codebee 0.1.7 → 0.1.9

package/app/core/catalog.py

@@ -75,12 +75,13 @@ DEFAULT_CATALOG = [
     },
     {
         "id": "aider", "name": "Aider", "cli_group": "installable",
-        "note": "Python 系结对编程 CLI；用 py -3.13 安装，模型经其配置/环境变量设置",
+        "note": "Python 系结对编程 CLI；用 uv tool 安装（自动备好 3.12 托管解释器），"
+                "模型经其配置/环境变量设置",
         "detect": {"cli": "aider"},
         "orch": {"kind": "aider", "command": "aider"},
         "config": {"path": "~/.aider.conf.yml", "format": None, "model_key": None},
-        "install": "py -3.13 -m pip install -U aider-chat",
-        "upgrade": "py -3.13 -m pip install -U aider-chat",
+        "install": "uv tool install --python 3.12 aider-chat",
+        "upgrade": "uv tool upgrade aider-chat",
         "default_enabled": False,
     },
     {
@@ -224,8 +225,6 @@ CONFIG_PATCH = {
 INSTALL_PATCH_NONWIN = {
     "claude-code": ("npm install -g @anthropic-ai/claude-code",
                     "npm install -g @anthropic-ai/claude-code@latest"),
-    "aider": ("python3 -m pip install -U aider-chat",
-              "python3 -m pip install -U aider-chat"),
 }
 
 
@@ -269,6 +268,13 @@ def derive_uninstall(cmd):
         if pkgs:
             head = m.group(1).replace("pip install", "pip uninstall")
             return "%s -y %s" % (head, pkgs[0])
+    m = re.search(r"uv\s+tool\s+install\b(.*)$", c)
+    if m:
+        # uv tool install 的包名在末尾（--python 3.12 这类 flag 的值不带横杠，
+        # 取最后一个非 flag token 才是包名）
+        pkgs = [t for t in m.group(1).split() if not t.startswith("-")]
+        if pkgs:
+            return "uv tool uninstall %s" % pkgs[-1]
     return None
 
 
@@ -303,6 +309,19 @@ def _apply_config_patch(entries):
 
 
 def _apply_install_patch(entries):
+    # Aider 渠道整体迁移到 uv tool（跨平台、含存量数据幂等修正）：anaconda 的
+    # py -3.13 装 aider 必挂在 numpy 源码构建（老 setuptools 引用 py3.12 已删除
+    # 的 pkgutil.ImpImporter），而多数机器又没有 3.9-3.12 的 pip 解释器；uv 能
+    # 自带托管解释器一条命令装好。只迁移仍旧 pip 形态的配置，已是 uv 或用户
+    # 自定义的其他命令不动（2026-09-18 本机实装失败定版）。
+    aider_uv = ("uv tool install --python 3.12 aider-chat",
+                "uv tool upgrade aider-chat")
+    for e in entries:
+        if e.get("id") != "aider":
+            continue
+        cur = (e.get("install") or "").strip()
+        if "pip" in cur and "install" in cur:
+            e["install"], e["upgrade"] = aider_uv
     if sys.platform == "win32":
         return
     for e in entries:

