codebee 0.1.53 → 0.1.55

package/app/core/modelhub.py

@@ -2156,11 +2156,14 @@ def _entry_endpoint(prov, allowed):
     """
     proto = prov.get("protocol")
     if proto in allowed:
-        return proto, prov.get("base_url"), prov.get("wire_api", "responses")
+        base = prov.get("base_url")
+        if not _wire_endpoint_compatible(proto, base):
+            return None
+        return proto, base, prov.get("wire_api", "responses")
     caps = prov.get("wire_caps") or {}
     for p in allowed:
         cap = caps.get(p) or {}
-        if cap.get("base"):
+        if cap.get("base") and _wire_endpoint_compatible(p, cap["base"]):
             return p, cap["base"], cap.get("wire_api") or "responses"
     return None
 
@@ -2172,10 +2175,12 @@ def _protocol_candidates(prov):
     调用方逐个试、全失败才报错——不猜一条去发请求。"""
     proto = (prov or {}).get("protocol")
     if proto in _PROTOCOLS:
-        return [(proto, (prov or {}).get("base_url") or "")]
+        base = (prov or {}).get("base_url") or ""
+        return ([(proto, base)] if _wire_endpoint_compatible(proto, base) else [])
     caps = (prov or {}).get("wire_caps") or {}
     return [(p, caps[p]["base"]) for p in _WIRE_PREFERENCE
-            if (caps.get(p) or {}).get("base")]
+            if (caps.get(p) or {}).get("base")
+            and _wire_endpoint_compatible(p, (caps.get(p) or {}).get("base"))]
 
 
 def _ensure_wire_candidates(provider_id, prov, model_name=""):
@@ -2195,6 +2200,26 @@ def _ensure_wire_candidates(provider_id, prov, model_name=""):
     return (_protocol_candidates(prov2) if prov2 else []), (note or "")
 
 
+def _wire_endpoint_compatible(proto, base_url):
+    """Reject an endpoint whose URL path contradicts the selected wire.
+
+    Some providers expose an Anthropic API under a path containing ``anthropic``
+    and may have stale ``wire_caps`` from an earlier probe that recorded that
+    same URL as OpenAI/Responses.  Codex then retries forever because it sends
+    Responses events to the Anthropic route.  A path marker is a conservative
+    local guard; normal shared roots such as ``https://host/v1`` remain valid
+    for both protocols.
+    """
+    if proto != "openai" or not base_url:
+        return True
+    try:
+        import urllib.parse
+        path = (urllib.parse.urlsplit(str(base_url)).path or "").lower()
+    except Exception:
+        return True
+    return re.search(r"(?:^|/)anthropic(?:/|$)", path) is None
+
+
 def bindable_protocols(agent_kind_or_id):
     """该 CLI 可绑定的 wire 协议（与 resolve_binding 的 allowed 一致）。
     供死链告警/失败文案解释「为什么绑不上」：claude 只认 anthropic，
@@ -2851,6 +2876,10 @@ def _wire_base_candidates(base_url, target_proto):
         cands = [base if base.endswith("/v1") else base + "/v1"]
         if not base.endswith("/v1"):
             cands.append(base)
+        # `/api/anthropic` 是 Anthropic 专用入口，不要把它拼成
+        # `/api/anthropic[/v1]/responses` 再误记为 Codex 能力。
+        if not _wire_endpoint_compatible(target_proto, base):
+            cands = []
     else:
         # anthropic 习惯：CLI 在 base 后拼 /v1/messages，base 本身不含 /v1
         cands = [base[:-3] if base.endswith("/v1") else base]

package/app/core/pipeline.py

@@ -19,7 +19,7 @@ import re
 import threading
 import time
 
-from . import aiflavor, attachments, branching, catalog, dispatch_log, history, hooks, jobs, knowledge, manager, modelhub, mocks, paihang, planner, registry, router, runner, skills, store, task_compile, usage, volumes
+from . import aiflavor, attachments, branching, catalog, chaptersafe, dispatch_log, history, hooks, jobs, knowledge, manager, modelhub, mocks, paihang, planner, registry, router, runner, skills, store, task_compile, usage, volumes
 from . import builtin_agent
 from . import diagnostics
 from . import paths as paths_mod
@@ -30,17 +30,60 @@ from .repeat_guard import guard as repeat_guard
 DEFAULT_RUBRIC = ["情节", "人物", "文笔", "节奏", "吸引力"]
 
