@xiaohhhh1/canvas-agent 0.4.74 → 0.4.76

package/dist/agent/codex.js

@@ -3,12 +3,14 @@ import os from "node:os";
 import path from "node:path";
 import { logger } from "../utils/logger.js";
 import { errorMessage, field } from "../utils/value.js";
-import { CodexAppClient } from "./codex-client.js";
+import { CodexAppClient, isCodexAppProcessError } from "./codex-client.js";
 import { summarizeCodexThread, threadMessages } from "./codex-history.js";
 import { boundedWorkerConcurrency, WorkerPool } from "./worker-pool.js";
 export const FLOW_C_CODEX_MODEL = "gpt-5.6-terra";
 export const FLOW_C_CODEX_REASONING_EFFORT = "medium";
 export const FLOW_C_CODEX_WORKER_CONCURRENCY = boundedWorkerConcurrency(process.env.FLOW_C_SCRIPT_CONCURRENCY);
+export const FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS = 3;
+const FLOW_C_CODEX_MIN_START_BUDGET_MS = 5_000;
 export function flowCCodexWorkerStatus() { return { active: workflowCodexPool.activeCount, limit: FLOW_C_CODEX_WORKER_CONCURRENCY }; }
 let codexQueue = Promise.resolve();
 let codexApp = null;
@@ -17,6 +19,46 @@ let codexThreadId = "";
 const unmaterializedThreadIds = new Set();
 const workflowCodexPool = new WorkerPool(FLOW_C_CODEX_WORKER_CONCURRENCY);
 const workflowCodexApps = new Map();
+/**
+ * 记录尚未确认 OS exit 的 worker 进程。worker 可以释放给队列，但在对应
+ * barrier 完成前只能等待/失败，绝不能启动替代 app-server。
+ */
+export class WorkflowCodexLaneQuarantine {
+    barriers = new Map();
+    quarantine(workerIndex, barrier) {
+        const previous = this.barriers.get(workerIndex);
+        const combined = (previous ? Promise.all([previous, barrier]) : Promise.resolve(barrier))
+            .then(() => undefined, () => undefined);
+        this.barriers.set(workerIndex, combined);
+        void combined.then(() => {
+            if (this.barriers.get(workerIndex) === combined)
+                this.barriers.delete(workerIndex);
+        });
+        return combined;
+    }
+    async wait(workerIndex, timeoutMs) {
+        const barrier = this.barriers.get(workerIndex);
+        if (!barrier)
+            return true;
+        if (timeoutMs <= 0)
+            return false;
+        let timer;
+        try {
+            return await Promise.race([
+                barrier.then(() => true),
+                new Promise((resolve) => { timer = setTimeout(() => resolve(false), timeoutMs); }),
+            ]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    isQuarantined(workerIndex) {
+        return this.barriers.has(workerIndex);
+    }
+}
+const workflowCodexLaneQuarantine = new WorkflowCodexLaneQuarantine();
 export { summarizeCodexThread } from "./codex-history.js";
 /** 将 Codex turn 加入串行队列并等待执行完成。 */
 export async function runCodexTurn(prompt, emit, attachments = [], options = {}) {
@@ -37,41 +79,104 @@ export async function interruptCodexTurn(threadId) {
  */
 export async function runCodexWorkflowTurn(prompt, emit, options) {
     if (!prompt.trim())
-        return { ok: false, error: "Codex prompt is empty", retryable: false, timings: { queueWaitMs: 0, threadStartMs: 0, modelMs: 0 } };
+        return { ok: false, error: "Codex prompt is empty", retryable: false, failureKind: "contract", timings: { queueWaitMs: 0, threadStartMs: 0, modelMs: 0 } };
     return await workflowCodexPool.run(async (workerIndex, queueWaitMs) => {
         options.onWorkerStart?.();
         const modelSettings = { model: FLOW_C_CODEX_MODEL, reasoningEffort: FLOW_C_CODEX_REASONING_EFFORT };
-        const threadStartedAt = Date.now();
+        const deadlineAt = Date.now() + Math.max(1, options.timeoutMs);
         let threadStartMs = 0;
-        let modelStartedAt = 0;
-        let app = workflowCodexApps.get(workerIndex);
+        let modelMs = 0;
+        let app;
+        let processAttempts = 0;
+        let processRecoveryObserved = false;
+        let cleanupConfirmed = true;
         let files = [];
         try {
-            const operation = (async () => {
-                files = await writeAttachmentFiles(options.attachments || []);
-                if (!app)
-                    app = await startWorkflowCodexApp(workerIndex, options.appEmit || emit);
-                const thread = await app.startThread(options.cwd, options.permissionMode || "request", modelSettings);
