sintbot 1.4.15 → 1.4.17

package/src/ui/serverbase.js

@@ -24,6 +24,9 @@ const { codexCatalogWindows, windowForProvider } = require('../agent/modelwindow
 const claudestatus = require('../agent/claudestatus') // Claude 订阅登录态(卡片「检测登录」· doctor 同源)
 const claudemodels = require('../agent/claudemodels') // Claude 模型候选(仅登录后给)
 const claudeusage = require('../agent/claudeusage') // Claude 订阅额度(oauth/usage,cc-hud 同源;v0.11.3)
+const { collectEnvConflicts } = require('../agent/envconflicts') // 模型卡「环境冲突」(B5):守护进程 env / settings.json / config.toml,只回键名
+// 探不出来给空数组 —— 这行告警绝不能拖垮登录检测本身。
+const envWarningsFor = (runner, provider) => { try { return collectEnvConflicts({ runner, provider }) } catch { return [] } }
 const codexAgent = require('../agent/codexcode') // codex --version 探针(概览健康,仅配了 codex provider 时)
 const { globalPlugins, codexPlugins, projectPlugins, mcpReachability } = require('../plugins')
 const gitrepo = require('../gitrepo') // 群项目 ↔ git 远端关联(「仓库地址」:init + origin,幂等)+ ls-remote 连通性探测
@@ -43,6 +46,9 @@ const { platformsConfigured, chatPlatform, inferChatPlatform, PLATFORMS } = requ
 const { feishuClient, fetchBotOpenId, fetchAppIdentity, fetchChats, createChat, fetchChatMembers, addChatMembers, deleteChat, sendChatText, larkErrMsg, feishuPrecheck, fetchAdminCandidates, resolveContactToOpenId, fetchOrgUsers } = require('../platform/feishu')
 const { slackPrecheck, fetchSlackChannels, sendSlackText } = require('../platform/slack') // Slack:控制台侧只用这三个助手(收发在 daemon 里)
 const { getUsage, refreshUsage } = require('../usage')
+const brainMod = require('../core/brain') // a group's model and depth on one backend: the single resolver
+const { applyBrainChange, auditRow } = require('../groupbrain')
+const { effortsFor, fillPicks } = require('../core/modelcmd')
 
 // 反馈本默认落点(与 CLI / 群命令同一个文件 —— 三个入口一本账,不许各记各的)
 const DEFAULT_ISSUES_FILE = () => path.join(os.homedir(), '.sbot', 'issues.jsonl')
@@ -50,6 +56,11 @@ const DEFAULT_ISSUES_FILE = () => path.join(os.homedir(), '.sbot', 'issues.jsonl
 const DEFAULT_SESSIONS_FILE = () => path.join(os.homedir(), '.sbot', 'ui-sessions.json')
 