 
-class Cancelled(Exception):
-    pass
+class Cancelled(Exception):
+    pass
+
+
+class TaskTimeout(Exception):
+    pass
 
 
 def _now():
     return time.strftime("%Y-%m-%d %H:%M:%S")
 
 
-def _check_cancel(ev):
-    if ev is not None and ev.is_set():
-        raise Cancelled()
+def _check_cancel(ev):
+    if ev is not None and ev.is_set():
+        raise Cancelled()
+
+
+def _run_deadline(run_id):
+    """Convert the persisted wall-clock cutoff into a monotonic deadline."""
+    run = store.get_run(run_id) or {}
+    try:
+        deadline_at = float(run.get("deadline_at"))
+    except (TypeError, ValueError):
+        return None
+    return time.monotonic() + (deadline_at - time.time())
+
+
+def _ensure_budget(run_id):
+    deadline = _run_deadline(run_id)
+    if deadline is not None and time.monotonic() >= deadline:
+        store.update_run(run_id, expected_status="running", status="timeout",
+                         ended_at=_now(), error="任务总时限已到")
+        raise TaskTimeout()
+    return deadline
+
+
+def _step_timeout(run_id, requested, deadline=None):
+    value = max(0.0, float(requested or runner.DEFAULT_TIMEOUT))
+    deadline = deadline if deadline is not None else _run_deadline(run_id)
+    if deadline is not None:
+        value = min(value, max(0.0, deadline - time.monotonic()))
+    return value, deadline
+
+
+def _planner_call(fn, *args, deadline=None, **kwargs):
+    """Allow older injected planner doubles to omit the new deadline kwarg."""
+    if deadline is None:
+        return fn(*args, **kwargs)
+    try:
+        return fn(*args, deadline=deadline, **kwargs)
+    except TypeError as exc:
+        if "unexpected keyword argument 'deadline'" not in str(exc):
+            raise
+        return fn(*args, **kwargs)
 
 
 def _inside(dirpath, target):
@@ -195,12 +238,12 @@ def _get_session(run_id):
         return s
 
 
-def _make_llm_caller(agent, workdir):
+def _make_llm_caller(agent, workdir, deadline=None):
     """压缩摘要用 LLM：直接复用当前 step 的 agent（同 CLI 同模型）。"""
     def caller(messages):
         prompt = "\n\n".join(m.get("content", "") for m in messages)
-        res = runner.run_agent(agent, prompt, workdir=workdir, readonly=True,
-                               timeout=300)
+        res = runner.run_agent(agent, prompt, workdir=workdir, readonly=True,
+                               timeout=300, deadline=deadline)
         return res.get("text") or ""
     return caller
 
@@ -303,9 +346,11 @@ def _binding_dead_msg(agent):
                 "请在「模型调度（可选）」页为该 CLI 指定已启用的供应商")
 
