codebee 0.1.55 → 0.1.56

package/CHANGELOG.md

@@ -23,6 +23,12 @@ README 元数据带回，供老版本在「发现新版本」时展示新版更
 
 - **首选 KEY 超限自动切备用了**：同厂商多密钥此前只认欠费类文案——首选 KEY 撞上 429 限流（智谱「并发数超过限制」「每分钟Token数已超过上限」、claude 的 rate_limit_error、codex 的 "429 Too Many Requests" 等）只记一笔错误、不进冷却，每个新步骤仍从超限的首选 KEY 重新烧起。现在限流文案与欠费同口径：进冷却 30 分钟、密钥镜像自动切下一把、链展开跳过冷却中的 KEY（到期或「恢复」按钮一键回首选）。顺带补一处漏账：无显式链时「换模型回退」的链条目不带 KEY 标记，这类重试失败此前完全不记 KEY 账。
 
+## v0.1.56（2026-09-23）
+
+- 鉴权错误不再触发换将：密钥失效类错误换哪个 CLI 都一样，直接报错省时间
+- 超时任务提供「恢复」入口；排队任务状态文案更明确
+- 驾驶舱轮询载荷瘦身（大屏常开不再吃带宽）；移动端任务详情操作按钮对齐
+
 ## v0.1.55（2026-09-23）
 
 - 知识库可信度分级：引用核验借鉴——知识条目带 confidence 分级，low 直接丢弃，中高按置信度加权注入

package/README.md

@@ -21,10 +21,10 @@ Kimi Code、MiMo Code、Grok Build、Pi、DeepSeek Harness……），提供
 不会把你的任务内容交给任何第三方。
 
 <!-- relnotes:start -->
-### 最新版更新内容（v0.1.55）
+### 最新版更新内容（v0.1.56）
 
-- 知识库可信度分级：low 直接丢弃，注入按置信度加权
-- 编排执行稳定化 + 模型回退修复；定时任务终态徽章补全
+- 鉴权类错误不再无谓换将；超时任务新增「恢复」入口
+- 驾驶舱轮询载荷瘦身；移动端详情操作对齐；排队状态文案更明确
 <!-- relnotes:end -->
 
 ---

package/app/core/jobs.py

@@ -344,12 +344,12 @@ def _requeue_await_slot(job, waits_left=None):
             return
         if _restart_drain:
             _close_unstarted(job, "服务正在完成升级重启；本次未排队，请稍后重试",
-                             statuses=("running",))
+                             statuses=("queued", "running"))
         elif waits_left > 0:
             _requeue_await_slot(job, waits_left - 1)
         else:
             _close_unstarted(job, "并发位已满，排队等待超时仍未起跑，请稍后重试",
-                             statuses=("running",))
+                             statuses=("queued", "running"))
 
     with _timer_lock:
         if run_id in _deferred_timers:

package/app/core/knowledge.py

@@ -251,6 +251,11 @@ def block_for(task):
         stale = _is_stale(x.get("as_of"))
         mark = ("（事实截至 %s，可能过期，请自行核实时效）" % x.get("as_of") if stale
                 else ("（事实截至 %s）" % x.get("as_of") if x.get("as_of") else ""))
+        # 置信标注（引用核验续）：medium 不标（默认噪音为零），low 早已
+        # 在学习口丢弃——只有 high 显式加冕，模型据以分配采信权重
+        conf = str(x.get("confidence") or "medium").strip().lower()
+        if conf == "high":
+            mark += "［有据］"
         lines.append("- **%s**%s：%s" % (x["title"], mark, x["body"]))
         used.append(x["id"])
     text = "## 知识库（已确认的领域知识，供参考）\n\n" + "\n".join(lines)

package/app/core/modelhub.py

@@ -681,6 +681,7 @@ def provider_view():
 # 读取点（凭据注入/健康探测/取模型列表）无需感知多 KEY 结构。没配 keys 的老数据
 # 由 _provider_keys 按 api_key 现场合成一条——文件一个字节都不用改。
 _KEY_COOLDOWN_S = 30 * 60      # 欠费类失败后的冷却时长
+_AUTH_COOLDOWN_S = 30 * 60     # 明确认证拒绝后的冷却时长，可在 UI 手动恢复
 MAX_PROVIDER_KEYS = 8          # 单厂商 KEY 上限
 MAX_CHAIN_ATTEMPTS = 8         # 链展开后的尝试上限（模型 × KEY）
 # 欠费/配额/限流类失败：换 KEY 有意义（同厂商另一账号=另一份额度与并发桶），
@@ -699,6 +700,19 @@ def _quota_error(err):
     return any(k in e for k in _QUOTA_HINTS)
 