-                const threadId = String(field(thread, "id") || "");
-                options.onThread?.(threadId);
-                threadStartMs = Date.now() - threadStartedAt;
-                modelStartedAt = Date.now();
-                return await app.startTurn(threadId, prompt, files, options.permissionMode || "request", options.onTurn, options.outputSchema, modelSettings);
-            })();
-            const result = await runBoundedWorkflowOperation(operation, options.timeoutMs, async () => {
-                workflowCodexApps.delete(workerIndex);
-                await app?.terminate("Flow C 脚本执行链路超时，已仅回收当前 worker");
+            files = await writeAttachmentFiles(options.attachments || []);
+            const text = await runCodexProcessRetries(async (attempt) => {
+                processAttempts = attempt;
+                const attemptStartedAt = Date.now();
+                let modelStartedAt = 0;
+                try {
+                    const laneReady = await workflowCodexLaneQuarantine.wait(workerIndex, Math.max(0, deadlineAt - Date.now()));
+                    if (!laneReady) {
+                        cleanupConfirmed = false;
+                        throw new CodexWorkflowTimeoutError();
+                    }
+                    const startupBudgetMs = deadlineAt - Date.now();
+                    if (startupBudgetMs < FLOW_C_CODEX_MIN_START_BUDGET_MS)
+                        throw new CodexWorkflowTimeoutError();
+                    app = workflowCodexApps.get(workerIndex);
+                    if (!app)
+                        app = await startWorkflowCodexApp(workerIndex, options.appEmit || emit, startupBudgetMs);
+                    const remainingMs = deadlineAt - Date.now();
+                    if (remainingMs <= 0)
+                        throw new CodexWorkflowTimeoutError();
+                    const operation = (async () => {
+                        const thread = await app.startThread(options.cwd, options.permissionMode || "request", modelSettings);
+                        const threadId = String(field(thread, "id") || "");
+                        options.onThread?.(threadId);
+                        modelStartedAt = Date.now();
+                        return await app.startTurn(threadId, prompt, files, options.permissionMode || "request", options.onTurn, options.outputSchema, modelSettings);
+                    })();
+                    const result = await runBoundedWorkflowOperation(operation, remainingMs, async () => {
+                        const timedOutApp = app;
+                        cleanupConfirmed = await discardWorkflowCodexApp(workerIndex, timedOutApp, "Flow C 脚本执行链路超时，已仅回收当前 worker", true);
+                        if (app === timedOutApp)
+                            app = undefined;
+                    });
+                    if (result.timedOut)
+                        throw new CodexWorkflowTimeoutError();
+                    return result.value;
+                }
+                finally {
+                    if (modelStartedAt)
+                        modelMs += Date.now() - modelStartedAt;
+                    else
+                        threadStartMs += Date.now() - attemptStartedAt;
+                }
+            }, {
+                maxAttempts: FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS,
+                backoffMs: (failedAttempt) => Math.max(0, Math.min(failedAttempt === 1 ? 250 : 750, deadlineAt - Date.now())),
+                onRetry: async (error, failedAttempt) => {
+                    processRecoveryObserved = true;
+                    cleanupConfirmed = await discardWorkflowCodexApp(workerIndex, app, `Flow C 本机脚本引擎第 ${failedAttempt}/${FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS} 次进程异常，正在换新进程重试`);
+                    app = undefined;
+                    if (!cleanupConfirmed)
+                        throw error;
+                    if (deadlineAt - Date.now() < FLOW_C_CODEX_MIN_START_BUDGET_MS)
+                        throw new CodexWorkflowTimeoutError();
+                    emit("agent_log", { text: `Flow C 本机脚本引擎异常，已回收当前 worker，将进行第 ${failedAttempt + 1}/${FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS} 次尝试（${error.message}）` });
+                },
             });
-            if (result.timedOut) {
