codebee 0.1.73 → 0.1.74

package/CHANGELOG.md

@@ -38,6 +38,12 @@ README 元数据带回，供老版本在「发现新版本」时展示新版更
 - 调度层加固：绑定链上的「纯模型条目」（只配模型名、没挂供应商）起跑前即被点名——所有 CLI 起跑日志新增凭据模式审计行（绑定链注入/无注入/本机默认，密钥值绝不入日志），缺凭据+登录闸门类错误按 CLI 附修复指引；不再只有 claude 有这层观测（2026-09-25 Mac claude 实案的三层加固通用化）。
 - **Mac 桌宠不再是「白板蜜蜂」**：macOS 的 Tk 没有逐像素窗口透明（`-transparentcolor` 是 Windows 专属），蜜蜂的矩形底板整个露出来还带系统边框（实拍=一块白板）。现在非 Windows 平台把底板画成深色卡片（对齐悬停清单面板色），桌宠呈「桌面小组件」形态；睡觉/失联的状态滤镜改为只作用于蜂体（原先整帧压暗靠键色噪点兜底，卡片底兜不回来会浮出一块更暗的小框）。Windows 逐像素透明不受影响。
 
+## v0.1.74（2026-09-30）
+
+- 新增 `TOOL_LAUNCH` 错误码：本地 CLI 启动失败（找不到可执行文件）与供应商故障彻底区分——此前这类失败被记成供应商健康故障，把健康的 Bigmodel 评测作废、整链判死（claude 垫片被清实案）
+- runner：Popen 异常统一包裹前缀「启动失败」零误判识别，先于一切上游分类
+- 评测/重探间隔与失败探针刷新调优
+
 ## v0.1.73（2026-09-30）
 
 - **建书假「已建书」三修**（我的马甲藏不住实案）：建书未取得 book_id 先按书名对账补回、仍空则**不落台账**（空条目曾让界面亮「已建书」）；校准遇空 book_id 先对账、找不回明报「可能尚未建成」，不再盲跑作品列表页误报「可能改版」；七猫补齐对账通道（resolve_book_id）

package/README.md

@@ -33,10 +33,10 @@ Trae Agent……），提供
 ---
 
 <!-- relnotes:start -->
-### 最新版更新内容（v0.1.73）
+### 最新版更新内容（v0.1.74）
 
-- 建书假「已建书」三修：book_id 空时按书名对账补回、找不回不落台账不亮「已建书」、七猫补齐对账通道
-- 扫榜选材与排名扫描增强（flows/paihang）
+- 新增 TOOL_LAUNCH 错误码：本地 CLI 启动失败与供应商故障彻底区分，不再误作废健康评测
+- 评测/重探间隔与失败探针刷新调优
 <!-- relnotes:end -->
 
 

package/app/core/analytics.py

@@ -0,0 +1,38 @@
+"""Task cost/quality rollups for operator views."""
+from __future__ import annotations
+
+from collections import defaultdict
+
+
+def summary(store):
+    by_task = defaultdict(lambda: {"runs": 0, "done": 0, "failed": 0,
+                                   "tokens": 0, "cost_usd": 0.0, "quality_sum": 0.0,
+                                   "quality_count": 0})
+    for run in store.list_runs(limit=None):
+        tid = run.get("task_id") or "_unowned"
+        row = by_task[tid]
+        row["runs"] += 1
+        row["done"] += int(run.get("status") == "done")
+        row["failed"] += int(run.get("status") == "failed")
+        row["tokens"] += int(run.get("tokens") or 0)
+        row["cost_usd"] += float(run.get("cost_usd") or 0)
+        verdict = run.get("verdict") or {}
+        quality = verdict.get("overall")
+        if isinstance(quality, (int, float)):
+            row["quality_sum"] += float(quality)
+            row["quality_count"] += 1
+    rows = []
+    for task_id, row in by_task.items():
+        item = dict(row)
+        item["task_id"] = task_id
+        item["cost_usd"] = round(item["cost_usd"], 6)
+        item["quality_avg"] = round(item.pop("quality_sum") / item.pop("quality_count"), 2) \
+            if item["quality_count"] else None
+        item.pop("quality_count", None)
+        rows.append(item)
+    rows.sort(key=lambda x: (-x["cost_usd"], x["task_id"]))
+    return {"tasks": rows, "totals": {
+        "runs": sum(x["runs"] for x in rows),
+        "tokens": sum(x["tokens"] for x in rows),
+        "cost_usd": round(sum(x["cost_usd"] for x in rows), 6),
+    }}

package/app/core/bookmeta.py

@@ -31,20 +31,6 @@ def template_only():
     return str(os.environ.get("TUTTI_BOOKMETA_TEMPLATE_ONLY") or "").strip() in ("1", "true", "yes")
 
