codebee 0.1.53 → 0.1.54

package/CHANGELOG.md

@@ -23,6 +23,16 @@ README 元数据带回，供老版本在「发现新版本」时展示新版更
 
 - **首选 KEY 超限自动切备用了**：同厂商多密钥此前只认欠费类文案——首选 KEY 撞上 429 限流（智谱「并发数超过限制」「每分钟Token数已超过上限」、claude 的 rate_limit_error、codex 的 "429 Too Many Requests" 等）只记一笔错误、不进冷却，每个新步骤仍从超限的首选 KEY 重新烧起。现在限流文案与欠费同口径：进冷却 30 分钟、密钥镜像自动切下一把、链展开跳过冷却中的 KEY（到期或「恢复」按钮一键回首选）。顺带补一处漏账：无显式链时「换模型回退」的链条目不带 KEY 标记，这类重试失败此前完全不记 KEY 账。
 
+## v0.1.54（2026-09-23）
+
+- 任务驾驶舱大屏：/board.html 独立页 + /api/board 聚合端点——模型/厂商分布、实时思考流、排队滚动，中英双语
+- 连载章节安全落盘：临时文件 + 原子改名，半截稿不再污染章节文件
+- 日志抽屉一键复制全文（报错 JSON 不再手动圈选）
+- 删除/归档乐观清场：SSE 半死时已删/已归档任务不再挂侧栏
+- 卡死的模型调用快速失败转投，不再耗满超时
+- run_end 钩子新增「完成后 AI 复查并自动提交推送」：AI 复查 diff 判 OK 才 commit+push
+- 蜂巢卡显示当前使用模型 + 运行中思考过程行
+
 ## v0.1.53（2026-09-23）
 
 - 换将救活两类「假终态」：上游内容拒答（"can't help with this" 一类 refusal）与真超时，现在都会换绑定链上下一个候选再试——此前拒答直接判死整轮任务（链上异上游候选从未被尝试），超时能不能换全凭输出尾段碰巧带 "timeout" 字样；真实案：夜间知识库整理任务被网关 gemini 拒答后整 run 白烧

package/README.md

@@ -21,11 +21,11 @@ Kimi Code、MiMo Code、Grok Build、Pi、DeepSeek Harness……），提供
 不会把你的任务内容交给任何第三方。
 
 <!-- relnotes:start -->
-### 最新版更新内容（v0.1.53）
+### 最新版更新内容（v0.1.54）
 
-- 换将救活两类「假终态」：上游内容拒答（refusal）与真超时都会换链上下一个候选再试，不再整轮白烧
-- 同一慢上游连烧止损：连续两次相同超时即收手；取消绝不降级
-- 网关模型漂移可见：请求与实际服务的模型不一致时，失败信息明确标注
+- 新增任务驾驶舱大屏（/board.html）：模型/厂商分布、实时思考流、排队滚动
+- 章节原子落盘；日志一键复制；删除/归档乐观清场；卡死调用快速转投
+- run_end 钩子支持「AI 复查后自动提交推送」；蜂巢卡显示当前模型与思考流
 <!-- relnotes:end -->
 