 
-def _run_step(run_id, role, agent, prompt, workdir, readonly, ev, timeout=runner.DEFAULT_TIMEOUT, note="", resume=None, images=None, require_tools=False):
-    """执行一个智能体步骤并记录。返回 runner 统一结果。"""
-    _wait_gate(run_id, ev)
+def _run_step(run_id, role, agent, prompt, workdir, readonly, ev, timeout=runner.DEFAULT_TIMEOUT, note="", resume=None, images=None, require_tools=False):
+    """执行一个智能体步骤并记录。返回 runner 统一结果。"""
+    _wait_gate(run_id, ev)
+    deadline = _ensure_budget(run_id)
+    timeout, deadline = _step_timeout(run_id, timeout, deadline)
     # 绑定解析为空分两种（2026-09-18 起 区分对待）：
     # · 从没配过链（binding_configured=False）：回落 CLI 本机默认照跑——
     #   用户根本没在 CodeBee 里配供应商，谈不到「烧自己配的配额」；判失败
@@ -331,7 +376,8 @@ def _run_step(run_id, role, agent, prompt, workdir, readonly, ev, timeout=runner
     if dead_binding:
         note = ((note + "；") if note else "") + "⚠ " + dead_msg
     step, log_abs = store.add_step(run_id, role, agent["id"],
-                                   agent.get("label", agent["id"]), note=note)
+                                   agent.get("label", agent["id"]), note=note,
+                                   model=agent.get("model") or "")
     start = time.time()
     if dead_binding:
         from .error_codes import ErrorCode
@@ -372,19 +418,24 @@ def _run_step(run_id, role, agent, prompt, workdir, readonly, ev, timeout=runner
         if directive_block:
             prompt = directive_block + "\n\n---\n\n" + prompt
         effective_prompt = (guard["reminder"] + "\n\n---\n\n" + prompt) if guard["reminder"] else prompt
-        res = _spawn_step(session_run_id=run_id, role=role, agent=agent,
-                          prompt=effective_prompt, workdir=workdir, readonly=readonly,
-                          ev=ev, timeout=timeout, resume=resume, step=step,
-                          log_abs=log_abs, images=images, require_tools=require_tools)
+        res = _spawn_step(session_run_id=run_id, role=role, agent=agent,
+                          prompt=effective_prompt, workdir=workdir, readonly=readonly,
+                          ev=ev, timeout=timeout, resume=resume, step=step,
+                          log_abs=log_abs, images=images, require_tools=require_tools,
+                          deadline=deadline)
     # 先收尾再查取消：取消时进程已被 run_process 杀停，若先抛 Cancelled，
-    # 步骤记录会永远停在「运行中」变僵尸（与 _run_verify 的顺序对齐）
-    _finish_step_result(run_id, step, res, role, agent, start)
-    _check_cancel(ev)
+    # 步骤记录会永远停在「运行中」变僵尸（与 _run_verify 的顺序对齐）
+    _finish_step_result(run_id, step, res, role, agent, start)
+    if (res.get("raw") or {}).get("deadline_exceeded"):
+        store.update_run(run_id, expected_status="running", status="timeout",
+                         ended_at=_now(), error="任务总时限已到")
+        raise TaskTimeout()
+    _check_cancel(ev)
     return res
 
 
-def _run_builtin_step(run_id, role, bi, prompt, workdir, ev, note="", images=None,
-                      followups=False):
+def _run_builtin_step(run_id, role, bi, prompt, workdir, ev, note="", images=None,
+                      followups=False):
     """内置智能体步骤：直连模型 API + 工具循环（builtin_agent），不经 CLI 进程。
 
     与 _run_step 对齐的三件事：暂停/取消闸门、运行中指令 drain 注入、重复调用
@@ -392,8 +443,10 @@ def _run_builtin_step(run_id, role, bi, prompt, workdir, ev, note="", images=Non
     日志只有「迭代/工具」摘要行——对话视图吃 output，日志抽屉看工具轨迹。
     followups=True 时从回答末尾解析「建议追问」块（直连对话专用协议）：
     剥离出结构化列表落步骤记录，正文保持干净。"""
-    _wait_gate(run_id, ev)
-    step, log_abs = store.add_step(run_id, role, "builtin", "CodeBee", note=note)
+    _wait_gate(run_id, ev)
+    deadline = _ensure_budget(run_id)
+    step, log_abs = store.add_step(run_id, role, "builtin", "CodeBee", note=note,
+                                   model=bi.get("model") or "")
     start = time.time()
     agent_pseudo = {"id": "builtin", "label": "CodeBee", "kind": "builtin", "mode": "real",
                     "provider": {"id": bi.get("provider_id") or "",
@@ -435,9 +488,11 @@ def _run_builtin_step(run_id, role, bi, prompt, workdir, ev, note="", images=Non
     def _on_activity(line):
         store.stream_step(run_id, step["n"], activity=str(line or "")[:200])
 
-    res = builtin_agent.run(bi, prompt, workdir, cancel_event=ev, log=_log, images=images,
-                            on_reason=_on_reason, on_stream=_on_stream,
-                            on_activity=_on_activity)
+    remaining = None if deadline is None else max(0.0, deadline - time.monotonic())
+    res = builtin_agent.run(bi, prompt, workdir, timeout=remaining or 180,
+                            deadline=deadline, cancel_event=ev, log=_log, images=images,
+                            on_reason=_on_reason, on_stream=_on_stream,
+                            on_activity=_on_activity)
     if followups and res.get("ok"):
         clean, fups = _parse_followups(res.get("text") or "")
         if fups:
@@ -458,9 +513,13 @@ def _run_builtin_step(run_id, role, bi, prompt, workdir, ev, note="", images=Non
     res["raw"]["duration"] = time.time() - start
     res["tokens"] = int(usage.get("total") or 0)
     res.setdefault("cost_usd", 0.0)
-    # 先收尾再查取消：与 _run_step 同序，防步骤记录停在「运行中」变僵尸
-    _finish_step_result(run_id, step, res, role, agent_pseudo, start)
-    _check_cancel(ev)
+    # 先收尾再查取消：与 _run_step 同序，防步骤记录停在「运行中」变僵尸
+    _finish_step_result(run_id, step, res, role, agent_pseudo, start)
+    if (res.get("raw") or {}).get("deadline_exceeded"):
+        store.update_run(run_id, expected_status="running", status="timeout",
+                         ended_at=_now(), error="任务总时限已到")
+        raise TaskTimeout()
+    _check_cancel(ev)
     return res
 
