const line = buf.slice(0, i); buf = buf.slice(i + 1)
+        let o; try { o = JSON.parse(line) } catch { continue }
+        if (o && o.type === 'control_response') {
+          const r = o.response && (o.response.response || o.response)
+          return done(parseInitModels(r && r.models))
+        }
+      }
+    })
+    try { child.stdin.write(JSON.stringify({ type: 'control_request', request_id: 'sintbot-models', request: { subtype: 'initialize' } }) + '\n') } catch { done(null) }
+  })
+}
+
+module.exports = { listModels, mergeModels, parseExtraModels, readExtraModels, BUILTIN, parseInitModels, probeModels }

package/src/agent/claudeusage.js

@@ -180,21 +180,206 @@ async function fetchRaw(token, { ttl = 60_000, now = Date.now, log = warn, curl
   return data
 }
 
+// ── 令牌过期兜底(2026-11-12,cc-switch takeaways B3)──────────────────────────────
+// 纪律 2 不变:我们**不刷新**令牌。过期时让 Claude CLI 自己在自己的锁里刷新 —— 跑一次
+// `claude -p /usage`(官方的非交互用量面板),它顺手把额度写进 `~/.claude.json` 的
+// `cachedUsageUtilization`,我们只读那份缓存,交给核心 `usage_parse('claude','cached')` 判
+//(当前 CLI 使用 fetchedAtMs + utilization.limits;旧 limits[] 也保留支持，超过 645 秒判旧)。
+// 约束:
+//   · **不阻塞调用方**:需要刷新时在后台起跑(进程内一次一个),本次立刻回 null(或在跑期间回
+//     上一次解析出的值);之后的调用再读结果。/hud、/api/claude/verify 都是秒级回复。
+//   · **只信本进程跑成功后的文件**:退出码 0 才记一次「刷新完成时刻」,读文件以它为准;文件
+//     里没有 fetchedAt 时就用这个完成时刻 —— 别的进程(交互式 CLI)写的旧缓存不当新数。
+//     跑失败 / 超时 ⇒ null。
+//   · 同账号(按凭据文件路径)10 分钟最多跑一次 · 45 秒后 SIGTERM、再 5 秒 SIGKILL,子进程
+//     没 close 之前不会起下一个 · 旗子探测合成一次(短超时、有缓存),老 CLI 不认 ⇒ 跳过。
+//   · env 走 buildEnv({}) 再去掉 ANTHROPIC_API_KEY(只认 OAuth 登录态,别让 /usage 打到 API key
+//     或第三方网关)· cwd 用临时目录(别让它读到哪个项目的 CLAUDE.md / .mcp.json)· 输出不看不记。
+const FALLBACK_TIMEOUT_MS = 45_000
+const FALLBACK_KILL_GRACE_MS = 5_000
+const FALLBACK_INTERVAL_MS = 10 * 60_000
+const FALLBACK_FLAG_PROBE_MS = 2_000
+const FALLBACK_ARGS = Object.freeze(['-p', '/usage', '--output-format', 'json', '--tools', '', '--strict-mcp-config', '--setting-sources', '', '--no-session-persistence'])
+const FALLBACK_FLAGS = Object.freeze(['--tools', '--strict-mcp-config', '--setting-sources', '--no-session-persistence'])
+const USAGE_HELP_INFLIGHT = new Map()
+
+// Some native CLI builds exit before a long help page drains through a pipe.
+// A private regular file receives the complete page. The four flag checks share
+// one bounded process; this temporary file contains help text only.