 ---

package/app/core/board.py

@@ -0,0 +1,209 @@
+# -*- coding: utf-8 -*-
+"""任务驾驶舱（/board 大屏）的轻量聚合数据源。
+
+大屏 4 秒轮询：不能拉 /api/state 全量（MB 级），也不能每次全量扫 usage
+台账（summary 全历史读入），所以这里只取大屏要看的字段，并把 usage 聚合
+缓存 8 秒。只读 store/usage/jobs/health，不落新盘。
+"""
+from __future__ import annotations
+
+import time
+
+_CACHE = {"ts": 0.0, "data": None}
+_TTL = 8.0
+
+_TAIL_MAX = 150          # 跑马灯尾行截断
+_TAIL_LINES = 6          # 实时流窗口行数
+_TAIL_LINE_CHARS = 56    # 实时流单行截断（卡内 11px 等宽不换行的安全宽度）
+_RECENT_LIMIT = 10       # 最近完成/失败条数
+_RUN_WINDOW = 300        # 今日计数扫描的运行窗口（id 字典序=时间序）
+
+
+def payload():
+    now = time.time()
+    if _CACHE["data"] is not None and now - _CACHE["ts"] < _TTL:
+        return _CACHE["data"]
+    data = _build()
+    _CACHE["ts"] = now
+    _CACHE["data"] = data
+    return data
+
+
+def _tail(step):
+    """步骤实时流（正文优先，其次思考）的最后一行，给大屏跑马灯。"""
+    for key in ("stream", "thinking"):
+        v = step.get(key)
+        if isinstance(v, str) and v.strip():
+            lines = [ln.strip() for ln in v.strip().splitlines() if ln.strip()]
+            if lines:
+                return lines[-1][:_TAIL_MAX]
+    return ""
+
+
+def _live_block(step):
+    """步骤实时流窗口：尾部多行（正文优先，其次思考），供大屏看它在想什么。
+
+    返回 (来源标签 code, 文本)；标签是 code（output/thinking），由前端 i18n
+    翻译——大屏要做多语言，后端不下发中文。都没有返回 ("", "")。
+    """
+    for key, code in (("stream", "output"), ("thinking", "thinking")):
+        v = step.get(key)
+        if not (isinstance(v, str) and v.strip()):
+            continue
+        lines = [ln.strip()[:_TAIL_LINE_CHARS] for ln in v.strip().splitlines()]
+        lines = [ln for ln in lines if ln]
+        if lines:
+            return code, "\n".join(lines[-_TAIL_LINES:])
+    return "", ""
+
+
+def _model_provider_map():
+    """模型名 → 厂商名（enabled 优先，同模型多厂商取 priority 最靠前的）。"""
+    try:
+        from . import modelhub
+        rows = modelhub.models_view()
+    except Exception:
+        return {}
+    best = {}
+    for r in rows:
+        name = r.get("name")
+        if not name or not r.get("enabled", False):
+            continue
+        pri = r.get("priority", 0)
+        cur = best.get(name)
+        if cur is None or pri < cur[0]:
+            best[name] = (pri, r.get("provider_name") or r.get("provider_id") or "")
+    return {k: v[1] for k, v in best.items()}
+
+
+def _parse_ts(s):
+    try:
+        return time.mktime(time.strptime(str(s), "%Y-%m-%d %H:%M:%S"))
+    except (ValueError, TypeError):
+        return 0.0
+
+
+def _duration_s(run):
+    """运行耗时（秒）：ended-started，缺 started 用 created 兜底。"""
+    end = _parse_ts(run.get("ended_at"))
+    start = _parse_ts(run.get("started_at")) or _parse_ts(run.get("created_at"))
+    if end > 0 and start > 0 and end >= start:
+        return int(end - start)
+    return None
+
+
+def _step_view(steps, prov_map):
+    """进度概要：完成数 + 当前运行中步骤（含模型/厂商/实时流）。"""
+    done = sum(1 for s in steps if s.get("status") == "done")
+    cur = next((s for s in steps if s.get("status") == "running"), None)
+    cur_v = None
+    if cur:
+        live_label, live_text = _live_block(cur)
+        model = str(cur.get("model") or "")[:60]
+        cur_v = {"n": cur.get("n"), "role": cur.get("role") or "",
+                 "agent": cur.get("agent_label") or cur.get("agent") or "",
+                 "summary": (cur.get("summary") or "")[:80],
+                 "tail": _tail(cur),
+                 "model": model, "provider": prov_map.get(model, "") if model else "",
+                 "live_label": live_label, "live_text": live_text}
+    return done, len(steps), cur_v
+
+
+def _build():
+    from . import flows, health, jobs, store, usage
+
+    flow_map = {}
+    try:
+        for f in flows.list_flows():
+            flow_map[f.get("id")] = f
+    except Exception:
+        pass
+
+    prov_map = _model_provider_map()
