feat: 支持统一指定工蜂模型

README.md

@@ -56,6 +56,8 @@ Use ordinary language in Codex. For example, “Use the Codex-native GPT-5.6 Lun
 
 The native Luna choice is scoped to the requested work. `ds_model_defaults` stores only OpenCode worker defaults and cannot persist a native Codex model preference. A native subagent uses the model selected when it is created; changing it means creating a new subagent.
 
+You can also set one model for a group of delegates in ordinary language: “Use GPT-5.6 Luna for all workers in this task” makes every subsequently created delegate in that task a native Luna subagent; “Use Go GLM 5.3 Flash for all workers in this task” applies that external selection to each new OpenCode worker without changing the machine default. Existing workers keep their original model and must be replaced when the selection changes. “All workers” is task/thread scoped unless you explicitly say “future/global/all new workers”; native Luna still cannot be persisted through `ds_model_defaults`.
+
 [OpenAI documents GPT-5.6 Luna](https://developers.openai.com/api/docs/models/gpt-5.6-luna) as a cost-sensitive, high-volume model. Published API prices do not establish how a Codex plan meters native subagent usage, so this project does not claim a fixed Luna saving without a matched Codex measurement.
 
 For the OpenCode worker lane, without saved machine preferences, the built-in default remains `opencode-go/deepseek-v4.1-flash` with `max` reasoning. `ds_check` and `ds_spawn_agent` accept:
@@ -158,7 +160,7 @@ For native Luna, Codex sends a bounded task and the necessary repository context
 
 ### Route by task complexity
 
-Choose the route from reasoning, risk, and exploration/verification burden, not line or file counts. **Small** known edits that take a few minutes stay with Codex. **Medium** mechanical work with clear acceptance criteria prefers delegation: use Codex-native `gpt-5.6-luna` for a bounded, low-risk native subtask when available, or the persistent OpenCode worker when the user selects DeepSeek/GLM or the task benefits from its worktree, correction, and verification lifecycle. **Large or high-risk** work — state machines, concurrency, permissions, transactions, migrations — may delegate only bounded labor to either lane; Codex must first fix the design, interfaces, invariants, failure semantics and acceptance cases, then review the actual diff and run independent verification. A worker's self-report or passing self-tests are never acceptance. An explicit user model or lane choice overrides these defaults, and failures never authorize a silent cross-lane fallback.
+Choose the route from reasoning, risk, and exploration/verification burden, not line or file counts. **Small** known edits that take a few minutes stay with Codex. **Medium** mechanical work with clear acceptance criteria prefers delegation: use Codex-native `gpt-5.6-luna` for bounded, low-risk native subtasks when available. Prefer the DeepSeek/GLM OpenCode worker when persistent sessions, isolated worktrees, queued corrections/follow-ups, forks, or persisted verification materially matter, because Luna does not provide that plugin-managed lifecycle. **Large or high-risk** work — state machines, concurrency, permissions, transactions, migrations — may delegate only bounded labor to either lane; Codex must first fix the design, interfaces, invariants, failure semantics and acceptance cases, then review the actual diff and run independent verification. A worker's self-report or passing self-tests are never acceptance. An explicit per-task or fleet-wide model/lane choice overrides these defaults; capability conflicts must be reported, and failures never authorize a silent cross-lane fallback.
 
 A 2026-09-15 pilot paired one direct and one delegated DeepSeek execution per size from the same commit: [task routing pilot](./docs/task-routing-pilot-2026-09-15.md). It did not test Luna. It ran one execution per cell in parallel without alternating order, so it is not the repeated benchmark the queen protocol asks for, and its numbers neither generalize nor promise a fixed saving. In that pilot, delegated worker non-cached input plus output was 13.78% below the three direct runs, while the controller's own interval was 55.41% below the direct proxy total; the controller interval also covers managing the direct Codex control arm and reviewing both runs, so it is not a pure delegation bill. Worker totals including cached reads were higher than direct totals, so combined tokens and latency can still increase; medium and large worker usage is marked incomplete.
 