 
+_AUTH_HINTS = ("invalid api key", "invalid_api_key", "api key is invalid",
+               "incorrect api key", "unauthorized", "unauthorised",
+               "authentication failed", "authentication error",
+               "authentication_error", "invalid token", "invalid_token",
+               "http 401", "status code 401")
+
+
+def _auth_error(err):
+    """明确的凭据认证拒绝；不把一般 403/模型权限错误误判成 KEY 错误。"""
+    e = (err or "").lower()
+    return any(k in e for k in _AUTH_HINTS)
+
+
 def _provider_keys(prov, available_only=False, now=None):
     """供应商的 KEY 列表，顺序=调用顺序。返回 [{id,key,label,enabled,cooling,...}]。
 
@@ -826,7 +840,7 @@ def key_op(provider_id, op, key_id="", key="", label="", enabled=None, ids=None)
 
 
 def note_key_error(provider_id, key_id, error=""):
-    """一次 KEY 级失败回写：欠费类进冷却（后续解析自动跳过 → 切备用 KEY）。"""
+    """一次 KEY 级失败回写：欠费或明确认证拒绝进冷却，后续解析切备用 KEY。"""
     import time as _t
     if not provider_id or not key_id:
         return
@@ -842,6 +856,8 @@ def note_key_error(provider_id, key_id, error=""):
         target["last_fail_at"] = _t.time()
         if _quota_error(error):
             target["cool_until"] = _t.time() + _KEY_COOLDOWN_S
+        elif _auth_error(error):
+            target["cool_until"] = _t.time() + _AUTH_COOLDOWN_S
         _sync_api_key(prov)
         _save(data)
 

package/app/core/pipeline.py

@@ -1240,11 +1240,19 @@ def _run_code(run, task, agents, ev, stats, mode):
                     return False, res
             return True, res
 
-        ok, res = _run_one(impl_agent)
-        if ok:
-            return True
-        # 单路实现失败：Best-of-N 赛马兜底（借鉴 orca worktree 择优）——多路并行
-        # 各自 worktree 隔离实现+验证，胜者 diff 回主工作区；失败回落走换将
+        ok, res = _run_one(impl_agent)
+        if ok:
+            return True
+        if runner._auth_error(res.get("error") or ""):
+            auth_err = ("实现步骤失败（上游拒绝认证；已停止自动换 CLI，避免隐式切换供应商）。"
+                        "请检查当前绑定的 Key、账号权限和端点；需要认证降级时，"
+                        "请在该 CLI 的绑定链中显式配置不同凭据。错误：%s"
+                        % (res.get("error") or "")[:500])
+            store.update_run(run_id, expected_status="running", status="failed",
+                             error=auth_err, ended_at=_now())
+            return False
+        # 单路实现失败：Best-of-N 赛马兜底（借鉴 orca worktree 择优）——多路并行
+        # 各自 worktree 隔离实现+验证，胜者 diff 回主工作区；失败回落走换将
         if (mode == "auto" and impl_agent.get("mode") == "real"
                 and max(1, min(3, int(task.get("best_of") or 1))) >= 2
                 and resume_ctx is None

package/app/core/runner.py

@@ -30,6 +30,7 @@ from .error_codes import ErrorCode
 CREATE_NO_WINDOW = 0x08000000 if os.name == "nt" else 0
 DEFAULT_TIMEOUT = 1200  # 单步 20 分钟
 MAX_ATTEMPT_TIMEOUT_S = 60  # 无进展时单模型最多等 1 分钟
+DEFAULT_STREAM_ACTIVITY_TIMEOUT_S = 180  # 流式 CLI 的活动延长窗口
 