+function supportsUsageFlag(bin, flag) {
+  let probe = USAGE_HELP_INFLIGHT.get(bin)
+  if (!probe) {
+    probe = (async () => {
+      const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'sintbot-usage-help-'))
+      const file = path.join(dir, 'help.txt')
+      let fd
+      try {
+        fd = fs.openSync(file, 'wx', 0o600)
+        const ok = await new Promise(resolve => {
+          let child, timer, force, settled = false
+          const finish = value => { if (settled) return; settled = true; clearTimeout(timer); clearTimeout(force); resolve(value) }
+          try {
+            const command = require('./winexec').resolveSpawn(bin, ['--help'])
+            child = require('node:child_process').spawn(command.file, command.spawnArgs,
+              { cwd: dir, stdio: ['ignore', fd, 'ignore'], windowsHide: true })
+          } catch { return finish(false) }
+          child.once('error', () => finish(false))
+          child.once('close', code => finish(code === 0))
+          timer = setTimeout(() => {
+            try { child.kill('SIGTERM') } catch {}
+            force = setTimeout(() => { try { child.kill('SIGKILL') } catch {} }, 1000)
+            force.unref?.()
+          }, 5000)
+          timer.unref?.()
+        })
+        if (!ok || fs.statSync(file).size > 1024 * 1024) return null
+        return await fs.promises.readFile(file, 'utf8')
+      } finally {
+        if (fd !== undefined) fs.closeSync(fd)
+        await fs.promises.rm(dir, { recursive: true, force: true })
+      }
+    })().catch(() => null)
+    USAGE_HELP_INFLIGHT.set(bin, probe)
+    probe.finally(() => { if (USAGE_HELP_INFLIGHT.get(bin) === probe) USAGE_HELP_INFLIGHT.delete(bin) })
+  }
+  return probe.then(text => text === null ? null : text.includes(flag))
+}
+const FALLBACK = {
+  inflight: null,       // 正在跑的那次(Promise<boolean>);子进程 close 前不清
+  lastAt: new Map(),    // 凭据文件路径 -> 上次起跑时刻(节流)
+  doneAt: new Map(),    // 凭据文件路径 -> 本进程最近一次退出码 0 的完成时刻(没有 = 不信文件)
+  lastGood: new Map(),  // 凭据文件路径 -> 上一次解析出的一行(只在刷新进行中回它)
+  flags: null,          // { bin, until, p } 合成一次的旗子探测
+  file: null,           // { path, mtimeMs, body } 按 mtime 缓存的 ~/.claude.json 解析
+}
+
+// `~/.claude.json` 原文 → 交给核心的 body(cachedUsageUtilization 原样)。不是对象 ⇒ null。
+// 时效优先用对象自带的 fetchedAtMs/fetchedAt;两者都没有才用本进程刷新完成时刻。
+function readCachedUtilization(raw) {
+  let j = null
+  try { j = JSON.parse(String(raw || '')) } catch { return null }
+  const u = j && j.cachedUsageUtilization
+  return u && typeof u === 'object' && !Array.isArray(u) ? u : null
+}
+
+// 按 mtime 缓存的异步读:同一份文件只解析一次;stat/读失败 ⇒ null。
+async function readClaudeJson(file, { readFile, stat }) {
+  let st = null
+  try { st = await stat(file) } catch { return null }
+  const mtimeMs = st && typeof st.mtimeMs === 'number' ? st.mtimeMs : null
+  const c = FALLBACK.file
+  if (c && c.path === file && mtimeMs !== null && c.mtimeMs === mtimeMs) return c.body
+  let raw = null
+  try { raw = await readFile(file, 'utf8') } catch { return null }
+  const body = readCachedUtilization(raw)
+  FALLBACK.file = { path: file, mtimeMs, body }
+  return body
+}
+
+// 核心的 windows[] → parseLimits 的形状,formatClaudeUsage 原样可用。
+const windowsToLimits = (windows) => (Array.isArray(windows) ? windows : [])