package/app/core/errorlog.py

@@ -0,0 +1,179 @@
+# -*- coding: utf-8 -*-
+"""错误台账：把分散在各处的失败（步骤失败/超时/看门狗击杀、CLI 启动失败）
+统一落成结构化记录——「客户遇到了问题我们根本不知道」的第一块拼图。
+
+落盘：data/errors/errors-YYYYMM.jsonl（按月分文件，append-only，一行一记录）。
+与 usage.py 同一套纪律：
+- record() 任何异常都吞掉——埋点失败绝不能影响任务执行；
+- 落盘前先脱敏（scrub_text）：密钥/令牌/绝对路径/超长文本一概不进台账。
+
+隐私红线（上传侧在 telemetry.py 再兜一道底）：
+1. API KEY / 凭据绝不入台账；
+2. 任务正文 / 章节内容（用户版权内容）绝不入台账——detail 只允许失败原因摘录；
+3. 绝对路径剥成相对片段。
+"""
+from __future__ import annotations
+
+import json
+import re
+import threading
+import time
+import uuid
+
+from . import paths
+
+LOCK = threading.RLock()
+
+FIELDS = ("id", "ts", "day", "category", "reason", "detail", "provider",
+          "model", "tool", "role", "run_id", "task_id", "step",
+          "exit_code", "app_version", "os")
+
+# detail 摘录上限（字符）：失败原因足够，不要变成日志搬运
+DETAIL_LIMIT = 600
+
+
+# ---------------------------------------------------------------- 脱敏
+
+# 常见密钥形态：OpenAI 系 sk- 前缀、Bearer 令牌、显式 key/secret/token 赋值
+_KEY_PATTERNS = (
+    (re.compile(r"\bsk-[A-Za-z0-9_-]{8,}"), "[key]"),
+    (re.compile(r"\b(?:Bearer|bearer)\s+\S+"), "Bearer [key]"),
+    # 赋值/JSON 两种形态都要吃：api_key=xxx、api_key: "xxx"（冒号前可有闭引号）
+    (re.compile(r"(?i)\b((?:api[_-]?|access[_-]?|secret[_-]?|auth[_-]?)(?:key|token|secret))"
+                r"""["']?\s*[:=，,]\s*["']?[A-Za-z0-9._~+/=-]{8,}"""), r"\1[key]"),
+    # 裸长十六进制/64 位串（可能是凭据指纹）
+    (re.compile(r"\b[0-9a-fA-F]{40,}\b"), "[token]"),
+)
+
+# 绝对路径：Windows 盘符路径、UNC、POSIX 家目录——剥掉盘符/用户名只留尾部结构
+_PATH_PATTERNS = (
+    (re.compile(r"(?i)\b[A-Z]:\\(?:[^\\/:*?\"<>|\r\n]+\\)*[^\\/:*?\"<>|\r\n]*"),
+     lambda m: "[path]" + m.group(0).split("\\")[-1]),
+    (re.compile(r"(?i)\b(?:\\\\[^\\\s]+\\[^\s]+)"), "[path]"),
+    (re.compile(r"(?:/Users/|/home/|~)[^\s\"':]+"), lambda m: "[path]" + m.group(0).rsplit("/", 1)[-1]),
+)
+
+
+def scrub_text(text, limit=DETAIL_LIMIT):
+    """自由文本 → 可安全落台账/上传的摘录：剥密钥、剥绝对路径、截断。
+
+    顺序有讲究：先剥密钥（可能出现在路径或赋值串里），再剥路径，最后截断。
+    任何输入（None/非字符串）都安全。
+    """
+    if not isinstance(text, str):
+        text = "" if text is None else str(text)
+    out = text
+    for pat, rep in _KEY_PATTERNS:
+        out = pat.sub(rep, out)
+    for pat, rep in _PATH_PATTERNS:
+        try:
+            out = pat.sub(rep, out)
+        except Exception:
+            pass
+    out = out.strip()
+    if len(out) > limit:
+        out = out[:limit] + "…"
+    return out
+
+
+def _coerce_str(v, limit):
+    return str(v or "")[:limit]
+
+
+def _os_tag():
+    import sys
+    return {"win32": "windows", "darwin": "macos"}.get(sys.platform, sys.platform)
+
+
+def _version():
+    try:
+        from . import selfupdate
+        return str(selfupdate.package_version() or "dev")
+    except Exception:
+        return "dev"
+
+
+def record(category="", reason="", detail="", provider="", model="", tool="",
+           role="", run_id="", task_id="", step=0, exit_code=None, source=""):
+    """追加一条错误记录。缺省字段留空；任何异常都吞掉（埋点不拖垮业务）。
+
