@xiaohhhh1/canvas-agent 0.4.75 → 0.4.76

package/dist/utils/logger.d.ts

@@ -3,6 +3,7 @@ export declare class Logger {
     readonly enabled: boolean;
     readonly filePath: string;
     private readonly logger;
+    private failureLogger?;
     /** 根据命令行 Debug 参数初始化日志输出。 */
     constructor();
     /** 输出 Debug 级别日志。 */
@@ -13,5 +14,7 @@ export declare class Logger {
     warn(message: string, details?: unknown): void;
     /** 输出 Error 级别日志。 */
     error(message: string, details?: unknown): void;
+    /** Always persist minimal, caller-whitelisted failure metadata; no request bodies or URLs. */
+    failure(message: string, details: Record<string, unknown>): void;
 }
 export declare const logger: Logger;

package/dist/utils/logger.js

@@ -9,6 +9,7 @@ export class Logger {
     enabled = process.argv.includes("--debug");
     filePath = this.enabled ? path.join(os.homedir(), ".infinite-canvas", "logs", `canvas-agent-${formatDateForFilename()}.log`) : "";
     logger;
+    failureLogger;
     /** 根据命令行 Debug 参数初始化日志输出。 */
     constructor() {
         if (!this.enabled) {
@@ -53,6 +54,23 @@ export class Logger {
         else
             this.logger?.error(message, { details: sanitize(details) });
     }
+    /** Always persist minimal, caller-whitelisted failure metadata; no request bodies or URLs. */
+    failure(message, details) {
+        try {
+            if (!this.failureLogger) {
+                const directory = path.join(os.homedir(), ".infinite-canvas", "logs");
+                fs.mkdirSync(directory, { recursive: true });
+                this.failureLogger = winston.createLogger({
+                    level: "warn",
+                    format: format.combine(format.timestamp(), format.json()),
+                    transports: [new transports.File({ filename: path.join(directory, "canvas-agent-failures.log"), maxsize: 1_000_000, maxFiles: 3, options: { flags: "a", mode: 0o600 } })],
+                });
+                this.failureLogger.on("error", () => { });
+            }
+            this.failureLogger.warn(message, sanitize(details));
+        }
+        catch { /* Failure logging must never lose a saved result or mask the request error. */ }
+    }
 }
 /** 将日志详情格式化为紧凑的单行文本。 */
 function formatDetails(details) {

package/dist/workflow/commerce-http.d.ts

@@ -0,0 +1,34 @@
+export type CommerceRequestDiagnostic = {
+    stage: string;
+    method: string;
+    requestId: string;
+    name: string;
+    cause?: {
+        code: string;
+    };
+    status?: number;
+    attempt: number;
+    elapsedMs: number;
+    at: string;
+};
+export declare class CommerceRequestError extends Error {
+    readonly diagnostic: CommerceRequestDiagnostic;
+    readonly retryable: boolean;
+    status?: number;
+    code?: string;
+    resetOrdinals?: unknown;
+    rewriteOrdinals?: unknown;
+    constructor(message: string, diagnostic: CommerceRequestDiagnostic, retryable: boolean);
+}
+type RequestOptions = {
+    expiresAt?: string;
+    onFailure?: (diagnostic: CommerceRequestDiagnostic) => void;
+};
+type Transport = {
+    fetch: typeof fetch;
+    sleep: (ms: number) => Promise<void>;
+    now: () => number;
+};
+/** Only read-only requests and the two server-deduplicated handoff deliveries may retry. */
+export declare function commerceJson<T>(url: string, token: string, tokenHeader: string, init?: RequestInit, options?: RequestOptions, transport?: Transport): Promise<T>;
+export {};

package/dist/workflow/commerce-http.js

@@ -0,0 +1,114 @@
+import { randomUUID } from "node:crypto";
+export class CommerceRequestError extends Error {
+    diagnostic;
+    retryable;
+    status;
+    code;
+    resetOrdinals;
+    rewriteOrdinals;
+    constructor(message, diagnostic, retryable) {
+        super(message);
+        this.diagnostic = diagnostic;
+        this.retryable = retryable;
+        this.name = "CommerceRequestError";
+    }
+}
+const defaultTransport = { fetch: (...args) => fetch(...args), sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)), now: () => Date.now() };
+const safeCode = (value) => typeof value === "string" && /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(value) ? value : undefined;
+/** Only read-only requests and the two server-deduplicated handoff deliveries may retry. */
+export async function commerceJson(url, token, tokenHeader, init = {}, options = {}, transport = defaultTransport) {
+    const method = String(init.method || "GET").toUpperCase();
+    const pathname = new URL(url).pathname;
+    const handoff = /^\/api\/commerce\/workflow-script-handoffs\/[0-9a-f-]{36}\/(task|product-profiles|draft-chunks)$/.exec(pathname);
+    const canRetry = Boolean(handoff && (method === "GET" && handoff[1] === "task" || method === "POST" && typeof init.body === "string" && ["product-profiles", "draft-chunks"].includes(handoff[1])));
+    const stage = handoff?.[1] || "commerce-request";
+    const requestId = randomUUID();
+    const headers = new Headers(init.headers);
+    headers.set("accept", "application/json");
+    headers.set(tokenHeader, token);
+    headers.set("x-request-id", requestId);
+    if (init.body)
+        headers.set("content-type", "application/json");
+    // Capture the exact serialized payload once; retries never rebuild model output.