+  .map((w) => ({ kind: w.kind, percent: w.percentUsed, resetsAt: w.resetsAt ?? null, scopeName: w.scopeName || '' }))
+
+// 四个旗子合成**一次**探测:默认共享同一份完整 --help 输出，测试可注入探测函数。
+// 短超时兜底;结论 true/false 缓存 10 分钟、不知道(null)缓存 60 秒。
+function probeFlags(bin, supportsFlag, now, timeoutMs = FALLBACK_FLAG_PROBE_MS) {
+  const hit = FALLBACK.flags
+  if (hit && hit.bin === bin && now() < hit.until) return hit.p
+  const all = Promise.all(FALLBACK_FLAGS.map((f) => Promise.resolve().then(() => supportsFlag(bin, f))))
+    .then((a) => (a.every((v) => v === true) ? true : a.some((v) => v === false) ? false : null))
+  const late = new Promise((resolve) => { const t = setTimeout(() => resolve(null), timeoutMs); t.unref?.() })
+  const p = Promise.race([all, late]).catch(() => null)
+  FALLBACK.flags = { bin, until: now() + 60_000, p }
+  p.then((v) => { if (FALLBACK.flags && FALLBACK.flags.p === p) FALLBACK.flags.until = now() + (v === null ? 60_000 : 10 * 60_000) })
+  return p
+}
+
+// 跑一次 `claude -p /usage`;只在子进程 close(或起不来)后才落定 ⇒ 卡住的子进程不会与下一次重叠。
+// 超时:SIGTERM,再过 killGraceMs 还没 close 就 SIGKILL;两个计时器都 unref。
+function runUsageRefresh({ bin, spawn, buildEnv, tmpdir, log, timeoutMs, killGraceMs = FALLBACK_KILL_GRACE_MS }) {
+  return new Promise((resolve) => {
+    let child, settled = false, timedOut = false
+    const timers = []
+    const done = (ok, why) => { if (settled) return; settled = true; for (const t of timers) clearTimeout(t); if (why) log(why); resolve(ok) }
+    const later = (ms, fn) => { const t = setTimeout(fn, ms); t.unref?.(); timers.push(t) }
+    try {
+      const env = buildEnv({})
+      delete env.ANTHROPIC_API_KEY // 只认 OAuth 登录态
+      const { file, spawnArgs } = require('./winexec').resolveSpawn(bin, [...FALLBACK_ARGS])
+      child = spawn(file, spawnArgs, { cwd: tmpdir(), env, stdio: ['ignore', 'ignore', 'ignore'], windowsHide: true })
+    } catch (e) { return done(false, '额度兜底:claude 起不来(' + ((e && e.message) || '未知错误') + ')') }
+    later(timeoutMs, () => {
+      timedOut = true
+      try { child.kill('SIGTERM') } catch {}
+      later(killGraceMs, () => { try { child.kill('SIGKILL') } catch {} })
+    })
+    child.on('error', (e) => done(false, '额度兜底:claude 起不来(' + ((e && e.code) || (e && e.message) || '未知错误') + ')'))
+    child.on('close', (code) => {
+      if (timedOut) return done(false, `额度兜底:claude -p /usage 超时(${timeoutMs}ms),已终止`)
+      done(code === 0, code === 0 ? null : `额度兜底:claude -p /usage 退出码 ${code}`)
+    })
+  })
+}
+
+// 需要就在后台起一次刷新(不 await):进程内一次一个,同账号 10 分钟一次。
+function startRefreshIfDue(account, { bin, now, log, spawn, supportsFlag, buildEnv, tmpdir, timeoutMs, killGraceMs, intervalMs, flagProbeMs }) {
+  if (FALLBACK.inflight) return
+  const last = FALLBACK.lastAt.get(account) || 0
+  if (last && now() - last < intervalMs) return
+  FALLBACK.lastAt.set(account, now())
+  FALLBACK.inflight = (async () => {
+    const flags = await probeFlags(bin, supportsFlag, now, flagProbeMs)
+    if (flags !== true) { log('额度兜底:本机 claude 不认所需旗子,跳过'); return false }
+    const ok = await runUsageRefresh({ bin, spawn, buildEnv, tmpdir, log, timeoutMs, killGraceMs })
+    if (ok) FALLBACK.doneAt.set(account, now())
+    else FALLBACK.doneAt.delete(account)
+    return ok
+  })().catch(() => { FALLBACK.doneAt.delete(account); return false })
