@xiaohhhh1/canvas-agent 0.4.73 → 0.4.75

package/agent-instructions.md

@@ -17,11 +17,14 @@
 - 用户要求打开带货任务时，调用 `open_flow_c_website`，不要输出或询问 Local URL、连接令牌。
 - 网站把脚本任务交给本机 Codex 后，使用 `flow_c_get_script_task` 读取完整、服务器持久化的任务，再用 `flow_c_submit_script_chunk` 每次回传 1–30 条。不要要求用户复制 JSON、选择交接文件或把短期令牌发到聊天中。
 - 大批量脚本按本机助手指定的序号分段创作；批量大小不能成为降低质量、缩短脚本或套用模板的理由。每条都必须独立构思、符合目标市场自然语言习惯、保持紧凑但清晰可说完的 10 秒节奏。
+- 三种制作方式 `storyboard`、`visual-storyboard`、`first-frame-chain` 共用完全相同、与媒体模式无关的脚本层：同一套爆款蓝图/带货形式库选择、商品适配、目标地区当地化、口播、完整脚本和局部 0–10 秒段。制作方式及分镜布局不得进入脚本创作提示，不得据此重写、过滤、重选或简化脚本。
 - 10 秒仍走原有单段结构。只有任务明确给出 20 或 30 秒时，才先写一份完整总脚本，再拆成 2 或 3 个各自从 0–10 秒计时、可独立生成的段落；同人物同场景用 `continue` 并固定人物、服装、音色身份、场景、光线与商品状态，明确换人物或场景才用 `reset`。音色身份需详细到年龄、音高、音质、语速、口音、停连和说话习惯，情绪随剧情变化，整体仍保持快节奏。
 - 写脚本和回传草案不创建付费任务。只有客户在网站审阅并确认费用后，中心服务才可开始故事板和视频生成。
 
 - 用户明确选择流程 C 时，必须新建独立画布、清单和归档目录，不得混用流程 A 或 B 的资产。
-- 先使用原始同 SKU 商品图和完整脚本生成 9:16、10 秒导演分镜板；每镜必须包含时长、画面/镜头、对应配音、音效/BGM 节奏和情绪，并附专业技术规格栏。
+- 脚本定稿后才按已持久化制作方式分流媒体控制：`storyboard` 使用同一局部脚本和原始同 SKU 商品图生成 9:16 `director-table-scripted-v1` 导演总表；`first-frame-chain` 使用同一局部脚本生成干净 9:16 首帧，并按既有首帧/尾帧连续控制执行。
+- 新 `visual-storyboard` 使用同一局部脚本和原始同 SKU 商品图生成原生横向 16:9 `visual-storyboard-landscape-v2` 纯视觉分镜图。镜头按时间行优先排列（从左到右，再到下一排）：1–4 镜单排；5–8 镜为 3+2、3+3、4+3、4+4 的平衡两排。每排铺满且每格都是真实镜头，不得添加空白、占位格、连续性小块、元数据栏、技术块、脚本、标签、时间码或字幕；镜头景别、镜头、运镜、动作和切点保持原脚本不变，关键内容放在竖屏安全核心。已持久化 `visual-storyboard-adaptive-v1` 仍按原 9:16 历史合同恢复，不得升级或重解释为 v2。
+- Omni 成片在三种制作方式下始终是单一全屏竖向 9:16。纯视觉 v2 按同一行优先顺序把横板每格重建为完整动态镜头，禁止把横板、网格、接缝、边框、空白、分屏、画中画、联系表或幻灯片渲染进成片；20/30 秒仍逐段生成后只做 stream-copy 无损拼接。
 - 原始商品图是唯一商品标准：每一格都必须保持颜色、外形、文字或 Logo、比例、部件和数量一致。分镜通过逐格检查前，严禁提交视频任务。
-- 视频阶段必须同时提供已通过的分镜板和原始商品图。技术失败、超时、明显商品不一致或明显分镜错误时自动重做；提示词、参考图或平台合规问题才暂停等待用户修改。
+- 视频阶段必须按已持久化制作方式提供控制图和原始商品图：导演总表与纯视觉分镜图固定为 `[当前故事板, ...原商品图]`；首帧模式沿用其首帧/尾帧引用合同。技术失败、超时、明显商品不一致或明显分镜错误时按中心既有有界策略处理；提示词、参考图或平台合规问题才暂停等待用户修改。
 - 未配置流程 C 的第三方视频接口时，只能完成分镜准备和验收，明确说明“待管理员配置视频接口”，不得假装已提交或产生扣费。

package/dist/agent/codex-client.d.ts

@@ -5,10 +5,40 @@ export type CodexModelSettings = {
     model?: string;
     reasoningEffort?: string;
 };
+export type CodexAppPhase = "spawn" | "initialize" | "idle" | "thread/start" | "turn/start" | "turn/running" | "terminating" | "exited";
+export type CodexAppProcessFailureDetails = {
+    phase: CodexAppPhase | string;
+    code: number | null;
+    signal: NodeJS.Signals | null;
+    stderr: string;
+    cause?: unknown;
+    source?: "spawn" | "exit" | "stdin" | "timeout";
+    diagnosticId?: string;
+    cleanupConfirmed?: boolean;
+    cleanupBarrier?: Promise<void>;
+};
+/** 可安全向网页和本机状态暴露的 app-server 进程故障。 */
+export declare class CodexAppProcessError extends Error {
+    readonly phase: string;
+    readonly code: number | null;
+    readonly signal: NodeJS.Signals | null;
+    readonly stderr: string;
+    readonly source: "spawn" | "exit" | "stdin" | "timeout";
+    readonly diagnosticId: string;
+    cleanupConfirmed: boolean;
+    cleanupBarrier?: Promise<void>;
+    constructor(details: CodexAppProcessFailureDetails);
+}
+export declare function isCodexAppProcessError(error: unknown): error is CodexAppProcessError;
+/** 去掉凭证、图片、用户目录及控制符，只保留有界的 stderr 尾部。 */
+export declare function sanitizeCodexDiagnosticText(value: unknown, maxChars?: number): string;
+/** Append stderr only after redaction so the in-memory tail never holds raw payloads. */
+export declare function appendCodexDiagnosticTail(current: string, chunk: unknown, maxChars?: number): string;
 /** 封装 Codex app-server 的 JSON-RPC 通信与事件转换。 */
 export declare class CodexAppClient {
     private child;
     private emit;
+    private onExit;
     private nextId;
     private buffer;
     private currentThreadId;
@@ -22,10 +52,20 @@ export declare class CodexAppClient {
     private pendingDeltas;
     private plansByTurn;
     private approvalRequests;
+    private phase;
+    private stderrTail;
+    private logicalClosed;
+    private osExitSeen;
+    private failDelivered;
+    private terminationExpected;
+    private exitDelivered;
+    private terminalError;
+    private exitPromise;
+    private resolveExit;
     /** 保存 app-server 子进程和事件出口。 */
     private constructor();
     /** 启动并初始化 Codex app-server。 */
-    static start(emit: AgentEmit, onExit: () => void): Promise<CodexAppClient>;
+    static start(emit: AgentEmit, onExit: () => void, initializeTimeoutMs?: number): Promise<CodexAppClient>;
     /** 创建新的 Codex 线程。 */
     startThread(cwd?: string, permissionMode?: AgentPermissionMode, modelSettings?: CodexModelSettings): Promise<import("./codex-protocol.js").CodexThread>;
     /** 恢复已有 Codex 线程。 */
@@ -51,7 +91,12 @@ export declare class CodexAppClient {
     /** 中断当前正在运行的 Codex turn。 */
     interruptCurrentTurn(): Promise<boolean>;
     /** 终止失去响应的 app-server，让后续队列可以在新进程继续。 */
-    terminate(message?: string): Promise<void>;
+    terminate(message?: string, diagnostics?: {
+        persistDiagnostic?: boolean;
+        phase?: CodexAppPhase | string;
+    }): Promise<boolean>;
+    /** 仅供 worker 隔离等待真实 OS exit；不包含 stderr 或其它诊断内容。 */
+    waitForExit(): Promise<void>;
     /** 回复网页端已经确认的 Codex 权限请求。 */
     resolveApproval(requestId: string, decision: string): boolean;
     /** 发送 JSON-RPC 请求并保存待处理 Promise。 */
@@ -83,6 +128,12 @@ export declare class CodexAppClient {
     private resolve;
     /** 拒绝指定 JSON-RPC 请求。 */
     private reject;
+    /** 只在内存保存 stderr 尾部；原文绝不直接发往网页或写入日志。 */
+    private recordStderr;
+    /** error/exit/stdin 统一且只执行一次的进程收尾。 */
+    private handleProcessFailure;
+    private noteOsExit;
+    private deliverExit;
     /** 拒绝进程退出时仍未完成的请求与 turn。 */
     private failAll;
 }