 const CONSOLE_HTML = path.join(__dirname, 'console.html')
+// Model display names: the same function as group replies and cards, injected
+// into the page (with a plain fallback when the page is opened directly).
+const MODELNAME_SLOT = "/*__SBOT_MODELNAME__*/(s=>String(s==null?'':s))"
+const MODELNAME_SRC = '(' + require('../core/modelname').modelDisplayName.toString() + ')'
+const { knownModelNames } = require('../core/modelname')
 const LIVE_ACTIVITY_JS = fs.readFileSync(path.join(__dirname, 'liveactivity-client.js'), 'utf8')
 const BROWSER_HTML = path.join(__dirname, 'browser.html') // 接管浏览器页(自包含单文件,群成员凭一次性链接也能进)
 const takeover = require('./takeover') // 接管链接的票据与 cookie(纯逻辑)
@@ -311,6 +322,71 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
   // 悄悄换到另一个后端并重置会话(拖一下排序、加一个不相干的模型都会触发)⇒ 那里**只在默认模型
   // 已不存在**(文件和内置都没有这个名字)时补一个,其余一律不动;隐藏默认模型由写入方直接拒绝。
   // 返回 { from, to } = 这次自动改了默认模型(调用方据此如实报告),null = 没改。
+  // ── Backend · model · depth of one group (group card; the old provider route
+  // forwards here). The same change logic as the chat /model command
+  // (src/groupbrain.js). Only a backend change resets the session.
+  const catalogFor = async (name, prov) => {
+    const c = runtimePolicy && runtimePolicy.modelCatalog
+    if (!c || !prov) return null
+    try { return await c(name, prov) } catch { return null }
+  }
+  // The target backend of a change as the file says now ({} when unknown).
+  const brainTarget = (raw, chatId, change) => {
+    const g = raw.groups && raw.groups[chatId]
+    if (!g) return {}
+    const defName = raw.defaultProvider || DEFAULTS.defaultProvider
+    const home = g.provider || defName
+    const target = change.provider || home
+    return { g, defName, home, target, tProv: { ...DEFAULTS.providers, ...(raw.providers || {}) }[target] }
+  }
+  async function changeGroupBrain(chatId, change, by = 'console') {
+    // The model list may need a CLI handshake: fetch it first, then read,
+    // decide and write with no await in between, so a /model change made
+    // meanwhile is never overwritten by a stale copy.
+    const first = brainTarget(readRaw(), chatId, change)
+    const cat = first.tProv ? await catalogFor(first.target, first.tProv) : null
+    const raw = readRaw()
+    const { g, defName, home, target, tProv } = brainTarget(raw, chatId, change)
+    if (!g) return { status: 404, body: { error: 'no such group' } }
+    if (!tProv) return { status: 400, body: { error: `未知模型 '${target}'` } }
+    if (target !== first.target) return { status: 409, body: { error: '这个群的后端刚被改过,请刷新后再改' } }
+    if (change.provider && change.provider !== home && (tProv.hidden || (runtimePolicy && !runtimePolicy.providerSupported(tProv)))) {
+      return { status: 400, body: { error: `「${target}」已隐藏或不受支持,不能选` } }
+    }
+    const switching = target !== home
+    const tBrain = brainMod.groupBrain(g, target, tProv, { defaultProvider: defName })
+    let model = change.model, effort = change.effort
+    if (model !== undefined && model !== '' && tProv.baseUrl) return { status: 400, body: { error: '这个模型的型号是连接设置,请在「模型」页修改' } }
+    if (model !== undefined && model !== '' && !brainMod.isModel(model)) return { status: 400, body: { error: '型号格式不对' } }
+    if (effort !== undefined && effort !== '' && !brainMod.isEffort(effort)) return { status: 400, body: { error: '思考深度格式不对' } }
+    if (model === tBrain.model) model = undefined
+    if (effort === tBrain.effort && model === undefined) effort = undefined
+    const f = fillPicks({ switching, model, effort, currentModel: tBrain.model, currentEffort: tBrain.effort, third: !!tProv.baseUrl, cat })
+    model = f.model; effort = f.effort
+    const nextModel = model === undefined ? tBrain.model : model
+    if (effort) {
+      const known = cat && Array.isArray(cat.models) ? cat.models.find((m) => m.id === nextModel) : null
+      if (known && Array.isArray(known.efforts) && !known.efforts.length) return { status: 400, body: { error: '这个型号不支持调思考深度' } }
+      const effs = cat ? effortsFor(cat, nextModel) : []
+      if (change.effort !== undefined && effs.length && !effs.includes(effort)) return { status: 400, body: { error: `这个型号没有「${effort}」这档深度(可选:${effs.join(' · ')})` } }
+    }
+    if (tProv.runner === 'codex' && tProv.contextWindowTokens > 0 && nextModel) {
+      const maximum = codexCatalogWindows().get(nextModel)?.maxTokens
+      if (maximum && tProv.contextWindowTokens > maximum) return { status: 400, body: { error: `「${target}」的自定义上下文窗口超过这个型号的上限 ${maximum} token,先在「模型」页调小` } }
+    }
+    const r = applyBrainChange(raw, chatId, { provider: switching ? target : undefined, model, effort })
+    if (r.error) return { status: 400, body: { error: r.error } }
+    if (!r.changed) return { status: 200, body: { ...(await buildState()), brainChange: { changed: false } } }
+    try { writeRaw(raw) } catch (e) {
+      const m = (e && e.message) || String(e)
+      return { status: 400, body: { error: /settled|unresolved|未结/.test(m) ? '该群有任务进行中或记录未结账，等它结束后再改' : m } }
+    }
+    audit.append(auditRow(chatId, r, { source: 'console', by }))
+    const resets = runtimePolicy && runtimePolicy.appliedResets ? runtimePolicy.appliedResets() : []
+    return { status: 200, body: { ...(await buildState()), brainChange: { changed: true, switching: r.switching,
+      modelChanged: r.modelChanged, effortChanged: r.effortChanged, filled: f.filled, provider: target,
+      model: r.after.model, effort: r.after.effort, reset: resets.includes(chatId) } } }
+  }
   const settleDefault = (raw) => {
     if (!runtimePolicy) { fixDefault(raw); return null }
     const current = raw.defaultProvider || DEFAULTS.defaultProvider
@@ -625,6 +701,7 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
       health,
       providers,
       defaultProvider: raw.defaultProvider || cfg.defaultProvider,
+      modelNames: knownModelNames(), // official names registered from the live model lists
       groups,
       // 项目根目录:绑群弹窗的路径提示用 projectsRoots(生效值);设置页那张卡用 projectsRootsInfo
       //(每条根在不在 · 配置原文 · 被忽略的值与原因 · 哪些群在根外)。与围栏同一份判据。
@@ -660,7 +737,7 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
 
       leftovers: await leftoversState(),
 
-      codexStatus: codexStatusCache ? { login: codexStatusCache.login, usage: codexStatusCache.usage } : null, // 前端加载回填,codex 卡片刷新不丢
+      codexStatus: codexStatusCache ? { login: codexStatusCache.login, usage: codexStatusCache.usage, envWarningsByProvider: codexStatusCache.envWarningsByProvider || {} } : null, // 前端加载回填,codex 卡片刷新不丢
       claudeStatus: claudeStatusCache ? claudeStatusCache.login : null, // 同上,Claude 订阅登录态
       // 服务器时区/时间(顶栏时钟):tz/offsetMin = bot 工作时区(cfg.timezone,默认北京)——
       // 群里/prompt 时间戳用的就是这个口径,运维看到的钟要和群里一致;hostTz 是主机系统时区
@@ -699,6 +776,14 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
     return state
   }
 