+    category: step / run / launch / service（枚举放宽，未知值原样入库）
+    reason:   失败原因码（error_codes.ErrorCode 的字符串值优先，如 TIMEOUT）
+    detail:   失败摘录（内部先过 scrub_text，绝不存原文）
+    """
+    try:
+        rec = {
+            "id": "%s-%s" % (time.strftime("%Y-%m-%d %H:%M:%S"),
+                             uuid.uuid4().hex[:8]),
+            "ts": time.strftime("%Y-%m-%d %H:%M:%S"),
+            "day": time.strftime("%Y-%m-%d"),
+            "category": _coerce_str(category, 24) or "step",
+            "reason": _coerce_str(reason, 40) or "UNKNOWN",
+            "detail": scrub_text(detail),
+            "provider": _coerce_str(provider, 60),
+            "model": _coerce_str(model, 80),
+            "tool": _coerce_str(tool, 24),
+            "role": _coerce_str(role, 40),
+            "run_id": _coerce_str(run_id, 64),
+            "task_id": _coerce_str(task_id, 64),
+            "step": int(step or 0),
+            "exit_code": exit_code,
+            "app_version": _version()[:24],
+            "os": _os_tag(),
+        }
+        line = json.dumps(rec, ensure_ascii=False)
+        day = rec["day"]
+        with LOCK:
+            paths.ERRORS_DIR.mkdir(parents=True, exist_ok=True)
+            with open(paths.ERRORS_DIR / ("errors-%s.jsonl" % day[:7].replace("-", "")),
+                      "a", encoding="utf-8") as f:
+                f.write(line + "\n")
+    except Exception:
+        pass
+
+
+def iter_records(days=0):
+    """按时间范围读取台账（days=0 表示全部）。返回按写入顺序的记录列表。"""
+    out = []
+    try:
+        files = sorted(paths.ERRORS_DIR.glob("errors-*.jsonl")) if paths.ERRORS_DIR.is_dir() else []
+    except Exception:
+        return out
+    since_day = ""
+    if days:
+        import datetime
+        since_day = (datetime.date.today()
+                     - datetime.timedelta(days=int(days) - 1)).isoformat()
+    for p in files:
+        try:
+            for line in p.read_text(encoding="utf-8", errors="replace").splitlines():
+                line = line.strip()
+                if not line.startswith("{"):
+                    continue
+                try:
+                    r = json.loads(line)
+                except Exception:
+                    continue
+                if not isinstance(r, dict):
+                    continue
+                if since_day and str(r.get("day", "")) < since_day:
+                    continue
+                out.append(r)
+        except Exception:
+            continue
+    return out
+
+
+def pending_since(cursor, limit=200):
+    """取 cursor（上次上传到的记录 id）之后的记录，最多 limit 条。
+
+    id 以时间开头、uuid 尾巴保证唯一且字典序≈时间序；返回 (records, new_cursor)。
+    """
+    try:
+        recs = [r for r in iter_records(0) if str(r.get("id") or "") > str(cursor or "")]
+        recs.sort(key=lambda r: str(r.get("id") or ""))
+        batch = recs[:max(1, int(limit))]
+        new_cursor = str(batch[-1].get("id")) if batch else str(cursor or "")
+        return batch, new_cursor
+    except Exception:
+        return [], str(cursor or "")