+    const request = { ...init, method, headers };
+    const startedAt = transport.now();
+    const expiresAt = options.expiresAt === undefined ? Infinity : typeof options.expiresAt === "string" ? Date.parse(options.expiresAt) : NaN;
+    const invalidCapability = options.expiresAt !== undefined && !Number.isFinite(expiresAt);
+    for (let attempt = 1;; attempt += 1) {
+        let status;
+        let body = {};
+        let expired = false;
+        try {
+            if (invalidCapability)
+                throw new Error("InvalidCapability");
+            if (init.signal?.aborted)
+                throw new Error("AbortError");
+            const remaining = expiresAt - transport.now();
+            if (remaining <= 0) {
+                expired = true;
+                throw new Error("CapabilityExpired");
+            }
+            const response = await transport.fetch(url, { ...request, signal: AbortSignal.timeout(Math.max(1, Math.min(120_000, Number.isFinite(remaining) ? remaining : 120_000))) });
+            status = response.status;
+            // A lost/truncated successful response is ambiguous delivery, never an empty success.
+            try {
+                const value = await response.json();
+                if (!value || typeof value !== "object" || Array.isArray(value))
+                    throw new SyntaxError("InvalidResponse");
+                body = value;
+            }
+            catch (error) {
+                if (response.ok)
+                    throw error;
+            }
+            if (!response.ok)
+                throw new Error("HTTPError");
+            if (handoff)
+                validateHandoffResponse(stage, body, pathname.split("/").at(-2));
+            return body;
+        }
+        catch (cause) {
+            const aborted = Boolean(init.signal?.aborted);
+            const error = cause;
+            const causeCode = safeCode(error?.cause?.code) || safeCode(error?.code);
+            const diagnostic = {
+                stage, method, requestId, name: invalidCapability ? "InvalidCapability" : expired ? "CapabilityExpired" : aborted ? "AbortError" : status && status >= 400 ? "HTTPError" : safeCode(error?.name) || "Error",
+                ...(causeCode ? { cause: { code: causeCode } } : {}), ...(status ? { status } : {}),
+                attempt, elapsedMs: Math.max(0, transport.now() - startedAt), at: new Date(transport.now()).toISOString(),
+            };
+            const contractFailure = /invalid_json_schema|invalid_response_format|invalid response_format/i.test(`${body.code || ""} ${body.error || ""}`);
+            const retryable = !invalidCapability && !expired && !aborted && !contractFailure && (status === undefined || status >= 200 && status < 300 || [408, 429, 500, 502, 503, 504].includes(status));
+            const message = invalidCapability ? "脚本交接有效期无效，请在网页重新授权交接"
+                : expired ? "脚本交接能力已过期，请在网页重新授权交接"
+                    : aborted ? "中心请求已取消，已保留本机结果"
+                        : status && status >= 400 ? String(body.error || `中心接口返回 ${status}`).split(token).join("[REDACTED]").replace(/https?:\/\/\S+/gi, "[URL]").slice(0, 500)
+                            : `中心${stage === "task" ? "任务读取" : "结果回传"}连接失败，已保留本机结果，请重试（诊断 ${requestId}）`;
+            const failure = new CommerceRequestError(message, diagnostic, retryable);
+            failure.status = status;
+            failure.code = invalidCapability ? "WORKFLOW_CAPABILITY_INVALID" : expired ? "WORKFLOW_CAPABILITY_EXPIRED" : aborted ? "WORKFLOW_REQUEST_ABORTED" : safeCode(body.code);
+            failure.resetOrdinals = body.resetOrdinals;
+            failure.rewriteOrdinals = body.rewriteOrdinals;
+            options.onFailure?.(diagnostic);
+            if (!canRetry || !retryable || attempt >= 3 || init.signal?.aborted)
+                throw failure;
+            const delay = attempt === 1 ? 500 : 1500;
+            if (transport.now() + delay >= expiresAt)
+                throw failure;
+            await transport.sleep(delay);
+        }
+    }
+}
+function validateHandoffResponse(stage, body, handoffId) {
+    if (stage === "task") {
+        const task = body.handoff;
+        if (task && task.id === handoffId && Array.isArray(task.received_ordinals))
+            return;
+    }
+    else {
+        const counts = stage === "draft-chunks" ? ["accepted", "received", "requestedCount"] : ["accepted", "profiled", "requestedProducts", "selected", "requestedCount"];
