codebee 0.1.98 → 0.1.100

package/app/core/builtin_agent.py

@@ -98,15 +98,15 @@ def resolve(provider_id="", model="", difficulty="default"):
                 if selected not in enabled_names:
                     return None
             if not selected:
-                selected = (p.get("model_hard") if difficulty == "hard" else
-                            p.get("model_easy") if difficulty == "easy" else
-                            p.get("model") or "").strip()
-            if not selected:
+                # 默认/难度模型键位与 models[] 启停开关不联动：键位指向已停用
+                # 模型时对账启用名单回落，不冒充可用（停用的模型不准用）
                 try:
-                    names = modelhub._enabled_models(p)
+                    selected = modelhub._usable_default_model(
+                        p, (p.get("model_hard") if difficulty == "hard" else
+                            p.get("model_easy") if difficulty == "easy" else
+                            p.get("model")) or "")
                 except Exception:
-                    names = []
-                selected = names[0]["name"] if names else ""
+                    selected = (p.get("model") or "").strip()
             if selected:
                 return {"prov": p, "model": selected,
                         "provider_id": p.get("id") or "",
@@ -125,15 +125,13 @@ def resolve(provider_id="", model="", difficulty="default"):
     for p in modelhub.providers():
         if not p.get("enabled", True) or not p.get("api_key"):
             continue
-        m = ((p.get("model_hard") if difficulty == "hard" else
-              p.get("model_easy") if difficulty == "easy" else
-              p.get("model")) or "").strip()
-        if not m:
-            try:
-                names = modelhub._enabled_models(p)
-            except Exception:
-                names = []
-            m = names[0]["name"] if names else ""
+        try:
+            m = modelhub._usable_default_model(
+                p, (p.get("model_hard") if difficulty == "hard" else
+                    p.get("model_easy") if difficulty == "easy" else
+                    p.get("model")) or "")
+        except Exception:
+            m = (p.get("model") or "").strip()
         if m:
             return {"prov": p, "model": m, "provider_id": p.get("id") or "",
                     "provider_name": p.get("name") or p.get("id") or ""}
@@ -422,7 +420,11 @@ def _tool_run_command(workdir, args, cancel_event=None, deadline=None, sandbox=N
     → cmd /c 或 /bin/sh -c），仓库唯一的 shell 落点，不另起炉灶。全信任档
     （用户拍板 2026-09-22）：无白名单无确认闸，与 codex/claude 全权沙箱同档。
     提权靠模型自己包 Start-Process -Verb RunAs——UAC 必须人点，绕不过也不该绕。
-    输出按字符头尾截断（解码已在 run_process 完成，无残缺多字节问题）。"""
+    输出按字符头尾截断（解码已在 run_process 完成，无残缺多字节问题）。
+    沙箱闸策略感知（与外部 CLI 闸 b267107 同口径）：Linux 有 bwrap 全策略
+    强制；Win/Mac 无 OS 后端，进程内无法兑现的收窄仍拒（禁网、env 白名单
+    ——run_process 的 env 是注入语义滤不掉），默认宽策略保持全信任档直跑，
+    目录闸由 path_allowed 兑现。"""
     cmdline = str(args.get("command") or "").strip()
     if not cmdline:
         return "（命令为空，未执行）"
@@ -432,15 +434,20 @@ def _tool_run_command(workdir, args, cancel_event=None, deadline=None, sandbox=N
     cwd = os.path.abspath(workdir or ".")
     if not policy.path_allowed(cwd, sandbox):
         return "（沙箱拒绝：工作目录不在允许范围内，命令未执行）"
-    # This process runner has no OS-level network/filesystem namespace. Do not
-    # imply network isolation when policy requests it; fail closed instead.
-    if sandbox.get("network") is False:
-        if os.name != "posix" or not shutil.which("bwrap"):
-            return "（沙箱拒绝：当前系统没有可用的网络隔离后端，命令未执行）"
-    # Enforce the declared filesystem boundary at the process boundary too.