+  // A card without its own model (subscription) is tried with the catalog's
+  // recommendation, the same one a newly bound group starts with.
+  async function recommendedModel(name, provider) {
+    if (!provider || provider.baseUrl) return undefined
+    const cat = await catalogFor(name, provider)
+    return (cat && cat.recommended && cat.recommended.model) || undefined
+  }
+
   async function testProvider(name, prompt) {
     const cfg = loadConfig(configPath); applyProxyEnv(cfg)
     const provider = cfg.providers[name]
@@ -718,7 +803,7 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         bin: cfg.agent.bin,
         prompt: prompt || verify.TRIAL_PROMPT,
         provider,
-        model: provider.model,
+        model: provider.model || await recommendedModel(name, provider),
         permissionMode: cfg.agent.permissionMode,
         signal: ac.signal, // a one-line reply — needs no tools, so no allow list
       })
@@ -728,7 +813,7 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
       lease?.assertWritable()
       const ok = !(result && result.isError)
       verify.recordTurn(provider, ok, (result && result.text) || '', vopts) // doctor / 概览据此报「能用」或「key 不对」
-      return { ok, model: provider.model, reply: (result && result.text) || '(no text)', ms: Date.now() - t0 }
+      return { ok, model: provider.model || '', reply: (result && result.text) || '(no text)', ms: Date.now() - t0 }
     } catch (e) {
       closed ||= isClosedRunnerError(e)
       if (!lease) verify.recordTurn(provider, false, (e && e.message) || String(e), vopts)
@@ -873,7 +958,7 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         //   隧道对端哪天被写成 127.0.0.1:4600,也不会退化成「公网全员免密」;伪造这两个头只会让自己失去免密,方向安全。
         const localBypass = !loopbackBind && isLoopbackReq(req) && !req.headers['x-forwarded-for'] && !req.headers['x-forwarded-proto']
         const injectTok = (authConfigured() && !localBypass) ? '' : token
-        return fs.readFile(CONSOLE_HTML, 'utf8', (e, html) => e ? (res.writeHead(500), res.end('console.html missing')) : (res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }), res.end(html.replace('__SBOT_TOKEN__', injectTok).replace('__SBOT_VERSION__', PKG_VERSION).replace('__SBOT_FEISHU_LOGIN__', feishuLoginInfo().ready ? '1' : '').replace('/*__LIVE_ACTIVITY__*/', () => LIVE_ACTIVITY_JS))))
+        return fs.readFile(CONSOLE_HTML, 'utf8', (e, html) => e ? (res.writeHead(500), res.end('console.html missing')) : (res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' }), res.end(html.replace('__SBOT_TOKEN__', injectTok).replace('__SBOT_VERSION__', PKG_VERSION).replace('__SBOT_FEISHU_LOGIN__', feishuLoginInfo().ready ? '1' : '').replace('/*__LIVE_ACTIVITY__*/', () => LIVE_ACTIVITY_JS).replace(MODELNAME_SLOT, () => MODELNAME_SRC))))
       }
       // 接管浏览器页。群成员的一次性链接是 /browser#k=<票>:票在 URL 片段里,服务端根本收不到 ⇒ 不进任何日志、链接预览的
       //   裸 GET 也抓不走;页面脚本读片段、人点「开始接管」后 POST /api/browser/claim 换 cookie。这里只分发页面:
@@ -951,7 +1036,7 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         codexModelsCache = { at: Date.now(), val }
         return sendJSON(res, 200, val)
       }
-      if (p === '/api/usage' && req.method === 'GET') { const cfg = loadConfig(configPath); return sendJSON(res, 200, await getUsage(cfg.providers)) }
+      if (p === '/api/usage' && req.method === 'GET') { const cfg = loadConfig(configPath); return sendJSON(res, 200, await getUsage(cfg.providers, { bin: cfg.agent.bin })) }
       // 模型卡「额度」行的 ↻:只刷这一个 provider 且绕过两层缓存(见 usage.js refreshUsage)。
       // 分工 = 整页 /api/usage 走 5 分钟缓存,手点才现拉;codex 走自家 /api/codex/verify 的 force。
       if (p === '/api/usage/refresh' && req.method === 'POST') {
@@ -959,7 +1044,7 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         const cfg = loadConfig(configPath)
         const prov = cfg.providers && cfg.providers[name]
         if (!prov) return sendJSON(res, 400, { error: `未知模型 '${name}'` })
-        return sendJSON(res, 200, { name, usage: await refreshUsage(name, prov) })
+        return sendJSON(res, 200, { name, usage: await refreshUsage(name, prov, { bin: cfg.agent.bin }) })
       }
 