+    today = time.strftime("%Y-%m-%d")
+    tasks = store.list_tasks(200, archived=False)
+    latest = store.latest_run_by_task()
+
+    running, queued = [], []
+    for t in tasks:
+        tid = t.get("id")
+        run = latest.get(tid)
+        status = t.get("status")
+        if status == "running" and run and run.get("status") == "running":
+            done, total, cur = _step_view(run.get("steps") or [], prov_map)
+            running.append({
+                "task_id": tid, "run_id": run.get("id"),
+                "title": t.get("title") or "", "goal": (t.get("goal") or "")[:120],
+                "type": t.get("type") or "",
+                "type_name": (flow_map.get(t.get("type")) or {}).get("name") or (t.get("type") or ""),
+                "status": status,
+                "started_at": run.get("started_at") or run.get("created_at") or "",
+                "steps_done": done, "steps_total": total,
+                "current": cur,
+                "run_tokens": run.get("tokens") or 0,
+                "run_cost_usd": round(float(run.get("cost_usd") or 0.0), 4),
+                "estimate_s": run.get("estimated_duration_s"),
+            })
+        elif status == "queued":
+            queued.append({
+                "task_id": tid, "run_id": (run or {}).get("id"),
+                "title": t.get("title") or "",
+                "type_name": (flow_map.get(t.get("type")) or {}).get("name") or (t.get("type") or ""),
+                "created_at": (run or {}).get("created_at") or "",
+            })
+    running.sort(key=lambda c: _parse_ts(c["started_at"]))
+    queued.sort(key=lambda c: _parse_ts(c["created_at"]))
+
+    runs = store.list_runs(_RUN_WINDOW)
+    today_done = today_failed = 0
+    recent = []
+    for r in runs:
+        st = r.get("status")
+        ended = str(r.get("ended_at") or "")
+        if st in ("done", "failed", "cancelled") and ended.startswith(today):
+            if st == "done":
+                today_done += 1
+            elif st == "failed":
+                today_failed += 1
+        if len(recent) < _RECENT_LIMIT and st in ("done", "failed", "cancelled") and ended:
+            recent.append({
+                "run_id": r.get("id"), "task_id": r.get("task_id"),
+                "title": r.get("title") or "", "status": st,
+                "ended_at": ended, "duration_s": _duration_s(r),
+                "error": (r.get("error") or "")[:80],
+            })
+
+    trend, models, usage_today = [], [], {"tokens": 0, "calls": 0, "cost_usd": 0.0}
+    try:
+        s = usage.summary(days=7)
+        trend = [{"day": d.get("day"), "tokens": d.get("tokens") or 0}
+                 for d in (s.get("by_day") or [])]
+        for row in (s.get("by_model") or [])[:5]:
+            if not row.get("tokens"):
+                continue
+            models.append({"model": row.get("key") or "?",
+                           "tokens": row.get("tokens") or 0,
+                           "calls": row.get("calls") or 0})
+        for d in s.get("by_day") or []:
+            if str(d.get("day")) == today:
+                usage_today = {"tokens": d.get("tokens") or 0,
+                               "calls": d.get("calls") or 0,
+                               "cost_usd": round(float(d.get("cost_usd") or 0.0), 3)}
+                break
+    except Exception:
+        pass
+
+    return {
+        "now": time.strftime("%Y-%m-%d %H:%M:%S"),
+        "today": today,
+        "running": running,
+        "queued": queued,
+        "today_done": today_done,
+        "today_failed": today_failed,
+        "recent": recent,
+        "trend": trend,
+        "models": models,
+        "usage_today": usage_today,
+        "pool": jobs.workers_info(),
+        "health": health.snapshot().get("providers") or [],
+    }