+        if (counts.every((field) => Number.isInteger(body[field]) && Number(body[field]) >= 0) && typeof body.status === "string"
+            && (stage !== "draft-chunks" || Array.isArray(body.receivedOrdinals)))
+            return;
+    }
+    throw new SyntaxError("InvalidHandoffResponse");
+}

package/dist/workflow/manager.d.ts

@@ -1,6 +1,7 @@
 import type { AgentEmit } from "../agent/types.js";
 import { type CanvasAgentConfig } from "../config.js";
 import { type FlowCProductExecutionProfile } from "./product-profile.js";
+import { type CommerceRequestDiagnostic } from "./commerce-http.js";
 export declare const FLOW_C_CODEX_TURN_TIMEOUT_MS: number;
 export declare const FLOW_C_SELECTED_BLUEPRINT_PROMPT_MAX_CHARS = 36000;
 export declare const FLOW_C_SCRIPT_REWRITE_MAX_ATTEMPTS = 2;
@@ -24,6 +25,9 @@ type ScriptRecord = {
     chunkSize?: number;
     activeChunks?: number;
     productProfiles?: FlowCProductExecutionProfile[];
+    pendingScriptJobs?: DraftJob[];
+    lastFailure?: CommerceRequestDiagnostic;
+    retryRequested?: boolean;
     priorityAt?: string;
     updatedAt: string;
 };
@@ -147,10 +151,32 @@ type ScriptTask = {
     received_ordinals: number[];
     expires_at: string;
 };
+type DraftJob = {
+    ordinal: number;
+    productIndex: number;
+    sellingFormId: string;
+    script: string;
+    expectedCandidateRevision?: string;
+    masterScript?: string;
+    creativePlan?: Record<string, unknown>;
+    executionBindings?: Record<string, unknown>;
+    creativeTags?: Record<string, unknown>;
+    voiceProfile?: Record<string, string>;
+    qualityGate?: Record<string, string>;
+    segmentVoiceovers?: string[][];
+    segment?: {
+        script: string;
+        continuityMode: "continue" | "reset";
+    };
+    segments?: Array<{
+        script: string;
+        continuityMode: "continue" | "reset";
+    }>;
+};
 type ScriptChunkResult = {
     error?: string;
     terminal: boolean;
-    terminalKind?: "contract" | "transport" | "timeout" | "turn";
+    terminalKind?: "contract" | "transport" | "timeout" | "turn" | "delivery";
     replanOrdinals?: number[];
 };
 /** 本机持久化的 Flow C 控制器：脚本交给本机 Codex，视频直接落盘。 */
@@ -215,22 +241,12 @@ export declare class WorkflowManager {
         receivedOrdinals?: number[];
         requestedCount: number;
         status: string;
-    } & {
-        error?: string;
-        code?: string;
-        resetOrdinals?: unknown;
-        rewriteOrdinals?: unknown;
     }>;
     submitCandidateChunk(idValue: unknown, groupsValue: unknown): Promise<{
         accepted: number;
         selected: number;
         requestedCount: number;
         selectedCandidates: SelectedCandidate[];
-    } & {
-        error?: string;
-        code?: string;
-        resetOrdinals?: unknown;
-        rewriteOrdinals?: unknown;
     }>;
     submitProductProfileChunk(idValue: unknown, profilesValue: unknown[], contractVersion?: string): Promise<{
         accepted: number;
@@ -239,12 +255,8 @@ export declare class WorkflowManager {
         selected: number;
         requestedCount: number;
         status: string;
-    } & {
-        error?: string;
-        code?: string;
-        resetOrdinals?: unknown;
-        rewriteOrdinals?: unknown;
     }>;
+    private scriptRequestOptions;
     downloadState(): {
         configured: boolean;
         directoryName: string | undefined;
@@ -422,4 +434,5 @@ export declare function nextScriptPipelineWave(task: Pick<ScriptTask, "requested
 };
 export declare function immediateScriptOrdinals(task: Pick<ScriptTask, "selected_candidates">, receivedOrdinals: number[], candidateOrdinals: number[]): number[];
 export declare function missingOrdinals(total: number, received: number[]): number[];
+export declare function mergeProductProfiles(local?: FlowCProductExecutionProfile[], confirmed?: FlowCProductExecutionProfile[]): FlowCProductExecutionProfile[];
 export {};

package/dist/workflow/manager.js

@@ -13,6 +13,7 @@ import { FLOW_C_SCRIPT_CHUNK_MAX, flowCScriptChunks, flowCScriptChunkSizes } fro
 import { FLOW_C_CREATIVE_CANDIDATE_CONTRACT_VERSION, flowCCreativeCandidateOutputSchema, parseFlowCCreativeCandidateOutput } from "./creative-candidates.js";
 import { FLOW_C_LEGACY_PRODUCT_EXECUTION_PROFILE_CONTRACT_VERSION, FLOW_C_PRODUCT_EXECUTION_PROFILE_CONTRACT_VERSION, flowCProductExecutionProfileOutputSchema, parseFlowCProductExecutionProfileOutput } from "./product-profile.js";