 
-def needs_book_meta(task):
-    """这本书是否需要开书资料：连载首批（start_chapter <= 1）才需要。
-
-    开书资料属于「这本书」而不是某一批章节——续写批次沿用第一批的书名/简介/
-    标签即可，重复生成只会覆盖成同内容的近义版本。非连载任务一律不需要。"""
-    serial = (task or {}).get("serial")
-    if not isinstance(serial, dict):
-        return False
-    try:
-        return int(serial.get("start_chapter") or 1) <= 1
-    except (TypeError, ValueError):
-        return True
-
-
 # 各平台建书表单的字段展示顺序（前端卡片与 Markdown 归档共用）。
 # 番茄官方表单（2026-09 实抓）：签约模式=连载模式/完本模式；阅读标签=主分类(必选1)
 # +主题/角色/情节(各≤2)；内容标签=情节(≤4)/情感(≤2)/人设(≤4)/世界观(≤1)。

package/app/core/contracts.py

@@ -0,0 +1,255 @@
+"""Durable task contracts, evidence, approvals and completion receipts."""
+from __future__ import annotations
+
+import json
+import re
+import threading
+import time
+import uuid
+from pathlib import Path
+
+from . import paths
+
+_DIR = paths.DATA_DIR / "contracts"
+_LOCK = threading.RLock()
+_ID_RE = re.compile(r"^[A-Za-z][0-9A-Za-z_-]{0,99}$")
+_CRITERIA_MAX = 40
+_EVIDENCE_MAX = 300
+_MISSING = object()
+_CASE_KEYWORDS = {
+    "correctness": ("正确", "验证", "测试", "质量", "correct", "test", "verify"),
+    "performance": ("性能", "耗时", "成本", "token", "performance", "latency", "cost"),
+    "boundary": ("边界", "极端", "boundary", "edge"),
+    "exception": ("异常", "失败处理", "容错", "exception", "error", "failure"),
+    "readability": ("可读", "文档", "表达", "readability", "documentation"),
+    "security": ("安全", "权限", "注入", "security", "auth", "injection"),
+}
+
+
+def _valid_id(task_id):
+    return bool(_ID_RE.fullmatch(str(task_id or "")))
+
+
+def _path(task_id):
+    if not _valid_id(task_id):
+        raise ValueError("任务 ID 无效")
+    return _DIR / (str(task_id) + ".json")
+
+
+def _now():
+    return time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+
+
+def _save(item):
+    p = _path(item["task_id"])
+    p.parent.mkdir(parents=True, exist_ok=True)
+    tmp = p.with_suffix(".tmp")
+    tmp.write_text(json.dumps(item, ensure_ascii=False, indent=2), encoding="utf-8")
+    tmp.replace(p)
+
+
+def _load(task_id):
+    try:
+        value = json.loads(_path(task_id).read_text(encoding="utf-8"))
+        return value if isinstance(value, dict) else None
+    except (OSError, ValueError):
+        return None
+
+
+def _actor(value):
+    return str(value or "local").strip()[:120] or "local"
+
+
+def create(task_id, payload=None):
+    """Create or update a task's contract, preserving evidence and audit history."""
+    payload = payload if isinstance(payload, dict) else {}
+    raw_criteria = payload.get("acceptance_criteria", _MISSING)
+    if raw_criteria is not _MISSING and not isinstance(raw_criteria, list):
+        raise ValueError("acceptance_criteria 必须是列表")
+    clean = []
+    for value in (raw_criteria if raw_criteria is not _MISSING else [])[:_CRITERIA_MAX]:
+        text = str(value or "").strip()[:500]
+        if text and text not in clean:
+            clean.append(text)
+    with _LOCK:
+        item = _load(task_id) or {
+            "version": 1, "task_id": str(task_id), "created_at": _now(),
+            "acceptance_criteria": [], "evidence": [], "approval_required": False,
+            "approval": None, "blocked_reason": "", "completion_receipt": None,
+            "audit": [], "status": "open",
+        }
+        # Partial updates must not erase an existing contract field merely
+        # because the caller omitted it (MCP/UI frequently send sparse patches).
+        if raw_criteria is not _MISSING:
+            item["acceptance_criteria"] = clean
+        if "approval_required" in payload:
+            approval_required = payload.get("approval_required")
+            if not isinstance(approval_required, bool):
+                raise ValueError("approval_required 必须是布尔值")
+            item["approval_required"] = approval_required
+        item["updated_at"] = _now()
+        item["audit"].append({"at": item["updated_at"], "actor": _actor(payload.get("actor")),
+                              "action": "contract_updated",
+                              "criteria_count": len(item.get("acceptance_criteria") or [])})
+        _save(item)
+        return item
+
+
+def get(task_id):
+    with _LOCK:
+        return _load(task_id)
+
+
+def add_evidence(task_id, evidence, actor="local"):
+    if not isinstance(evidence, dict):
+        raise ValueError("证据必须是对象")
+    status = str(evidence.get("status") or "unknown").lower()
+    if status not in ("passed", "failed", "unknown", "not_evaluated"):
+        raise ValueError("证据状态无效")
+    with _LOCK:
+        item = _load(task_id)
+        if not item:
+            item = create(task_id, {})
+        row = {"id": "ev-%s" % uuid.uuid4().hex[:20],
+               "criterion": str(evidence.get("criterion") or "")[:500], "status": status,
+               "summary": str(evidence.get("summary") or "")[:2000],
+               "source": str(evidence.get("source") or "manual")[:80], "at": _now(),
+               "actor": _actor(actor)}
+        item["evidence"].append(row)
+        item["evidence"] = item["evidence"][-_EVIDENCE_MAX:]
+        item["audit"].append({"at": row["at"], "actor": row["actor"],
+                              "action": "evidence_added", "evidence_id": row["id"]})
+        item["updated_at"] = row["at"]
+        _save(item)
+        return item
+
+
+def record_acceptance_cases(task_id, cases, actor="system"):
+    """Map acceptance-matrix cases onto matching user criteria.
+