README.zh-CN.md

@@ -56,6 +56,8 @@ opencode-go/deepseek-v4.1-flash
 
 Luna 选择只作用于本次要求的工作。`ds_model_defaults` 只保存 OpenCode Worker 默认值，不能持久化 Codex 原生模型偏好。原生子 Agent 创建后固定使用当时选择的模型；换模型要新建子 Agent。
 
+也可以直接给一组工蜂统一指定模型。例如“当前任务所有工蜂都用 5.6 Luna”，表示从这条指令之后，本任务新建的每个工蜂都走 Codex 原生 Luna；“本次全部工蜂使用 Go GLM 5.3 Flash”则让本任务新建的 OpenCode Worker 统一使用该模型，但不改本机默认值。已经创建的工蜂保持原模型，需要换模型时应新建替代工蜂。“所有工蜂”默认只作用于当前任务或当前 Codex 会话；只有明确说“以后 / 全局 / 所有新执行者”才表示持久偏好，而且 Luna 仍不能通过 `ds_model_defaults` 持久化。
+
 [OpenAI 官方将 GPT-5.6 Luna 定位为面向成本敏感、高吞吐工作负载的模型](https://developers.openai.com/api/docs/models/gpt-5.6-luna)。公开 API 价格不能直接证明 Codex 套餐如何计算原生子 Agent 用量，因此本项目不会在缺少同条件 Codex 实测时承诺固定节省比例。
 
 对于 OpenCode Worker 通道，未保存本机偏好时，内置默认是 `opencode-go/deepseek-v4.1-flash`，推理档位 `max`。`ds_check` 和 `ds_spawn_agent` 可以传入：
@@ -165,7 +167,7 @@ npm --prefix plugins/deepseek-code-agent run test:live
 
 ### 按任务复杂度路由
 
-路由依据判断量、风险以及探索与验证负担，而不是行数或文件数。**小型**已知改动几分钟可完成，由 Codex 直接处理；**中型**机械实现且验收标准清晰时优先委派：范围明确、风险较低的原生子任务可优先使用 `gpt-5.6-luna`，用户指定 DeepSeek/GLM 或任务需要持久会话、worktree、纠错与验证生命周期时使用 OpenCode Worker。**大型或高风险**任务（状态机、并发、权限、事务、迁移等）只能把边界明确的劳动交给任一通道，Codex 必须先确定设计、接口、不变量、失败语义和验收案例，再审查实际 diff 并独立验证。绝不按 Worker 自报或自测通过来接受；用户明确选择优先，任何失败都不能触发静默跨通道降级。
+路由依据判断量、风险以及探索与验证负担，而不是行数或文件数。**小型**已知改动几分钟可完成，由 Codex 直接处理；**中型**机械实现且验收标准清晰时优先委派：范围明确、风险较低的原生子任务可优先使用 `gpt-5.6-luna`。任务确实需要持久会话、独立 worktree、纠错/追加消息队列、fork 或持久化验收时，优先使用 DeepSeek/GLM OpenCode Worker，因为 Luna 不提供这套插件生命周期。**大型或高风险**任务（状态机、并发、权限、事务、迁移等）只能把边界明确的劳动交给任一通道，Codex 必须先确定设计、接口、不变量、失败语义和验收案例，再审查实际 diff 并独立验证。绝不按 Worker 自报或自测通过来接受；用户对本次或全部工蜂的明确模型选择优先于自动路由，能力冲突必须如实说明，任何失败都不能触发静默跨通道降级。
 
 2026-09-15 的 pilot 在同一基线 commit 上为每个规模各做了一次 Codex 直接执行与委派 DeepSeek 执行：[任务分级 pilot](./docs/task-routing-pilot-2026-09-15.md)。它没有测试 Luna。每格仅一次、双臂并行、顺序未交替，因此它不是 queen 协议要求的三次重复正式基准，结果不能推广，也不承诺固定节省。该 pilot 中，worker 非缓存输入加输出合计比三次 direct 低 13.78%，controller 自身区间的 proxy 比 direct proxy 合计低 55.41%；controller 区间也包含管理 Codex 直接执行对照组和审查两组结果，不能当作纯委派账单。计入缓存后 worker total 高于 direct total，总 Token 和耗时仍可能增加；medium 和 large 的 worker 用量标记为不完整。
 

plugins/deepseek-code-agent/.codex-plugin/plugin.json

@@ -33,6 +33,7 @@
     ],
     "defaultPrompt": [
       "Use Codex-native GPT-5.6 Luna with maximum reasoning for this bounded implementation; do not use OpenCode or external credentials.",
+      "Use GPT-5.6 Luna with maximum reasoning for all new workers in this task.",
       "Use DeepSeek or GLM to implement this coding goal, then review and verify its patch.",
       "Set OpenCode Go GLM 5.3 Flash with maximum reasoning as my machine default for new coding workers.",
       "Show the current OpenCode worker default and inspect the active coding agent."