-    # bubblewrap is the supported Linux backend. Windows/macOS without an
-    # equivalent backend fail closed rather than pretending cwd is a sandbox.
-    if os.name == "posix" and shutil.which("bwrap"):
+    # Enforce the declared boundary at the process boundary where an OS
+    # backend exists (bubblewrap on Linux). Windows/macOS have no equivalent:
+    # stay policy-aware like the external-CLI gate (b267107) — the narrowings
+    # this in-process runner cannot honor fail closed, while a default wide
+    # policy keeps the user-approved full-trust tier (2026-09-22) instead of
+    # refusing every command.
+    has_bwrap = os.name == "posix" and bool(shutil.which("bwrap"))
+    if sandbox.get("network") is False and not has_bwrap:
+        return "（沙箱拒绝：当前系统没有可用的网络隔离后端，命令未执行）"
+    if sandbox.get("env_allowlist"):
+        # run_process 的 env 是注入语义（合并进完整父环境，供凭据注入），
+        # 不是白名单替换——环境收窄在子进程侧无法兑现，宁拒不假装
+        return "（沙箱拒绝：该任务带环境变量白名单，命令执行无法兑现该策略，未执行）"
+    if has_bwrap:
         argv = ["bwrap", "--die-with-parent", "--new-session", "--tmpfs", "/"]
         # Mount only the runtime needed by ordinary commands. Do not expose the
         # entire host root read-only: read access can still leak user secrets.
@@ -461,18 +468,10 @@ def _tool_run_command(workdir, args, cancel_event=None, deadline=None, sandbox=N
             argv.extend(["--dir", root_path])
             argv.extend(["--bind", root_path, root_path])
         argv.extend(["--chdir", cwd, "--", "/bin/sh", "-lc", cmdline])
-    elif os.name == "posix" and sys.platform == "darwin":
-        return "（沙箱拒绝：当前 macOS 执行器尚未接入文件系统隔离后端，命令未执行）"
-    elif os.name != "posix":
-        return "（沙箱拒绝：当前 Windows 执行器尚未接入文件系统隔离后端，命令未执行）"
     else:
-        return "（沙箱拒绝：未安装 bubblewrap 隔离后端，命令未执行）"
-    env_policy = dict(sandbox)
-    env_policy["env_allowlist"] = list(dict.fromkeys(
-        list(sandbox.get("env_allowlist") or [])
-        + ["PATH", "SYSTEMROOT", "WINDIR", "TEMP", "TMP", "COMSPEC", "HOME", "USERPROFILE"]))
-    r = runner.run_process(argv=argv, cwd=cwd,
-                           env=policy.filter_env(os.environ, env_policy),
+        argv = None   # 全信任档：runner 按平台自包 cmd /c 或 /bin/sh -c
+    r = runner.run_process(argv=argv, shell_cmd=cmdline if argv is None else None,
+                           cwd=cwd, env=None,
                            timeout=min(timeout, CMD_MAX_TIMEOUT),
                            deadline=deadline, cancel_event=cancel_event)
     out = runner.clean_cli_text(
@@ -959,6 +958,18 @@ def _exec_tool(workdir, name, args, cancel_event=None, deadline=None, task_creat
             except Exception:
                 return "（检查点拒绝：文件原始版本保存失败，未执行文件操作）"
         if name == "run_command":
+            try:
+                from . import command_auth
+                approval = command_auth.authorize(
+                    str((args or {}).get("command") or ""),
+                    run_id=checkpoint_run_id, workdir=workdir,
+                    deadline=deadline, cancel_event=cancel_event,
+                    source="run_command")
+            except Exception:
+                approval = {"allowed": False, "reason": "authorization_unavailable"}
+            if not approval.get("allowed"):
+                reason = approval.get("reason") or "denied"
+                return "（命令授权%s，未执行；拒绝后不会自动重放，请模型检查并重新请求）" % reason
             result = fn(workdir, args or {}, cancel_event=cancel_event,
                         deadline=deadline, sandbox=sandbox)
         else:

package/app/core/command_auth.py

@@ -0,0 +1,302 @@
+# -*- coding: utf-8 -*-