       if (p === '/api/provider-key' && req.method === 'POST') {
@@ -975,7 +1060,7 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
       }
       // upsert a provider (add or edit — the ⚙ config panel + 添加模型 both use this)
       if (p === '/api/providers/add' && req.method === 'POST') {
-        const { name, baseUrl, model, apiKey, env, toolQuality, effort, reasoningEffort, autocompactTokens, contextWindowTokens, hidden, vision, modelClear, runner } = await body(req)
+        let { name, baseUrl, model, apiKey, env, toolQuality, effort, reasoningEffort, autocompactTokens, contextWindowTokens, hidden, vision, modelClear, runner } = await body(req)
         if (!name || !/^[\w.-]+$/.test(name)) return sendJSON(res, 400, { error: '名称必填,且只用字母/数字/._-' })
         // 持久处理流程只跑 Codex / Claude Code:别的后端名不能被下面的白名单悄悄改写成 Claude 存进去。
         if (runtimePolicy && runner !== undefined && runner !== '' && !runtimePolicy.providerSupported({ runner })) {
@@ -986,6 +1071,13 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         const prev = raw.providers[name] ? { model: raw.providers[name].model || '', re: raw.providers[name].reasoningEffort || '' } : null
         const pr = { ...(raw.providers[name] || {}) }
         if (baseUrl !== undefined) pr.baseUrl = baseUrl || undefined
+        // Durable hosts: model and depth belong to each group (group card / /model).
+        // A subscription card takes neither; a third-party endpoint keeps its
+        // model as connection configuration and takes no depth.
+        if (runtimePolicy) {
+          effort = undefined; reasoningEffort = undefined
+          if (!pr.baseUrl) { model = undefined; modelClear = undefined }
+        }
         if (model) pr.model = model
         // 「默认(跟随 Claude Code)」= 不指定型号 ⇒ spawn 时不设 ANTHROPIC_MODEL,用 CLI 自己的默认。
         // 空 model 与「没传 model」要分开,所以用显式的 modelClear,而不是 `model !== undefined`
@@ -1025,8 +1117,16 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         }
         if (pr.runner !== 'codex') delete pr.contextWindowTokens
         if (pr.contextWindowTokens > 0) {
-          const maximum = codexCatalogWindows().get(pr.model)?.maxTokens
-          if (maximum && pr.contextWindowTokens > maximum) return sendJSON(res, 400, { error: `上下文窗口超过当前模型目录上限 ${maximum} token` })
+          // Check every model a group runs on this card (and the card's own, if any).
+          const windows = codexCatalogWindows()
+          const defName = raw.defaultProvider || DEFAULTS.defaultProvider
+          const models = new Set([pr.model, ...Object.entries(raw.groups || {})
+            .filter(([id, g]) => id !== 'oc_example_chat_id' && g && (g.provider || defName) === name)
+            .map(([, g]) => brainMod.groupBrain(g, name, pr, { defaultProvider: defName }).model)].filter(Boolean))
+          for (const m of models) {
+            const maximum = windows.get(m)?.maxTokens
+            if (maximum && pr.contextWindowTokens > maximum) return sendJSON(res, 400, { error: `上下文窗口超过型号 ${m} 的目录上限 ${maximum} token` })
+          }
         }
         raw.providers[name] = pr
         const defaultChange = settleDefault(raw); writeRaw(raw)
@@ -1733,6 +1833,18 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         // Fail here, not at the first task: a binding to a missing
         // directory would only surface when a turn tries to run in it.
         if (!fs.existsSync(workdir)) return sendJSON(res, 400, { error: `workdir 不存在: ${workdir}` })
+        // The model list is fetched before the read below, so no await sits
+        // between reading and writing the file (a /model change made meanwhile
+        // must not be overwritten).
+        let preName = '', preCat = null
+        if (runtimePolicy) {
+          try {
+            const r0 = readRaw()
+            preName = provider || (r0.groups && r0.groups[chatId] && r0.groups[chatId].provider) || r0.defaultProvider || DEFAULTS.defaultProvider
+            const p0 = { ...DEFAULTS.providers, ...(r0.providers || {}) }[preName]
+            if (p0) preCat = await catalogFor(preName, p0)
+          } catch { /* the read below reports a broken file */ }
+        }
         const raw = readRaw(); raw.groups = raw.groups || {}; delete raw.groups.oc_example_chat_id
         // 已绑定的群重存:旧对象在下面整个展开再覆盖(见 next),这里只是取出来比目录有没有改
         const prev = raw.groups[chatId] || {}
@@ -1762,6 +1874,20 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         // ⚠ 不按「那个平台配了凭据没」拒绝:纯配置模式(先绑群、后填凭据)一直是允许的;没配的平台由 doctor 的群行报「收不到消息」
         next.platform = PLATFORMS.includes(platform) ? platform : chatPlatformOf(raw, chatId)
         raw.groups[chatId] = next
+        if (runtimePolicy) {
+          // A new binding or another backend starts with the recommended model
+          // and depth where the group has not chosen (same rule as /model).
+          const defName = raw.defaultProvider || DEFAULTS.defaultProvider
+          const tName = next.provider || defName
+          const tProv = { ...DEFAULTS.providers, ...(raw.providers || {}) }[tName]
+          if (tProv && (isNewBinding || tName !== (prev.provider || defName))) {
+            brainMod.migrateLegacyModel(next, defName)
+            const b = brainMod.groupBrain(next, tName, tProv, { defaultProvider: defName })
+            const f = fillPicks({ switching: true, currentModel: b.model, currentEffort: b.effort,
+              third: !!tProv.baseUrl, cat: tName === preName ? preCat : null })
+            if (f.model !== undefined || f.effort !== undefined) applyBrainChange(raw, chatId, { model: f.model, effort: f.effort })
+          }
+        }
         writeRaw(raw)
         // First-time binding: drop a confirmation into the group (best-effort) so a
         // fresh chat is immediately alive and members know how to use it.
@@ -2268,6 +2394,19 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
       }
       // real-time per-group model switch: persist to config (+ hot-reload) AND set
       // the live runtime override so it takes effect on the very next turn.
+      if (p === '/api/groups/brain' && req.method === 'POST') {
+        const { chatId, provider, model, effort } = await body(req)