plugins/deepseek-code-agent/README.md

@@ -27,6 +27,8 @@ Before using an external worker on the other computer, run the plugin's `ds_chec
 
 For a bounded, low-risk native task, ask Codex to “use the native GPT-5.6 Luna subagent.” If no effort is stated, Codex must create it with `model="gpt-5.6-luna"` and `reasoning_effort="max"`; an explicit effort such as `medium` is passed unchanged. That route uses the host's model directly and does not call `ds_check`, `ds_spawn_agent`, OpenCode, or an external credential. It is task-scoped, is not accepted as a plugin `provider`, and is not persisted by `ds_model_defaults`. Host availability is checked when Codex creates the native subagent; failure never silently switches lanes.
 
+A fleet-scoped request can select one model for every new delegate in the current task or Codex thread. For example, “use GPT-5.6 Luna for all workers in this task” routes every subsequently created delegate to native Luna/max, while “use Go GLM 5.3 Flash for all workers in this task” applies that OpenCode selection without changing the machine default. Existing workers retain their original model and must be replaced to change it. “All workers” is not machine-global unless the user explicitly says “future/global/all new workers”; Luna cannot be persisted through `ds_model_defaults`.
+
 [OpenAI describes Luna](https://developers.openai.com/api/docs/models/gpt-5.6-luna) as cost-sensitive and high-volume. API list prices are not a promise about native Codex plan metering, and this project has not benchmarked the Luna lane.
 
 For the persistent OpenCode worker lane, the built-in default is `opencode-go/deepseek-v4.1-flash` with variant `max`; a saved machine preference takes precedence. Pass `model="glm-5.3-flash"` for Go GLM, or `provider="deepseek"` for official `deepseek-flash`. `deepseek-v4-pro` and other models in the selected provider's OpenCode catalog are also supported. The saved model pair inherits its saved variant; a different selected provider/model pair defaults to `max` when no variant is supplied; an explicit `variant=null` removes the override for that request.
@@ -50,7 +52,7 @@ The live test makes a small request to the selected model in a temporary Git rep
 
 ## Routing expectation
 
-Route by judgment, risk, and exploration/verification burden, not line counts. Small known edits that take a few minutes stay with Codex. Medium mechanical work with clear acceptance criteria prefers delegation: use native `gpt-5.6-luna` for a bounded low-risk subtask when available, and use the persistent OpenCode worker when the user selects DeepSeek/GLM or needs its worktree, correction, and verification lifecycle. Large or high-risk work (state machines, concurrency, permissions, transactions, migrations) may delegate only bounded labor to either lane; Codex first decides the design, interfaces, data flows, invariants, failure semantics and acceptance examples, then reviews the actual diff and runs independent verification. Worker self-reports and passing self-tests are never acceptance. An explicit user request overrides these defaults, and lane failures never cause silent fallback.
+Route by judgment, risk, and exploration/verification burden, not line counts. Small known edits that take a few minutes stay with Codex. Medium mechanical work with clear acceptance criteria prefers delegation: use native `gpt-5.6-luna` for bounded low-risk subtasks when available. Prefer the DeepSeek/GLM OpenCode lane when persistent sessions, isolated worktrees, queued corrections/follow-ups, forks, or persisted verification materially matter, because native Luna does not provide that plugin-managed lifecycle. Large or high-risk work (state machines, concurrency, permissions, transactions, migrations) may delegate only bounded labor to either lane; Codex first decides the design, interfaces, data flows, invariants, failure semantics and acceptance examples, then reviews the actual diff and runs independent verification. Worker self-reports and passing self-tests are never acceptance. An explicit per-task or fleet-wide model choice overrides these defaults; capability conflicts must be reported, and lane failures never cause silent fallback.
 