+    Matching is deliberately conservative: only criteria containing a known
+    case keyword (or the explicit ``acceptance:<case>`` form) are linked. Any
+    unmatched criterion remains unverified rather than being guessed green.
+    """
+    if not isinstance(cases, list):
+        return get(task_id)
+    item = get(task_id)
+    if not item:
+        return None
+    criteria = item.get("acceptance_criteria") or []
+    for case in cases:
+        if not isinstance(case, dict):
+            continue
+        name = str(case.get("case") or "").strip().lower()
+        status = str(case.get("status") or "unknown").lower()
+        if name not in _CASE_KEYWORDS or status not in ("passed", "failed", "unknown", "not_evaluated"):
+            continue
+        for criterion in criteria:
+            text = str(criterion or "").strip()
+            low = text.lower()
+            explicit = low == "acceptance:" + name
+            matched = explicit or any(keyword.lower() in low for keyword in _CASE_KEYWORDS[name])
+            if not matched:
+                continue
+            add_evidence(task_id, {"criterion": text, "status": status,
+                                   "summary": case.get("reason") or
+                                             "acceptance matrix: " + name,
+                                   "source": "acceptance"}, actor=actor)
+    return get(task_id)
+
+
+def _decision(task_id, status, actor, note):
+    with _LOCK:
+        item = _load(task_id)
+        if not item:
+            return None, "任务契约不存在"
+        decision = {"status": status, "actor": _actor(actor),
+                    "note": str(note or "").strip()[:1000], "at": _now()}
+        item["approval"] = decision
+        item["status"] = "approved" if status == "approved" else "open"
+        item["audit"].append(dict(decision, action=status))
+        item["updated_at"] = decision["at"]
+        _save(item)
+        return item, None
+
+
+def approve(task_id, actor="local", note=""):
+    return _decision(task_id, "approved", actor, note)
+
+
+def reject(task_id, actor="local", note=""):
+    if not str(note or "").strip():
+        return None, "拒绝审批必须说明原因"
+    return _decision(task_id, "rejected", actor, note)
+
+
+def set_blocked(task_id, reason, actor="local"):
+    reason = str(reason or "").strip()[:1000]
+    if not reason:
+        return None, "Blocked 状态必须填写原因"
+    with _LOCK:
+        item = _load(task_id)
+        if not item:
+            return None, "任务契约不存在"
+        item["status"] = "blocked"
+        item["blocked_reason"] = reason
+        item["updated_at"] = _now()
+        item["audit"].append({"at": item["updated_at"], "actor": _actor(actor),
+                              "action": "blocked", "reason": reason})
+        _save(item)
+        return item, None
+
+
+def release_allowed(task_id):
+    item = get(task_id)
+    # Task creation persists the approval bit redundantly for backwards
+    # compatibility.  Combine both sources with OR so a damaged/tampered
+    # sidecar cannot downgrade an approval-protected task to releasable.
+    try:
+        from . import store
+        task = store.get_task(task_id) or {}
+    except Exception:
+        task = {}
+    requires = bool((item or {}).get("approval_required")) or bool(task.get("approval_required"))
+    if not requires:
+        return True
+    if item is None:
+        return False
+    approval = item.get("approval") or {}
+    return approval.get("status") == "approved"
+
+
+def complete(task_id, run):
+    if not isinstance(run, dict) or run.get("status") not in ("done", "failed", "cancelled", "timeout"):
+        return None, "完成回执只能关联终态运行"
+    with _LOCK:
+        item = _load(task_id)
+        if not item:
+            item = create(task_id, {})
+        criteria = item.get("acceptance_criteria") or []
+        evidence = item.get("evidence") or []
+        latest = {}
+        for row in evidence:
+            if row.get("criterion"):
+                latest[row["criterion"]] = row
+        checked = [latest.get(c) for c in criteria]
+        receipt = {"version": 1, "task_id": str(task_id), "run_id": run.get("id"),
+                   "run_status": run.get("status"), "criteria_total": len(criteria),
+                   "criteria_passed": sum(1 for row in checked if row and row.get("status") == "passed"),
+                   "criteria_failed": sum(1 for row in checked if row and row.get("status") == "failed"),
+                   "criteria_unverified": sum(1 for row in checked if not row or row.get("status") not in ("passed", "failed")),
+                   "evidence_ids": [row.get("id") for row in checked if row],
+                   "cost_usd": float(run.get("cost_usd") or 0), "tokens": int(run.get("tokens") or 0),
+                   "completed_at": _now()}
+        # Completion is idempotent for the same run.  A late duplicate status
+        # write must not manufacture a second audit event or mutate the
+        # original cost/token receipt.
+        previous = item.get("completion_receipt") or {}
+        if previous.get("run_id") == receipt["run_id"]:
+            return previous, None
+        item["completion_receipt"] = receipt
+        item["audit"].append({"at": receipt["completed_at"], "actor": "system",
+                              "action": "completion_receipt_created", "run_id": run.get("id")})
+        item["updated_at"] = receipt["completed_at"]
+        _save(item)
+        return receipt, None