-                return { ok: false, error: "Flow C 脚本执行链路超过 8 分钟，已自动终止当前 worker", retryable: true, timings: { queueWaitMs, threadStartMs: threadStartMs || Date.now() - threadStartedAt, modelMs: modelStartedAt ? Date.now() - modelStartedAt : 0 } };
-            }
-            return { ok: true, text: result.value, timings: { queueWaitMs, threadStartMs, modelMs: Date.now() - modelStartedAt } };
+            return { ok: true, text, timings: { queueWaitMs, threadStartMs, modelMs } };
         }
         catch (error) {
             logger.error("Flow C Codex worker failed", { workerIndex, error });
-            const message = errorMessage(error);
+            const processFailure = isCodexAppProcessError(error);
+            const contractFailure = isDeterministicWorkflowContractError(error);
+            const timeoutFailure = error instanceof CodexWorkflowTimeoutError;
+            const deadlineAfterProcessFailure = timeoutFailure && processRecoveryObserved;
+            const transportFailure = !contractFailure && (processFailure || deadlineAfterProcessFailure);
+            if (processFailure && error.cleanupConfirmed === false)
+                cleanupConfirmed = false;
+            if (processFailure && error.cleanupBarrier)
+                workflowCodexLaneQuarantine.quarantine(workerIndex, error.cleanupBarrier);
+            const failureKind = contractFailure ? "contract" : transportFailure ? "transport" : timeoutFailure ? "timeout" : "turn";
+            const rawMessage = errorMessage(error);
+            let message = deadlineAfterProcessFailure
+                ? `本机 Codex 脚本引擎进程异常后未能在原 8 分钟截止时间内完成恢复，已停止当前任务：${rawMessage}`
+                : transportFailure
+                    ? `本机 Codex 脚本引擎已自动尝试 ${Math.max(1, processAttempts)}/${FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS} 次仍失败：${rawMessage}`
+                    : timeoutFailure ? "Flow C 脚本执行链路超过 8 分钟，已自动终止当前 worker" : rawMessage;
+            if ((processFailure || timeoutFailure) && app) {
+                cleanupConfirmed = await discardWorkflowCodexApp(workerIndex, app, "Flow C 脚本执行结束，正在确认当前 worker 已退出", timeoutFailure);
+                app = undefined;
+            }
+            if (!cleanupConfirmed)
+                message = `${message}；旧 app-server 在 2 秒清理宽限内未确认退出，已停止自动启动替代进程`;
             emit("agent_error", { message });
-            return { ok: false, error: message, retryable: !isDeterministicWorkflowContractError(message), timings: { queueWaitMs, threadStartMs: threadStartMs || Date.now() - threadStartedAt, modelMs: modelStartedAt ? Date.now() - modelStartedAt : 0 } };
+            return { ok: false, error: message, retryable: isWorkflowFailureRetryable(failureKind, cleanupConfirmed, processRecoveryObserved), failureKind, timings: { queueWaitMs, threadStartMs, modelMs } };
         }
         finally {
             await Promise.all(files.map((file) => fs.unlink(file).catch(() => undefined)));
@@ -79,6 +184,38 @@ export async function runCodexWorkflowTurn(prompt, emit, options) {
         }
     });
 }
+/** A deadline exhausted after process recovery is terminal for this handoff wave. */
+export function isWorkflowFailureRetryable(failureKind, cleanupConfirmed, processRecoveryObserved) {
+    if (!cleanupConfirmed)
+        return false;
+    if (failureKind === "turn")
+        return true;
+    return failureKind === "timeout" && !processRecoveryObserved;
+}
+/** 只重试明确的 app-server 进程/stdio 故障；结构契约和普通模型失败均立即上抛。 */
+export async function runCodexProcessRetries(operation, options = {}) {
+    const maxAttempts = Math.max(1, Math.floor(options.maxAttempts || FLOW_C_CODEX_PROCESS_MAX_ATTEMPTS));
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        try {
+            return await operation(attempt);
+        }
+        catch (error) {
+            if (isDeterministicWorkflowContractError(error) || !isCodexAppProcessError(error) || error.cleanupConfirmed === false || attempt >= maxAttempts)
+                throw error;
+            await options.onRetry?.(error, attempt);
+            const backoffMs = typeof options.backoffMs === "function" ? options.backoffMs(attempt) : Number(options.backoffMs || 0);
+            if (backoffMs > 0)
+                await new Promise((resolve) => setTimeout(resolve, backoffMs));