 Codex decides the design, interfaces, invariants and acceptance cases. A native Luna subagent receives one bounded task; a persistent OpenCode worker can additionally use the plugin's worktree, correction and verification lifecycle. Codex reviews the actual patch from either lane. After two unsuccessful OpenCode review correction rounds it may take over, after confirming the worker and verification have stopped.
 

plugins/deepseek-code-agent/skills/deepseek-coding-delegation/SKILL.md

@@ -16,6 +16,7 @@ Use the queen where its judgment most affects quality: intent, acceptance criter
 ## Select the worker lane and model
 
 - Honor an explicit lane or model choice. “Codex 内置 Luna / 原生 Luna / GPT-5.6 Luna” selects the native `gpt-5.6-luna` subagent lane. “OpenCode Go / Go 套餐”, “官方 DeepSeek / DeepSeek API”, DeepSeek, or GLM selects the external OpenCode worker lane. Never silently switch lanes after unavailability, authentication, quota, or model errors.
+- Treat a fleet-scoped instruction such as “所有工蜂都用 5.6 Luna” or “本次全部 worker 使用 GLM 5.3 Flash” as the model/lane choice for every new delegate in the stated scope. It overrides automatic lane preferences but not safety, review or capability boundaries. Existing workers keep the model they were created with; create replacement workers when the fleet instruction requires another model. Unless the user says “以后 / 全局 / 所有新执行者”, “所有工蜂” means the current coding task or current Codex thread, not a machine-wide preference.
 - For native Luna, use Codex's native subagent capability with `model="gpt-5.6-luna"`. When the user does not explicitly specify an effort, pass `reasoning_effort="max"` in the spawn call; do not rely on the host default. Do not call any `ds_*` tool, start OpenCode, pass plugin `provider` fields, or read/forward external provider credentials. Native availability comes from the current Codex host; report an unsupported model/effort combination rather than substituting another model. This plugin cannot persist a native Luna default through `ds_model_defaults`; a Luna choice is scoped to the requested work or current thread preference, and changing its model requires a new subagent.
 - Map native “推理最大 / 最高 / 拉满 / max” to `reasoning_effort="max"`, “高 / high” to `high`, “中 / medium” to `medium`, and “低 / low” to `low`. If the user explicitly asks for “默认档位 / 自动”, omit `reasoning_effort` for that request; this is an intentional override and is distinct from leaving the effort unspecified. Never silently lower an unsupported effort.
 - The remaining model-selection rules in this section apply only to the external OpenCode worker lane.
@@ -33,7 +34,7 @@ Use the queen where its judgment most affects quality: intent, acceptance criter
 Choose the route from how much judgment, risk, and exploration/verification burden the task carries — not from line counts or file counts. This is a decision guide for Codex’s situational judgment, not an automatic classifier, and an explicit user request to delegate or to stay direct overrides it.
 
 - **Small (direct):** a known, clearly understood change that takes a few minutes and needs neither broad discovery nor risky design. Handle it in Codex directly; briefing and reviewing a worker would cost more than the edit. Report the route as direct.
-- **Medium (prefer delegation):** mechanical implementation, or a larger amount of testing, with clear and objective acceptance criteria. Prefer native `gpt-5.6-luna` for one bounded, low-risk subtask when the host supports it. Use the persistent OpenCode worker when the user selects DeepSeek/GLM, an applicable worker already exists, or the work benefits from an isolated worktree, persistent correction loop, forks, queued follow-ups, usage reporting, or persisted `task_spec` verification.
+- **Medium (prefer delegation):** mechanical implementation, or a larger amount of testing, with clear and objective acceptance criteria. Prefer native `gpt-5.6-luna` for one bounded, low-risk subtask when the host supports it. When persistent sessions, isolated worktrees, queued corrections/follow-ups, forks, usage reporting, or persisted `task_spec` verification materially matter, prefer the DeepSeek/GLM OpenCode lane because those are OpenCode-worker capabilities. An explicit user fleet/model choice still wins: if it selects Luna, use native Luna for all new delegates in scope and state that the OpenCode lifecycle features are unavailable instead of pretending to provide them or silently changing models.
 - **Large or high-risk (delegated labor, queen-owned design):** state machines, concurrency, permissions, transactions, migrations, or changes where a wrong invariant, interface or failure semantic is expensive. Bounded labor may go to either lane, but Codex must first decide the design, interface, data flow, invariants, failure semantics and acceptance examples; then Codex reviews the actual diff and runs independent verification. Never accept any delegate’s self-report or passing self-tests as acceptance.
 - Hand off a coherent behavior or investigation with acceptance criteria, rather than one function or tool command per turn.
 - Prefer one lane and one delegate for a coherent task. Keep Luna prompts bounded and reuse an applicable native subagent only while its task and selected model remain coherent. Reuse a persistent OpenCode worker for related corrections; use a fresh worker for unrelated tasks.