package/app/core/error_codes.py

@@ -37,6 +37,7 @@ class ErrorCode(str, Enum):
     RATE_LIMIT = "RATE_LIMIT"              # 短时速率/并发限制（429）
     LOCAL_STATE = "LOCAL_STATE"            # 本地 CLI 状态/锁冲突
     CONTEXT_OVERFLOW = "CONTEXT_OVERFLOW"  # 触发压缩（与 MAX_TOKENS 不同）
+    TOOL_LAUNCH = "TOOL_LAUNCH"            # 本地 CLI 启动失败（找不到可执行文件）
 
     # === ok ===
     # "" 表示成功，不设枚举值
@@ -91,6 +92,11 @@ _NETWORK = ("stream disconnected", "stream closed", "connection reset", "connect
             "输出停滞")
 _LOCAL_STATE = ("database is locked", "database locked", "sqlite busy",
                 "unable to open database file")
+# run_process 对 Popen 异常的统一包裹前缀（"启动失败: %r"）。供应商侧任何
+# 报错都不会长这个样子，所以单靠前缀即可零误判地识别「本地工具链起不来」。
+# 2026-09-30 claude 垫片被清案：这类失败被记成供应商健康故障，把健康的
+# Bigmodel 评测作废、整链判死——必须先于一切上游分类识别。
+_TOOL_LAUNCH = ("启动失败",)
 _TRANSIENT_HINTS = ("stream closed before response.completed", "output stall", "timed out",
                     "timeout", "output stalled", "ENOTFOUND", "Reconnecting...",
                     "initialize", "[1211]")
@@ -116,6 +122,8 @@ def classify_error_text(error):
     text = str(error or "").lower()
     if not text:
         return None
+    if any(marker in text for marker in _TOOL_LAUNCH):
+        return ErrorCode.TOOL_LAUNCH
     if re.search(r"(?:http(?:/\d(?:\.\d)?)?\s*|status(?:\s+code)?\s*[:=]?\s*)401\b", text):
         return ErrorCode.AUTH
     # An explicit HTTP 403 is authoritative even when the provider describes the
@@ -196,6 +204,7 @@ _SAFE_ERROR_SUMMARIES = {
     ErrorCode.RATE_LIMIT: "上游触发速率或并发限制",
     ErrorCode.LOCAL_STATE: "CLI 本地状态或数据库锁冲突",
     ErrorCode.CONTEXT_OVERFLOW: "输入上下文超出模型容量",
+    ErrorCode.TOOL_LAUNCH: "本地 CLI 启动失败（可执行文件不存在，与供应商无关）",
 }
 
 

package/app/core/health.py

@@ -143,9 +143,22 @@ def report_success(provider: str):
 
 def report_failure(provider: str, error: str = "", *, model: str = "",
                    provider_id: str = ""):
-    """一次真实失败调用。provider 用展示名（与 usage 台账一致）。"""
+    """一次真实失败调用。provider 用展示名（与 usage 台账一致）。
+
+    本地 CLI 启动失败（TOOL_LAUNCH：找不到可执行文件等）与供应商无关，
+    记进来会把健康供应商的评测结论作废、链被解析层过滤成死链——
+    2026-09-30 claude 垫片被清案：Bigmodel 全程健康却被连续启动失败
+    拖进 down。只打日志提醒修本地环境，不进健康台账。"""
     if not provider:
         return
+    try:
+        from .error_codes import ErrorCode, classify_error_text
+        if classify_error_text(error) == ErrorCode.TOOL_LAUNCH:
+            log.warning("[health] 本地 CLI 启动失败（与供应商 %s 无关，不记健康故障）：%s",
+                        provider, str(error or "")[:160])
+            return
+    except Exception:
+        pass
 
     # A failed live call invalidates capability evidence for this upstream.
     # Keep this hook lazy and best-effort: health telemetry must never make a

package/app/core/jobs.py

@@ -422,6 +422,56 @@ def _schedule_enqueue(job, delay_s):
     return True
 
 
+def enqueue_now(run_id):
+    """立即重试：退避窗口内的续跑副本跳过等待马上入队（详情页按钮触发）。
+
+    返回 (ok, err)。先摘到点 Timer 再直接 enqueue——CAS 认领保证与 Timer
+    竞态时只有一方生效，Timer 抢先起跑按目的已达成处理。resume_enqueue_at
+    同步清空：副本一旦入队/起跑，UI 不该再显示「将于 HH:MM 自动续跑」；
+    满载转排队后由补跑心跳接管，巡检也把它当普通排队记录。跳过退避是
+    用户的主动选择（等效于手动重试），不受「别烧退避窗口」的巡检约束。"""
+    from . import store
+    run = store.get_run(run_id)
+    if not run:
+        return False, "运行不存在"
+    if run.get("status") != "queued":
+        return False, "该运行已不在排队等待中"
+    if not str(run.get("resume_enqueue_at") or ""):
+        return False, "该运行不在自动续跑等待中"
+    if str(run.get("kind") or "orchestration") != "orchestration" or not run.get("task_id"):
+        return False, "该运行不支持立即重试"
+    resume_at = str(run.get("resume_enqueue_at") or "")
+    with _timer_lock:
+        old = _deferred_timers.pop(run_id, None)
+    if old is not None:
+        old.cancel()
+    if store.update_run(run_id, resume_enqueue_at="") is None:
+        if old is not None:
+            _schedule_enqueue({"kind": "orchestration", "run_id": run_id,
+                               "task_id": run.get("task_id")}, 1.0)
+        return False, "运行状态已变化，请刷新后重试"
+    try:
+        enqueue({"kind": "orchestration", "run_id": run_id,
+                 "task_id": run.get("task_id")})
+    except DuplicateJobError:
+        pass   # 到点 Timer 抢先起跑/运行已被取消接管：无需再排
+    except Exception as exc:
+        # A non-duplicate enqueue failure must not strand the run with the
+        # backoff marker cleared and its original timer removed.
+        current = store.get_run(run_id)
+        if current and current.get("status") == "queued":
+            store.update_run(run_id, resume_enqueue_at=resume_at)
+            try:
+                import time as _time
+                due = _time.mktime(_time.strptime(resume_at, "%Y-%m-%d %H:%M:%S"))
+                _schedule_enqueue({"kind": "orchestration", "run_id": run_id,
+                                   "task_id": run.get("task_id")}, max(0.0, due - _time.time()))
+            except Exception:
+                pass
+        return False, "立即重试失败，已恢复自动续跑：%s" % str(exc)[:160]
+    return True, ""
+
+
 def restore_deferred_resumes(limit=None, now=None):
     """重建重启前的自动续跑退避 Timer；返回成功恢复的数量。"""
     import time as _t