 
@@ -483,8 +542,9 @@ def _budget_max_tokens():
         return 0
 
 
-def _spawn_step(session_run_id, role, agent, prompt, workdir, readonly, ev,
-                timeout, resume, step, log_abs, images=None, require_tools=False):
+def _spawn_step(session_run_id, role, agent, prompt, workdir, readonly, ev,
+                timeout, resume, step, log_abs, images=None, require_tools=False,
+                deadline=None):
     """真实 CLI 调用：压缩灰度路径或原路径。"""
     # T2.1 预算闸：已用 token 达到单次 run 上限 → 阻断后续真实调用（ENV_BLOCK）。
     # 只拦「下一步」，允许越过线的当前步完成；auto 续跑可在用户调高预算后接手。
@@ -507,10 +567,10 @@ def _spawn_step(session_run_id, role, agent, prompt, workdir, readonly, ev,
     if _compaction_enabled() and not resume:
         # Phase 2（1D）：撑爆 → 压缩 → 守门重试；同时把 usage 累进 token_meter（1C）
         session = _get_session(session_run_id)
-        llm_caller = _make_llm_caller(agent, workdir)
-        call_kwargs = dict(workdir=workdir, readonly=readonly,
-                           timeout=timeout, cancel_event=ev, log_path=str(log_abs),
-                           images=images, require_tools=require_tools)
+        llm_caller = _make_llm_caller(agent, workdir, deadline=deadline)
+        call_kwargs = dict(workdir=workdir, readonly=readonly,
+                           timeout=timeout, cancel_event=ev, log_path=str(log_abs),
+                           images=images, require_tools=require_tools, deadline=deadline)
 
         def _call(p, **kw):
             nonlocal usage_recorded
@@ -535,9 +595,10 @@ def _spawn_step(session_run_id, role, agent, prompt, workdir, readonly, ev,
             session, _call, prompt, model=agent.get("model") or "",
             llm_caller=llm_caller)
     else:
-        res = runner.run_agent(agent, prompt, workdir=workdir, readonly=readonly,
-                               timeout=timeout, cancel_event=ev, log_path=str(log_abs),
-                               resume=resume, images=images, require_tools=require_tools)
+        res = runner.run_agent(agent, prompt, workdir=workdir, readonly=readonly,
+                               timeout=timeout, cancel_event=ev, log_path=str(log_abs),
+                               resume=resume, images=images, require_tools=require_tools,
+                               deadline=deadline)
     # 默认关闭压缩和 resume 都走直通分支，也必须把真实 usage 送进预算表；否则
     # 下一步永远看到 used=0，max_tokens_per_run 只是一个无效设置。
     if not usage_recorded:
@@ -724,14 +785,17 @@ def _files_hint(sub):
         "`%s`" % str(f) for f in files[:10])
 