+        }
+    }
+    throw new Error("Codex app-server process retry loop ended unexpectedly");
+}
+class CodexWorkflowTimeoutError extends Error {
+    constructor() {
+        super("Flow C script workflow deadline exceeded");
+        this.name = "CodexWorkflowTimeoutError";
+    }
+}
 /**
  * 给 Flow C 的完整 app-server 链路设置硬截止时间。超时后不再等待原 Promise
  * 自行结束；否则初始化或 thread/start 永不返回时会永久占住 worker lane。
@@ -107,18 +244,31 @@ export async function runBoundedWorkflowOperation(operation, timeoutMs, onTimeou
 }
 /** Contract/preflight 4xx errors are deterministic and must never burn every fallback chunk size. */
 export function isDeterministicWorkflowContractError(error) {
-    const message = errorMessage(error);
+    const message = `${errorMessage(error)}\n${isCodexAppProcessError(error) ? error.stderr : ""}`;
     return /invalid_json_schema|invalid schema for response_format|text\.format\.schema|response[_ ]format[^\n]*(?:invalid|schema)/i.test(message);
 }
-async function startWorkflowCodexApp(workerIndex, emit) {
+async function startWorkflowCodexApp(workerIndex, emit, initializeTimeoutMs) {
     let started;
     started = await CodexAppClient.start(emit, () => {
-        if (!started || workflowCodexApps.get(workerIndex) === started)
+        if (!started)
+            return;
+        workflowCodexLaneQuarantine.quarantine(workerIndex, started.waitForExit());
+        if (workflowCodexApps.get(workerIndex) === started)
             workflowCodexApps.delete(workerIndex);
-    });
+    }, initializeTimeoutMs);
     workflowCodexApps.set(workerIndex, started);
     return started;
 }
+async function discardWorkflowCodexApp(workerIndex, app, message, persistDiagnostic = false) {
+    if (app && workflowCodexApps.get(workerIndex) === app)
+        workflowCodexApps.delete(workerIndex);
+    if (!app)
+        return true;
+    const confirmed = await app.terminate(message, { persistDiagnostic });
+    if (!confirmed)
+        workflowCodexLaneQuarantine.quarantine(workerIndex, app.waitForExit());
+    return confirmed;
+}
 /** 强制回收失去响应的 app-server；只用于有界超时恢复。 */
 export async function restartCodexApp(message = "Codex 执行超时，正在重启本机脚本引擎") {
     const app = codexApp;

package/dist/utils/logger.d.ts

@@ -3,6 +3,7 @@ export declare class Logger {
     readonly enabled: boolean;
     readonly filePath: string;
     private readonly logger;
+    private failureLogger?;
     /** 根据命令行 Debug 参数初始化日志输出。 */
     constructor();
     /** 输出 Debug 级别日志。 */
@@ -13,5 +14,7 @@ export declare class Logger {
     warn(message: string, details?: unknown): void;
     /** 输出 Error 级别日志。 */
     error(message: string, details?: unknown): void;
+    /** Always persist minimal, caller-whitelisted failure metadata; no request bodies or URLs. */
+    failure(message: string, details: Record<string, unknown>): void;
 }
 export declare const logger: Logger;

package/dist/utils/logger.js

@@ -9,6 +9,7 @@ export class Logger {
     enabled = process.argv.includes("--debug");
     filePath = this.enabled ? path.join(os.homedir(), ".infinite-canvas", "logs", `canvas-agent-${formatDateForFilename()}.log`) : "";
     logger;
+    failureLogger;
     /** 根据命令行 Debug 参数初始化日志输出。 */
     constructor() {
         if (!this.enabled) {
@@ -53,6 +54,23 @@ export class Logger {
         else
             this.logger?.error(message, { details: sanitize(details) });
     }
+    /** Always persist minimal, caller-whitelisted failure metadata; no request bodies or URLs. */
+    failure(message, details) {
+        try {
+            if (!this.failureLogger) {
+                const directory = path.join(os.homedir(), ".infinite-canvas", "logs");
+                fs.mkdirSync(directory, { recursive: true });
+                this.failureLogger = winston.createLogger({
+                    level: "warn",
+                    format: format.combine(format.timestamp(), format.json()),
+                    transports: [new transports.File({ filename: path.join(directory, "canvas-agent-failures.log"), maxsize: 1_000_000, maxFiles: 3, options: { flags: "a", mode: 0o600 } })],
+                });
+                this.failureLogger.on("error", () => { });
+            }
+            this.failureLogger.warn(message, sanitize(details));
+        }