package/app/core/chaptersafe.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*-
+"""章节安全落盘（tmp+原子改名，inkos 安全章节工作区借鉴）。
+
+写一半崩溃/磁盘满不会留下半章正文冒充成稿——断点续跑按「文件够长」
+判定，半文件会被误当合法稿复用；.tmp 写完 os.replace 原子落位，
+失败清理残渣后原样抛出。路径守卫用 pathlib resolve+parents 惯用法
+（同 _ms_io/_inside 口径）。pipeline._write_chapter 委托此函数。"""
+from __future__ import annotations
+
+from pathlib import Path
+
+
+def atomic_write_chapter(workdir, i, text):
+    """第 i 章安全落盘：tmp 写入 → 原子改名。返回最终路径。"""
+    root = Path(workdir).resolve()
+    p = (root / ("chapter-%02d.md" % int(i))).resolve()
+    # 守卫：目标必须在 workdir 之内且不得是 workdir 本身（".." 作 workdir
+    # 时 resolve 到父目录，p 仍是其中一章——但那不是调用方的工作目录，
+    # 一并拒绝：workdir 必须是已存在的目录）
+    if root not in p.parents or not root.is_dir():
+        raise ValueError("章节路径越界: chapter-%02d.md" % int(i))
+    tmp = Path(str(p) + ".tmp")
+    try:
+        tmp.write_text(str(text), encoding="utf-8", errors="replace")
+        tmp.replace(p)
+    except BaseException:
+        try:
+            tmp.unlink(missing_ok=True)
+        except OSError:
+            pass
+        raise
+    return p