package/dist/agent/codex-client.js

@@ -1,8 +1,10 @@
 import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
 import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { VERSION } from "../config.js";
+import { CONFIG_DIR, VERSION } from "../config.js";
 import { logger } from "../utils/logger.js";
 import { field } from "../utils/value.js";
 const canvasAgentMcp = canvasAgentMcpCommand();
@@ -10,10 +12,89 @@ const require = createRequire(import.meta.url);
 const STREAM_UPDATE_INTERVAL_MS = 40;
 const TURN_RECONCILE_INTERVAL_MS = 5_000;
 const APP_SERVER_INITIALIZE_TIMEOUT_MS = 30_000;
+const CODEX_STDERR_TAIL_CHARS = 32 * 1024;
+const CODEX_VISIBLE_DIAGNOSTIC_CHARS = 2_048;
+const CODEX_DIAGNOSTIC_FILE_BYTES = 512 * 1024;
+const CODEX_DIAGNOSTIC_ENTRY_BYTES = 12 * 1024;
+let diagnosticWriteQueue = Promise.resolve();
+/** 可安全向网页和本机状态暴露的 app-server 进程故障。 */
+export class CodexAppProcessError extends Error {
+    phase;
+    code;
+    signal;
+    stderr;
+    source;
+    diagnosticId;
+    cleanupConfirmed;
+    cleanupBarrier;
+    constructor(details) {
+        const stderr = sanitizeCodexDiagnosticText(details.stderr, 8_192);
+        const source = details.source || "exit";
+        const diagnosticId = details.diagnosticId || randomUUID();
+        const summary = [
+            `Codex app-server process failure (phase=${details.phase}`,
+            `code=${details.code ?? "none"}`,
+            `signal=${details.signal ?? "none"}`,
+            `diagnosticId=${diagnosticId})`,
+        ].join(", ");
+        super(summary);
+        this.name = "CodexAppProcessError";
+        this.phase = details.phase;
+        this.code = details.code;
+        this.signal = details.signal;
+        this.stderr = stderr;
+        this.source = source;
+        this.diagnosticId = diagnosticId;
+        this.cleanupConfirmed = details.cleanupConfirmed !== false;
+        this.cleanupBarrier = details.cleanupBarrier;
+        if (details.cause !== undefined)
+            this.cause = details.cause;
+    }
+}
+export function isCodexAppProcessError(error) {
+    return error instanceof CodexAppProcessError || Boolean(error && typeof error === "object" && error.name === "CodexAppProcessError");
+}
+/** 去掉凭证、图片、用户目录及控制符，只保留有界的 stderr 尾部。 */
+export function sanitizeCodexDiagnosticText(value, maxChars = CODEX_VISIBLE_DIAGNOSTIC_CHARS) {
+    const budget = Math.max(0, Math.floor(maxChars));
+    if (!budget)
+        return "";
+    let text = String(value || "")
+        .replace(/\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g, "")
+        .replace(/data:image\/[a-z0-9.+-]+;base64,[a-z0-9+/=_-]+/gi, "data:image/[REDACTED]")
+        // `trim()` below can remove the only space when "Bearer " and its
+        // value arrive in separate stderr chunks, so also redact the joined
+        // continuation form before it can enter the retained tail.
+        .replace(/\bBearer\s*[^\s"',;]+/gi, "Bearer [REDACTED]")
+        .replace(/\bsk-[a-z0-9_-]+/gi, "sk-[REDACTED]")
+        // stderr can arrive in arbitrary chunks. If the previous chunk ended
+        // inside a redacted value, discard every token-like continuation first
+        // so later assignment rules stay idempotent.
+        .replace(/["']?\[REDACTED(?:_LONG_TOKEN)?\]["']?[a-z0-9._~+/_=-]+/gi, "[REDACTED]")
+        .replace(/(["']?)([a-z][a-z0-9_]*(?:_token|_secret|_password|_api_key))\1(\s*[:=]\s*)(?:\[REDACTED(?:_LONG_TOKEN)?\]|"[^"]*"|'[^']*'|[^\s,;\]}]+)/gi, '$1$2$1$3"[REDACTED]"')
+        .replace(/([?&](?:access_token|refresh_token|connect_token|token|api_?key|secret|password)=)[^&\s]+/gi, "$1[REDACTED]")
+        .replace(/(["']?(?:authorization|api[-_ ]?key|access[-_ ]?token|refresh[-_ ]?token|connect[-_ ]?token|cookie|session|password|secret)["']?\s*[=:]\s*)["'][^"']*["']/gi, "$1\"[REDACTED]\"")
+        .replace(/((?:authorization|api[-_ ]?key|access[-_ ]?token|refresh[-_ ]?token|connect[-_ ]?token|cookie|session|password|secret)\s*[=:]\s*)(?:\[REDACTED(?:_LONG_TOKEN)?\]|[^\s"',;\]}]+)/gi, "$1[REDACTED]")
+        // A tail slice can begin in the middle of an image payload or unknown
+        // credential and therefore no longer contain a recognisable prefix.
+        .replace(/(?<![a-z0-9])[a-z0-9._~+/_=-]{32,}(?![a-z0-9])/gi, "[REDACTED_LONG_TOKEN]")
+        .replace(/[a-z]:[\\/]Users[\\/][^\\/]+(?=[\\/])/gi, "%USERPROFILE%")
+        .replace(/\/(?:Users|home)\/[^/\s]+/g, "$HOME")
+        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, "")
+        .trim();
+    if (text.length > budget)
+        text = text.slice(-budget);
+    return text;
+}
+/** Append stderr only after redaction so the in-memory tail never holds raw payloads. */
+export function appendCodexDiagnosticTail(current, chunk, maxChars = CODEX_STDERR_TAIL_CHARS) {
+    return sanitizeCodexDiagnosticText(`${current}${String(chunk || "")}`, maxChars);
+}
 /** 封装 Codex app-server 的 JSON-RPC 通信与事件转换。 */
 export class CodexAppClient {
     child;
     emit;
+    onExit;
     nextId = 1;
     buffer = "";
     currentThreadId = "";
@@ -27,55 +108,89 @@ export class CodexAppClient {
     pendingDeltas = new Map();
     plansByTurn = new Map();
     approvalRequests = new Map();
+    phase = "spawn";
+    stderrTail = "";
+    logicalClosed = false;
+    osExitSeen = false;
+    failDelivered = false;
+    terminationExpected = false;
+    exitDelivered = false;
+    terminalError = null;
+    exitPromise;
+    resolveExit;
     /** 保存 app-server 子进程和事件出口。 */
-    constructor(child, emit) {
+    constructor(child, emit, onExit) {
         this.child = child;
         this.emit = emit;
+        this.onExit = onExit;
+        this.exitPromise = new Promise((resolve) => { this.resolveExit = resolve; });
     }
     /** 启动并初始化 Codex app-server。 */
-    static async start(emit, onExit) {
+    static async start(emit, onExit, initializeTimeoutMs = APP_SERVER_INITIALIZE_TIMEOUT_MS) {
         logger.info("Starting Codex app-server", { executable: process.execPath, codex: codexBin() });
         const child = spawn(process.execPath, [codexBin(), "app-server", "--stdio"], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
-        const client = new CodexAppClient(child, emit);
+        const client = new CodexAppClient(child, emit, onExit);
         child.stdout?.on("data", (chunk) => client.read(chunk.toString()));
         child.stderr?.on("data", (chunk) => {
-            const text = chunk.toString();
-            logger.warn("Codex app-server stderr", { text });
-            emit("agent_log", { text });
+            client.recordStderr(chunk.toString());
+        });
+        child.once("error", (error) => {
+            client.handleProcessFailure(new CodexAppProcessError({ phase: client.phase, code: null, signal: null, stderr: `${client.stderrTail}\n${error.message}`, cause: error, source: "spawn" }));
         });
-        child.on("error", (error) => {
-            logger.error("Codex app-server process error", error);
-            emit("agent_error", { message: error.message });
+        child.once("exit", (code, signal) => {
+            client.handleProcessFailure(new CodexAppProcessError({ phase: client.phase, code, signal, stderr: client.stderrTail, source: "exit" }), true);
         });
-        child.on("exit", (code) => {
-            logger.warn("Codex app-server exited", { code });
-            client.failAll(`Codex app-server exited: ${code ?? 0}`);
-            onExit();
-            emit("agent_log", { text: `Codex app-server exited: ${code ?? 0}` });