 import { flowCScriptOutputSchema, parseFlowCScriptOutput } from "./script-output.js";
+import { commerceJson, CommerceRequestError } from "./commerce-http.js";
 const STATE_FILE = path.join(CONFIG_DIR, "workflow-state.json");
 export const FLOW_C_CODEX_TURN_TIMEOUT_MS = 8 * 60 * 1000;
 export const FLOW_C_SELECTED_BLUEPRINT_PROMPT_MAX_CHARS = 36_000;
@@ -67,6 +68,8 @@ export class WorkflowManager {
             chunkSize: previous?.chunkSize,
             activeChunks: 0,
             productProfiles: previous?.productProfiles || [],
+            pendingScriptJobs: previous?.pendingScriptJobs || [],
+            lastFailure: previous?.lastFailure,
             priorityAt: now(),
             message: previous?.status === "complete" ? previous.message : "已进入本机 Codex 队列",
             updatedAt: now(),
@@ -78,6 +81,15 @@ export class WorkflowManager {
     retryScript(idValue) {
         const id = workflowId(idValue, "脚本交接 ID");
         const record = this.scriptRecord(id);
+        if (this.runningScripts.has(id)) {
+            record.retryRequested = true;
+            record.priorityAt = now();
+            record.message = "当前任务仍在处理，结束后优先重试";
+            record.updatedAt = now();
+            this.save();
+            return this.scriptStatus(id);
+        }
+        delete record.retryRequested;
         record.status = "queued";
         record.activeChunks = 0;
         // A failed manual attempt may leave a very large or interrupted thread.
@@ -97,12 +109,13 @@ export class WorkflowManager {
     /** MCP 读取服务端持久化的完整任务，不向模型暴露令牌。 */
     async scriptTask(idValue) {
         const record = this.scriptRecord(workflowId(idValue, "脚本交接 ID"));
-        const data = await commerceJson(`${record.apiBase}/workflow-script-handoffs/${encodeURIComponent(record.id)}/task`, record.accessToken, "x-workflow-handoff-token");
+        const data = await commerceJson(`${record.apiBase}/workflow-script-handoffs/${encodeURIComponent(record.id)}/task`, record.accessToken, "x-workflow-handoff-token", {}, this.scriptRequestOptions(record));
         const task = data.handoff;
         record.requestedCount = Number(task.requested_count || 0);
-        record.receivedOrdinals = Array.isArray(task.received_ordinals) ? task.received_ordinals.map(Number).filter(Number.isInteger).sort((left, right) => left - right) : [];
-        if (Array.isArray(task.product_execution_profiles))
-            record.productProfiles = task.product_execution_profiles;
+        record.receivedOrdinals = [...new Set([...record.receivedOrdinals, ...task.received_ordinals.map(Number).filter(Number.isInteger)])].sort((left, right) => left - right);
+        task.received_ordinals = record.receivedOrdinals;
+        record.productProfiles = mergeProductProfiles(record.productProfiles, task.product_execution_profiles);
+        record.pendingScriptJobs = (record.pendingScriptJobs || []).filter((job) => !record.receivedOrdinals.includes(job.ordinal));
         record.expiresAt = task.expires_at;
         record.updatedAt = now();
         this.save();
@@ -114,7 +127,13 @@ export class WorkflowManager {
         if (!Array.isArray(jobsValue) || !jobsValue.length || jobsValue.length > FLOW_C_SCRIPT_CHUNK_MAX)
             throw new Error(`每段必须包含 1–${FLOW_C_SCRIPT_CHUNK_MAX} 条脚本`);
         const jobs = jobsValue;
-        const data = await commerceJson(`${record.apiBase}/workflow-script-handoffs/${encodeURIComponent(record.id)}/draft-chunks`, record.accessToken, "x-workflow-handoff-token", { method: "POST", body: JSON.stringify({ jobs }) });
+        const pending = new Map((record.pendingScriptJobs || []).map((job) => [job.ordinal, job]));
+        for (const job of jobs)
+            if (!record.receivedOrdinals.includes(job.ordinal))
+                pending.set(job.ordinal, structuredClone(job));
+        record.pendingScriptJobs = [...pending.values()].sort((left, right) => left.ordinal - right.ordinal);
+        this.save();
+        const data = await commerceJson(`${record.apiBase}/workflow-script-handoffs/${encodeURIComponent(record.id)}/draft-chunks`, record.accessToken, "x-workflow-handoff-token", { method: "POST", body: JSON.stringify({ jobs }) }, this.scriptRequestOptions(record));
         if (Array.isArray(data.receivedOrdinals))
             record.receivedOrdinals = [...new Set([...record.receivedOrdinals, ...data.receivedOrdinals.map(Number).filter(Number.isInteger)])].sort((left, right) => left - right);
         else {
@@ -125,6 +144,7 @@ export class WorkflowManager {