package/app/core/jobs.py

@@ -949,7 +949,7 @@ def _ai_repair(run_id, entry, ev, failed_cmd, orig_log):
               .replace("__OS__", _repair_os_label())
               .replace("__ALLOW__", " / ".join(p.strip() for p in _repair_allow())))
     step, log_abs = store.add_step(run_id, "ai-repair", agent["id"], agent.get("label"),
-                                   note="自动诊断修复")
+                                   note="自动诊断修复", model=agent.get("model") or "")
     res = runner.run_agent(agent, prompt, readonly=True, timeout=300,
                            cancel_event=ev, log_path=str(log_abs))
     try:

package/app/core/pipeline.py

@@ -19,7 +19,7 @@ import re
 import threading
 import time
 
-from . import aiflavor, attachments, branching, catalog, dispatch_log, history, hooks, jobs, knowledge, manager, modelhub, mocks, paihang, planner, registry, router, runner, skills, store, task_compile, usage, volumes
+from . import aiflavor, attachments, branching, catalog, chaptersafe, dispatch_log, history, hooks, jobs, knowledge, manager, modelhub, mocks, paihang, planner, registry, router, runner, skills, store, task_compile, usage, volumes
 from . import builtin_agent
 from . import diagnostics
 from . import paths as paths_mod
@@ -331,7 +331,8 @@ def _run_step(run_id, role, agent, prompt, workdir, readonly, ev, timeout=runner
     if dead_binding:
         note = ((note + "；") if note else "") + "⚠ " + dead_msg
     step, log_abs = store.add_step(run_id, role, agent["id"],
-                                   agent.get("label", agent["id"]), note=note)
+                                   agent.get("label", agent["id"]), note=note,
+                                   model=agent.get("model") or "")
     start = time.time()
     if dead_binding:
         from .error_codes import ErrorCode
@@ -393,7 +394,8 @@ def _run_builtin_step(run_id, role, bi, prompt, workdir, ev, note="", images=Non
     followups=True 时从回答末尾解析「建议追问」块（直连对话专用协议）：
     剥离出结构化列表落步骤记录，正文保持干净。"""
     _wait_gate(run_id, ev)
-    step, log_abs = store.add_step(run_id, role, "builtin", "CodeBee", note=note)
+    step, log_abs = store.add_step(run_id, role, "builtin", "CodeBee", note=note,
+                                   model=bi.get("model") or "")
     start = time.time()
     agent_pseudo = {"id": "builtin", "label": "CodeBee", "kind": "builtin", "mode": "real",
                     "provider": {"id": bi.get("provider_id") or "",
@@ -940,6 +942,72 @@ def _record_dispatch_completed(run_id, task, result, verify_pass=None, review_pa
         pass
 