+    .finally(() => { FALLBACK.inflight = null })
+}
+
+// 过期/缺凭据时的那条腿:(必要时)后台让 CLI 刷新 → 读缓存(只信本进程刷成功后的)→ 核心判 →
+// 一行人话;任何一步不行 ⇒ null。调用方不会被挡住:这里只 await 一次文件读。
+async function cachedUsageFallback({ home = os.homedir(), bin = 'claude', now = Date.now, log = warn,
+  spawn = require('node:child_process').spawn, readFile = fs.promises.readFile, stat = fs.promises.stat, tmpdir = os.tmpdir,
+  supportsFlag = null, buildEnv = null, timeoutMs = FALLBACK_TIMEOUT_MS, killGraceMs = FALLBACK_KILL_GRACE_MS,
+  intervalMs = FALLBACK_INTERVAL_MS, flagProbeMs = FALLBACK_FLAG_PROBE_MS } = {}) {
+  const account = path.join(home, '.claude', '.credentials.json')
+  startRefreshIfDue(account, { bin, now, log, spawn, tmpdir, timeoutMs, killGraceMs, intervalMs, flagProbeMs,
+    supportsFlag: supportsFlag || supportsUsageFlag, buildEnv: buildEnv || require('./claudecode').buildEnv })
+  const doneAt = FALLBACK.doneAt.get(account)
+  if (!doneAt) return FALLBACK.inflight ? (FALLBACK.lastGood.get(account) || null) : null
+  const raw = await readClaudeJson(path.join(home, '.claude.json'), { readFile, stat })
+  if (!raw) return null
+  const body = raw.fetchedAtMs != null || raw.fetchedAt != null ? raw : { ...raw, fetchedAt: doneAt }
+  const parsed = require('./privatecore').usageParse('claude', 'cached', null, body, now())
+  if (!parsed.ok) return FALLBACK.inflight ? (FALLBACK.lastGood.get(account) || null) : null
+  const line = formatClaudeUsage(windowsToLimits(parsed.windows), now())
+  if (line) FALLBACK.lastGood.set(account, line)
+  return line
+}
+function resetFallback() { FALLBACK.inflight = null; FALLBACK.lastAt.clear(); FALLBACK.doneAt.clear(); FALLBACK.lastGood.clear(); FALLBACK.flags = null; FALLBACK.file = null }
+// 单测用:等后台那次刷新落定(没有就立刻回)。
+const settleFallback = () => (FALLBACK.inflight ? FALLBACK.inflight.then(() => undefined) : Promise.resolve())
+
 // 拉一次 → 一行人话;拿不到 null。走 fetchRaw ⇒ 与告警共享那份缓存。
 // 缓存口径与 fetchRaw 一致:成功 60s、失败 10s(两层都压死一分钟就白搭下层的重试了)。
+// 凭据缺失/过期 ⇒ 走 cachedUsageFallback(见上),不再直接 null。
 const CACHE = { at: 0, val: null }
 const TTL = 60_000
-async function usageLine({ ttl = TTL, now = Date.now, readToken = readAccessToken, ...io } = {}) {
+async function usageLine({ ttl = TTL, now = Date.now, readToken = readAccessToken, fallback = cachedUsageFallback, home, bin, ...io } = {}) {
   if (CACHE.at && now() - CACHE.at < (CACHE.val ? ttl : FAIL_TTL_MS)) return CACHE.val
   let val = null
   const token = readToken()
   if (token) {
-    const data = await fetchRaw(token, { ttl, now, ...io })
+    const data = await fetchRaw(token, { ttl, now, log: io.log, curl: io.curl, sleep: io.sleep })
     val = formatClaudeUsage(parseLimits(data), now())
+  } else {
+    try { val = await fallback({ now, ...(home ? { home } : {}), ...(bin ? { bin } : {}), ...io }) } catch { val = null }
   }
   CACHE.at = now(); CACHE.val = val
   return val
 }
 function clearCache() { CACHE.at = 0; CACHE.val = null; RAW.at = 0; RAW.data = null }
 
-module.exports = { usageLine, fetchRaw, clearCache, parseCredentials, parseLimits, formatClaudeUsage, readAccessToken, fetchCurl, fetchNative, readCurlResult, fmtDurDecimal, QUOTA_SEP, TIMEOUT_MS, FAIL_TTL_MS, RETRY_WAIT_MS }