+        // spawn 失败时 Node 可能只有 error + close 而没有 exit；close 表示 stdio
+        // 已关闭，可安全解除 worker 的 OS-exit 隔离。正常 exit + close 由幂等保护处理。
+        child.once("close", () => {
+            client.noteOsExit();
         });
         try {
-            await withTimeout(client.request("initialize", { clientInfo: { name: "canvas-agent", title: "Infinite Canvas Agent", version: VERSION }, capabilities: { experimentalApi: true, requestAttestation: false } }), APP_SERVER_INITIALIZE_TIMEOUT_MS, "Codex app-server initialize timed out");
+            client.phase = "initialize";
+            await withTimeout(client.request("initialize", { clientInfo: { name: "canvas-agent", title: "Infinite Canvas Agent", version: VERSION }, capabilities: { experimentalApi: true, requestAttestation: false } }), Math.max(1, Math.min(APP_SERVER_INITIALIZE_TIMEOUT_MS, initializeTimeoutMs)), "Codex app-server initialize timed out");
             client.notify("initialized");
+            client.phase = "idle";
             return client;
         }
         catch (error) {
-            await client.terminate("Codex app-server 初始化超时，已回收失去响应的进程");
-            throw error;
+            const processError = isCodexAppProcessError(error) ? error : new CodexAppProcessError({ phase: "initialize", code: child.exitCode, signal: child.signalCode, stderr: `${client.stderrTail}\n${error instanceof Error ? error.message : String(error)}`, cause: error, source: "timeout" });
+            if (!isCodexAppProcessError(error))
+                void persistCodexProcessDiagnostic(processError);
+            processError.cleanupConfirmed = await client.terminate("Codex app-server 初始化失败，已回收当前进程");
+            if (!processError.cleanupConfirmed)
+                processError.cleanupBarrier = client.waitForExit();
+            throw processError;
         }
     }
     /** 创建新的 Codex 线程。 */
     async startThread(cwd, permissionMode = "request", modelSettings = {}) {
-        const { thread } = await this.request("thread/start", { ...threadSettings(permissionMode, modelSettings), ...(cwd ? { cwd } : {}), ...(modelSettings.model ? { model: modelSettings.model } : {}), threadSource: "user" });
-        if (!thread.id)
-            throw new Error("Codex app-server 没有返回 thread id");
-        return thread;
+        this.stderrTail = "";
+        this.phase = "thread/start";
+        try {
+            const { thread } = await this.request("thread/start", { ...threadSettings(permissionMode, modelSettings), ...(cwd ? { cwd } : {}), ...(modelSettings.model ? { model: modelSettings.model } : {}), threadSource: "user" });
+            if (!thread.id)
+                throw new Error("Codex app-server 没有返回 thread id");
+            return thread;
+        }
+        finally {
+            if (!this.logicalClosed)
+                this.phase = "idle";
+        }
     }
     /** 恢复已有 Codex 线程。 */
     async resumeThread(threadId, cwd, permissionMode = "request", modelSettings = {}) {
-        const { thread } = await this.request("thread/resume", { threadId, ...threadSettings(permissionMode, modelSettings), ...(cwd ? { cwd } : {}), ...(modelSettings.model ? { model: modelSettings.model } : {}) });
-        if (!thread.id)
-            throw new Error("Codex app-server 没有返回 thread id");
-        return thread;
+        this.stderrTail = "";
+        this.phase = "thread/start";
+        try {
+            const { thread } = await this.request("thread/resume", { threadId, ...threadSettings(permissionMode, modelSettings), ...(cwd ? { cwd } : {}), ...(modelSettings.model ? { model: modelSettings.model } : {}) });
+            if (!thread.id)
+                throw new Error("Codex app-server 没有返回 thread id");
+            return thread;
+        }
+        finally {
+            if (!this.logicalClosed)
+                this.phase = "idle";
+        }
     }
     /** 查询 Codex 线程列表。 */
     listThreads(params) {
@@ -103,25 +218,33 @@ export class CodexAppClient {
     /** 启动一个 Codex turn 并等待完成通知。 */
     async startTurn(threadId, prompt, images, permissionMode, onTurn, outputSchema, modelSettings = {}) {
         this.currentThreadId = threadId;
-        const { turn } = await this.request("turn/start", { threadId, input: codexInput(prompt, images), ...turnSettings(permissionMode), ...(modelSettings.model ? { model: modelSettings.model } : {}), ...(modelSettings.reasoningEffort ? { effort: modelSettings.reasoningEffort } : {}), ...(outputSchema ? { outputSchema } : {}) });
-        const turnId = turn.id;
-        if (!turnId)
-            throw new Error("Codex app-server 没有返回 turn id");
-        this.currentTurnId = turnId;
-        onTurn?.(turnId);
-        const completed = this.completedTurns.get(turnId);
-        if (this.completedTurns.has(turnId)) {
-            this.completedTurns.delete(turnId);
-            this.currentThreadId = "";
-            this.currentTurnId = "";
-            if (completed?.error)
-                throw completed.error;
-            return completed?.text || "";
+        this.phase = "turn/start";
+        try {
+            const { turn } = await this.request("turn/start", { threadId, input: codexInput(prompt, images), ...turnSettings(permissionMode), ...(modelSettings.model ? { model: modelSettings.model } : {}), ...(modelSettings.reasoningEffort ? { effort: modelSettings.reasoningEffort } : {}), ...(outputSchema ? { outputSchema } : {}) });
+            const turnId = turn.id;
+            if (!turnId)
+                throw new Error("Codex app-server 没有返回 turn id");
+            this.currentTurnId = turnId;
+            this.phase = "turn/running";
+            onTurn?.(turnId);
+            const completed = this.completedTurns.get(turnId);
+            if (this.completedTurns.has(turnId)) {
+                this.completedTurns.delete(turnId);
+                this.currentThreadId = "";
+                this.currentTurnId = "";
+                if (completed?.error)
+                    throw completed.error;
+                return completed?.text || "";
+            }
+            return await new Promise((resolve, reject) => {
+                this.activeTurns.set(turnId, { resolve, reject });
+                this.scheduleTurnReconciliation(threadId, turnId);
+            });
+        }
+        finally {
+            if (!this.logicalClosed)
+                this.phase = "idle";
         }
-        return await new Promise((resolve, reject) => {
-            this.activeTurns.set(turnId, { resolve, reject });
-            this.scheduleTurnReconciliation(threadId, turnId);
-        });
     }
     /** 中断当前正在运行的 Codex turn。 */
     async interruptCurrentTurn() {
@@ -140,15 +263,40 @@ export class CodexAppClient {
         }
     }
     /** 终止失去响应的 app-server，让后续队列可以在新进程继续。 */
-    terminate(message = "Codex app-server was restarted") {
-        this.failAll(message);
-        if (this.child.exitCode !== null)
-            return Promise.resolve();
-        return new Promise((resolve) => {
-            const timer = setTimeout(resolve, 2000);
-            this.child.once("exit", () => { clearTimeout(timer); resolve(); });
+    async terminate(message = "Codex app-server was restarted", diagnostics = {}) {
+        const failurePhase = diagnostics.phase || this.phase;
+        if (!this.logicalClosed) {
+            this.terminationExpected = true;
+            this.logicalClosed = true;
+            this.terminalError = new Error(message);
+            this.phase = "terminating";
+            this.failAll(this.terminalError);
+            this.deliverExit();
+        }