+        const pick = (v) => (v === undefined || v === null ? undefined : String(v))
+        const out = await changeGroupBrain(chatId, { provider: pick(provider) || undefined, model: pick(model), effort: pick(effort) })
+        return sendJSON(res, out.status, out.body)
+      }
+      if (p === '/api/groups/provider' && req.method === 'POST' && runtimePolicy) {
+        // Older console pages: same writer as the group card.
+        const { chatId, provider } = await body(req)
+        const out = await changeGroupBrain(chatId, { provider: provider ? String(provider) : undefined })
+        if (out.status === 200 && out.body.brainChange) out.body.switched = { chatId, provider, live: true }
+        return sendJSON(res, out.status, out.body)
+      }
       if (p === '/api/groups/provider' && req.method === 'POST') {
         const { chatId, provider } = await body(req); const raw = readRaw()
         if (!raw.groups || !raw.groups[chatId]) return sendJSON(res, 404, { error: 'no such group' })
@@ -2337,13 +2476,26 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         // 前端不显示额度行,不拖垮登录检测本身。
         let usage = null
         if (login && login.ok && login.loggedIn) {
-          try { if (force) claudeusage.clearCache(); usage = await claudeusage.usageLine() } catch { usage = null }
+          try { if (force) claudeusage.clearCache(); usage = await claudeusage.usageLine({ bin: cfg.agent.bin }) } catch { usage = null }
         }
-        claudeStatusCache = { at: Date.now(), login: { ...login, usage } }
-        return sendJSON(res, 200, { ...login, usage })
+        // 订阅卡 = 无 baseUrl、无 key 的直连形态;环境里的 ANTHROPIC_API_KEY 对它是合法鉴权,核心据此不报。
+        const envWarnings = envWarningsFor('claude', { baseUrl: null, hasApiKey: false })
+        claudeStatusCache = { at: Date.now(), login: { ...login, usage, envWarnings } }
+        return sendJSON(res, 200, { ...login, usage, envWarnings })
       }
       // Claude 模型下拉的候选。**未登录不给任何型号**(产品决定:没登录就别列)。
       // 已登录时 = 内置候选 + 本机账号的额外可选项;为什么不是官方实时清单,见 claudemodels.js 头部。
+      // What one backend offers on the group card: models (official names,
+      // supported depths), recommendation. models:null = a third-party
+      // endpoint whose model is set on the model card.
+      if (p === '/api/groups/model-options' && req.method === 'GET') {
+        const name = url.searchParams.get('provider') || ''
+        const raw = readRaw()
+        const prov = { ...DEFAULTS.providers, ...(raw.providers || {}) }[name]
+        if (!prov) return sendJSON(res, 404, { error: `未知模型 '${name}'` })
+        const cat = await catalogFor(name, prov)
+        return sendJSON(res, 200, cat || { ok: false, models: prov.baseUrl ? null : [], efforts: [], recommended: { model: '', effort: '' } })
+      }
       if (p === '/api/claude/models' && req.method === 'GET') {
         const cfg = loadConfig(configPath)
         const login = await claudestatus.cachedLoginStatus(cfg.agent.bin)
@@ -2351,8 +2503,9 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         // 会把 usage 字段洗掉,而 /api/claude/verify 的 60s 去抖随后会把这份缺 usage 的缓存原样
         // 吐回去 —— 表现就是卡片上的额度行凭空消失,而登录态一切正常,没人查得出为什么。
         if (login && login.ok) {
-          const keep = claudeStatusCache && claudeStatusCache.login && claudeStatusCache.login.usage
-          claudeStatusCache = { at: Date.now(), login: keep ? { ...login, usage: keep } : login }
+          const prev = (claudeStatusCache && claudeStatusCache.login) || {}
+          const keep = prev.usage
+          claudeStatusCache = { at: Date.now(), login: { ...login, ...(keep ? { usage: keep } : {}), ...(prev.envWarnings ? { envWarnings: prev.envWarnings } : {}) } }
         }
         return sendJSON(res, 200, { ...claudemodels.listModels({ loggedIn: !!(login && login.ok && login.loggedIn) }), login })
       }
@@ -2369,11 +2522,14 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
         const probe = await codexstatus.cachedAuthProbe('codex')
         const file = codexstatus.readAuthFile()
         const d = codexstatus.describeLogin(probe, file)
+        // B5:每张 codex 卡各算一份(baseUrl / key 不同,核心的判据不同);OPENAI_* / config.toml 的 model_provider,只有键名
+        const envWarningsByProvider = Object.fromEntries(Object.entries(loadConfig(configPath).providers || {})
+          .filter(([, x]) => x && x.runner === 'codex').map(([n, x]) => [n, envWarningsFor('codex', x)]))
         const login = { ok: true, verified: !!probe.verified, loggedIn: !!(probe.ok || (!probe.verified && file.exists && !file.expired)), dead: !!probe.dead, mode: file.mode || 'chatgpt', level: d.level, text: d.text }
         let usage = probe.usage || null
         if (!usage && !probe.dead && codexStatusCache && codexStatusCache.usage) usage = codexStatusCache.usage // 探不到时保住旧额度(同前端那条「同一份状态两个消费者」的教训)
-        codexStatusCache = { at: Date.now(), login, usage } // cached into /api/state so the card survives a page reload
-        return sendJSON(res, 200, { login, usage })
+        codexStatusCache = { at: Date.now(), login, usage, envWarningsByProvider } // cached into /api/state so the card survives a page reload
+        return sendJSON(res, 200, { login, usage, envWarningsByProvider })
       }
       if (p === '/api/playground/run' && req.method === 'POST') {
         const { provider: provName, workdir, prompt, sessionId } = await body(req)
@@ -2396,7 +2552,8 @@ function createUiServer({ configPath, getLiveState = null, getConnHealth = null,
             bin: cfg.agent.bin,
             prompt,
             provider,
-            model: provider.model,
+            model: (pgGroup && brainMod.groupBrain(pgGroup, provName, provider, { defaultProvider: cfg.defaultProvider }).model) || provider.model || await recommendedModel(provName, provider),
+            effort: (pgGroup && brainMod.groupBrain(pgGroup, provName, provider, { defaultProvider: cfg.defaultProvider }).effort) || '',
             workdir: workdir || undefined,
             sessionId: sessionId || undefined,
             permissionMode: (pgGroup && pgGroup.permissionMode) || 'dontAsk', // 试跑继承匹配群的模式(无全局默认,unset ⇒ dontAsk)