             record.receivedOrdinals = [...accepted].sort((a, b) => a - b);
         }
         record.requestedCount = Number(data.requestedCount || record.requestedCount);
+        record.pendingScriptJobs = (record.pendingScriptJobs || []).filter((job) => !record.receivedOrdinals.includes(job.ordinal));
         record.status = data.status === "ready" ? "complete" : "running";
         record.message = data.status === "ready" ? `全部 ${record.requestedCount} 条高质量脚本已回传` : `已回传 ${data.received}/${data.requestedCount} 条脚本`;
         record.updatedAt = now();
@@ -135,13 +155,21 @@ export class WorkflowManager {
         const record = this.scriptRecord(workflowId(idValue, "脚本交接 ID"));
         if (!Array.isArray(groupsValue) || !groupsValue.length || groupsValue.length > 10)
             throw new Error("每个候选子批必须包含 1–10 个 ordinal 组");
-        return commerceJson(`${record.apiBase}/workflow-script-handoffs/${encodeURIComponent(record.id)}/candidate-chunks`, record.accessToken, "x-workflow-handoff-token", { method: "POST", body: JSON.stringify({ contractVersion: FLOW_C_CREATIVE_CANDIDATE_CONTRACT_VERSION, groups: groupsValue }) });
+        return commerceJson(`${record.apiBase}/workflow-script-handoffs/${encodeURIComponent(record.id)}/candidate-chunks`, record.accessToken, "x-workflow-handoff-token", { method: "POST", body: JSON.stringify({ contractVersion: FLOW_C_CREATIVE_CANDIDATE_CONTRACT_VERSION, groups: groupsValue }) }, this.scriptRequestOptions(record));
     }
     async submitProductProfileChunk(idValue, profilesValue, contractVersion = FLOW_C_PRODUCT_EXECUTION_PROFILE_CONTRACT_VERSION) {
         const record = this.scriptRecord(workflowId(idValue, "脚本交接 ID"));
         if (!Array.isArray(profilesValue) || profilesValue.length > 10)
             throw new Error("每个商品执行档案子批最多 10 个产品");
-        return commerceJson(`${record.apiBase}/workflow-script-handoffs/${encodeURIComponent(record.id)}/product-profiles`, record.accessToken, "x-workflow-handoff-token", { method: "POST", body: JSON.stringify({ contractVersion, profiles: profilesValue }) });
+        return commerceJson(`${record.apiBase}/workflow-script-handoffs/${encodeURIComponent(record.id)}/product-profiles`, record.accessToken, "x-workflow-handoff-token", { method: "POST", body: JSON.stringify({ contractVersion, profiles: profilesValue }) }, this.scriptRequestOptions(record));
+    }
+    scriptRequestOptions(record) {
+        return { expiresAt: record.expiresAt, onFailure: (diagnostic) => {
+                record.lastFailure = diagnostic;
+                record.updatedAt = now();
+                this.save();
+                logger.failure("Flow C center request failed", { handoffId: record.id, ...diagnostic });
+            } };
     }
     downloadState() {
         return {
@@ -260,6 +288,7 @@ export class WorkflowManager {
         const record = this.scriptRecord(id);
         try {
             delete record.priorityAt;
+            delete record.retryRequested;
             record.status = "running";
             record.message = "正在读取完整产品清单";
             record.updatedAt = now();
@@ -311,6 +340,8 @@ export class WorkflowManager {
                     task = await this.scriptTask(id);
                     const terminalFailure = terminalScriptChunkFailure(results);
                     if (terminalFailure) {
+                        if (terminalFailure.terminalKind === "delivery")
+                            throw new Error(terminalFailure.error);
                         if (terminalFailure.terminalKind === "transport")
                             throw new Error(`创意或脚本阶段的本机 Codex 进程连续异常且自动恢复未成功，已停止当前任务且未提交缺失脚本（${terminalFailure.error}）`);
                         throw new Error(`创意或脚本结构化契约被 Codex 拒绝，已停止自动重试（${terminalFailure.error}）`);
@@ -324,6 +355,8 @@ export class WorkflowManager {
                         const replanResults = await Promise.all(replanOrdinals.map((ordinal) => this.runCandidateChunk(id, task, [ordinal], workspace.workspacePath)));
                         const replanTerminalFailure = terminalScriptChunkFailure(replanResults);
                         if (replanTerminalFailure) {
+                            if (replanTerminalFailure.terminalKind === "delivery")
+                                throw new Error(replanTerminalFailure.error);
                             if (replanTerminalFailure.terminalKind === "transport")
                                 throw new Error(`创意重新选题时本机 Codex 进程异常且自动恢复未成功，已停止当前任务（${replanTerminalFailure.error}）`);