package/app/core/flows.py

@@ -23,7 +23,7 @@ ENGINES = ("code", "review", "direct")
 # 引擎默认参数：自定义流程留空时的兜底
 ENGINE_DEFAULTS = {
     "review": {"manuscript": "output.md", "rubric": ["内容", "结构", "表达"],
-               "threshold": 7.0, "rounds": 2},
+               "threshold": 7.0, "rounds": 2, "best_of": 1},
     "code": {"verify_command": ""},
     # direct：无参数——目标+附件即全部输入，跑完即止
 }
@@ -118,7 +118,7 @@ _ID_RE = re.compile(r"^[a-z][a-z0-9_-]{0,31}$")
 # 自定义流程的 icon 在 upsert_flow 里直接落盘，不走 overrides。
 _EDITABLE = ("name", "goal_hint", "note", "manuscript", "rubric",
              "threshold", "rounds", "serial", "draft_prompt", "critique_prompt",
-             "verify_command")
+             "verify_command", "best_of")
 
 
 def _read():
@@ -279,6 +279,10 @@ def upsert_flow(payload):
             flow["rounds"] = max(1, min(5, int(payload.get("rounds") or dflt["rounds"])))
         except Exception:
             flow["rounds"] = dflt["rounds"]
+        try:
+            flow["best_of"] = max(1, min(3, int(payload.get("best_of") or dflt.get("best_of") or 1)))
+        except Exception:
+            flow["best_of"] = 1
         serial = _norm_serial(payload.get("serial"))
         if serial:
             flow["serial"] = serial

package/app/core/gitmod.py

@@ -33,6 +33,11 @@ def _git(workdir, *args, timeout=20):
     return r
 
 
+def _gh(workdir, *args, timeout=60):
+    """GitHub CLI 调用（pr_create 用）；与 _git 同构，缺失时由调用方给可读错误。"""
+    return runner.run_process(argv=["gh", *args], cwd=str(workdir), timeout=timeout)
+
+
 def _attach_entry(line):
     """status --porcelain 的一行是否为任务附件目录下的未跟踪项（不算脏改动）。"""
     if not line.startswith("?? "):
@@ -837,7 +842,7 @@ def file_diff(workdir, path):
 # 写操作白名单：action → 是否需要 confirm（不可恢复类）
 _WB_ACTIONS = {"checkout", "fetch", "pull", "push", "stage", "unstage",
                "discard", "delete", "commit", "stage_all", "unstage_all",
-               "stash_push", "stash_pop", "stash_drop"}
+               "stash_push", "stash_pop", "stash_drop", "pr_create"}
 
 
 def _res(r, extra=None):
@@ -938,6 +943,45 @@ def workbench_op(workdir, action, params=None):
             return _res(r)
         return _res(_git(wd, "reset", "-q", timeout=60))
 
+    if action == "pr_create":
+        # 「创建 PR」（借鉴 agent-orchestrator 的 planning→merge 闭环）：当前分支
+        # 推到 origin 后用 gh CLI 建 PR。gh 未安装/未登录给可读错误，不静默降级。
+        if info.get("detached") or not str(info.get("branch") or "").strip():
+            return False, "游离 HEAD 状态不能建 PR，请先切换到任务分支", {}
+        if not (info.get("remotes") or []):
+            return False, "该仓库没有配置远程（git remote），无法创建 PR", {}
+        if not _gh(wd, "--version", timeout=15)["ok"]:
+            return False, "未安装 gh CLI（https://cli.github.com/）：安装并 gh auth login 后可用", {}
+        br = info["branch"].strip()
+        base = str(params.get("base") or "").strip()
+        if not base:
+            bset = set(info.get("branches") or []) | set(info.get("remote_branches") or [])
+            for cand in ("main", "master"):
+                if cand in bset:
+                    base = cand
+                    break
+        if not base or base == br:
+            return False, "无法确定 PR 目标分支（base），请显式指定 base 参数", {}
+        title = str(params.get("title") or "").strip()[:120] or ("PR: %s" % br)
+        body_text = str(params.get("body") or "").strip()[:2000]
+        r_push = _git(wd, "push", "-u", "origin", br, timeout=180)
+        if not r_push["ok"]:
+            return _res(r_push)
+        argv = ["pr", "create", "--base", base, "--head", br, "--title", title]
+        if body_text:
+            argv += ["--body", body_text]
+        else:
+            argv += ["--fill"]   # 无描述时让 gh 用提交记录自动生成
+        r = _gh(wd, *argv, timeout=120)
+        ok, err, _d = _res(r)
+        if not ok:
+            low = (err or "").lower()
+            if "gh auth" in low or "authentic" in low or "log in" in low:
+                return False, "gh 未登录：请先在本机运行 gh auth login", {}
+            return False, (err or "gh pr create 失败")[:300], {}
+        lines = [ln.strip() for ln in (r.get("stdout") or "").splitlines() if ln.strip()]
+        return True, "", {"url": lines[-1] if lines else "", "branch": br, "base": base}
+
     if action == "commit":
         msg = str(params.get("message") or "").strip()[:500]
         if not msg:

package/app/core/health.py

@@ -66,6 +66,10 @@ def init(data_dir=None):
             for k in stale:
                 _PROVIDERS.pop(k, None)
             _persist()
+        # 供应商已删除的幽灵条目启动即清；运行期新增的幽灵由探针在探活时
+        # 发现（gone 标记）随手清——探针循环里不做全量扫描，避免和测试
+        # 夹具/运行期建条目赛跑。
+        _prune_missing()
         if not _STARTED:
             _STARTED = True
             t = threading.Thread(target=_probe_loop, name="health-probe", daemon=True)
@@ -251,16 +255,20 @@ def down_names() -> set:
 # ---------------------------------------------------------------- 探针
 
 def _probe_one(st):
-    """对单个故障 provider 发轻量探活。返回是否恢复。"""
+    """对单个故障 provider 发轻量探活。返回 (ok, gone)：
+    ok=是否恢复；gone=供应商已从配置里删除（健康记录应随之清掉）。"""
     try:
         from . import modelhub
         pid = st.get("provider_id") or ""
         model = st.get("model") or ""
-        provs = {p.get("name"): p for p in modelhub.providers()}
-        prov = provs.get(st.get("name")) or (modelhub.providers() and next(
-            (p for p in modelhub.providers() if p.get("id") == pid), None))
-        if not prov or not prov.get("api_key"):
-            return False  # 供应商被停用/删除：无法探测，保持状态
+        plist = modelhub.providers()
+        provs = {p.get("name"): p for p in plist}
+        prov = provs.get(st.get("name")) or next(
+            (p for p in plist if pid and p.get("id") == pid), None)
+        if not prov:
+            return False, True   # 供应商已删除：探不了也不再是「没恢复」
+        if not prov.get("api_key"):
+            return False, False  # 供应商在但没密钥：无法探测，保持状态
         if not model:
             try:
                 names = modelhub._enabled_models(prov)
@@ -268,12 +276,36 @@ def _probe_one(st):
             except Exception:
                 model = ""
         if not model:
-            return False
+            return False, False
         res = modelhub.chat(prov["id"], model, "1", max_tokens=8, timeout=20)
-        return bool(res.get("ok"))
+        return bool(res.get("ok")), False
     except Exception as e:
         log.debug("probe %s error: %s", st.get("name"), e)
-        return False
+        return False, False
+
+
+def _prune_missing():
+    """供应商被删除后清掉它的健康记录。
+
+    幽灵条目探不活也永远不会恢复，还会每轮把 last_fail_at 刷成「刚刚」，
+    健康页看起来像它一直在报错（Z.ai 删掉后仍显示 429 的误伤案，2026-09-18）。
+    """
+    try:
+        from . import modelhub
+        plist = modelhub.providers()
+    except Exception:
+        return
+    ids = {p.get("id") for p in plist}
+    names = {p.get("name") for p in plist}
+    with _LOCK:
+        stale = [n for n, st in _PROVIDERS.items()
+                 if not ((st.get("provider_id") and st.get("provider_id") in ids)
+                         or st.get("name") in names)]
+        if stale:
+            for n in stale:
+                _PROVIDERS.pop(n, None)
+            _persist()
+            log.info("[health] 清除已删除供应商的健康记录：%s", ", ".join(stale))
 
 
 def _probe_loop():
@@ -290,8 +322,13 @@ def _probe_loop():
                     st["probe_next_at"] = _now() + backoff
                     st["probe_backoff_idx"] = idx + 1
             for name, st in targets:
-                ok = _probe_one(st)
-                if ok:
+                ok, gone = _probe_one(st)
+                if gone:
+                    with _LOCK:
+                        if _PROVIDERS.pop(name, None) is not None:
+                            _persist()
+                    log.info("[health] %s 已删除，健康记录随之清除", name)
+                elif ok:
                     report_success(name)
                     log.info("[health] 探针确认 %s 已恢复", name)
                 else:

package/app/core/jobs.py

@@ -24,8 +24,8 @@ _seq = 0
 AI_REPAIR_PROMPT = """你是环境工程师。在 Windows 上执行下面的安装命令失败了，请诊断原因并给出修正命令。
 只输出一个 ```json 代码块，不要输出其他内容。JSON 结构：
 {"diagnosis": "失败原因（一句话）", "command": "修正后的完整安装命令", "safe": true/false}
-硬性约束：command 只能是本机包管理器的安装命令，前缀必须是 npm install / winget install /
-py -3.13 -m pip install 之一。给不出符合约束的安全命令时，safe 设为 false 且 command 留空。
+硬性约束：command 只能是本机包管理器的安装命令，前缀必须是 __ALLOW__ 之一。
+给不出符合约束的安全命令时，safe 设为 false 且 command 留空。
 
 ## 失败的命令
 __CMD__
@@ -36,8 +36,10 @@ __LOG__
 ## 本机环境
 __ENV__"""
 
-# AI 修复命令白名单：只放行包管理器的安装类命令
-AI_REPAIR_ALLOW = ("npm install ", "winget install", "py -3.13 -m pip install")
+# AI 修复命令白名单：只放行包管理器的安装类命令（提示词里的前缀清单由它生成，
+# 两处永远不会漂移）
+AI_REPAIR_ALLOW = ("npm install ", "winget install", "py -3.13 -m pip install",
+                   "uv tool install")
 
 
 def _repair_command_allowed(cmd):
@@ -139,6 +141,20 @@ AUTO_RESUME_DELAY_S = 300  # 自动续跑延迟入队秒数：网关限流/欠
                            # 立即重排会撞在同一堵墙上把续跑次数烧光（2026-09-17 七猫实测）
 
 
+def _task_active_run(task_id, exclude_run_id=None):
+    """该任务当前 queued/running 的运行（同任务单飞守卫用）；无则 None。"""
+    try:
+        from . import store
+        for r in store.task_runs(task_id):
+            if r.get("id") == exclude_run_id:
+                continue
+            if r.get("status") in ("queued", "running"):
+                return r
+    except Exception:
+        pass
+    return None
+
+
 def _maybe_auto_resume(run_id):
     """连载任务失败自动续跑：继承已完成章继续，最多 AUTO_RESUME_MAX 次。
 
@@ -157,11 +173,19 @@ def _maybe_auto_resume(run_id):
             return False   # 用户主动取消的运行绝不自动续跑
         if int(run.get("auto_resumes") or 0) >= AUTO_RESUME_MAX:
             return False
+        if _task_active_run(task["id"], exclude_run_id=run_id):
+            return False   # 同任务已有运行排队/在跑：再排副本只会与之撞车
         ok, err, new_run = store.retry_task(task["id"])
         if not ok or not new_run:
             return False
+        # 退避窗口要让用户看得见：把「预定入队时刻」写到 run 上，前端据此显示
+        # 「将在 HH:MM 自动续跑」而不是笼统的排队中（run 在建好到入队之间会
+        # 以 queued 状态干等 AUTO_RESUME_DELAY_S 秒）。
+        import time as _t
+        resume_at = _t.strftime("%Y-%m-%d %H:%M:%S",
+                                _t.localtime(_t.time() + AUTO_RESUME_DELAY_S))
         store.update_run(new_run["id"], auto_resumes=int(run.get("auto_resumes") or 0) + 1,
-                         auto_resumed_from=run_id)
+                         auto_resumed_from=run_id, resume_enqueue_at=resume_at)
 
         def _enqueue():
             _QUEUE.put({"kind": "orchestration",
@@ -238,6 +262,54 @@ def resume_interrupted(limit=3):
     return n
 