package/src/usage.js

@@ -1,19 +1,44 @@
+'use strict'
+
 // Per-provider account balance / plan usage — the numbers cc-hud surfaces, for
 // the console. Server-side (keys never reach the browser), best-effort, cached
-// 5 min, 2.5s timeout. Endpoints mirror cc-hud (deepseek / glm / minimax); other
-// providers (volcano coding-plan, Claude) have no public balance API → skipped.
+// 5 min. The host only moves bytes: which endpoint, which headers, how to render.
+// **Every response body is judged by the binary core** (`usage_parse`, ABI 36):
+// HTTP status + body → windows / balance / one of five error kinds. The host never
+// re-reads a provider's JSON shape, so one rule set serves the console, /hud and
+// the quota alert alike.
+//
+// Common rules (2026-11-12, cc-switch takeaways B1):
+//   · 15 s per request · real HTTP status goes to the core (network error ⇒ null)
+//   · `credentials` ⇒ the card shows「凭据失效」instead of going blank
+//   · `transient`   ⇒ keep the last good value of that provider for 10 min
+//   · `malformed` / `none` ⇒ null (nothing to show)
+//   · never log a response body or a key; the last-good cache is keyed by a key hash
+
+const crypto = require('node:crypto')
+const { usageParse } = require('./agent/privatecore')
 
 const CACHE = new Map() // provider name -> { val, ts }
 const TTL = 5 * 60 * 1000
+const REQUEST_TIMEOUT_MS = 15_000
+const LAST_GOOD_TTL_MS = 10 * 60 * 1000
+const LAST_GOOD = new Map() // kind|baseUrl|sha256(key)[:16] -> { val, ts }
 
-async function fetchJson(url, key, ms = 2500) {
+const CREDENTIALS_VALUE = Object.freeze({ label: '额度', value: '凭据失效' })
+
+// One request → { status, body }. Network error / timeout ⇒ status null (the core
+// files it under `transient`). Non-JSON bodies travel as text so the core can still
+// say `malformed`. The body is handed to the core and dropped — never logged.
+async function request(url, headers, { fetchImpl = globalThis.fetch, timeoutMs = REQUEST_TIMEOUT_MS } = {}) {
   const ac = new AbortController()
-  const timer = setTimeout(() => ac.abort(), ms)
+  const timer = setTimeout(() => ac.abort(), timeoutMs)
   try {
-    const r = await fetch(url, { headers: { Authorization: `Bearer ${key}` }, signal: ac.signal })
-    if (!r.ok) return null
-    return await r.json()
-  } catch { return null } finally { clearTimeout(timer) }
+    const r = await fetchImpl(url, { headers, signal: ac.signal })
+    const text = await r.text()
+    let body = text
+    try { body = JSON.parse(text) } catch { /* 非 JSON:原文交给核心判 malformed */ }
+    return { status: r.status, body }
+  } catch { return { status: null, body: null } } finally { clearTimeout(timer) }
 }
 
 // baseUrl → 哪一家的余额接口(null = 这家根本没有公开余额接口,如火山 coding plan)。
@@ -25,40 +50,107 @@ const balanceKind = (base = '') =>
       : base.includes('minimax') ? 'minimax'
         : null
 