+        catch { /* Failure logging must never lose a saved result or mask the request error. */ }
+    }
 }
 /** 将日志详情格式化为紧凑的单行文本。 */
 function formatDetails(details) {

package/dist/workflow/commerce-http.d.ts

@@ -0,0 +1,34 @@
+export type CommerceRequestDiagnostic = {
+    stage: string;
+    method: string;
+    requestId: string;
+    name: string;
+    cause?: {
+        code: string;
+    };
+    status?: number;
+    attempt: number;
+    elapsedMs: number;
+    at: string;
+};
+export declare class CommerceRequestError extends Error {
+    readonly diagnostic: CommerceRequestDiagnostic;
+    readonly retryable: boolean;
+    status?: number;
+    code?: string;
+    resetOrdinals?: unknown;
+    rewriteOrdinals?: unknown;
+    constructor(message: string, diagnostic: CommerceRequestDiagnostic, retryable: boolean);
+}
+type RequestOptions = {
+    expiresAt?: string;
+    onFailure?: (diagnostic: CommerceRequestDiagnostic) => void;
+};
+type Transport = {
+    fetch: typeof fetch;
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+};
+/** Only read-only requests and the two server-deduplicated handoff deliveries may retry. */
+export declare function commerceJson<T>(url: string, token: string, tokenHeader: string, init?: RequestInit, options?: RequestOptions, transport?: Transport): Promise<T>;
+export {};

package/dist/workflow/commerce-http.js

@@ -0,0 +1,114 @@
+import { randomUUID } from "node:crypto";
+export class CommerceRequestError extends Error {
+    diagnostic;
+    retryable;
+    status;
+    code;
+    resetOrdinals;
+    rewriteOrdinals;
+    constructor(message, diagnostic, retryable) {
+        super(message);
+        this.diagnostic = diagnostic;
+        this.retryable = retryable;
+        this.name = "CommerceRequestError";
+    }
+}
+const defaultTransport = { fetch: (...args) => fetch(...args), sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now: () => Date.now() };
+const safeCode = (value) => typeof value === "string" && /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(value) ? value : undefined;
+/** Only read-only requests and the two server-deduplicated handoff deliveries may retry. */
+export async function commerceJson(url, token, tokenHeader, init = {}, options = {}, transport = defaultTransport) {
+    const method = String(init.method || "GET").toUpperCase();
+    const pathname = new URL(url).pathname;
+    const handoff = /^\/api\/commerce\/workflow-script-handoffs\/[0-9a-f-]{36}\/(task|product-profiles|draft-chunks)$/.exec(pathname);
+    const canRetry = Boolean(handoff && (method === "GET" && handoff[1] === "task" || method === "POST" && typeof init.body === "string" && ["product-profiles", "draft-chunks"].includes(handoff[1])));
+    const stage = handoff?.[1] || "commerce-request";
+    const requestId = randomUUID();
+    const headers = new Headers(init.headers);
+    headers.set("accept", "application/json");
+    headers.set(tokenHeader, token);
+    headers.set("x-request-id", requestId);
+    if (init.body)
+        headers.set("content-type", "application/json");
+    // Capture the exact serialized payload once; retries never rebuild model output.
+    const request = { ...init, method, headers };
+    const startedAt = transport.now();
+    const expiresAt = options.expiresAt === undefined ? Infinity : typeof options.expiresAt === "string" ? Date.parse(options.expiresAt) : NaN;
+    const invalidCapability = options.expiresAt !== undefined && !Number.isFinite(expiresAt);
+    for (let attempt = 1;; attempt += 1) {
+        let status;
+        let body = {};
+        let expired = false;
+        try {
+            if (invalidCapability)
+                throw new Error("InvalidCapability");
+            if (init.signal?.aborted)
+                throw new Error("AbortError");
+            const remaining = expiresAt - transport.now();
+            if (remaining <= 0) {
+                expired = true;
+                throw new Error("CapabilityExpired");
+            }
+            const response = await transport.fetch(url, { ...request, signal: AbortSignal.timeout(Math.max(1, Math.min(120_000, Number.isFinite(remaining) ? remaining : 120_000))) });
+            status = response.status;
+            // A lost/truncated successful response is ambiguous delivery, never an empty success.