 
+def _retry_content_draft_with_cli(run_id, task, agents, impl, difficulty, mode,
+                                  stats, prompt, workdir, step_wd, ev, resume_ctx,
+                                  draft_note, draft_res):
+    """Auto content tasks may try another configured CLI after a draft failure.
+
+    Model/provider failover has already been exhausted inside run_agent. Keep
+    manual execution, user cancellation and resumed sessions pinned to the
+    user's explicit choice.
+    """
+    raw = draft_res.get("raw") or {}
+    if (mode == "manual" or impl.get("mode") != "real" or resume_ctx
+            or raw.get("cancelled") or draft_res.get("error_code") == "CANCELLED"):
+        return draft_res, impl, draft_note
+
+    tried = {impl.get("id")}
+    failures = ["%s：%s" % (impl.get("id") or "CLI",
+                            (draft_res.get("error") or "起草失败")[:180])]
+    dead_upstreams = []
+    first_upstreams = router.agent_upstreams(impl.get("id"))
+    if first_upstreams:
+        dead_upstreams.append(first_upstreams)
+    current = impl
+    last_impl = impl
+    last_result = draft_res
+    last_note = draft_note
+
+    while True:
+        _check_cancel(ev)
+        candidate, reason = router.pick_switch_candidate(
+            agents, "implement", task.get("type") or "novel", stats,
+            exclude=tried, dead_upstreams=dead_upstreams)
+        if candidate is None or candidate.get("id") in tried:
+            break
+        tried.add(candidate.get("id"))
+        if candidate.get("mode") != "real":
+            continue
+
+        why = (last_result.get("error") or "起草失败")[:180]
+        switch_note = ("起草自动换 CLI：%s → %s（%s）；前序失败：%s" % (
+            current.get("id") or "CLI", candidate.get("id") or "CLI",
+            reason or "自动路由", why))
+        attempt_note = (draft_note + "；" if draft_note else "") + switch_note
+        bound = modelhub.bind_agent(candidate, difficulty)
+        last_result = _run_step(
+            run_id, "draft", bound, prompt, step_wd, readonly=False, ev=ev,
+            note=attempt_note, images=_task_images(task, workdir))
+        last_impl = candidate
+        last_note = attempt_note
+        if last_result.get("ok"):
+            return last_result, candidate, attempt_note
+
+        failures.append("%s：%s" % (candidate.get("id") or "CLI",
+                                    (last_result.get("error") or "起草失败")[:180]))
+        if (last_result.get("raw") or {}).get("cancelled"):
+            break
+        ups = router.agent_upstreams(candidate.get("id"))
+        if ups:
+            dead_upstreams.append(ups)
+        current = candidate
+
+    if last_impl is not impl:
+        last_result = dict(last_result)
+        last_result["error"] = "CLI 自动切换均失败：%s" % "；".join(failures[-4:])
+    return last_result, last_impl, last_note
+
+
 def _run_code(run, task, agents, ev, stats, mode):
     run_id = run["id"]
     workdir = task["workdir"]
@@ -2108,8 +2176,9 @@ def _wc(text):
 
 
 def _write_chapter(workdir, i, text):
-    with _chapter_io(workdir, i, "w") as f:
-        f.write(text)
+    # 安全落盘委托（inkos 安全章节工作区借鉴）：tmp+原子改名，写一半
+    # 崩溃不留半章冒充成稿；路径守卫在 chaptersafe（resolve+parents）
+    chaptersafe.atomic_write_chapter(workdir, i, text)
 
 
 def _all_ge(scores, threshold):
@@ -3491,6 +3560,27 @@ def _run_content_review(run, task, agents, ev, stats, mode):
                                   ev=ev, note=draft_note,
                                   resume=resume_ctx["session"] if resume_ctx else None,
                                   images=_task_images(task, workdir))
+        if not draft_res["ok"]:
+            draft_res, actual_impl, fallback_note = _retry_content_draft_with_cli(
+                run_id, task, agents, impl, difficulty, mode, stats,
+                _draft_prompt_for(ms_name), workdir, step_wd, ev, resume_ctx,
+                draft_note, draft_res)
+            if actual_impl.get("id") != impl.get("id"):
+                impl = actual_impl
+                draft_note = fallback_note
+                route["author"] = fallback_note
+                if mode != "manual":
+                    critic_pool, route["critics"] = router.pick_critics(
+                        agents, task.get("type") or "novel", stats, impl=impl)
+                    critics = critic_pool[:workflow["reviewers"]]
+                plan = planner.make_novel_plan(_steered_task(run_id, task), impl, critics)
+                store.update_run(run_id, route=route, plan=plan)
+                _record_actual_route(
+                    run_id, task, agents, stats, impl, critics=critics,
+                    implement_reason=route.get("author", ""),
+                    review_reason=route.get("critics", ""))
+            if draft_res.get("raw", {}).get("cancelled"):
+                _check_cancel(ev)
         if not draft_res["ok"]:
             store.update_run(run_id, expected_status="running", status="failed",
                              error="起草失败: %s" % draft_res.get("error"),

package/app/core/runner.py

@@ -28,7 +28,8 @@ from .error_codes import ErrorCode
 # 非 Windows 必须置 0：POSIX 的 Popen 对非零 creationflags 直接抛 ValueError，
 # 置 0 则两边通用（remote.py 同款守卫）。
 CREATE_NO_WINDOW = 0x08000000 if os.name == "nt" else 0
-DEFAULT_TIMEOUT = 1200  # 单步 20 分钟
+DEFAULT_TIMEOUT = 1200  # 单步 20 分钟
+MAX_ATTEMPT_TIMEOUT_S = 60  # 单模型上游最多等 1 分钟，随后换模型/供应商
 