                             throw new Error(`创意重新选题被 Codex 拒绝，已停止自动重试（${replanTerminalFailure.error}）`);
@@ -358,6 +391,8 @@ export class WorkflowManager {
                 task = await this.scriptTask(id);
                 const terminalFailure = terminalScriptChunkFailure(results);
                 if (terminalFailure) {
+                    if (terminalFailure.terminalKind === "delivery")
+                        throw new Error(terminalFailure.error);
                     if (terminalFailure.terminalKind === "transport")
                         throw new Error(`本机 Codex 脚本引擎连续异常且自动恢复未成功，已停止当前任务且未提交缺失脚本。诊断已保存在本机 Agent 日志中（${terminalFailure.error}）`);
                     throw new Error(`本机脚本结构化契约被 Codex 拒绝，已停止自动重试且未提交缺失脚本。请先升级或修复 Canvas Agent，再手动重试（${terminalFailure.error}）`);
@@ -371,6 +406,8 @@ export class WorkflowManager {
                     const replanResults = await Promise.all(replanOrdinals.map((ordinal) => this.runCandidateChunk(id, task, [ordinal], workspace.workspacePath)));
                     const replanTerminalFailure = terminalScriptChunkFailure(replanResults);
                     if (replanTerminalFailure) {
+                        if (replanTerminalFailure.terminalKind === "delivery")
+                            throw new Error(replanTerminalFailure.error);
                         if (replanTerminalFailure.terminalKind === "transport")
                             throw new Error(`创意重新选题时本机 Codex 进程异常且自动恢复未成功，已停止当前任务（${replanTerminalFailure.error}）`);
                         throw new Error(`创意重新选题被 Codex 拒绝，已停止自动重试（${replanTerminalFailure.error}）`);
@@ -405,15 +442,26 @@ export class WorkflowManager {
                 throw new Error(`中心校验尚未通过（${record.receivedOrdinals.length}/${task.requested_count} 条），请点击重试`);
         }
         catch (error) {
-            record.status = error instanceof ExpiredCapabilityError ? "expired" : "error";
+            const expired = error instanceof ExpiredCapabilityError || error instanceof CommerceRequestError && error.code === "WORKFLOW_CAPABILITY_EXPIRED"
+                || record.lastFailure?.name === "CapabilityExpired" && Date.parse(record.expiresAt || "") <= Date.now();
+            record.status = expired ? "expired" : "error";
             record.message = error instanceof Error ? error.message : "本机 Codex 处理失败";
             logger.warn("Local Flow C script handoff paused", { handoffId: id, error: record.message });
         }
         finally {
+            const retry = record.retryRequested && record.status !== "complete";
+            delete record.retryRequested;
+            if (retry) {
+                record.status = "queued";
+                delete record.threadId;
+                record.message = "已保存本机结果，正在优先重试";
+            }
             record.updatedAt = now();
             record.activeChunks = 0;
             this.save();
             this.runningScripts.delete(id);
+            if (retry)
+                this.scheduleScript(id);
         }
     }
     /** Analyze each product once; image 1 owns identity and later images may only corroborate visible evidence. */
@@ -438,21 +486,37 @@ export class WorkflowManager {
                 && missing.some((product) => (product.productImageUrlsInExactOrder || []).length > 1);
             const profileConcurrency = includesSupportingImages ? 1 : FLOW_C_CODEX_WORKER_CONCURRENCY;
             const workerCount = Math.min(missing.length, Math.max(1, profileConcurrency));
-            await Promise.all(Array.from({ length: workerCount }, async () => {
-                while (nextProduct < missing.length) {
-                    const product = missing[nextProduct++];
-                    const productIndex = Number(product.productIndex);
-                    let profile = cached.get(productIndex);
-                    if (!profile) {
-                        profile = await this.runProductExecutionProfile(id, product, cwd, profileContractVersion);
-                        cached.set(productIndex, profile);
-                        record.productProfiles = [...cached.values()].sort((left, right) => left.productIndex - right.productIndex);
-                        record.updatedAt = now();
-                        this.save();
+            let stopped = false;
+            let firstFailure;
+            // Do not release the handoff lock while a sibling model turn can
+            // still produce a result. A quick retry must see its durable cache.