+            try {
+                const value = await response.json();
+                if (!value || typeof value !== "object" || Array.isArray(value))
+                    throw new SyntaxError("InvalidResponse");
+                body = value;
+            }
+            catch (error) {
+                if (response.ok)
+                    throw error;
+            }
+            if (!response.ok)
+                throw new Error("HTTPError");
+            if (handoff)
+                validateHandoffResponse(stage, body, pathname.split("/").at(-2));
+            return body;
+        }
+        catch (cause) {
+            const aborted = Boolean(init.signal?.aborted);
+            const error = cause;
+            const causeCode = safeCode(error?.cause?.code) || safeCode(error?.code);
+            const diagnostic = {
+                stage, method, requestId, name: invalidCapability ? "InvalidCapability" : expired ? "CapabilityExpired" : aborted ? "AbortError" : status && status >= 400 ? "HTTPError" : safeCode(error?.name) || "Error",
+                ...(causeCode ? { cause: { code: causeCode } } : {}), ...(status ? { status } : {}),
+                attempt, elapsedMs: Math.max(0, transport.now() - startedAt), at: new Date(transport.now()).toISOString(),
+            };
+            const contractFailure = /invalid_json_schema|invalid_response_format|invalid response_format/i.test(`${body.code || ""} ${body.error || ""}`);
+            const retryable = !invalidCapability && !expired && !aborted && !contractFailure && (status === undefined || status >= 200 && status < 300 || [408, 429, 500, 502, 503, 504].includes(status));
+            const message = invalidCapability ? "脚本交接有效期无效，请在网页重新授权交接"
+                : expired ? "脚本交接能力已过期，请在网页重新授权交接"
+                    : aborted ? "中心请求已取消，已保留本机结果"
+                        : status && status >= 400 ? String(body.error || `中心接口返回 ${status}`).split(token).join("[REDACTED]").replace(/https?:\/\/\S+/gi, "[URL]").slice(0, 500)
+                            : `中心${stage === "task" ? "任务读取" : "结果回传"}连接失败，已保留本机结果，请重试（诊断 ${requestId}）`;
+            const failure = new CommerceRequestError(message, diagnostic, retryable);
+            failure.status = status;
+            failure.code = invalidCapability ? "WORKFLOW_CAPABILITY_INVALID" : expired ? "WORKFLOW_CAPABILITY_EXPIRED" : aborted ? "WORKFLOW_REQUEST_ABORTED" : safeCode(body.code);
+            failure.resetOrdinals = body.resetOrdinals;
+            failure.rewriteOrdinals = body.rewriteOrdinals;
+            options.onFailure?.(diagnostic);
+            if (!canRetry || !retryable || attempt >= 3 || init.signal?.aborted)
+                throw failure;
+            const delay = attempt === 1 ? 500 : 1500;
+            if (transport.now() + delay >= expiresAt)
+                throw failure;
+            await transport.sleep(delay);
+        }
+    }
+}
+function validateHandoffResponse(stage, body, handoffId) {
+    if (stage === "task") {
+        const task = body.handoff;
+        if (task && task.id === handoffId && Array.isArray(task.received_ordinals))
+            return;
+    }
+    else {
+        const counts = stage === "draft-chunks" ? ["accepted", "received", "requestedCount"] : ["accepted", "profiled", "requestedProducts", "selected", "requestedCount"];
+        if (counts.every((field) => Number.isInteger(body[field]) && Number(body[field]) >= 0) && typeof body.status === "string"
+            && (stage !== "draft-chunks" || Array.isArray(body.receivedOrdinals)))
+            return;
+    }
+    throw new SyntaxError("InvalidHandoffResponse");
+}

package/dist/workflow/manager.d.ts

@@ -1,6 +1,7 @@
 import type { AgentEmit } from "../agent/types.js";
 import { type CanvasAgentConfig } from "../config.js";
 import { type FlowCProductExecutionProfile } from "./product-profile.js";