-async function providerUsage(provider) {
+// 核心的 windows[] → 与 Claude 订阅额度同一种一行:`5h:42% │ 7d:10% (5d)`。
+// 复用 claudeusage.formatClaudeUsage,窗口名映射:session=5h · weekly=7d · weekly_scoped=模型名。
+function formatWindows(windows, now = Date.now()) {
+  const { formatClaudeUsage } = require('./agent/claudeusage')
+  const limits = (Array.isArray(windows) ? windows : []).map((w) => ({
+    kind: w.kind === 'weekly' ? 'weekly_all' : w.kind,
+    percent: w.percentUsed,
+    resetsAt: w.resetsAt,
+    scopeName: w.scopeName || '',
+  }))
+  return formatClaudeUsage(limits, now)
+}
+
+const CURRENCY_SIGN = { CNY: '¥', RMB: '¥', USD: '$' }
+function formatBalance(balance) {
+  if (!balance || typeof balance.amount !== 'number' || !Number.isFinite(balance.amount)) return null
+  const sign = CURRENCY_SIGN[String(balance.currency || '').toUpperCase()]
+  return sign ? `${sign}${balance.amount.toFixed(2)}` : `${balance.amount.toFixed(2)} ${balance.currency || ''}`.trim()
+}
+
+// 核心的成功结果 → 卡片一行;窗口优先(额度),否则余额;两者皆无 ⇒ null。
+function render(parsed, now) {
+  const windows = formatWindows(parsed.windows, now)
+  if (windows) return { label: '额度', value: windows }
+  const balance = formatBalance(parsed.balance)
+  if (balance) return { label: '余额', value: balance }
+  return null
+}
+
+// 每家的取数顺序。返回核心的 usage_parse 结果(成功或失败),不在这里解释。
+async function probeGlm(base, key, io) {
+  const host = base.includes('api.z.ai') ? 'https://api.z.ai' : 'https://open.bigmodel.cn'
+  const now = io.now()
+  // coding plan 配额(5 小时 / 周窗口)。鉴权头不带 Bearer(智谱监控接口的口径)。
+  const quota = await request(`${host}/api/monitor/usage/quota/limit`,
+    { Authorization: key, 'Accept-Language': 'en-US,en' }, io)
+  const q = usageParse('glm', 'quota', quota.status, quota.body, now)
+  if (q.ok || (q.error !== 'noplan' && q.error !== 'credentials' && q.error !== 'transient')) return q
+  // 没有 coding plan ⇒ 按量付费账户,退回余额;配额接口拒绝/抖动时也问一次余额 —— 两个接口
+  // 鉴权口径未必相同,只有**两边都**说凭据不对才显示「凭据失效」;任一边抖动按瞬时算(保上次好值)。
+  const bal = await request(`${host}/api/biz/account/query-customer-account-report`, { Authorization: `Bearer ${key}` }, io)
+  const b = usageParse('glm', 'balance', bal.status, bal.body, io.now())
+  if (b.ok) return b
+  if (q.error === 'credentials' && b.error === 'credentials') return q
+  if (q.error === 'transient' || b.error === 'transient') return { ok: false, error: 'transient', detail: 'glm quota/balance transient' }
+  return b.error === 'credentials' ? { ok: false, error: 'malformed', detail: 'glm balance credentials without quota agreement' } : b
+}
+
+async function probeMinimax(base, key, io) {
+  const host = base.includes('minimaxi.com') ? 'https://api.minimaxi.com' : 'https://api.minimax.io'
+  const headers = { Authorization: `Bearer ${key}` }
+  const plan = await request(`${host}/v1/api/openplatform/coding_plan/remains`, headers, io)
+  const p = usageParse('minimax', 'quota', plan.status, plan.body, io.now())
+  if (p.ok || (p.error !== 'malformed' && p.error !== 'none')) return p
+  // 旧接口(Token Plan):形状相同,只在新接口认不得时退回
+  const legacy = await request(`${host}/v1/token_plan/remains`, headers, io)
+  return usageParse('minimax', 'quota', legacy.status, legacy.body, io.now())
+}
+
+async function probeDeepseek(_base, key, io) {
+  const r = await request('https://api.deepseek.com/user/balance', { Authorization: `Bearer ${key}` }, io)
+  return usageParse('deepseek', 'balance', r.status, r.body, io.now())
+}
+
+const PROBES = { glm: probeGlm, minimax: probeMinimax, deepseek: probeDeepseek }
+
+const keyHash = (key) => crypto.createHash('sha256').update(String(key)).digest('hex').slice(0, 16)
+
+// 单个 provider → { label, value } | null。`io`:bin(cfg.agent.bin,登录态 claude 的兜底要用)
+// 与可测注入(fetchImpl / now / timeoutMs)。
+async function providerUsage(provider, io = {}) {
   const key = provider.apiKey
   const base = provider.baseUrl || ''
   // Claude 订阅登录形态(无 baseUrl、非 codex):额度走 oauth/usage(cc-hud 同源通道,
-  // v0.11.3;凭据取本机 Claude Code 登录态,拿不到/未登录 ⇒ null 不显示)。
+  // v0.11.3;凭据取本机 Claude Code 登录态,拿不到/未登录 ⇒ 走 claudeusage 的兜底,仍可能 null)。
   if (!base && provider.runner !== 'codex') {
-    const v = await require('./agent/claudeusage').usageLine()
+    const v = await require('./agent/claudeusage').usageLine(io.bin ? { bin: io.bin } : {})
     return v ? { label: '订阅额度', value: v } : null
   }
   if (!key) return null
 
   const kind = balanceKind(base)
-  if (kind === 'deepseek') {
-    const d = await fetchJson('https://api.deepseek.com/user/balance', key)
-    const t = d && d.balance_infos && d.balance_infos[0] && d.balance_infos[0].total_balance
-    return t ? { label: '余额', value: `¥${t}` } : null
-  }
-  if (kind === 'glm') {
-    const host = base.includes('api.z.ai') ? 'https://api.z.ai' : 'https://open.bigmodel.cn'
-    const d = await fetchJson(`${host}/api/biz/account/query-customer-account-report`, key)
-    if (d && d.code && d.code !== 200) return null
-    const inner = (d && d.data) || d || {}
-    const v = inner.balance != null ? inner.balance : inner.total_balance != null ? inner.total_balance : inner.amount
-    if (v == null) return null
-    return { label: '余额', value: typeof v === 'number' ? `¥${v.toFixed(2)}` : `¥${String(v).replace(/^¥/, '')}` }
+  const probe = PROBES[kind]
+  if (!probe) return null // volcano / claude: no public balance API
+  const now = typeof io.now === 'function' ? io.now : Date.now
+  const ctx = { fetchImpl: io.fetchImpl || globalThis.fetch, timeoutMs: io.timeoutMs || REQUEST_TIMEOUT_MS, now }
+  const goodKey = `${kind}|${base}|${keyHash(key)}`
+
+  const parsed = await probe(base, key, ctx)
+  if (parsed.ok) {
+    const v = render(parsed, now())
+    if (v) LAST_GOOD.set(goodKey, { val: v, ts: now() })
+    return v
   }
-  if (kind === 'minimax') {
-    const host = base.includes('minimaxi.com') ? 'https://api.minimaxi.com' : 'https://api.minimax.io'
-    const d = await fetchJson(`${host}/v1/token_plan/remains`, key)
-    const m = d && d.model_remains && (d.model_remains.find((x) => x.current_interval_status === 1) || d.model_remains[0])
-    if (!m) return null
-    return { label: '额度', value: `5h:${Math.min(100, Math.max(0, Math.round(100 - m.current_interval_remaining_percent)))}%` } // 口径统一为「已用」(v0.11.8);接口给的是剩余 ⇒ 换算
+  if (parsed.error === 'credentials') { LAST_GOOD.delete(goodKey); return { ...CREDENTIALS_VALUE } }
+  if (parsed.error === 'transient') {
+    const last = LAST_GOOD.get(goodKey)
+    if (last && now() - last.ts < LAST_GOOD_TTL_MS) return last.val
+    LAST_GOOD.delete(goodKey)
   }
-  return null // volcano / claude: no public balance API
+  return null // malformed / none / stale transient
 }
 