+        if (diagnostics.persistDiagnostic) {
+            void persistCodexProcessDiagnostic(new CodexAppProcessError({ phase: failurePhase, code: this.child.exitCode, signal: this.child.signalCode, stderr: `${this.stderrTail}\n${message}`, source: "timeout" }));
+        }
+        if (this.osExitSeen || this.child.exitCode !== null) {
+            this.noteOsExit();
+            return true;
+        }
+        if (!this.child.killed)
             this.child.kill();
-        });
+        let timer;
+        try {
+            return await Promise.race([
+                this.exitPromise.then(() => true),
+                new Promise((resolve) => { timer = setTimeout(() => resolve(false), 2_000); }),
+            ]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    /** 仅供 worker 隔离等待真实 OS exit；不包含 stderr 或其它诊断内容。 */
+    waitForExit() {
+        return this.exitPromise;
     }
     /** 回复网页端已经确认的 Codex 权限请求。 */
     resolveApproval(requestId, decision) {
@@ -166,8 +314,18 @@ export class CodexAppClient {
     /** 发送 JSON-RPC 请求并保存待处理 Promise。 */
     request(method, params) {
         const id = this.nextId++;
-        this.write({ id, method, params });
-        return new Promise((resolve, reject) => this.pending.set(id, { resolve: (result) => resolve(result), reject }));
+        return new Promise((resolve, reject) => {
+            if (this.logicalClosed || this.terminalError)
+                return reject(this.terminalError || new Error("Codex app-server is closed"));
+            this.pending.set(id, { resolve: (result) => resolve(result), reject });
+            try {
+                this.write({ id, method, params });
+            }
+            catch (error) {
+                this.pending.delete(id);
+                reject(error instanceof Error ? error : new Error(String(error)));
+            }
+        });
     }
     /** 发送无需响应的 JSON-RPC 通知。 */
     notify(method, params) {
@@ -179,7 +337,24 @@ export class CodexAppClient {
         const params = field(value, "params");
         if (method)
             logger.debug(`Codex ${method}`, { id: field(value, "id"), threadId: field(params, "threadId") });
-        this.child.stdin?.write(`${JSON.stringify(value)}\n`);
+        const stdin = this.child.stdin;
+        if (!stdin || stdin.destroyed || !stdin.writable) {
+            const error = new CodexAppProcessError({ phase: this.phase, code: this.child.exitCode, signal: this.child.signalCode, stderr: this.stderrTail, source: "stdin" });
+            this.handleProcessFailure(error);
+            throw error;
+        }
+        try {
+            stdin.write(`${JSON.stringify(value)}\n`, (cause) => {
+                if (!cause)
+                    return;
+                this.handleProcessFailure(new CodexAppProcessError({ phase: this.phase, code: this.child.exitCode, signal: this.child.signalCode, stderr: `${this.stderrTail}\n${cause.message}`, cause, source: "stdin" }));
+            });
+        }
+        catch (cause) {
+            const error = new CodexAppProcessError({ phase: this.phase, code: this.child.exitCode, signal: this.child.signalCode, stderr: `${this.stderrTail}\n${cause instanceof Error ? cause.message : String(cause)}`, cause, source: "stdin" });
+            this.handleProcessFailure(error);
+            throw error;
+        }
     }
     /** 按行解析 app-server 标准输出。 */
     read(chunk) {
@@ -191,8 +366,8 @@ export class CodexAppClient {
                 this.handle(JSON.parse(line));
             }
             catch (error) {
-                logger.warn("Invalid Codex app-server output", { error, line });
-                this.emit("agent_log", { text: line });
+                logger.warn("Invalid Codex app-server output", { error: error instanceof Error ? error.message : String(error), bytes: line.length });
+                this.emit("agent_log", { text: "Codex app-server 返回了无法解析的本地响应；为保护提示词和凭证，原始内容仅丢弃不展示" });
             }
         });
     }
@@ -395,14 +570,55 @@ export class CodexAppClient {
         if (pending)
             (this.pending.delete(id), pending.reject(new Error(message)));
     }
+    /** 只在内存保存 stderr 尾部；原文绝不直接发往网页或写入日志。 */
+    recordStderr(chunk) {
+        this.stderrTail = appendCodexDiagnosticTail(this.stderrTail, chunk);
+    }
+    /** error/exit/stdin 统一且只执行一次的进程收尾。 */
+    handleProcessFailure(error, exitSeen = false) {
+        if (exitSeen)
+            this.noteOsExit();
+        if (this.logicalClosed)
+            return;
+        this.logicalClosed = true;
+        this.terminalError = error;
+        const expected = this.terminationExpected;
+        if (exitSeen)
+            this.phase = "exited";
+        if (!expected) {
+            this.failAll(error);
+            void persistCodexProcessDiagnostic(error);
+            logger.warn("Codex app-server process failure", { message: error.message });
+            this.emit("agent_log", { text: error.message });
+            if (this.child.exitCode === null && !this.child.killed)
+                this.child.kill();
+        }
+        this.deliverExit();
+    }
+    noteOsExit() {
+        if (this.osExitSeen)
+            return;
+        this.osExitSeen = true;
+        this.phase = "exited";
+        this.resolveExit();
+    }
+    deliverExit() {
+        if (this.exitDelivered)
+            return;
+        this.exitDelivered = true;
+        this.onExit();
+    }
     /** 拒绝进程退出时仍未完成的请求与 turn。 */
-    failAll(message) {
-        [...this.pending.values()].forEach((item) => item.reject(new Error(message)));
+    failAll(error) {
+        if (this.failDelivered)
+            return;
+        this.failDelivered = true;
+        [...this.pending.values()].forEach((item) => item.reject(error));
         [...this.activeTurns.entries()].forEach(([turnId, item]) => {
             if (item.reconcileTimer)
                 clearTimeout(item.reconcileTimer);
             this.activeTurns.delete(turnId);
-            item.reject(new Error(message));
+            item.reject(error);
         });
         this.pendingDeltas.forEach((item) => clearTimeout(item.timer));
         this.pending.clear();
@@ -415,6 +631,29 @@ export class CodexAppClient {
         this.currentTurnId = "";
     }
 }
+/** 将脱敏诊断写入用户目录；单日有界，写入失败不影响脚本恢复。 */
+function persistCodexProcessDiagnostic(error) {
+    diagnosticWriteQueue = diagnosticWriteQueue.catch(() => undefined).then(async () => {
+        const directory = path.join(CONFIG_DIR, "logs");
+        const file = path.join(directory, `codex-app-server-diagnostics-${new Date().toISOString().slice(0, 10)}.jsonl`);
+        await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+        const currentBytes = await fs.stat(file).then((value) => value.size).catch(() => 0);
+        const entry = `${JSON.stringify({
+            at: new Date().toISOString(),
+            diagnosticId: error.diagnosticId,
+            phase: error.phase,
+            source: error.source,
+            code: error.code,
+            signal: error.signal,
+            stderr: sanitizeCodexDiagnosticText(error.stderr, 8_192),
+        })}\n`;
+        const bytes = Buffer.byteLength(entry);
+        if (bytes > CODEX_DIAGNOSTIC_ENTRY_BYTES || currentBytes + bytes > CODEX_DIAGNOSTIC_FILE_BYTES)
+            return;
+        await fs.appendFile(file, entry, { encoding: "utf8", mode: 0o600 });
+    }).catch((error) => logger.debug("Failed to persist Codex process diagnostic", { error }));
+    return diagnosticWriteQueue;
+}
 async function withTimeout(promise, timeoutMs, message) {
     let timer;
     try {