+import { type CommerceRequestDiagnostic } from "./commerce-http.js";
 export declare const FLOW_C_CODEX_TURN_TIMEOUT_MS: number;
 export declare const FLOW_C_SELECTED_BLUEPRINT_PROMPT_MAX_CHARS = 36000;
 export declare const FLOW_C_SCRIPT_REWRITE_MAX_ATTEMPTS = 2;
@@ -24,6 +25,9 @@ type ScriptRecord = {
     chunkSize?: number;
     activeChunks?: number;
     productProfiles?: FlowCProductExecutionProfile[];
+    pendingScriptJobs?: DraftJob[];
+    lastFailure?: CommerceRequestDiagnostic;
+    retryRequested?: boolean;
     priorityAt?: string;
     updatedAt: string;
 };
@@ -147,9 +151,32 @@ type ScriptTask = {
     received_ordinals: number[];
     expires_at: string;
 };
+type DraftJob = {
+    ordinal: number;
+    productIndex: number;
+    sellingFormId: string;
+    script: string;
+    expectedCandidateRevision?: string;
+    masterScript?: string;
+    creativePlan?: Record<string, unknown>;
+    executionBindings?: Record<string, unknown>;
+    creativeTags?: Record<string, unknown>;
+    voiceProfile?: Record<string, string>;
+    qualityGate?: Record<string, string>;
+    segmentVoiceovers?: string[][];
+    segment?: {
+        script: string;
+        continuityMode: "continue" | "reset";
+    };
+    segments?: Array<{
+        script: string;
+        continuityMode: "continue" | "reset";
+    }>;
+};
 type ScriptChunkResult = {
     error?: string;
     terminal: boolean;
+    terminalKind?: "contract" | "transport" | "timeout" | "turn" | "delivery";
     replanOrdinals?: number[];
 };
 /** 本机持久化的 Flow C 控制器：脚本交给本机 Codex，视频直接落盘。 */
@@ -214,22 +241,12 @@ export declare class WorkflowManager {
         receivedOrdinals?: number[];
         requestedCount: number;
         status: string;
-    } & {
-        error?: string;
-        code?: string;
-        resetOrdinals?: unknown;
-        rewriteOrdinals?: unknown;
     }>;
     submitCandidateChunk(idValue: unknown, groupsValue: unknown): Promise<{
         accepted: number;
         selected: number;
         requestedCount: number;
         selectedCandidates: SelectedCandidate[];
-    } & {
-        error?: string;
-        code?: string;
-        resetOrdinals?: unknown;
-        rewriteOrdinals?: unknown;
     }>;
     submitProductProfileChunk(idValue: unknown, profilesValue: unknown[], contractVersion?: string): Promise<{
         accepted: number;
@@ -238,12 +255,8 @@ export declare class WorkflowManager {
         selected: number;
         requestedCount: number;
         status: string;
-    } & {
-        error?: string;
-        code?: string;
-        resetOrdinals?: unknown;
-        rewriteOrdinals?: unknown;
     }>;
+    private scriptRequestOptions;
     downloadState(): {
         configured: boolean;
         directoryName: string | undefined;
@@ -371,6 +384,11 @@ export declare function terminalScriptChunkError(results: Array<{
     error?: string;
     terminal?: boolean;
 }>): string;
+export declare function terminalScriptChunkFailure<T extends {
+    error?: string;
+    terminal?: boolean;
+    terminalKind?: ScriptChunkResult["terminalKind"];
+}>(results: T[]): T | undefined;
 export declare function scriptCreativeReplanOrdinals(results: unknown[]): number[];
 /** Keep a mixed reset signal after an exact-duplicate rewrite finishes. */
 export declare function preserveScriptRecoveryReplans(result: ScriptChunkResult, error: unknown): ScriptChunkResult;
@@ -416,4 +434,5 @@ export declare function nextScriptPipelineWave(task: Pick<ScriptTask, "requested
 };
 export declare function immediateScriptOrdinals(task: Pick<ScriptTask, "selected_candidates">, receivedOrdinals: number[], candidateOrdinals: number[]): number[];
 export declare function missingOrdinals(total: number, received: number[]): number[];
+export declare function mergeProductProfiles(local?: FlowCProductExecutionProfile[], confirmed?: FlowCProductExecutionProfile[]): FlowCProductExecutionProfile[];
 export {};