 
-def _run_verify(run_id, task, workdir, ev):
-    """确定性验证。返回 (verify_pass, ran)。"""
-    if not task.get("verify_command"):
-        return True, False
+def _run_verify(run_id, task, workdir, ev):
+    """确定性验证。返回 (verify_pass, ran)。"""
+    deadline = _ensure_budget(run_id)
+    if not task.get("verify_command"):
+        return True, False
     step, log_abs = store.add_step(run_id, "verify", "builtin", "内置验证器")
     start = time.time()
-    r = runner.run_process(shell_cmd=task["verify_command"], cwd=workdir,
-                           timeout=600, cancel_event=ev, log_path=str(log_abs))
+    timeout, deadline = _step_timeout(run_id, 600, deadline)
+    r = runner.run_process(shell_cmd=task["verify_command"], cwd=workdir,
+                           timeout=timeout, deadline=deadline, cancel_event=ev,
+                           log_path=str(log_abs))
     ok = r["ok"]
     # 与 _finish_step_result 同一套显示层细分：超时/取消杀停不再冒充「失败」
     if r.get("cancelled"):
@@ -741,9 +805,13 @@ def _run_verify(run_id, task, workdir, ev):
     else:
         v_status = "done" if ok else "failed"
         v_sum = "验证通过" if ok else "验证失败（exit %s）" % r["exit_code"]
-    store.finish_step(run_id, step["n"], v_status,
-                      summary=v_sum,
-                      exit_code=r["exit_code"], duration_s=time.time() - start)
+    store.finish_step(run_id, step["n"], v_status,
+                      summary=v_sum,
+                      exit_code=r["exit_code"], duration_s=time.time() - start)
+    if r.get("deadline_exceeded"):
+        store.update_run(run_id, expected_status="running", status="timeout",
+                         ended_at=_now(), error="任务总时限已到")
+        raise TaskTimeout()
     _check_cancel(ev)
     return ok, True
 
@@ -940,6 +1008,72 @@ def _record_dispatch_completed(run_id, task, result, verify_pass=None, review_pa
         pass
 
 
+def _retry_content_draft_with_cli(run_id, task, agents, impl, difficulty, mode,
+                                  stats, prompt, workdir, step_wd, ev, resume_ctx,
+                                  draft_note, draft_res):
+    """Auto content tasks may try another configured CLI after a draft failure.
+
+    Model/provider failover has already been exhausted inside run_agent. Keep
+    manual execution, user cancellation and resumed sessions pinned to the
+    user's explicit choice.
+    """
+    raw = draft_res.get("raw") or {}
+    if (mode == "manual" or impl.get("mode") != "real" or resume_ctx
+            or raw.get("cancelled") or draft_res.get("error_code") == "CANCELLED"):
+        return draft_res, impl, draft_note
+
+    tried = {impl.get("id")}
+    failures = ["%s：%s" % (impl.get("id") or "CLI",
+                            (draft_res.get("error") or "起草失败")[:180])]
+    dead_upstreams = []
+    first_upstreams = router.agent_upstreams(impl.get("id"))
+    if first_upstreams:
+        dead_upstreams.append(first_upstreams)
+    current = impl
+    last_impl = impl
+    last_result = draft_res
+    last_note = draft_note
+
+    while True:
+        _check_cancel(ev)
+        candidate, reason = router.pick_switch_candidate(
+            agents, "implement", task.get("type") or "novel", stats,
+            exclude=tried, dead_upstreams=dead_upstreams)
+        if candidate is None or candidate.get("id") in tried:
+            break
+        tried.add(candidate.get("id"))
+        if candidate.get("mode") != "real":
+            continue
+
+        why = (last_result.get("error") or "起草失败")[:180]
+        switch_note = ("起草自动换 CLI：%s → %s（%s）；前序失败：%s" % (
+            current.get("id") or "CLI", candidate.get("id") or "CLI",
+            reason or "自动路由", why))
+        attempt_note = (draft_note + "；" if draft_note else "") + switch_note
+        bound = modelhub.bind_agent(candidate, difficulty)
+        last_result = _run_step(
+            run_id, "draft", bound, prompt, step_wd, readonly=False, ev=ev,
+            note=attempt_note, images=_task_images(task, workdir))
+        last_impl = candidate
+        last_note = attempt_note
+        if last_result.get("ok"):
+            return last_result, candidate, attempt_note
+
+        failures.append("%s：%s" % (candidate.get("id") or "CLI",
+                                    (last_result.get("error") or "起草失败")[:180]))
+        if (last_result.get("raw") or {}).get("cancelled"):
+            break
+        ups = router.agent_upstreams(candidate.get("id"))
+        if ups:
+            dead_upstreams.append(ups)
+        current = candidate
+
+    if last_impl is not impl:
+        last_result = dict(last_result)
+        last_result["error"] = "CLI 自动切换均失败：%s" % "；".join(failures[-4:])
+    return last_result, last_impl, last_note
+
+
 def _run_code(run, task, agents, ev, stats, mode):
     run_id = run["id"]
     workdir = task["workdir"]
@@ -989,11 +1123,14 @@ def _run_code(run, task, agents, ev, stats, mode):
         _wait_gate(run_id, ev)
         plan_step, plan_log = store.add_step(run_id, "plan", impl["id"], impl.get("label"),
                                              note=route.get("implementer", ""))
-        plan = planner.make_code_plan(_steered_task(run_id, task),
-                                      modelhub.bind_agent(impl, difficulty),
-                                      _resume_workdir(resume_ctx, workdir), ev,
-                                      resume=resume_ctx["session"] if resume_ctx else None,
-                                      log_path=str(plan_log) if plan_log else None)
+        plan = _planner_call(
+            planner.make_code_plan, _steered_task(run_id, task),
+            modelhub.bind_agent(impl, difficulty),
+            _resume_workdir(resume_ctx, workdir), ev,
+            resume=resume_ctx["session"] if resume_ctx else None,
+            log_path=str(plan_log) if plan_log else None,
+            deadline=_run_deadline(run_id))
+        _ensure_budget(run_id)
         # 规划器判定优先于启发式（仅当用户未显式指定难度）
         if not explicit and plan.get("difficulty") in ("easy", "hard"):
             difficulty = plan["difficulty"]
@@ -2108,8 +2245,9 @@ def _wc(text):
 