 _BASH_CANDIDATES = [
     r"D:\Git\usr\bin\bash.exe",
@@ -237,9 +238,13 @@ def _pipe_reader(stream, chunks, log_fh, stamp=None):
             b = stream.read1(65536)
             if not b:
                 break
-            chunks.append(b)
-            if stamp is not None:
-                stamp[0] = time.time()
+            chunks.append(b)
+            if stamp is not None:
+                stamp[0] = time.time()
+                if len(stamp) > 1:
+                    stamp[1] = True
+                if len(stamp) > 2:
+                    stamp[2] = time.monotonic()
             if log_fh:
                 try:
                     log_fh.write(b)
@@ -601,13 +606,17 @@ def _normalize_abort_markers(value):
 def run_process(argv=None, shell_cmd=None, stdin_text=None, cwd=None, env=None,
                 timeout=DEFAULT_TIMEOUT, cancel_event=None, log_path=None,
                 stall_timeout=0, repeat_abort=None, deadline=None,
-                abort_markers=None):
+                abort_markers=None, activity_timeout=0):
     """通用子进程执行：并发读管道防死锁；超时/取消杀整棵进程树。
 
-    stall_timeout：停滞看门狗（秒，0=关闭）——超过该时长 stdout/stderr 无任何
-    新输出即判卡死，提前杀树返回（timed_out=True + stalled=True）。只对输出
-    持续流动的 CLI 开（codex JSONL 事件流）；claude json 到结束才一次性输出，
-    开了会把正常长任务误杀。
+    stall_timeout：停滞看门狗（秒，0=关闭）——超过该时长 stdout/stderr 无任何
+    新输出即判卡死，提前杀树返回（timed_out=True + stalled=True）。只对输出
+    持续流动的 CLI 开（codex JSONL 事件流）；claude json 到结束才一次性输出，
+    开了会把正常长任务误杀。
+
+    activity_timeout：基础 timeout 到期后，最近仍有真实输出的流式 CLI 允许继续
+    运行的最长静默窗口（秒，0=关闭）。它独立于 stall_timeout，避免环境把
+    停滞看门狗设为 0 后，Claude/Codex 又在基础超时处被硬杀；总延长仍有上限。
 
     repeat_abort：可选 (marker, count)，也接受多个 ``(marker, count)``；同一
     致命错误达到次数即提前杀树，处理 CLI 自身不断打印重连消息、因此永远
@@ -636,6 +645,10 @@ def run_process(argv=None, shell_cmd=None, stdin_text=None, cwd=None, env=None,
         timeout = max(0.0, float(timeout))
     except (TypeError, ValueError):
         timeout = float(DEFAULT_TIMEOUT)
+    try:
+        activity_timeout = max(0.0, float(activity_timeout))
+    except (TypeError, ValueError):
+        activity_timeout = 0.0
     if deadline is not None and time.monotonic() >= deadline:
         return {"ok": False, "exit_code": None, "stdout": "",
                 "stderr": "[任务总时限已到，未启动子进程]", "duration": 0.0,
@@ -679,7 +692,7 @@ def run_process(argv=None, shell_cmd=None, stdin_text=None, cwd=None, env=None,
                     "cancelled": False, "timed_out": False, "stalled": False,
                     "deadline_exceeded": False, "abort_marker": None}
         out_chunks, err_chunks = [], []
-        stamp = [time.time()]   # 最后输出时刻（两条管道共同刷新）
+        stamp = [time.time(), False, time.monotonic()]  # [墙钟、是否有输出、单调时钟]
         t_out = threading.Thread(target=_pipe_reader, args=(proc.stdout, out_chunks, log_fh, stamp), daemon=True)
         t_err = threading.Thread(target=_pipe_reader, args=(proc.stderr, err_chunks, log_fh, stamp), daemon=True)
         t_out.start()
@@ -696,7 +709,8 @@ def run_process(argv=None, shell_cmd=None, stdin_text=None, cwd=None, env=None,
                     except Exception:
                         pass
             threading.Thread(target=_feed, daemon=True).start()
-        start = time.time()
+        start = time.time()
+        start_mono = time.monotonic()
         cancelled = timed_out = stalled = repeat_aborted = False
         deadline_exceeded = False
         abort_marker = None
@@ -717,11 +731,14 @@ def run_process(argv=None, shell_cmd=None, stdin_text=None, cwd=None, env=None,
                 _kill_tree(proc.pid)
                 _drain_streams(proc, t_out, t_err, timeout=5)
                 break
-            if time.time() - start > timeout:
+            elapsed = time.monotonic() - start_mono
+            if elapsed > timeout:
                 # Claude/Codex 的工具循环可能持续吐 stream-json 事件而迟迟
-                # 不给最终 result。只要仍有活动，交给 stall_timeout 作为静默
-                # 上限；无输出的挂死仍按原单模型 timeout 快速换将。
-                active = stall_timeout and time.time() - stamp[0] < stall_timeout
+                # 不给最终 result。活动延长与 stall 看门狗分离：无输出的挂死
+                # 仍按原单模型 timeout 快速换将，收到过输出则最多再给一个活动窗口。
+                active = (activity_timeout > 0 and stamp[1]
+                          and time.monotonic() - stamp[2] < activity_timeout
+                          and elapsed < timeout + activity_timeout)
                 if not active:
                     timed_out = True
                     _kill_tree(proc.pid)
@@ -782,12 +799,16 @@ def run_process(argv=None, shell_cmd=None, stdin_text=None, cwd=None, env=None,
             stderr += "\n[输出停滞 %ss，已终止进程树]" % stall_timeout
         elif timed_out:
             stderr += "\n[超时 %ss，已终止进程树]" % timeout
-        return {
-            "ok": exit_code == 0 and not cancelled and not timed_out,
-            "exit_code": exit_code, "stdout": stdout, "stderr": stderr,
+        return {
+            "ok": exit_code == 0 and not cancelled and not timed_out,
+            "exit_code": exit_code, "stdout": stdout, "stderr": stderr,
             "duration": duration, "cancelled": cancelled, "timed_out": timed_out,
             "stalled": stalled, "deadline_exceeded": deadline_exceeded,
             "abort_marker": abort_marker,
+            "activity_extended": bool(activity_timeout and stamp[1]
+                                       and duration > timeout),
+            "activity_timeout": activity_timeout,
+            "last_output_age": max(0.0, time.time() - stamp[0]),
         }
     finally:
         if log_fh:
@@ -975,15 +996,33 @@ def _transient_error(err):
 