 _BASH_CANDIDATES = [
     r"D:\Git\usr\bin\bash.exe",
@@ -774,8 +775,8 @@ def _codex_fail_msg(stdout):
     2026-09-16 实测：配额/限流只出现在 error 与 turn.failed 事件里，旧解析器
     两者都丢——进程退出码非 0 时错误串里只剩 "Reading prompt from stdin..."，
     _quota_error/_transient_error 判不出可降级，健康后继模型从未被尝试。
-    Reconnecting... 是 CLI 内部重试噪音（可能自愈），不取；turn.failed 是
-    终态优先于裸 error（后者取最后一条兜底）。
+    Reconnecting... 是 CLI 内部重试噪音（可能自愈），不取作终态错误；重复
+    重连由进程看门狗提前中断。turn.failed 优先于裸 error（后者取最后一条兜底）。
     """
     terminal, last_err = "", ""
     for line in (stdout or "").splitlines():
@@ -917,21 +918,15 @@ def _refusal_error(err):
     return any(k in err for k in _REFUSAL)
 
 
-def _fail_sig(err):
-    """错误串的病根特征（剥掉输出尾段/数字/会话 id 等易变片段），供换将
-    循环做同因连撞止损。与 jobs._err_signature 同思路的轻量版，避免 core
-    模块环。超时错误的尾段是每次被杀时刻的输出快照，必然不同，签名只取
-    头部（；分隔符之前）。"""
-    s = str(err or "")
-    for sep in ("；stderr/stdout", "；日志错误行"):
-        i = s.find(sep)
-        if i > 0:
-            s = s[:i]
-            break
-    s = re.sub(r"[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}",
-               "<sid>", s)
-    s = re.sub(r"\d+", "N", s)
-    return re.sub(r"\s+", " ", s).strip()[:200]
+def _attempt_upstream(att):
+    """返回尝试项的上游身份；同一 host 换模型/供应商别名不重复烧超时。"""
+    provider = (att or {}).get("provider") or {}
+    base_url = str(provider.get("base_url") or "").strip()
+    match = re.match(r"^[a-zA-Z][a-zA-Z0-9+.-]*://([^/?#]+)", base_url)
+    if match:
+        return match.group(1).lower()
+    provider_id = str((att or {}).get("provider_id") or "").strip()
+    return "provider:" + provider_id if provider_id else "unknown"
 
 
 def _claude_drift_note(att_model, parsed):
@@ -984,7 +979,7 @@ def _augment_error_from_log(out, log_path, limit=300):
     out["error"] = (out["error"] + "；日志错误行: " + hits[-1][:limit])[-800:]
 
 
-def _grace_wait(cancel_event, seconds, log_path=None, why=""):
+def _grace_wait(cancel_event, seconds, log_path=None, why=""):
     """链尾限流宽限等待：小片睡眠随时响应取消。返回 False=已取消（别再重试）。"""
     if log_path:
         try:
@@ -993,11 +988,11 @@ def _grace_wait(cancel_event, seconds, log_path=None, why=""):
                          % (why or "上游限流（429）", seconds))
         except Exception:
             pass
-    end = time.time() + seconds
-    while time.time() < end:
-        if cancel_event is not None and cancel_event.is_set():
-            return False
-        time.sleep(min(3, max(0.5, end - time.time())))
+    end = time.monotonic() + seconds
+    while time.monotonic() < end:
+        if cancel_event is not None and cancel_event.is_set():
+            return False
+        time.sleep(min(3, max(0.5, end - time.monotonic())))
     return cancel_event is None or not cancel_event.is_set()
 
 
@@ -1310,14 +1305,16 @@ def run_agent(agent, prompt, workdir=None, readonly=True,
 