 
 def _write_chapter(workdir, i, text):
-    with _chapter_io(workdir, i, "w") as f:
-        f.write(text)
+    # 安全落盘委托（inkos 安全章节工作区借鉴）：tmp+原子改名，写一半
+    # 崩溃不留半章冒充成稿；路径守卫在 chaptersafe（resolve+parents）
+    chaptersafe.atomic_write_chapter(workdir, i, text)
 
 
 def _all_ge(scores, threshold):
@@ -2260,8 +2398,11 @@ def _run_serial_review(run, task, agents, ev, stats, mode, critics, impl, route,
         _wait_gate(run_id, ev)
         outline_step, outline_log = store.add_step(run_id, "outline", impl["id"], impl.get("label"),
                                                    note=route.get("author", ""))
-        outline = planner.make_serial_outline(_steered_task(run_id, task), impl, workdir, ev,
-                                              log_path=str(outline_log) if outline_log else None)
+        outline = _planner_call(
+            planner.make_serial_outline, _steered_task(run_id, task), impl, workdir, ev,
+            log_path=str(outline_log) if outline_log else None,
+            deadline=_run_deadline(run_id))
+        _ensure_budget(run_id)
         if outline.get("degraded") and impl.get("mode") != "mock":
             # 兜底模板只有章号没有情节，据此写出的两万字等于废稿——
             # 中止并交给自动续跑等编排者恢复后重试，而不是空转烧配额。
@@ -3431,8 +3572,11 @@ def _run_content_review(run, task, agents, ev, stats, mode):
     draft_note = route.get("author", "") if mode != "manual" else ""
 