 # 欠费/配额/限流耗尽：换 KEY 与换厂商都该继续（同厂商另一账号往往还能用）。
 # 与 modelhub._QUOTA_HINTS 同源，这里独立一份避免 core 模块间循环依赖。
-_QUOTA = ("insufficient", "quota", "balance", "credit", "billing", "arrears",
-          "payment required", "402", "欠费", "余额", "额度", "exceeded",
-          "too many requests", "rate limit", "rate_limit", "http 429",
-          "并发", "超过限")
+_QUOTA = ("insufficient", "quota", "balance", "credit", "billing", "arrears",
+          "payment required", "402", "欠费", "余额", "额度", "exceeded",
+          "too many requests", "rate limit", "rate_limit", "http 429",
+          "并发", "超过限")
 
 
-def _quota_error(err):
-    err = (err or "").lower()
-    return any(k in err for k in _QUOTA)
+def _quota_error(err):
+    err = (err or "").lower()
+    return any(k in err for k in _QUOTA)
+
+
+_AUTH = ("invalid api key", "invalid_api_key", "api key is invalid",
+         "incorrect api key", "unauthorized", "unauthorised",
+         "authentication failed", "authentication error", "authentication_error",
+         "invalid token", "invalid_token", "http 401", "status code 401")
+
+
+def _auth_error(err):
+    """只识别明确的凭据拒绝，不把一般模型权限错误（403）当成 KEY 错。"""
+    err = (err or "").lower()
+    return any(k in err for k in _AUTH)
+
+
+def _attempt_credential(att):
+    """绑定链中凭据的非敏感身份；不把密钥值写入日志或尝试记录。"""
+    return (str((att or {}).get("provider_id") or ""),
+            str((att or {}).get("key_id") or ""))
 
 
 # 限流（429）专项：与一般瞬态不同，它是「等一个窗口就常能自愈」的病——
@@ -1044,10 +1083,11 @@ def _rate_limited(err):
 
 
 # 审计日志错误行探针：只认强信号，避免把回显提示词里的普通词当错误
-_LOG_ERR_HINT = re.compile(
-    r"(429|402|rate[_ ]?limit|quota|余额|欠费|insufficient|billing|arrears"
-    r"|ENOTFOUND|ECONNREFUSED|failed to run prompt|api_error|overloaded)",
-    re.I)
+_LOG_ERR_HINT = re.compile(
+    r"(429|402|rate[_ ]?limit|quota|余额|欠费|insufficient|billing|arrears"
+    r"|401|unauthorized|unauthorised|invalid[_ ]api[_ ]key|authentication[_ ]error"
+    r"|ENOTFOUND|ECONNREFUSED|failed to run prompt|api_error|overloaded)",
+    re.I)
 