 // 能不能给这个 provider 查额度 —— getUsage 与 refreshUsage 共用的单一判据(两处各写一份
@@ -83,13 +175,13 @@ const hasUsageApi = (p) => !!p && p.runner !== 'codex' && !(p.baseUrl && !p.apiK
   && (isClaudeLogin(p) || !!balanceKind(p.baseUrl || ''))
 
 // Fetch balances for all keyed providers (resolved apiKey). Returns { name: {label,value} }.
-async function getUsage(providers = {}) {
+async function getUsage(providers = {}, { bin } = {}) {
   const out = {}
   await Promise.all(Object.entries(providers).map(async ([name, p]) => {
     if (!queryable(p)) return
     const c = CACHE.get(name)
     if (c && Date.now() - c.ts < TTL) { out[name] = c.val; return }
-    const v = await providerUsage(p)
+    const v = await providerUsage(p, bin ? { bin } : {})
     if (v) { CACHE.set(name, { val: v, ts: Date.now() }); out[name] = v }
     else if (c) out[name] = c.val // stale fallback
   }))
@@ -100,12 +192,12 @@ async function getUsage(providers = {}) {
 // 本模块的 5 分钟 CACHE,以及登录态 claude 那条通道自己的 60s TTL(与 /api/claude/verify 同口径)。
 // ⚠ 拉不到时把上一次的值留在缓存里 —— 手点刷新失败不该让卡片上原本显示着的额度行凭空消失
 // (旧 ts 保留 ⇒ 它照样算过期,下一次 getUsage 仍会重拉)。probe/now 注入是为了可单测。
-async function refreshUsage(name, provider, { probe = providerUsage, now = Date.now } = {}) {
+async function refreshUsage(name, provider, { probe = providerUsage, now = Date.now, bin } = {}) {
   if (!queryable(provider)) { CACHE.delete(name); return null }
   const prev = CACHE.get(name)
   CACHE.delete(name)
   if (isClaudeLogin(provider)) { try { require('./agent/claudeusage').clearCache() } catch { /* best-effort */ } }
-  const v = await probe(provider).catch(() => null)
+  const v = await probe(provider, bin ? { bin } : {}).catch(() => null)
   if (v) CACHE.set(name, { val: v, ts: now() })
   else if (prev) CACHE.set(name, prev)
   return v
@@ -121,7 +213,8 @@ async function refreshUsage(name, provider, { probe = providerUsage, now = Date.
 //     而这两句话给群成员的下一步完全相反(一个别再问,一个过会儿再问)。
 // 缓存:**成功压 60s,失败只压 10s**(与 claudeusage 同口径)—— 失败也压一分钟,等于一次
 // 偶发超时让整整一分钟查不到;完全不压又让连点 /hud 直捅端点限流。
-function createUsageProbe({ codexUsage = async () => null, probe = providerUsage, ttl = 60_000, failTtl = 10_000, now = Date.now } = {}) {
+// `bin` = cfg.agent.bin:登录态 claude 的额度兜底要起它(见 claudeusage),不传就是 PATH 上的 claude。
+function createUsageProbe({ codexUsage = async () => null, probe = providerUsage, ttl = 60_000, failTtl = 10_000, now = Date.now, bin } = {}) {
   const cache = new Map() // provider name + '|' + baseUrl -> { v, ts }
   return async (name, provider) => {
     const isCodex = !!provider && provider.runner === 'codex'
@@ -134,11 +227,11 @@ function createUsageProbe({ codexUsage = async () => null, probe = providerUsage
     let v = null
     try {
       if (isCodex) v = await codexUsage(provider)
-      else { const u = await probe(provider); v = u ? `${u.label} ${u.value}` : null }
+      else { const u = await probe(provider, bin ? { bin } : {}); v = u ? `${u.label} ${u.value}` : null }
     } catch { v = null }
     cache.set(key, { v: v || null, ts: now() })
     return { supported: true, value: v || null }
   }
 }
 
-module.exports = { getUsage, providerUsage, refreshUsage, queryable, hasUsageApi, createUsageProbe }
+module.exports = { getUsage, providerUsage, refreshUsage, queryable, hasUsageApi, createUsageProbe, REQUEST_TIMEOUT_MS, LAST_GOOD_TTL_MS }

package/src/modelcontext.js

@@ -1,13 +0,0 @@
-'use strict'
-
-// Configuration projection shared by chat, cards and the console. A configured
-// model is not proof of what an executor ultimately selected or fell back to.
-function modelContext(group = {}, provider = {}) {
-  group ||= {}; provider ||= {}
-  const environment = provider.runner === 'codex' ? '' : provider.env?.ANTHROPIC_MODEL
-  const model = group.model || provider.model || environment || ''
-  return { model, source: group.model ? 'group' : provider.model ? 'provider' : environment ? 'environment' : 'default',
-    actualModel: null }
-}
-
-module.exports = { modelContext }