     # 编排者大纲：只对真实执行有意义；失败静默退回无大纲（喂入带指令的任务副本）
-    outline = (planner.make_review_outline(_steered_task(run_id, task))
-               if workflow["outline"] and impl.get("mode") != "mock" else None)
+    outline = (_planner_call(planner.make_review_outline,
+                             _steered_task(run_id, task),
+                             deadline=_run_deadline(run_id))
+               if workflow["outline"] and impl.get("mode") != "mock" else None)
+    _ensure_budget(run_id)
     if outline:
         workflow = task_compile.content_workflow(
             task, difficulty, plan=outline, mode=mode)
@@ -3491,6 +3635,27 @@ def _run_content_review(run, task, agents, ev, stats, mode):
                                   ev=ev, note=draft_note,
                                   resume=resume_ctx["session"] if resume_ctx else None,
                                   images=_task_images(task, workdir))
+        if not draft_res["ok"]:
+            draft_res, actual_impl, fallback_note = _retry_content_draft_with_cli(
+                run_id, task, agents, impl, difficulty, mode, stats,
+                _draft_prompt_for(ms_name), workdir, step_wd, ev, resume_ctx,
+                draft_note, draft_res)
+            if actual_impl.get("id") != impl.get("id"):
+                impl = actual_impl
+                draft_note = fallback_note
+                route["author"] = fallback_note
+                if mode != "manual":
+                    critic_pool, route["critics"] = router.pick_critics(
+                        agents, task.get("type") or "novel", stats, impl=impl)
+                    critics = critic_pool[:workflow["reviewers"]]
+                plan = planner.make_novel_plan(_steered_task(run_id, task), impl, critics)
+                store.update_run(run_id, route=route, plan=plan)
+                _record_actual_route(
+                    run_id, task, agents, stats, impl, critics=critics,
+                    implement_reason=route.get("author", ""),
+                    review_reason=route.get("critics", ""))
+            if draft_res.get("raw", {}).get("cancelled"):
+                _check_cancel(ev)
         if not draft_res["ok"]:
             store.update_run(run_id, expected_status="running", status="failed",
                              error="起草失败: %s" % draft_res.get("error"),
@@ -3899,10 +4064,14 @@ def execute_run(run_id):
     if store.update_run(run_id, expected_status=initial_status, status="running",
                         started_at=_now()) is None:
         return
-    if task is None:
-        store.update_run(run_id, expected_status="running", status="failed",
-                         error="找不到任务 %s" % run.get("task_id"), ended_at=_now())
-        return
+    if task is None:
+        store.update_run(run_id, expected_status="running", status="failed",
+                         error="找不到任务 %s" % run.get("task_id"), ended_at=_now())
+        return
+    try:
+        _ensure_budget(run_id)
+    except TaskTimeout:
+        return
     # 统一任务编译：旧字段继续供各引擎读取，规格作为运行级诊断与调度输入落盘。
     task_spec = task_compile.compile_task(task)
     store.update_run(run_id, task_spec=task_spec,
@@ -4021,9 +4190,12 @@ def execute_run(run_id):
                                    critics, impl, route, resume_ctx, difficulty)
             else:
                 _run_content_review(run, task, agents, ev, stats, mode)
-    except Cancelled:
-        store.update_run(run_id, expected_status="running",
-                         status="cancelled", ended_at=_now())
+    except TaskTimeout:
+        store.update_run(run_id, expected_status="running",
+                         status="timeout", ended_at=_now(), error="任务总时限已到")
+    except Cancelled:
+        store.update_run(run_id, expected_status="running",
+                         status="cancelled", ended_at=_now())
     except Exception as e:
         import traceback
         store.update_run(run_id, expected_status="running", status="failed",

package/app/core/planner.py

@@ -69,7 +69,7 @@ def _log_streamer(log_path, min_chars=400, min_secs=0.8):
     return cb
 
 
-def _outline_timeout():
+def _outline_timeout():
     """大纲/规划的 CLI 兜底超时（秒）：env TUTTI_OUTLINE_TIMEOUT（秒）优先，
     其次设置 orchestrator.outline_timeout_s，缺省 900。"""
     try:
@@ -86,7 +86,16 @@ def _outline_timeout():
             return v
     except Exception:
         pass
-    return DEFAULT_OUTLINE_TIMEOUT
+    return DEFAULT_OUTLINE_TIMEOUT
+
+
+def _deadline_timeout(deadline, requested):
+    if deadline is None:
+        return requested
+    try:
+        return max(1, min(float(requested), deadline - time.monotonic()))
+    except (TypeError, ValueError):
+        return requested
 
 
 def _log_usage(source, role, task, res, agent=None, tool="", model="", provider="",
@@ -346,7 +355,8 @@ def book_volume_plan(task, outline, upto):
     return volumes.merge_titles(plan, named)
 
 
-def make_serial_outline(task, author_agent=None, workdir=None, ev=None, log_path=None):
+def make_serial_outline(task, author_agent=None, workdir=None, ev=None, log_path=None,
+                        deadline=None):
     """连载大纲：编排者 API 优先 → 作者 CLI → 模板。返回 {book_title, chapters:[{title,beats,hook}]}。
 