 
 def _augment_error_from_log(out, log_path, limit=300):
@@ -1359,7 +1399,9 @@ def _build_call(agent, kind, sid, readonly, model, prompt, images=None, workdir=
             # simple generic adapters and test shims that read stdin. CLI tools
             # that intentionally use argv still receive the bounded file hint.
             if kind == "generic" and stdin_text is None and len(tmpl) > 1:
-                stdin_text = prompt
+                # 模板明确将提示词放进 argv 时，原文只保存在文件里；同时再
+                # 写入 stdin 会让部分包装器重复读取，也无法解决 Windows 命令行上限。
+                stdin_text = None
             tmp_files.append(pf)
     return argv, stdin_text, prompt, tmp_files
 
@@ -1384,15 +1426,23 @@ def _check_approval(agent):
     return False, "sensitive step requires policy=ask UI flow (Phase 5) — currently blocking"
 
 
-def _stall_timeout(env_name, default):
+def _stall_timeout(env_name, default):
     """停滞看门狗秒数：stdout/stderr 持续无新输出超过该时长 → 判卡死提前杀，
     错误按超时归类走既有换模型/换将链路。只对事件流持续流动的 CLI 启用
     （codex JSONL / claude stream-json）；qwen/opencode/generic 结束才一次性
     输出，开了会误杀正常长任务，仍靠总超时兜底。env 可调，0=关闭。"""
     try:
         return max(0, int(os.environ.get(env_name, str(default))))
-    except Exception:
-        return default
+    except Exception:
+        return default
+
+
+def _activity_timeout(env_name, default=DEFAULT_STREAM_ACTIVITY_TIMEOUT_S):
+    """流式 CLI 的活动延长窗口，独立于停滞看门狗配置。"""
+    try:
+        return max(0, int(os.environ.get(env_name, str(default))))
+    except Exception:
+        return default
 