package/dist/agent/codex.d.ts

@@ -1,3 +1,4 @@
+import { type CodexAppProcessError } from "./codex-client.js";
 import type { AgentAttachment, AgentEmit, AgentPermissionMode } from "./types.js";
 type CodexRunOptions = {
     threadId?: string;
@@ -29,19 +30,34 @@ export type CodexWorkflowRunResult = {
     ok: false;
     error: string;
     retryable: boolean;
+    failureKind: "contract" | "transport" | "timeout" | "turn";
     timings: {
         queueWaitMs: number;
         threadStartMs: number;
         modelMs: number;
     };
 };
+type CodexWorkflowFailureKind = Extract<CodexWorkflowRunResult, {
+    ok: false;
+}>["failureKind"];
 export declare const FLOW_C_CODEX_MODEL = "gpt-5.6-terra";
 export declare const FLOW_C_CODEX_REASONING_EFFORT = "medium";
 export declare const FLOW_C_CODEX_WORKER_CONCURRENCY: number;
+export declare const FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS = 3;
 export declare function flowCCodexWorkerStatus(): {
     active: number;
     limit: number;
 };
+/**
+ * 记录尚未确认 OS exit 的 worker 进程。worker 可以释放给队列，但在对应
+ * barrier 完成前只能等待/失败，绝不能启动替代 app-server。
+ */
+export declare class WorkflowCodexLaneQuarantine {
+    private barriers;
+    quarantine(workerIndex: number, barrier: Promise<void>): Promise<undefined>;
+    wait(workerIndex: number, timeoutMs: number): Promise<boolean>;
+    isQuarantined(workerIndex: number): boolean;
+}
 export { summarizeCodexThread } from "./codex-history.js";
 /** 将 Codex turn 加入串行队列并等待执行完成。 */
 export declare function runCodexTurn(prompt: string, emit: AgentEmit, attachments?: AgentAttachment[], options?: CodexRunOptions): Promise<CodexRunResult>;
@@ -57,6 +73,15 @@ export declare function runCodexWorkflowTurn(prompt: string, emit: AgentEmit, op
     onWorkerStart?: () => void;
     onWorkerFinish?: () => void;
 }): Promise<CodexWorkflowRunResult>;
+/** A deadline exhausted after process recovery is terminal for this handoff wave. */
+export declare function isWorkflowFailureRetryable(failureKind: CodexWorkflowFailureKind, cleanupConfirmed: boolean, processRecoveryObserved: boolean): boolean;
+type CodexProcessRetryOptions = {
+    maxAttempts?: number;
+    backoffMs?: number | ((failedAttempt: number) => number);
+    onRetry?: (error: CodexAppProcessError, failedAttempt: number) => Promise<void> | void;
+};
+/** 只重试明确的 app-server 进程/stdio 故障；结构契约和普通模型失败均立即上抛。 */
+export declare function runCodexProcessRetries<T>(operation: (attempt: number) => Promise<T>, options?: CodexProcessRetryOptions): Promise<T>;
 /**
  * 给 Flow C 的完整 app-server 链路设置硬截止时间。超时后不再等待原 Promise
  * 自行结束；否则初始化或 thread/start 永不返回时会永久占住 worker lane。