     续写批次（serial.start_chapter > 1）：改用续写大纲提示词，注入前情大纲与
@@ -443,8 +453,8 @@ def make_serial_outline(task, author_agent=None, workdir=None, ev=None, log_path
             # prompt 逐字节相同，命中省一次全量规划调用。第 2 次尝试故意
             # 旁路缓存——首试 ok 但 JSON 不合法时，重试要的是「再抽一次样
             # 本」而不是同一份坏文本。
-            res = modelhub.chat(prov["id"], model, prompt,
-                                max_tokens=16000, timeout=300, on_delta=cb,
+            res = modelhub.chat(prov["id"], model, prompt,
+                                max_tokens=16000, timeout=_deadline_timeout(deadline, 300), on_delta=cb,
                                 reasoning_effort=_reasoning_effort(task),
                                 cache_ttl=3600 if _attempt == 1 else 0)
             cb.flush()
@@ -473,7 +483,8 @@ def make_serial_outline(task, author_agent=None, workdir=None, ev=None, log_path
         _append_log(log_path, "===== 作者 CLI（%s）=====" % author_agent.get("id", "?"))
         res = runner.run_agent(modelhub.bind_agent(author_agent), prompt,
                                workdir=workdir or task.get("workdir"), readonly=True,
-                               timeout=_outline_timeout(), cancel_event=ev,
+                               timeout=_deadline_timeout(deadline, _outline_timeout()),
+                               deadline=deadline, cancel_event=ev,
                                log_path=log_path)
         _log_usage("outline", "outline", task, res, agent=author_agent)
         if not res["ok"]:
@@ -591,11 +602,13 @@ def _reasoning_effort(task):
     return "medium"
 
 
-def make_code_plan(task, planner_agent, workdir, ev=None, resume=None, log_path=None):
+def make_code_plan(task, planner_agent, workdir, ev=None, resume=None, log_path=None,
+                   deadline=None):
     """代码任务计划：编排者 API 优先 → CLI 智能体 → 单步模板。"""
     orch = _orchestrator()
     if orch:
-        plan = _orch_code_plan(task, orch[0], orch[1], log_path=log_path)
+        plan = _orch_code_plan(task, orch[0], orch[1], log_path=log_path,
+                               deadline=deadline)
         if plan:
             return plan
     if planner_agent is None:
@@ -607,7 +620,8 @@ def make_code_plan(task, planner_agent, workdir, ev=None, resume=None, log_path=
               .replace("__CONTEXT__", task.get("context") or "（无）")
               .replace("__VERIFY__", task.get("verify_command") or "（未配置）"))
     res = runner.run_agent(planner_agent, prompt, workdir=workdir, readonly=True,
-                           timeout=300, cancel_event=ev, resume=resume,
+                           timeout=_deadline_timeout(deadline, 300), deadline=deadline,
+                           cancel_event=ev, resume=resume,
                            log_path=log_path)
     _log_usage("plan", "plan", task, res, agent=planner_agent)
     data = runner.extract_json(res.get("text") or "")
@@ -624,7 +638,7 @@ def _fallback_code_plan(task, note):
             "steps": [{"title": "实现任务", "detail": task["goal"]}]}
 
 
-def _orch_code_plan(task, prov, model, log_path=None):
+def _orch_code_plan(task, prov, model, log_path=None, deadline=None):
     cb = _log_streamer(log_path)
     # §07 T2.2：代码计划同任务同 prompt（断点续跑/重试），TTL 1h 精确缓存
     res = modelhub.chat(prov["id"], model,
@@ -632,7 +646,7 @@ def _orch_code_plan(task, prov, model, log_path=None):
                          .replace("__GOAL__", task["goal"])
                          .replace("__CONTEXT__", task.get("context") or "（无）")
                          .replace("__VERIFY__", task.get("verify_command") or "（未配置）")),
-                        max_tokens=8000, timeout=300, on_delta=cb,
+                        max_tokens=8000, timeout=_deadline_timeout(deadline, 300), on_delta=cb,
                         reasoning_effort=_reasoning_effort(task),
                         cache_ttl=3600)
     cb.flush()
@@ -652,7 +666,7 @@ def _orch_code_plan(task, prov, model, log_path=None):
             "workflow": _plan_workflow(data)}
 
 
-def make_review_outline(task):
+def make_review_outline(task, deadline=None):
     """review 类任务：编排者产出写作大纲（失败返回 None，起草退回无大纲）。"""
     orch = _orchestrator()
     if not orch:
@@ -662,7 +676,7 @@ def make_review_outline(task):
                         (REVIEW_OUTLINE_PROMPT
                          .replace("__GOAL__", task["goal"])
                          .replace("__CONTEXT__", task.get("context") or "（无）")),
-                        max_tokens=8000, timeout=300,
+                        max_tokens=8000, timeout=_deadline_timeout(deadline, 300),
                         reasoning_effort=_reasoning_effort(task),
                         cache_ttl=3600)   # §07 T2.2：同任务重试幂等，TTL 1h
     _log_usage("outline", "outline", task, res, model=model,