+module.exports = { usageLine, fetchRaw, clearCache, parseCredentials, parseLimits, formatClaudeUsage, readAccessToken, fetchCurl, fetchNative, readCurlResult, fmtDurDecimal, cachedUsageFallback, readCachedUtilization, readClaudeJson, supportsUsageFlag, resetFallback, settleFallback, QUOTA_SEP, TIMEOUT_MS, FAIL_TTL_MS, RETRY_WAIT_MS, FALLBACK_ARGS, FALLBACK_FLAGS, FALLBACK_TIMEOUT_MS, FALLBACK_KILL_GRACE_MS, FALLBACK_INTERVAL_MS, FALLBACK_FLAG_PROBE_MS }

package/src/agent/codexapp.js

@@ -64,7 +64,7 @@ function itemEvent(method, item) {
 // App Server 的请求和通知共用一条 stdout 流；单轮独立进程使关闭成为续接边界。
 function runTurn(opts = {}) {
   const {
-    bin = 'codex', prompt, provider = {}, model, workdir, sessionId,
+    bin = 'codex', prompt, provider = {}, model, effort: wantEffort, workdir, sessionId,
     permissionMode, autocompactTokens, appendSystemPrompt, codexApp, codexProjectDocFallback, extraEnv,
     onEvent, onDurableEvent, onSteerReady, onSteerLanded, onTurnAccepted, onSpawnFailed, signal, log = () => {},
     softStopGraceMs = 10000, spawnFn = spawn,
@@ -102,7 +102,8 @@ function runTurn(opts = {}) {
     let childCloseObserved = false
     let settled = false
     let completed = false
-    let effort = provider.reasoningEffort || ''
+    const configuredEffort = wantEffort || provider.reasoningEffort || ''
+    let effort = configuredEffort
     let retriedEffort = false
     let pendingTurnStart = false
     let acceptedTurnId = null
@@ -350,7 +351,7 @@ function runTurn(opts = {}) {
       else if (action === 3) { aborted = true; lastResult = null }
       else lastResult = { type: 'result', subtype: 'success', text: lastAgentText, usage: totalUsage, usageCumulative: !!totalUsage,
         contextTokens, contextWindowTokens, contextCompacted }
-      if (lastResult && retriedEffort) lastResult.effortFellBack = provider.reasoningEffort || ''
+      if (lastResult && retriedEffort) lastResult.effortFellBack = configuredEffort
       if (lastResult) emit(lastResult)
       // 让服务端自行落盘退出；收到完成通知就强杀会破坏下一轮 resume。
       try { child.stdin.end() } catch {}

package/src/agent/codexcode.js

@@ -108,7 +108,7 @@ function isEffortRejection(result) {
  * @returns {Promise<import('../core/interfaces').RunTurnResult>}
  */
 function runTurn(opts = {}) {
-  const wantEffort = (opts.provider && opts.provider.reasoningEffort) || ''
+  const wantEffort = opts.effort || (opts.provider && opts.provider.reasoningEffort) || ''
   if (!wantEffort) return runOnce(opts, '')
   // Attempt 1 with the configured effort. Hold back only ERROR result events so a
   // recoverable effort-rejection can't finalize the turn early (the engine finalizes on

package/src/agent/envconflicts.js

@@ -0,0 +1,74 @@
+'use strict'
+
+// Environment conflicts (2026-11-12, cc-switch takeaways B5): things outside
+// SintBot's configuration that can silently reroute the Claude / Codex CLI —
+// daemon env (`ANTHROPIC_*`, `CLAUDE_CODE_*`, `AWS_*`, `VERTEX_*`, `OPENAI_*`),
+// `~/.claude/settings.json` (`env`, top-level `model` …) and `~/.codex/config.toml`
+// (`model_provider`, `[model_providers.*]`). The host only gathers the inputs; the
+// rule set lives in the binary core (`env_conflicts`, ABI 36) and it returns key
+// names only — values never leave the process. Warn-only: `buildEnv` keeps clearing
+// exactly what it cleared before.