package/app/core/manager.py

@@ -589,6 +589,30 @@ def read_model(entry):
     return None
 
 
+def _atomic_write_bytes(path, data):
+    """CLI 自家配置写盘统一走临时文件 + os.replace 原子替换。
+
+    就地 write_bytes 有「截断→重写」窗口：并行评审爆发期多个 CLI 同时被
+    拉起（bind_agent 先同步配置再 spawn），正在启动的 CLI 恰好读配置就会
+    读到半截文件——opencode 对残缺 jsonc 的反应正是打一行横幅就退出码 1
+    （2026-09-30 14:56 实案）。os.replace 原地换名，读者要么见旧要么见新。
+    """
+    path = str(path)
+    d = os.path.dirname(path) or "."
+    fd, tmp = tempfile.mkstemp(prefix=os.path.basename(path) + ".",
+                               suffix=".tmp", dir=d)
+    try:
+        with os.fdopen(fd, "wb") as fh:
+            fh.write(data)
+        os.replace(tmp, path)
+    except Exception:
+        try:
+            os.remove(tmp)
+        except OSError:
+            pass
+        raise
+
+
 def write_model(entry, model):
     """写入默认模型（改动前自动备份 .bak）。支持 toml-line / toml-section /
     json / json-path / jsonc / yaml-line。"""
@@ -623,7 +647,7 @@ def write_model(entry, model):
             # settings.json、openclaw 缺失即安全默认——官方文档明确「缺失即
             # 内置默认」）；它正是用户层覆盖的落点，缺了按需创建
             Path(path).parent.mkdir(parents=True, exist_ok=True)
-            Path(path).write_bytes(b"{}" if fmt in ("json", "json-path", "jsonc") else b"")
+            _atomic_write_bytes(path,b"{}" if fmt in ("json", "json-path", "jsonc") else b"")
         if fmt == "jsonc":
             # mimo（mimocode.jsonc）有注释，整体重解析会丢注释——复用
             # _jsonc_set 做就地片段改写（只动目标键，其余原样保留）
@@ -634,7 +658,7 @@ def write_model(entry, model):
             if not ok:
                 return {"ok": False,
                         "error": "jsonc 结构异常，未能就地写入 %s（已避免覆盖）" % path}
-            Path(path).write_bytes(new_text.encode("utf-8"))
+            _atomic_write_bytes(path,new_text.encode("utf-8"))
         elif fmt == "toml-line":
             text = _read_text(path)
             new_line = 'model = "%s"' % model
@@ -642,17 +666,17 @@ def write_model(entry, model):
                 text = re.sub(r'(?m)^\s*model\s*=\s*"[^"]*"', new_line, text)
             else:
                 text = text.rstrip("\n") + "\n" + new_line + "\n"
-            Path(path).write_bytes(text.encode("utf-8"))
+            _atomic_write_bytes(path,text.encode("utf-8"))
         elif fmt == "toml-section":
             text = _read_text(path, preserve_newlines=True)
             text = _toml_write_value(text, *_dotted_key(cfg), value=model)
-            Path(path).write_bytes(text.encode("utf-8"))
+            _atomic_write_bytes(path,text.encode("utf-8"))
         elif fmt == "yaml-line":
             # newline="" 关掉通用换行转换：文本层面看不出 \r\n 就会被静默改写成 LF，
             # 用户的 Windows 配置不该因为写个模型名而整篇换行符被替换
             text = _read_text(path, preserve_newlines=True)
             text = _yaml_write_value(text, *_yaml_model_path(cfg), value=model)
-            Path(path).write_bytes(text.encode("utf-8"))
+            _atomic_write_bytes(path,text.encode("utf-8"))
         elif fmt == "json-path":
             # openclaw（agents.defaults.model.primary）：默认模型藏在嵌套对象里，
             # 且 openclaw 对未知顶层键直接拒绝启动——绝不能写顶层 "model"
@@ -662,7 +686,7 @@ def write_model(entry, model):
             except Exception:
                 return {"ok": False, "error": "配置文件不是合法 JSON，已中止（避免覆盖）"}
             _json_path_set(data, (cfg.get("model_key") or "model").split("."), model)
-            Path(path).write_bytes(
+            _atomic_write_bytes(path,