package/dist/agent/codex.js

@@ -3,12 +3,14 @@ import os from "node:os";
 import path from "node:path";
 import { logger } from "../utils/logger.js";
 import { errorMessage, field } from "../utils/value.js";
-import { CodexAppClient } from "./codex-client.js";
+import { CodexAppClient, isCodexAppProcessError } from "./codex-client.js";
 import { summarizeCodexThread, threadMessages } from "./codex-history.js";
 import { boundedWorkerConcurrency, WorkerPool } from "./worker-pool.js";
 export const FLOW_C_CODEX_MODEL = "gpt-5.6-terra";
 export const FLOW_C_CODEX_REASONING_EFFORT = "medium";
 export const FLOW_C_CODEX_WORKER_CONCURRENCY = boundedWorkerConcurrency(process.env.FLOW_C_SCRIPT_CONCURRENCY);
+export const FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS = 3;
+const FLOW_C_CODEX_MIN_START_BUDGET_MS = 5_000;
 export function flowCCodexWorkerStatus() { return { active: workflowCodexPool.activeCount, limit: FLOW_C_CODEX_WORKER_CONCURRENCY }; }
 let codexQueue = Promise.resolve();
 let codexApp = null;
@@ -17,6 +19,46 @@ let codexThreadId = "";
 const unmaterializedThreadIds = new Set();
 const workflowCodexPool = new WorkerPool(FLOW_C_CODEX_WORKER_CONCURRENCY);
 const workflowCodexApps = new Map();
+/**
+ * 记录尚未确认 OS exit 的 worker 进程。worker 可以释放给队列，但在对应
+ * barrier 完成前只能等待/失败，绝不能启动替代 app-server。
+ */
+export class WorkflowCodexLaneQuarantine {
+    barriers = new Map();
+    quarantine(workerIndex, barrier) {
+        const previous = this.barriers.get(workerIndex);
+        const combined = (previous ? Promise.all([previous, barrier]) : Promise.resolve(barrier))
+            .then(() => undefined, () => undefined);
+        this.barriers.set(workerIndex, combined);
+        void combined.then(() => {
+            if (this.barriers.get(workerIndex) === combined)
+                this.barriers.delete(workerIndex);
+        });
+        return combined;
+    }
+    async wait(workerIndex, timeoutMs) {
+        const barrier = this.barriers.get(workerIndex);
+        if (!barrier)
+            return true;
+        if (timeoutMs <= 0)
+            return false;
+        let timer;
+        try {
+            return await Promise.race([
+                barrier.then(() => true),
+                new Promise((resolve) => { timer = setTimeout(() => resolve(false), timeoutMs); }),
+            ]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    isQuarantined(workerIndex) {
+        return this.barriers.has(workerIndex);
+    }
+}
+const workflowCodexLaneQuarantine = new WorkflowCodexLaneQuarantine();
 export { summarizeCodexThread } from "./codex-history.js";
 /** 将 Codex turn 加入串行队列并等待执行完成。 */
 export async function runCodexTurn(prompt, emit, attachments = [], options = {}) {
@@ -37,41 +79,104 @@ export async function interruptCodexTurn(threadId) {
  */
 export async function runCodexWorkflowTurn(prompt, emit, options) {
     if (!prompt.trim())
-        return { ok: false, error: "Codex prompt is empty", retryable: false, timings: { queueWaitMs: 0, threadStartMs: 0, modelMs: 0 } };
+        return { ok: false, error: "Codex prompt is empty", retryable: false, failureKind: "contract", timings: { queueWaitMs: 0, threadStartMs: 0, modelMs: 0 } };
     return await workflowCodexPool.run(async (workerIndex, queueWaitMs) => {
         options.onWorkerStart?.();
         const modelSettings = { model: FLOW_C_CODEX_MODEL, reasoningEffort: FLOW_C_CODEX_REASONING_EFFORT };
-        const threadStartedAt = Date.now();
+        const deadlineAt = Date.now() + Math.max(1, options.timeoutMs);
         let threadStartMs = 0;
-        let modelStartedAt = 0;
-        let app = workflowCodexApps.get(workerIndex);
+        let modelMs = 0;
+        let app;
+        let processAttempts = 0;
+        let processRecoveryObserved = false;
+        let cleanupConfirmed = true;
         let files = [];
         try {
-            const operation = (async () => {
-                files = await writeAttachmentFiles(options.attachments || []);
-                if (!app)
-                    app = await startWorkflowCodexApp(workerIndex, options.appEmit || emit);
-                const thread = await app.startThread(options.cwd, options.permissionMode || "request", modelSettings);
-                const threadId = String(field(thread, "id") || "");
-                options.onThread?.(threadId);
-                threadStartMs = Date.now() - threadStartedAt;
-                modelStartedAt = Date.now();
-                return await app.startTurn(threadId, prompt, files, options.permissionMode || "request", options.onTurn, options.outputSchema, modelSettings);
-            })();
-            const result = await runBoundedWorkflowOperation(operation, options.timeoutMs, async () => {
-                workflowCodexApps.delete(workerIndex);
-                await app?.terminate("Flow C 脚本执行链路超时，已仅回收当前 worker");
+            files = await writeAttachmentFiles(options.attachments || []);
+            const text = await runCodexProcessRetries(async (attempt) => {
+                processAttempts = attempt;
+                const attemptStartedAt = Date.now();
+                let modelStartedAt = 0;
+                try {
+                    const laneReady = await workflowCodexLaneQuarantine.wait(workerIndex, Math.max(0, deadlineAt - Date.now()));
+                    if (!laneReady) {
+                        cleanupConfirmed = false;
+                        throw new CodexWorkflowTimeoutError();
+                    }
+                    const startupBudgetMs = deadlineAt - Date.now();
+                    if (startupBudgetMs < FLOW_C_CODEX_MIN_START_BUDGET_MS)
+                        throw new CodexWorkflowTimeoutError();
+                    app = workflowCodexApps.get(workerIndex);
+                    if (!app)
+                        app = await startWorkflowCodexApp(workerIndex, options.appEmit || emit, startupBudgetMs);
+                    const remainingMs = deadlineAt - Date.now();
+                    if (remainingMs <= 0)
+                        throw new CodexWorkflowTimeoutError();
+                    const operation = (async () => {
+                        const thread = await app.startThread(options.cwd, options.permissionMode || "request", modelSettings);
+                        const threadId = String(field(thread, "id") || "");
+                        options.onThread?.(threadId);
+                        modelStartedAt = Date.now();
+                        return await app.startTurn(threadId, prompt, files, options.permissionMode || "request", options.onTurn, options.outputSchema, modelSettings);
+                    })();
+                    const result = await runBoundedWorkflowOperation(operation, remainingMs, async () => {
+                        const timedOutApp = app;
+                        cleanupConfirmed = await discardWorkflowCodexApp(workerIndex, timedOutApp, "Flow C 脚本执行链路超时，已仅回收当前 worker", true);
+                        if (app === timedOutApp)
+                            app = undefined;
+                    });
+                    if (result.timedOut)
+                        throw new CodexWorkflowTimeoutError();
+                    return result.value;
+                }
+                finally {
+                    if (modelStartedAt)
+                        modelMs += Date.now() - modelStartedAt;
+                    else
+                        threadStartMs += Date.now() - attemptStartedAt;
+                }
+            }, {
+                maxAttempts: FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS,
+                backoffMs: (failedAttempt) => Math.max(0, Math.min(failedAttempt === 1 ? 250 : 750, deadlineAt - Date.now())),
+                onRetry: async (error, failedAttempt) => {
+                    processRecoveryObserved = true;
+                    cleanupConfirmed = await discardWorkflowCodexApp(workerIndex, app, `Flow C 本机脚本引擎第 ${failedAttempt}/${FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS} 次进程异常，正在换新进程重试`);
+                    app = undefined;
+                    if (!cleanupConfirmed)
+                        throw error;
+                    if (deadlineAt - Date.now() < FLOW_C_CODEX_MIN_START_BUDGET_MS)
+                        throw new CodexWorkflowTimeoutError();
+                    emit("agent_log", { text: `Flow C 本机脚本引擎异常，已回收当前 worker，将进行第 ${failedAttempt + 1}/${FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS} 次尝试（${error.message}）` });
+                },
             });
-            if (result.timedOut) {
-                return { ok: false, error: "Flow C 脚本执行链路超过 8 分钟，已自动终止当前 worker", retryable: true, timings: { queueWaitMs, threadStartMs: threadStartMs || Date.now() - threadStartedAt, modelMs: modelStartedAt ? Date.now() - modelStartedAt : 0 } };
-            }
-            return { ok: true, text: result.value, timings: { queueWaitMs, threadStartMs, modelMs: Date.now() - modelStartedAt } };
+            return { ok: true, text, timings: { queueWaitMs, threadStartMs, modelMs } };
         }
         catch (error) {
             logger.error("Flow C Codex worker failed", { workerIndex, error });
-            const message = errorMessage(error);
+            const processFailure = isCodexAppProcessError(error);
+            const contractFailure = isDeterministicWorkflowContractError(error);
+            const timeoutFailure = error instanceof CodexWorkflowTimeoutError;
+            const deadlineAfterProcessFailure = timeoutFailure && processRecoveryObserved;
+            const transportFailure = !contractFailure && (processFailure || deadlineAfterProcessFailure);
+            if (processFailure && error.cleanupConfirmed === false)
+                cleanupConfirmed = false;
+            if (processFailure && error.cleanupBarrier)
+                workflowCodexLaneQuarantine.quarantine(workerIndex, error.cleanupBarrier);
+            const failureKind = contractFailure ? "contract" : transportFailure ? "transport" : timeoutFailure ? "timeout" : "turn";
+            const rawMessage = errorMessage(error);
+            let message = deadlineAfterProcessFailure
+                ? `本机 Codex 脚本引擎进程异常后未能在原 8 分钟截止时间内完成恢复，已停止当前任务：${rawMessage}`
+                : transportFailure
+                    ? `本机 Codex 脚本引擎已自动尝试 ${Math.max(1, processAttempts)}/${FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS} 次仍失败：${rawMessage}`
+                    : timeoutFailure ? "Flow C 脚本执行链路超过 8 分钟，已自动终止当前 worker" : rawMessage;
+            if ((processFailure || timeoutFailure) && app) {
+                cleanupConfirmed = await discardWorkflowCodexApp(workerIndex, app, "Flow C 脚本执行结束，正在确认当前 worker 已退出", timeoutFailure);
+                app = undefined;
+            }
+            if (!cleanupConfirmed)
+                message = `${message}；旧 app-server 在 2 秒清理宽限内未确认退出，已停止自动启动替代进程`;
             emit("agent_error", { message });
-            return { ok: false, error: message, retryable: !isDeterministicWorkflowContractError(message), timings: { queueWaitMs, threadStartMs: threadStartMs || Date.now() - threadStartedAt, modelMs: modelStartedAt ? Date.now() - modelStartedAt : 0 } };
+            return { ok: false, error: message, retryable: isWorkflowFailureRetryable(failureKind, cleanupConfirmed, processRecoveryObserved), failureKind, timings: { queueWaitMs, threadStartMs, modelMs } };
         }
         finally {
             await Promise.all(files.map((file) => fs.unlink(file).catch(() => undefined)));
@@ -79,6 +184,38 @@ export async function runCodexWorkflowTurn(prompt, emit, options) {
         }
     });
 }
+/** A deadline exhausted after process recovery is terminal for this handoff wave. */
+export function isWorkflowFailureRetryable(failureKind, cleanupConfirmed, processRecoveryObserved) {
+    if (!cleanupConfirmed)
+        return false;
+    if (failureKind === "turn")
+        return true;
+    return failureKind === "timeout" && !processRecoveryObserved;
+}
+/** 只重试明确的 app-server 进程/stdio 故障；结构契约和普通模型失败均立即上抛。 */
+export async function runCodexProcessRetries(operation, options = {}) {
+    const maxAttempts = Math.max(1, Math.floor(options.maxAttempts || FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS));
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        try {
+            return await operation(attempt);
+        }
+        catch (error) {
+            if (isDeterministicWorkflowContractError(error) || !isCodexAppProcessError(error) || error.cleanupConfirmed === false || attempt >= maxAttempts)
+                throw error;
+            await options.onRetry?.(error, attempt);
+            const backoffMs = typeof options.backoffMs === "function" ? options.backoffMs(attempt) : Number(options.backoffMs || 0);
+            if (backoffMs > 0)
+                await new Promise((resolve) => setTimeout(resolve, backoffMs));
+        }
+    }
+    throw new Error("Codex app-server process retry loop ended unexpectedly");
+}
+class CodexWorkflowTimeoutError extends Error {
+    constructor() {
+        super("Flow C script workflow deadline exceeded");
+        this.name = "CodexWorkflowTimeoutError";
+    }
+}
 /**
  * 给 Flow C 的完整 app-server 链路设置硬截止时间。超时后不再等待原 Promise
  * 自行结束；否则初始化或 thread/start 永不返回时会永久占住 worker lane。
@@ -107,18 +244,31 @@ export async function runBoundedWorkflowOperation(operation, timeoutMs, onTimeou
 }
 /** Contract/preflight 4xx errors are deterministic and must never burn every fallback chunk size. */
 export function isDeterministicWorkflowContractError(error) {
-    const message = errorMessage(error);
+    const message = `${errorMessage(error)}\n${isCodexAppProcessError(error) ? error.stderr : ""}`;
     return /invalid_json_schema|invalid schema for response_format|text\.format\.schema|response[_ ]format[^\n]*(?:invalid|schema)/i.test(message);
 }
-async function startWorkflowCodexApp(workerIndex, emit) {
+async function startWorkflowCodexApp(workerIndex, emit, initializeTimeoutMs) {
     let started;
     started = await CodexAppClient.start(emit, () => {
-        if (!started || workflowCodexApps.get(workerIndex) === started)
+        if (!started)
+            return;
+        workflowCodexLaneQuarantine.quarantine(workerIndex, started.waitForExit());
+        if (workflowCodexApps.get(workerIndex) === started)
             workflowCodexApps.delete(workerIndex);
-    });
+    }, initializeTimeoutMs);
     workflowCodexApps.set(workerIndex, started);
     return started;
 }
+async function discardWorkflowCodexApp(workerIndex, app, message, persistDiagnostic = false) {
+    if (app && workflowCodexApps.get(workerIndex) === app)
+        workflowCodexApps.delete(workerIndex);
+    if (!app)
+        return true;
+    const confirmed = await app.terminate(message, { persistDiagnostic });
+    if (!confirmed)
+        workflowCodexLaneQuarantine.quarantine(workerIndex, app.waitForExit());
+    return confirmed;
+}
 /** 强制回收失去响应的 app-server；只用于有界超时恢复。 */
 export async function restartCodexApp(message = "Codex 执行超时，正在重启本机脚本引擎") {
     const app = codexApp;