 
 def _max_model_attempts(has_deadline=False):
@@ -1471,18 +1521,21 @@ def run_agent(agent, prompt, workdir=None, readonly=True,
                     "tokens": 0, "usage": None, "error": repo_issue,
                     "error_code": ErrorCode.VENDOR_ERROR, "raw": None,
                     "kind": kind, "model": agent.get("model"), "attempts": []}
-    if kind == "codex":
-        stall_t = _stall_timeout("TUTTI_CODEX_STALL_TIMEOUT", 600)
-    elif kind == "claude":
-        stall_t = _stall_timeout("TUTTI_CLAUDE_STALL_TIMEOUT", 600)
-    else:
+    if kind == "codex":
+        stall_t = _stall_timeout("TUTTI_CODEX_STALL_TIMEOUT", 600)
+        activity_t = _activity_timeout("TUTTI_CODEX_ACTIVITY_TIMEOUT")
+    elif kind == "claude":
+        stall_t = _stall_timeout("TUTTI_CLAUDE_STALL_TIMEOUT", 600)
+        activity_t = _activity_timeout("TUTTI_CLAUDE_ACTIVITY_TIMEOUT")
+    else:
         # 数据驱动：catalog orch.stall_timeout_s——给 kimi/qwen 这类评审用
         # CLI 配置后，静默挂死即杀（qwen 900s：2026-09-22 MCP 收尾死锁案）；
         # mimo 等结束才一次性输出的仍留 0（开了必误杀），靠总超时兜底
         try:
             stall_t = max(0, int((agent.get("orch") or {}).get("stall_timeout_s") or 0))
-        except Exception:
-            stall_t = 0
+        except Exception:
+            stall_t = 0
+        activity_t = 0
     # 5G：approval NEVER 一线（无人值守不静默降级）
     ok, reason = _check_approval(agent)
     if not ok:
@@ -1536,7 +1589,22 @@ def run_agent(agent, prompt, workdir=None, readonly=True,
     grace_left = RATE_LIMIT_GRACE_N  # 链尾限流宽限预算：整链撞 429 时原地等一个窗口再试一次
     timed_out_upstreams = {}  # 同一上游两次超时后跳过剩余模型
     skipped_upstreams = set()
+    auth_failed_credentials = set()
     for ai, att in enumerate(attempts):
+        credential = _attempt_credential(att)
+        if credential in auth_failed_credentials:
+            attempt_history.append({
+                "model": att.get("model") or "",
+                "provider_id": att.get("provider_id") or "",
+                "provider": ((att.get("provider") or {}).get("name", "")
+                             if isinstance(att.get("provider"), dict) else ""),
+                "kind": kind, "ok": False, "skipped": True,
+                "error_code": ErrorCode.VENDOR_ERROR,
+                "error": "同一凭据已被认证拒绝，跳过该凭据的其他模型",
+            })
+            if out is not None:
+                out["attempts"] = list(attempt_history)
+            continue
         upstream = _attempt_upstream(att)
         if upstream in skipped_upstreams:
             continue
@@ -1582,6 +1650,7 @@ def run_agent(agent, prompt, workdir=None, readonly=True,
                                       timeout=min(timeout, remaining), deadline=deadline,
                                       cancel_event=cancel_event,
                                       log_path=log_path, stall_timeout=stall_t,
+                                      activity_timeout=activity_t,
                                       repeat_abort=repeat_guard,
                                       abort_markers=stream_abort_markers)
                 finally:
@@ -1751,7 +1820,13 @@ def run_agent(agent, prompt, workdir=None, readonly=True,
                     attempts.append(retry)
                     continue
             return out
-        # 换将闸门：什么失败值得烧链上下一个候选。
+        if _auth_error(out.get("error")):
+            auth_failed_credentials.add(credential)
+            if not any(_attempt_credential(candidate) not in auth_failed_credentials
+                       for candidate in attempts[ai + 1:]):
+                return out
+            continue
+        # 换将闸门：什么失败值得烧链上下一个候选。
         # · 瞬态/配额（文本特征，含 CLI 内部 api_retry 的 429/5xx 字样）照旧；
         # · 超时：显式可换（看 res 标志位）——慢上游换快候选可能救回。
         #   2026-09-23 夜班实案：旧逻辑里超时能否换将全赌输出尾部碰巧含有
@@ -1760,10 +1835,10 @@ def run_agent(agent, prompt, workdir=None, readonly=True,
         #   换异上游候选常常就活；判死则整 run 白烧（同案：gemini 拒答后
         #   链上云知声候选从未被尝试）。
         raw = out.get("raw") or {}
-        if (raw.get("cancelled")   # 取消是用户意志，绝不降级（尾段可能带瞬态字样）
-                or not (_transient_error(out.get("error")) or _quota_error(out.get("error"))
-                        or _refusal_error(out.get("error"))
-                        or raw.get("timed_out"))):
+        if (raw.get("cancelled")   # 取消是用户意志，绝不降级（尾段可能带瞬态字样）
+                or not (_transient_error(out.get("error")) or _quota_error(out.get("error"))
+                        or _refusal_error(out.get("error"))
+                        or raw.get("timed_out"))):
             return out  # 取消/解析失败等真终态不降级
         # 同一上游的模型连续两次超时就收手——
         # 链上候选绑同一上游时换将=换壳不换命（2026-09-22 429 集群教训；

package/app/core/zentao.py

@@ -1965,6 +1965,17 @@ def save_config(patch):
     return view()["config"]
 
 
+def bug_web_base(cfg=None):
+    """给前端拼 bug 详情页用的 web 根：探测出的有效地基（含自动补的 /zentao 子路径）
+    优先，没探测过回落用户填的原始地址。返回 stripped 根或空串。"""
+    c = dict(cfg) if cfg else _cfg()
+    hit = resolved_base_url(c.get("base_url"))
+    if hit:
+        return hit
+    b = re.sub(r"/api\.php/v1$", "", str(c.get("base_url") or "").strip().rstrip("/"))
+    return b if b.startswith(("http://", "https://")) else ""
+
+
 def view():
     """前端视图：配置脱敏（password 只回是否已设）+ claims 列表（新在前）。"""
     _ensure_loaded()
@@ -1973,9 +1984,11 @@ def view():
         has_pw = bool(cfg.get("password"))
         cfg["password"] = ""
         cfg["has_password"] = has_pw
+        bug_base = bug_web_base(cfg)
         claims = sorted(_STATE["claims"].values(),
                         key=lambda c: str(c.get("claimed_at") or ""), reverse=True)
         return {"config": cfg,
+                "bug_base": bug_base,
                 "claims": [dict(c) for c in claims],
                 "last_scan": _STATE.get("last_scan") or "",
                 "next_scan": _STATE.get("next_scan") or "",