+
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const { envConflicts } = require('./privatecore')
+
+// JSON file → parsed object; missing / invalid / not an object ⇒ null.
+function readClaudeSettings(home, readFile) {
+  try {
+    const j = JSON.parse(String(readFile(path.join(home, '.claude', 'settings.json'), 'utf8')))
+    return j && typeof j === 'object' && !Array.isArray(j) ? j : null
+  } catch { return null }
+}
+
+// TOML text as-is (the core matches lines; no TOML parser); missing ⇒ null.
+function readCodexConfig(home, readFile) {
+  try { return String(readFile(path.join(home, '.codex', 'config.toml'), 'utf8')) } catch { return null }
+}
+
+// Only string-valued entries travel to the core (process.env can hold undefined).
+const snapshotEnv = (env) => Object.fromEntries(Object.entries(env || {}).filter(([, v]) => typeof v === 'string'))
+
+// → [{ where: 'env'|'claude-settings'|'codex-config', key, reason }]. `provider` is a
+// resolved provider ({ baseUrl, apiKey }) or an explicit { baseUrl, hasApiKey }.
+function collectEnvConflicts({ runner = 'claude', provider = {}, env = process.env, home = os.homedir(), readFile = fs.readFileSync } = {}) {
+  const p = provider || {}
+  const input = {
+    runner: runner === 'codex' ? 'codex' : 'claude',
+    provider: { baseUrl: p.baseUrl || null, hasApiKey: typeof p.hasApiKey === 'boolean' ? p.hasApiKey : !!p.apiKey },
+    env: snapshotEnv(env),
+    claudeSettings: readClaudeSettings(home, readFile),
+    codexConfig: readCodexConfig(home, readFile),
+  }
+  return envConflicts(input).warnings.map((w) => ({ where: w.where, key: w.key, reason: w.reason }))
+}
+
+// Preflight / log line: `<key> — <reason>`; never a value.
+const describeWarning = (w) => `${w.key} — ${w.reason}`
+
+// `sintbot start --preflight`: one line per key for each provider an active route
+// uses. The snapshot is this process's environment — a launchd job inherits a
+// different one, so the block is prefixed with that caveat. Never fatal.
+const PREFLIGHT_SCOPE_LINE = 'preflight · 环境冲突检查基于当前终端环境(launchd 任务的环境可能不同)\n'
+function reportEnvConflicts({ cfg, routes } = {}, write = (message) => process.stderr.write(message), { collect = collectEnvConflicts } = {}) {
+  const seen = new Set()
+  let prefixed = false
+  for (const route of routes || []) {
+    if (!route || route.paused) continue
+    const name = route.group?.provider || cfg?.defaultProvider || ''
+    if (!name || seen.has(name)) continue
+    seen.add(name)
+    if (!prefixed) { prefixed = true; write(PREFLIGHT_SCOPE_LINE) }
+    try {
+      for (const warning of collect({ runner: route.provider?.runner, provider: route.provider })) {
+        write(`preflight · ${name}: ${describeWarning(warning)}\n`)
+      }
+    } catch (error) {
+      write(`preflight · ${name}: environment check skipped (${error?.message || String(error)})\n`)
+    }
+  }
+  return [...seen]
+}
+
+module.exports = { collectEnvConflicts, describeWarning, reportEnvConflicts, PREFLIGHT_SCOPE_LINE }