package/dist/workflow/manager.d.ts

@@ -54,7 +54,7 @@ type ReferenceStyleCard = {
         categories?: unknown;
     };
 };
-type StoryboardLayoutVersion = "director-table-scripted-v1" | "visual-storyboard-adaptive-v1" | "hybrid-three-anchor-v1" | "legacy-five-row-v1";
+type StoryboardLayoutVersion = "director-table-scripted-v1" | "visual-storyboard-landscape-v2" | "visual-storyboard-adaptive-v1" | "hybrid-three-anchor-v1" | "legacy-five-row-v1";
 type FlowCProductionMode = "storyboard" | "visual-storyboard" | "first-frame-chain";
 type ProductInput = {
     productIndex: number;
@@ -150,6 +150,7 @@ type ScriptTask = {
 type ScriptChunkResult = {
     error?: string;
     terminal: boolean;
+    terminalKind?: "contract" | "transport" | "timeout" | "turn";
     replanOrdinals?: number[];
 };
 /** 本机持久化的 Flow C 控制器：脚本交给本机 Codex，视频直接落盘。 */
@@ -371,6 +372,11 @@ export declare function terminalScriptChunkError(results: Array<{
     error?: string;
     terminal?: boolean;
 }>): string;
+export declare function terminalScriptChunkFailure<T extends {
+    error?: string;
+    terminal?: boolean;
+    terminalKind?: ScriptChunkResult["terminalKind"];
+}>(results: T[]): T | undefined;
 export declare function scriptCreativeReplanOrdinals(results: unknown[]): number[];
 /** Keep a mixed reset signal after an exact-duplicate rewrite finishes. */
 export declare function preserveScriptRecoveryReplans(result: ScriptChunkResult, error: unknown): ScriptChunkResult;