+            await Promise.allSettled(Array.from({ length: workerCount }, async () => {
+                try {
+                    while (!stopped && nextProduct < missing.length) {
+                        const product = missing[nextProduct++];
+                        const productIndex = Number(product.productIndex);
+                        let profile = cached.get(productIndex);
+                        if (!profile) {
+                            profile = await this.runProductExecutionProfile(id, product, cwd, profileContractVersion);
+                            cached.set(productIndex, profile);
+                            record.productProfiles = [...cached.values()].sort((left, right) => left.productIndex - right.productIndex);
+                            record.updatedAt = now();
+                            this.save();
+                        }
+                        if (stopped)
+                            return;
+                        await this.submitProductProfileChunk(id, [profile], profileContractVersion);
                     }
-                    await this.submitProductProfileChunk(id, [profile], profileContractVersion);
+                }
+                catch (error) {
+                    if (!stopped)
+                        firstFailure = error;
+                    stopped = true;
+                    throw error;
                 }
             }));
+            if (stopped)
+                throw firstFailure;
             task = await this.scriptTask(id);
         }
         const profiled = Number(task.product_profile_stage?.completed || task.product_execution_profiles?.length || 0);
@@ -532,33 +596,44 @@ export class WorkflowManager {
     }
     /** 一个 chunk 使用独立线程；解析与中心持久化失败不会影响并行 lane。 */
     async runScriptChunk(id, task, ordinals, cwd, rewriteAttempt = 0, revisionAttempt = 0) {
-        const durationSeconds = Number(task.duration_seconds || 10);
-        let prompt;
-        try {
-            prompt = scriptChunkPrompt(id, task, ordinals, rewriteAttempt);
-        }
-        catch (error) {
-            if (isFlowCPromptPayloadTooLarge(error))
-                return { error: error.message, terminal: false };
-            throw error;
-        }
-        const result = await runCodexWorkflowTurn(prompt, this.emit, {
-            cwd,
-            permissionMode: "full",
-            timeoutMs: FLOW_C_CODEX_TURN_TIMEOUT_MS,
-            outputSchema: flowCScriptOutputSchema(durationSeconds, ordinals.length),
-            onThread: (threadId) => { this.scriptRecord(id).threadId = threadId; this.save(); },
-            onWorkerStart: () => { const record = this.scriptRecord(id); record.activeChunks = Number(record.activeChunks || 0) + 1; record.updatedAt = now(); this.save(); },
-            onWorkerFinish: () => { const record = this.scriptRecord(id); record.activeChunks = Math.max(0, Number(record.activeChunks || 0) - 1); record.updatedAt = now(); this.save(); },
-        });
-        this.emitScriptStage(id, ordinals, "queue_wait", result.timings.queueWaitMs);
-        this.emitScriptStage(id, ordinals, "thread_start", result.timings.threadStartMs);
-        this.emitScriptStage(id, ordinals, "model", result.timings.modelMs);
-        if (!result.ok)
-            return { error: result.error, terminal: !result.retryable, ...(!result.retryable ? { terminalKind: result.failureKind } : {}) };
-        if (!result.text)
-            return { error: "Codex 未返回可用的结构化脚本", terminal: false };
         try {
+            const record = this.scriptRecord(id);
+            ordinals = ordinals.filter((ordinal) => !record.receivedOrdinals.includes(ordinal));
+            if (!ordinals.length)
+                return { terminal: false };
+            const cached = (record.pendingScriptJobs || []).filter((job) => ordinals.includes(job.ordinal));
+            if (cached.length) {
+                await this.submitGeneratedScriptJobs(id, cached);
+                ordinals = ordinals.filter((ordinal) => !record.receivedOrdinals.includes(ordinal));
+                if (!ordinals.length)
+                    return { terminal: false };
+            }
+            const durationSeconds = Number(task.duration_seconds || 10);
+            let prompt;
+            try {
+                prompt = scriptChunkPrompt(id, task, ordinals, rewriteAttempt);
+            }
+            catch (error) {
+                if (isFlowCPromptPayloadTooLarge(error))
+                    return { error: error.message, terminal: false };
+                throw error;
+            }
+            const result = await runCodexWorkflowTurn(prompt, this.emit, {
+                cwd,
+                permissionMode: "full",
+                timeoutMs: FLOW_C_CODEX_TURN_TIMEOUT_MS,
+                outputSchema: flowCScriptOutputSchema(durationSeconds, ordinals.length),
+                onThread: (threadId) => { this.scriptRecord(id).threadId = threadId; this.save(); },
+                onWorkerStart: () => { const record = this.scriptRecord(id); record.activeChunks = Number(record.activeChunks || 0) + 1; record.updatedAt = now(); this.save(); },
+                onWorkerFinish: () => { const record = this.scriptRecord(id); record.activeChunks = Math.max(0, Number(record.activeChunks || 0) - 1); record.updatedAt = now(); this.save(); },
+            });
+            this.emitScriptStage(id, ordinals, "queue_wait", result.timings.queueWaitMs);
+            this.emitScriptStage(id, ordinals, "thread_start", result.timings.threadStartMs);
+            this.emitScriptStage(id, ordinals, "model", result.timings.modelMs);
+            if (!result.ok)
+                return { error: result.error, terminal: !result.retryable, ...(!result.retryable ? { terminalKind: result.failureKind } : {}) };
+            if (!result.text)
+                return { error: "Codex 未返回可用的结构化脚本", terminal: false };
             const parseStartedAt = Date.now();
             const selected = selectedCandidatesForOrdinals(task, ordinals);
             const jobs = parseFlowCScriptOutput(result.text, ordinals).map((job) => ({
@@ -574,6 +649,14 @@ export class WorkflowManager {
             return { terminal: false };
         }
         catch (error) {
+            // Only explicit semantic rejection may discard the affected saved output.