 
+def _yield_duplicate(run_id):
+    """同任务单飞（worker 出队时把关）：系统续跑副本出队时若同任务已有
+    运行排队/在跑，取消自己让位——恢复副本与原轮并行跑只会双烧评审。
+    用户轮不在此拦（retry_task 建轮时已拒运行中任务）。返回 True 表示
+    本运行已落 cancelled，不要执行。"""
+    try:
+        from . import store
+        r0 = store.get_run(run_id)
+        if not r0 or not r0.get("auto_resumed_from"):
+            return False
+        other = _task_active_run(r0.get("task_id"), exclude_run_id=run_id)
+        if not other or other.get("kind") != "orchestration":
+            return False
+        store.update_run(run_id, status="cancelled", ended_at=_now(),
+                         error="同任务已有运行在跑（%s），续跑副本自动让位" % other.get("id"))
+        return True
+    except Exception:
+        return False
+
+
+def requeue_pending(limit=10):
+    """启动补队：队列在内存里，进程一死排队项就没人管了（2026-09-18
+    七猫 r-162724 排队僵尸案：续跑副本 created 后服务重启，Timer 随进程
+    蒸发，运行永远停在「排队中」）。重启后把近 24h 的遗留 queued 编排运行
+    重新入队；同任务已有在跑/排队的不重复补。返回补队条数。"""
+    try:
+        from . import store
+    except Exception:
+        return 0
+    n = 0
+    try:
+        for run in store.list_runs(200):
+            if n >= limit:
+                break
+            if run.get("status") != "queued" or run.get("kind") != "orchestration":
+                continue
+            if not run.get("task_id") or not _recent(run):
+                continue
+            if _task_active_run(run["task_id"], exclude_run_id=run["id"]):
+                continue   # 同任务已有更活跃的运行，别再排一份
+            _QUEUE.put({"kind": "orchestration", "run_id": run["id"],
+                        "task_id": run["task_id"]})
+            n += 1
+    except Exception:
+        pass
+    return n
+
+
 def _worker():
     global _alive
     with _pool_lock:
@@ -262,6 +334,8 @@ def _worker():
                     r0 = store.get_run(run_id)
                     if r0 and r0.get("status") == "cancelled":
                         continue   # task_done 由 finally 统一收口，不能在此重复
+                    if job.get("kind") == "orchestration" and _yield_duplicate(run_id):
+                        continue   # 同任务单飞：续跑副本让位（已落 cancelled）
                 if job.get("kind") == "orchestration":
                     from . import pipeline
                     pipeline.execute_run(run_id)
@@ -314,12 +388,21 @@ def _do_mgmt(job, ev):
     if op in ("install", "upgrade", "uninstall"):
         res = manager.run_mgmt_command(entry, op, cancel_event=ev, log_path=str(log_abs))
         ok = res["ok"]
+        # 文件占用类失败（Windows 文件锁 EBUSY/EPERM）给人话结论并跳过 AI 修复：
+        # 修复智能体面对文件锁只会给出 taskkill 全杀 node 之类白名单必拒的危险
+        # 命令，白白烧一轮 300s 诊断（2026-09-18 dsh 同版本重装 EBUSY 案）
+        lock_hit = (not ok and op in ("install", "upgrade") and _file_lock_error(res))
+        if lock_hit:
+            summary = ("失败：安装文件被占用（可能有同名程序在运行，或杀毒软件正在扫描），"
+                       "请关闭占用该文件的程序后重试。完整输出见日志。")
+        else:
+            summary = ("完成" if ok else "失败") + (": " + res["error"][:300] if res.get("error") else "")
         store.finish_step(run_id, step["n"],
                           "done" if ok else "failed",
-                          summary=("完成" if ok else "失败") + (": " + res["error"][:300] if res.get("error") else ""),
+                          summary=summary,
                           exit_code=res.get("exit_code"))
         # AI 修复只针对安装类失败；卸载失败多为权限/程序占用，留给用户看日志处理
-        if not ok and op in ("install", "upgrade"):
+        if not ok and op in ("install", "upgrade") and not lock_hit:
             ok = _ai_repair(run_id, entry, ev, entry.get(op), log_abs)
     elif op == "smoke":
         from . import runner as _r
@@ -383,6 +466,12 @@ def _do_selfupgrade(job):
                      summary="CodeBee selfupgrade %s" % ("完成" if res["ok"] else "失败"))
 