package/app/main.py

@@ -367,6 +367,12 @@ class Handler(BaseHTTPRequestHandler):
             if m:
                 run = store.get_run(m.group(1))
                 return self._json(200, {"run": run}) if run else self._json(404, {"error": "not found"})
+            m = re.match(r"^/api/runs/([^/]+)/messages$", path)
+            if m:
+                run = store.get_run(m.group(1))
+                if not run:
+                    return self._json(404, {"error": "not found"})
+                return self._json(200, {"messages": run.get("messages") or []})
             m = re.match(r"^/api/runs/([^/]+)/report$", path)
             if m:
                 run = store.get_run(m.group(1))
@@ -419,6 +425,10 @@ class Handler(BaseHTTPRequestHandler):
             if m:
                 # 任务检查器（右缘停靠列）专用：轻量聚合、可轮询，不带 diff 文本
                 return self._api_task_side(m.group(1))
+            m = re.match(r"^/api/tasks/([^/]+)/detail$", path)
+            if m:
+                task = store.get_task(m.group(1))
+                return self._json(200, {"task": task}) if task else self._json(404, {"error": "not found"})
             m = re.match(r"^/api/tasks/([^/]+)/runs$", path)
             if m:
                 # 任务级详情用：该任务全部 run（含 steps），不受前端 run 窗口限制
@@ -2365,16 +2375,20 @@ def _state_payload(client_id="", ver=None):
     agents = registry.effective_agents(catalog.load(), manager.detect_all())
     if ver is None:
         ver = store.state_version()
+    runs = store.list_runs(40)
+    latest = store.latest_run_by_task()
     return {
         "v": ver,
         "agents": agents,
         "tasks": store.list_tasks(30, archived=False),
-        "archived_tasks": store.list_tasks(30, archived=True),
+        # 归档任务默认隐藏；目标/上下文可能很大，只有查看或恢复时再按需读取。
+        "archived_tasks": [_state_task_summary(t) for t in store.list_tasks(30, archived=True)],
         # 每个任务的最近一次运行（不受 runs 窗口限制）：侧栏靠它展示各任务真实近况
-        "task_latest": store.latest_run_by_task(),
+        "task_latest": {tid: _state_run_summary(run) for tid, run in latest.items()},
         # 每个任务的运行次数/步骤总数（全量）：侧栏「查看全部」的计数来源
         "task_stats": store.task_run_stats(),
-        "runs": store.list_runs(40),
+        # 列表与 SSE 只带摘要；日志、模型输出、计划、消息正文等走详情 API。
+        "runs": [_state_run_summary(run) for run in runs],
         "control": remote.control_view(client_id),
         # 供应商健康/告警（顶栏横幅数据源；有告警时 bump_state 会推给所有端）
         "health": health.snapshot(),
@@ -2383,6 +2397,32 @@ def _state_payload(client_id="", ver=None):
     }
 
 
+def _state_task_summary(task):
+    """归档任务的最小索引；大字段由 /api/tasks/<id>/detail 按需读取。"""
+    fields = ("id", "title", "type", "engine", "workdir", "status",
+              "created_at", "archived", "git_state", "serial")
+    return {key: task[key] for key in fields if key in task}
+
+
+def _state_run_summary(run):
+    """列表/SSE 投影，不重复携带运行详情中的大字段。"""
+    fields = ("id", "task_id", "kind", "op", "title", "status", "created_at",
+              "started_at", "ended_at", "summary", "error", "paused", "direct_session",
+              "auto_resumes", "resume_enqueue_at", "cost_usd", "tokens")
+    summary = {key: run[key] for key in fields if key in run}
+    summary["step_count"] = len(run.get("steps") or [])
+    messages = run.get("messages") or []
+    summary["message_count"] = len(messages)
+    summary["pending_message_count"] = sum(1 for message in messages if not message.get("consumed"))
+    verdict = run.get("verdict") or {}
+    if isinstance(verdict, dict):
+        checks = ("pass", "publishable", "verify_pass", "review_pass")
+        compact = {key: verdict[key] for key in checks if key in verdict}
+        if compact:
+            summary["verdict"] = compact
+    return summary
+
+
 class ThreadedServer(ThreadingHTTPServer):
     """Windows 下 SO_REUSEADDR 允许两个进程同时 LISTEN 同一端口（请求随机
     分发到其中一个——服务"时好时坏"的根源）。独占锁让第二个实例在这里