+            // Network/response loss, auth failures and validation stops retain it.
+            const invalidated = [...candidateRevisionChangedOrdinals(error), ...scriptRewriteOrdinals(error), ...creativeReplanOrdinals(error)];
+            if (invalidated.length) {
+                const record = this.scriptRecord(id);
+                record.pendingScriptJobs = (record.pendingScriptJobs || []).filter((job) => !invalidated.includes(job.ordinal));
+                this.save();
+            }
             const revisionOrdinals = candidateRevisionChangedOrdinals(error);
             if (revisionOrdinals.length && !creativeReplanOrdinals(error).length) {
                 if (revisionAttempt >= FLOW_C_CANDIDATE_REVISION_MAX_ATTEMPTS) {
@@ -632,6 +715,8 @@ export class WorkflowManager {
                 };
                 return preserveScriptRecoveryReplans(rewriteResult, error);
             }
+            if (error instanceof CommerceRequestError && !creativeReplanOrdinals(error).length)
+                return { error: error.message, terminal: true, terminalKind: "delivery" };
             return {
                 error: error instanceof Error ? `结构化脚本未通过本机校验：${error.message}` : "结构化脚本未通过本机校验",
                 terminal: terminalScriptValidationError(error),
@@ -653,7 +738,7 @@ export class WorkflowManager {
             return;
         }
         catch (error) {
-            if (jobs.length === 1)
+            if (jobs.length === 1 || error instanceof CommerceRequestError && ![400, 409, 422].includes(error.status || 0))
                 throw error;
             let accepted = 0;
             const failures = [];
@@ -663,6 +748,8 @@ export class WorkflowManager {
                     accepted += 1;
                 }
                 catch (jobError) {
+                    if (jobError instanceof CommerceRequestError && ![400, 409, 422].includes(jobError.status || 0))
+                        throw jobError;
                     failures.push(jobError);
                 }
             }
@@ -1326,23 +1413,11 @@ function safeDownloadUrl(value) { const url = new URL(String(value || "")); if (
     throw new Error("下载地址必须使用 HTTPS"); return url.toString(); }
 function safeName(value) { return String(value || "市场").replace(/[<>:"/\\|?*\u0000-\u001f]/g, "-").replace(/[. ]+$/g, "").slice(0, 60) || "市场"; }
 function now() { return new Date().toISOString(); }
-async function commerceJson(url, token, tokenHeader, init = {}) {
-    const headers = new Headers(init.headers);
-    headers.set("accept", "application/json");
-    headers.set(tokenHeader, token);
-    if (init.body)
-        headers.set("content-type", "application/json");
-    const response = await fetch(url, { ...init, headers, signal: AbortSignal.timeout(120_000) });
-    const body = await response.json().catch(() => ({}));
-    if (!response.ok) {
-        const error = new Error(body.error || `中心接口返回 ${response.status}`);
-        error.status = response.status;
-        error.code = body.code;
-        error.resetOrdinals = body.resetOrdinals;
-        error.rewriteOrdinals = body.rewriteOrdinals;
-        throw error;
-    }
-    return body;
+export function mergeProductProfiles(local = [], confirmed = []) {
+    const merged = new Map(local.map((profile) => [Number(profile.productIndex), profile]));
+    for (const profile of confirmed || [])
+        merged.set(Number(profile.productIndex), profile);
+    return [...merged.values()].sort((left, right) => left.productIndex - right.productIndex);
 }
 function loadState() {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiaohhhh1/canvas-agent",
-  "version": "0.4.75",
+  "version": "0.4.76",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",