     模型尝试顺序来自 _resolve_attempts：跨厂商链（每条独立 env）或
     主模型 + 降级备选；瞬态/配额/超时/上游拒答换下一条，取消与解析
-    失败不降级；超时连续两次同签名即止损（同一慢上游换壳无用）。
+    失败不降级；同一上游超时两次即跳过该上游剩余模型。
 
-    5E：catalog `orch.timeout_ms`（毫秒）优先于 caller 传入的 timeout。
+    5E：catalog `orch.timeout_ms`（毫秒）优先于 caller 传入的 timeout；
+    但单个模型/上游调用硬封顶 60 秒，超时即试链上下一家。
     """
     # 5E：catalog orch.timeout_ms 优先
     orch_timeout_ms = (agent.get("orch") or {}).get("timeout_ms")
-    if orch_timeout_ms:
-        timeout = float(orch_timeout_ms) / 1000.0
+    if orch_timeout_ms:
+        timeout = float(orch_timeout_ms) / 1000.0
+    timeout = min(float(timeout), MAX_ATTEMPT_TIMEOUT_S)
     kind = agent.get("kind", "generic")
     if kind == "aider":
         repo_issue = _git_repo_issue(workdir)
@@ -1363,9 +1360,14 @@ def run_agent(agent, prompt, workdir=None, readonly=True,
     attempts = _resolve_attempts(agent)
     out = None
     grace_left = RATE_LIMIT_GRACE_N  # 链尾限流宽限预算：整链撞 429 时原地等一个窗口再试一次
-    prev_sig = ""  # 上一次尝试的失败签名：同因连撞止损用
-    for ai, att in enumerate(attempts):
-        env = dict(base_env)
+    timed_out_upstreams = {}  # 同一上游两次超时后跳过剩余模型
+    skipped_upstreams = set()
+    for ai, att in enumerate(attempts):
+        upstream = _attempt_upstream(att)
+        if upstream in skipped_upstreams:
+            continue
+        model_deadline = att.get("_deadline") or (time.monotonic() + timeout)
+        env = dict(base_env)
         env.update(att["env"])
         if kind == "codex":
             # 网关自定义模型名（如 [opencode]xxx）是合法 API 模型名不能改，但方括号
@@ -1379,25 +1381,32 @@ def run_agent(agent, prompt, workdir=None, readonly=True,
         elif att["from_chain"] and "codex_provider" in eff_agent:
             # 链内条目未注入供应商时不能沿用上一条（可能是另一家厂商）的 -c 覆盖
             del eff_agent["codex_provider"]
-        for attempt in range(2):  # claude 偶发空响应（0 token）自动重试一次
-            argv, stdin_text, prompt_eff, tmp_files = _build_call(
-                eff_agent, kind, sid, readonly,
-                att["model"], prompt,
-                images=images if kind == "codex" else None,
-                workdir=workdir)
-            try:
-                repeat_guard = (("Reconnecting... waiting for network", 5)
-                                if kind == "codex" else None)
-                res = run_process(argv=argv, stdin_text=stdin_text, cwd=workdir, env=env,
-                                  timeout=timeout, cancel_event=cancel_event, log_path=log_path,
-                                  stall_timeout=stall_t, repeat_abort=repeat_guard)
-            finally:
-                # 超长指令临时文件：CLI 进程已结束（管道已收），即刻清场不污染工作目录
-                for tf in tmp_files:
-                    try:
-                        os.remove(tf)
-                    except OSError:
-                        pass
+        for attempt in range(2):  # claude 偶发空响应（0 token）自动重试一次
+            remaining = model_deadline - time.monotonic()
+            if remaining <= 0:
+                res = {"ok": False, "exit_code": None, "stdout": "", "stderr": "",
+                       "duration": timeout, "cancelled": False, "timed_out": True,
+                       "stalled": False}
+            else:
+                argv, stdin_text, prompt_eff, tmp_files = _build_call(
+                    eff_agent, kind, sid, readonly,
+                    att["model"], prompt,
+                    images=images if kind == "codex" else None,
+                    workdir=workdir)
+                try:
+                    repeat_guard = (("Reconnecting...", 2)
+                                    if kind == "codex" else None)
+                    res = run_process(argv=argv, stdin_text=stdin_text, cwd=workdir, env=env,
+                                      timeout=min(timeout, remaining), cancel_event=cancel_event,
+                                      log_path=log_path, stall_timeout=stall_t,
+                                      repeat_abort=repeat_guard)
+                finally:
+                    # 超长指令临时文件：CLI 进程已结束（管道已收），即刻清场不污染工作目录
+                    for tf in tmp_files:
+                        try:
+                            os.remove(tf)
+                        except OSError:
+                            pass
             out = {"ok": res["ok"], "text": "", "json": None, "cost_usd": 0.0,
                    "tokens": 0, "usage": None, "error": "", "error_code": "",
                    "sid": "", "raw": res, "kind": kind, "model": att["model"],
@@ -1525,17 +1534,21 @@ def run_agent(agent, prompt, workdir=None, readonly=True,
                 if not out["text"]:
                     out["error_code"] = _classify_failure(res, kind=kind, empty_output=True)
             break
-        _report_key(att, out)
-        if out["ok"] or ai == len(attempts) - 1:
-            if (not out["ok"] and grace_left > 0 and _rate_limited(out.get("error"))
-                    and not (cancel_event is not None and cancel_event.is_set())):
-                # 链尾限流宽限：enumerate 活列表——把链尾这条 append 回去，
-                # 下一轮迭代就是「原地重试一次」；再撞限流时预算已耗尽照常判死。
-                grace_left -= 1
-                if _grace_wait(cancel_event, RATE_LIMIT_GRACE_S, log_path=log_path):
-                    attempts.append(att)
-                    continue
-            return out
+        _report_key(att, out)
+        if out["ok"] or ai == len(attempts) - 1:
+            remaining = model_deadline - time.monotonic()
+            if (not out["ok"] and grace_left > 0 and _rate_limited(out.get("error"))
+                    and remaining > 2
+                    and not (cancel_event is not None and cancel_event.is_set())):
+                # 链尾限流宽限：enumerate 活列表——把链尾这条 append 回去，
+                # 下一轮迭代就是「原地重试一次」；再撞限流时预算已耗尽照常判死。
+                grace_left -= 1
+                grace_s = min(RATE_LIMIT_GRACE_S, remaining - 1)
+                if _grace_wait(cancel_event, grace_s, log_path=log_path):
+                    retry = dict(att, _deadline=model_deadline)
+                    attempts.append(retry)
+                    continue
+            return out
         # 换将闸门：什么失败值得烧链上下一个候选。
         # · 瞬态/配额（文本特征，含 CLI 内部 api_retry 的 429/5xx 字样）照旧；
         # · 超时：显式可换（看 res 标志位）——慢上游换快候选可能救回。
@@ -1550,16 +1563,15 @@ def run_agent(agent, prompt, workdir=None, readonly=True,
                         or _refusal_error(out.get("error"))
                         or raw.get("timed_out"))):
             return out  # 取消/解析失败等真终态不降级
-        # 超时同因连撞止损：头部签名（超时/输出停滞）连续相同就收手——
-        # 链上候选绑同一上游时换将=换壳不换命（2026-09-22 429 集群教训；
-        # 2026-09-23 夜班实案同一慢上游连烧 3×20 分钟全超时零产出），最坏
-        # 情况从 N×步超时压到 2×。其余瞬态/拒答仍按链长全部尝试：各家病根
+        # 同一上游的模型连续两次超时就收手——
+        # 链上候选绑同一上游时换将=换壳不换命（2026-09-22 429 集群教训；
+        # 2026-09-23 夜班实案同一慢上游连烧 3×20 分钟全超时零产出），最多
+        # 两个模型预算后转向其他上游。其余瞬态/拒答仍按链长全部尝试：各家病根
         # 不同，每个候选都值得一次机会。
-        if raw.get("timed_out"):
-            sig = _fail_sig(out.get("error"))
-            if sig and sig == prev_sig:
-                return out
-            prev_sig = sig
+        if raw.get("timed_out"):
+            timed_out_upstreams[upstream] = timed_out_upstreams.get(upstream, 0) + 1
+            if timed_out_upstreams[upstream] >= 2:
+                skipped_upstreams.add(upstream)
     return out