                 json.dumps(data, ensure_ascii=False, indent=2).encode("utf-8"))
         else:
             try:
@@ -673,7 +697,7 @@ def write_model(entry, model):
             except Exception:
                 return {"ok": False, "error": "配置文件不是合法 JSON，已中止（避免覆盖）"}
             data["model"] = model
-            Path(path).write_bytes(
+            _atomic_write_bytes(path,
                 json.dumps(data, ensure_ascii=False, indent=2).encode("utf-8"))
         return {"ok": True, "model": read_model(entry)}
     except Exception as e:
@@ -835,7 +859,7 @@ def _sync_dsh_settings(entry, model, base_url):
         if text2 != text:
             if os.path.isfile(path):
                 shutil.copyfile(path, path + ".bak")
-            Path(path).write_bytes(text2.encode("utf-8"))
+            _atomic_write_bytes(path,text2.encode("utf-8"))
         return None
     except Exception as e:
         return repr(e)
@@ -992,7 +1016,7 @@ def _sync_codex_settings(entry, model, cp):
         if text2 != text:
             if os.path.isfile(path):
                 shutil.copyfile(path, path + ".bak")
-            Path(path).write_bytes(text2.encode("utf-8"))
+            _atomic_write_bytes(path,text2.encode("utf-8"))
         return None
     except Exception as e:
         return repr(e)
@@ -1209,7 +1233,7 @@ def _sync_settings_env(path, updates, remove_keys=()):
         data["env"] = env
         if os.path.isfile(path):
             shutil.copyfile(path, path + ".bak")
-        Path(path).write_bytes(json.dumps(data, ensure_ascii=False, indent=2).encode("utf-8"))
+        _atomic_write_bytes(path,json.dumps(data, ensure_ascii=False, indent=2).encode("utf-8"))
         return None
     except Exception as e:
         return repr(e)
@@ -1321,7 +1345,7 @@ def _sync_mimo_settings(entry, model, prov):
                                   json.dumps("codebee/" + model))
         if not ok:
             return "mimocode.jsonc 结构异常，未能写入 model（已避免覆盖）"
-        Path(path).write_bytes(new_text.encode("utf-8"))
+        _atomic_write_bytes(path,new_text.encode("utf-8"))
         return None
     except OSError as e:
         return "写入 mimocode.jsonc 失败：%s" % str(e)[:80]
@@ -1401,7 +1425,7 @@ def _sync_opencode_settings(entry, model, prov):
                                          json.dumps(top_perms))
             if os.path.isfile(path):
                 shutil.copyfile(path, path + ".bak")
-            Path(path).write_bytes(new_text.encode("utf-8"))
+            _atomic_write_bytes(path,new_text.encode("utf-8"))
         except Exception as e:
             errs.append("%s: %r" % (path, e))
     return "；".join(errs) or None
@@ -1475,7 +1499,7 @@ def _sync_kimi_settings(entry, model, prov):
                 new_text = top + "\n" + body + "\n" + tables
             else:
                 new_text = (body + "\n" if body else "") + managed
-            Path(path).write_bytes(new_text.encode("utf-8"))
+            _atomic_write_bytes(path,new_text.encode("utf-8"))
         except Exception as e:
             errs.append("%s: %r" % (path, e))
     return "；".join(errs) or None
@@ -1516,7 +1540,7 @@ def _pi_write_json(path, mutate):
     if os.path.isfile(path):
         shutil.copyfile(path, path + ".bak")
     Path(path).parent.mkdir(parents=True, exist_ok=True)
-    Path(path).write_bytes(
+    _atomic_write_bytes(path,
         json.dumps(data, ensure_ascii=False, indent=2).encode("utf-8"))
     return None