package/dist/workflow/manager.js

@@ -309,9 +309,12 @@ export class WorkflowManager {
                     }));
                     const results = pipelineResults.flat();
                     task = await this.scriptTask(id);
-                    const terminalError = terminalScriptChunkError(results);
-                    if (terminalError)
-                        throw new Error(`创意或脚本结构化契约被 Codex 拒绝，已停止自动重试（${terminalError}）`);
+                    const terminalFailure = terminalScriptChunkFailure(results);
+                    if (terminalFailure) {
+                        if (terminalFailure.terminalKind === "transport")
+                            throw new Error(`创意或脚本阶段的本机 Codex 进程连续异常且自动恢复未成功，已停止当前任务且未提交缺失脚本（${terminalFailure.error}）`);
+                        throw new Error(`创意或脚本结构化契约被 Codex 拒绝，已停止自动重试（${terminalFailure.error}）`);
+                    }
                     const replanOrdinals = scriptCreativeReplanOrdinals(results);
                     if (replanOrdinals.length) {
                         recordCreativeReplanAttempts(creativeReplanAttempts, replanOrdinals);
@@ -319,9 +322,12 @@ export class WorkflowManager {
                         record.updatedAt = now();
                         this.save();
                         const replanResults = await Promise.all(replanOrdinals.map((ordinal) => this.runCandidateChunk(id, task, [ordinal], workspace.workspacePath)));
-                        const replanTerminalError = terminalScriptChunkError(replanResults);
-                        if (replanTerminalError)
-                            throw new Error(`创意重新选题被 Codex 拒绝，已停止自动重试（${replanTerminalError}）`);
+                        const replanTerminalFailure = terminalScriptChunkFailure(replanResults);
+                        if (replanTerminalFailure) {
+                            if (replanTerminalFailure.terminalKind === "transport")
+                                throw new Error(`创意重新选题时本机 Codex 进程异常且自动恢复未成功，已停止当前任务（${replanTerminalFailure.error}）`);
+                            throw new Error(`创意重新选题被 Codex 拒绝，已停止自动重试（${replanTerminalFailure.error}）`);
+                        }
                         const replanError = replanResults.find((result) => result.error)?.error;
                         if (replanError)
                             throw new Error(`创意重新选题失败（${replanError}），请点击重试`);
@@ -350,9 +356,11 @@ export class WorkflowManager {
                 this.save();
                 const results = await Promise.all(wave.chunks.map((ordinals) => this.runScriptChunk(id, task, ordinals, workspace.workspacePath)));
                 task = await this.scriptTask(id);
-                const terminalError = terminalScriptChunkError(results);
-                if (terminalError) {
-                    throw new Error(`本机脚本结构化契约被 Codex 拒绝，已停止自动重试且未提交缺失脚本。请先升级或修复 Canvas Agent，再手动重试（${terminalError}）`);
+                const terminalFailure = terminalScriptChunkFailure(results);
+                if (terminalFailure) {
+                    if (terminalFailure.terminalKind === "transport")
+                        throw new Error(`本机 Codex 脚本引擎连续异常且自动恢复未成功，已停止当前任务且未提交缺失脚本。诊断已保存在本机 Agent 日志中（${terminalFailure.error}）`);
+                    throw new Error(`本机脚本结构化契约被 Codex 拒绝，已停止自动重试且未提交缺失脚本。请先升级或修复 Canvas Agent，再手动重试（${terminalFailure.error}）`);
                 }
                 const replanOrdinals = scriptCreativeReplanOrdinals(results);
                 if (replanOrdinals.length) {
@@ -361,9 +369,12 @@ export class WorkflowManager {
                     record.updatedAt = now();
                     this.save();
                     const replanResults = await Promise.all(replanOrdinals.map((ordinal) => this.runCandidateChunk(id, task, [ordinal], workspace.workspacePath)));
-                    const replanTerminalError = terminalScriptChunkError(replanResults);
-                    if (replanTerminalError)
-                        throw new Error(`创意重新选题被 Codex 拒绝，已停止自动重试（${replanTerminalError}）`);
+                    const replanTerminalFailure = terminalScriptChunkFailure(replanResults);
+                    if (replanTerminalFailure) {
+                        if (replanTerminalFailure.terminalKind === "transport")
+                            throw new Error(`创意重新选题时本机 Codex 进程异常且自动恢复未成功，已停止当前任务（${replanTerminalFailure.error}）`);
+                        throw new Error(`创意重新选题被 Codex 拒绝，已停止自动重试（${replanTerminalFailure.error}）`);
+                    }
                     const replanError = replanResults.find((result) => result.error)?.error;
                     if (replanError)
                         throw new Error(`创意重新选题失败（${replanError}），请点击重试`);
@@ -504,8 +515,10 @@ export class WorkflowManager {
             onWorkerFinish: () => { const record = this.scriptRecord(id); record.activeChunks = Math.max(0, Number(record.activeChunks || 0) - 1); record.updatedAt = now(); this.save(); },
         });
         this.emitScriptStage(id, ordinals, "candidate_model", result.timings.queueWaitMs + result.timings.threadStartMs + result.timings.modelMs);
-        if (!result.ok || !result.text)
-            return { error: result.ok ? "Codex 未返回创意候选" : result.error, terminal: !result.ok && !result.retryable };
+        if (!result.ok)
+            return { error: result.error, terminal: !result.retryable, ...(!result.retryable ? { terminalKind: result.failureKind } : {}) };
+        if (!result.text)
+            return { error: "Codex 未返回创意候选", terminal: false };
         try {
             const groups = parseFlowCCreativeCandidateOutput(result.text, ordinals);
             const startedAt = Date.now();
@@ -541,8 +554,10 @@ export class WorkflowManager {
         this.emitScriptStage(id, ordinals, "queue_wait", result.timings.queueWaitMs);
         this.emitScriptStage(id, ordinals, "thread_start", result.timings.threadStartMs);
         this.emitScriptStage(id, ordinals, "model", result.timings.modelMs);
-        if (!result.ok || !result.text)
-            return { error: result.ok ? "Codex 未返回可用的结构化脚本" : result.error, terminal: !result.ok && !result.retryable };
+        if (!result.ok)
+            return { error: result.error, terminal: !result.retryable, ...(!result.retryable ? { terminalKind: result.failureKind } : {}) };
+        if (!result.text)
+            return { error: "Codex 未返回可用的结构化脚本", terminal: false };
         try {
             const parseStartedAt = Date.now();
             const selected = selectedCandidatesForOrdinals(task, ordinals);
@@ -579,9 +594,11 @@ export class WorkflowManager {
                 if (!pendingRevisionOrdinals.length)
                     return { terminal: false };
                 const revisionResults = await Promise.all(pendingRevisionOrdinals.map((ordinal) => this.runScriptChunk(id, refreshedTask, [ordinal], cwd, 0, revisionAttempt + 1)));
-                const revisionError = terminalScriptChunkError(revisionResults) || revisionResults.map((result) => result.error).filter(Boolean).join("；");
+                const revisionTerminalFailure = terminalScriptChunkFailure(revisionResults);
+                const revisionError = revisionTerminalFailure?.error || revisionResults.map((result) => result.error).filter(Boolean).join("；");
                 return {
-                    terminal: Boolean(terminalScriptChunkError(revisionResults)),
+                    terminal: Boolean(revisionTerminalFailure),
+                    ...(revisionTerminalFailure?.terminalKind ? { terminalKind: revisionTerminalFailure.terminalKind } : {}),
                     ...(revisionError ? { error: revisionError } : {}),
                     ...(scriptCreativeReplanOrdinals(revisionResults).length ? { replanOrdinals: scriptCreativeReplanOrdinals(revisionResults) } : {}),
                 };
@@ -605,9 +622,11 @@ export class WorkflowManager {
                 if (!pendingRewriteOrdinals.length)
                     return preserveScriptRecoveryReplans({ terminal: false }, error);
                 const rewriteResults = await Promise.all(pendingRewriteOrdinals.map((ordinal) => this.runScriptChunk(id, refreshedTask, [ordinal], cwd, rewriteAttempt + 1)));
-                const rewriteError = terminalScriptChunkError(rewriteResults) || rewriteResults.map((result) => result.error).filter(Boolean).join("；");
+                const rewriteTerminalFailure = terminalScriptChunkFailure(rewriteResults);
+                const rewriteError = rewriteTerminalFailure?.error || rewriteResults.map((result) => result.error).filter(Boolean).join("；");
                 const rewriteResult = {
-                    terminal: Boolean(terminalScriptChunkError(rewriteResults)),
+                    terminal: Boolean(rewriteTerminalFailure),
+                    ...(rewriteTerminalFailure?.terminalKind ? { terminalKind: rewriteTerminalFailure.terminalKind } : {}),
                     ...(rewriteError ? { error: rewriteError } : {}),
                     ...(scriptCreativeReplanOrdinals(rewriteResults).length ? { replanOrdinals: scriptCreativeReplanOrdinals(rewriteResults) } : {}),
                 };
@@ -793,7 +812,10 @@ export function compareScriptQueueRecords(left, right) {
 }
 /** A deterministic response-format failure stops fallback isolation immediately. */
 export function terminalScriptChunkError(results) {
-    return results.find((result) => result.terminal)?.error || "";
+    return terminalScriptChunkFailure(results)?.error || "";
+}
+export function terminalScriptChunkFailure(results) {
+    return results.find((result) => result.terminal);
 }
 export function scriptCreativeReplanOrdinals(results) {
     return [...new Set(results.flatMap((result) => (result && typeof result === "object" ? result.replanOrdinals || [] : [])).filter((ordinal) => Number.isInteger(ordinal) && ordinal > 0))].sort((left, right) => left - right);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiaohhhh1/canvas-agent",
-  "version": "0.4.73",
+  "version": "0.4.75",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",