 
+def _file_lock_error(res):
+    """安装/升级失败输出是否为文件占用类错误（npm/pip 的 EBUSY/EPERM 文件锁）。"""
+    err = (res or {}).get("error") or ""
+    return "EBUSY" in err or "EPERM" in err
+
+
 def _ai_repair(run_id, entry, ev, failed_cmd, orig_log):
     """安装失败后的 AI 诊断修复：诊断 → 白名单校验 → 执行 → 复检。"""
     from . import catalog, manager, registry, router, runner, store
@@ -405,7 +494,8 @@ def _ai_repair(run_id, entry, ev, failed_cmd, orig_log):
     ]
     prompt = (AI_REPAIR_PROMPT.replace("__CMD__", failed_cmd or "（未知）")
               .replace("__LOG__", log_tail)
-              .replace("__ENV__", "\n".join(env_lines)))
+              .replace("__ENV__", "\n".join(env_lines))
+              .replace("__ALLOW__", " / ".join(p.strip() for p in AI_REPAIR_ALLOW)))
     step, log_abs = store.add_step(run_id, "ai-repair", agent["id"], agent.get("label"),
                                    note="自动诊断修复")
     res = runner.run_agent(agent, prompt, readonly=True, timeout=300,
@@ -430,7 +520,9 @@ def _ai_repair(run_id, entry, ev, failed_cmd, orig_log):
     cmd = str((data or {}).get("command") or "").strip()
     safe = bool((data or {}).get("safe")) and _repair_command_allowed(cmd)
     try:
-        log_abs.write_text(
+        # write_bytes 而非 write_text(...encode())：bytes 传入文本模式 write 会
+        # TypeError 且被下面的裸 except 吞掉，诊断三行从未落过日志（2026-09-18 修）
+        log_abs.write_bytes(
             ("\n[AI 诊断] %s\n[AI 建议] %s\n[白名单] %s\n" %
              (diagnosis, cmd or "（无）", "通过" if safe else "不通过，拒绝自动执行")).encode("utf-8"))
     except Exception:
@@ -445,6 +537,9 @@ def _ai_repair(run_id, entry, ev, failed_cmd, orig_log):
     manager.detect_all(force=True)
     with manager._LOCK:
         manager._STATE["versions"].pop(entry["id"], None)
+    if fix["ok"]:
+        # 修复安装同样会改变版本结论，徽章缓存一并作废复检
+        manager.refresh_update_async(entry)
     installed = manager.detect_entry(entry)["installed"]
     store.finish_step(run_id, step["n"],
                       "done" if (fix["ok"] and installed) else "failed",

package/app/core/manager.py

@@ -1576,10 +1576,31 @@ def run_mgmt_command(entry, op, cancel_event=None, log_path=None):
     detect_all(force=True)
     with _LOCK:
         _STATE["versions"].pop(entry["id"], None)
+    if res["ok"]:
+        # 安装/升级成功即作废该条目的更新检查缓存并后台复检：否则 10 分钟 TTL
+        # 内徽章仍显示「有新版本」，诱导同版本重装（重装易撞 EBUSY 文件锁，
+        # 2026-09-18 dsh 案）。
+        refresh_update_async(entry)
     return {"ok": res["ok"], "exit_code": res["exit_code"], "command": cmd,
             "error": "" if res["ok"] else (res["stderr"][-800:] or "退出码 %s" % res["exit_code"])}
 
 
+def refresh_update_async(entry):
+    """作废单条目的更新检查缓存，并后台立刻复检一次远端最新版本。
+
+    完成的安装/升级调用它，卡片徽章马上脱离旧结论（unknown → 几秒后
+    「已是最新/有新版本」），不用等 10 分钟缓存过期。npm view 在后台线程
+    跑，不阻塞 mgmt 任务收尾。
+    """
+    with _LOCK:
+        _UPDATE_CACHE.pop(entry["id"], None)
+    try:
+        threading.Thread(target=check_update, args=(entry,), kwargs={"force": True},
+                         name="update-recheck-%s" % entry.get("id"), daemon=True).start()
+    except Exception:
+        pass
+
+
 # ---------------------------------------------------------------- 版本检查
 
 _UPDATE_CACHE = {}   # agent_id → (ts, {current, latest, updatable, note})