+"""Command execution policy with live approval requests and redacted audit."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import threading
+import time
+import uuid
+from pathlib import Path
+
+from .redact import scrub_text
+
+_LOCK = threading.RLock()
+_FILE = None
+_PENDING = {}
+_WAIT_SECONDS = 300
+_MAX_AUDIT = 500
+_MODES = {"legacy", "restricted"}
+_SCOPES = {"once", "run", "project", "global"}
+_MATCHES = {"exact", "prefix", "any"}
+_SHELL_META = re.compile(r"[;&|<>`$\r\n]")
+
+
+def init(data_dir=None):
+    global _FILE, _PENDING
+    with _LOCK:
+        if data_dir is None:
+            from . import paths
+            base = paths.DATA_DIR
+        else:
+            base = Path(data_dir)
+        base.mkdir(parents=True, exist_ok=True)
+        _FILE = base / "command-permissions.json"
+        _PENDING = {}
+
+
+def _file():
+    global _FILE
+    if _FILE is None:
+        init()
+    return _FILE
+
+
+def _default_state():
+    return {"mode": "legacy", "rules": [], "audit": []}
+
+
+def _load():
+    path = _file()
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        return _default_state()
+    except (OSError, ValueError):
+        return {"mode": "restricted", "rules": [], "audit": []}
+    if not isinstance(data, dict) or data.get("mode") not in _MODES:
+        return {"mode": "restricted", "rules": [], "audit": []}
+    return {"mode": data["mode"],
+            "rules": data.get("rules") if isinstance(data.get("rules"), list) else [],
+            "audit": data.get("audit") if isinstance(data.get("audit"), list) else []}
+
+
+def _persist(state):
+    path = _file()
+    tmp = path.with_name(path.name + ".tmp")
+    tmp.write_text(json.dumps(state, ensure_ascii=False, indent=2), encoding="utf-8")
+    try:
+        os.chmod(str(tmp), 0o600)
+    except OSError:
+        pass
+    os.replace(str(tmp), str(path))
+
+
+def _hash(value):
+    return hashlib.sha256(str(value or "").encode("utf-8")).hexdigest()
+
+
+def _path_key(workdir):
+    if not workdir:
+        return ""
+    return _hash(os.path.normcase(os.path.realpath(os.path.expanduser(str(workdir)))))
+
+
+def _scope_key(scope, run_id, workdir):
+    if scope == "global":
+        return "*"
+    if scope == "run":
+        return str(run_id or "")
+    if scope == "project":
+        return _path_key(workdir)
+    return ""
+
+
+def _prefix_tokens(value):
+    return tuple(str(value or "").strip().split())
+
+
+def _rule_matches(rule, command, run_id, workdir):
+    scope = rule.get("scope")
+    if scope not in ("run", "project", "global"):
+        return False
+    if _scope_key(scope, run_id, workdir) != rule.get("scope_key"):
+        return False
+    match = rule.get("match")
+    if match == "any":
+        return True
+    if match == "exact":
+        return _hash(command) == rule.get("command_hash")
+    if match == "prefix":
+        if _SHELL_META.search(command):
+            return False
+        tokens = _prefix_tokens(command)
+        prefix_hashes = rule.get("prefix_hashes") or []
+        return (bool(prefix_hashes) and len(tokens) >= len(prefix_hashes) and
+                [_hash(x) for x in tokens[:len(prefix_hashes)]] == prefix_hashes)
+    return False
+
+
+def _audit(state, action, command, request_id="", scope="", match=""):
+    entry = {"id": request_id or uuid.uuid4().hex[:16], "action": action,
+             "command": scrub_text(command, limit=240), "command_sha256": _hash(command),
+             "scope": scope or "", "match": match or "", "at": time.time()}
+    state["audit"] = (state.get("audit") or [])[-(_MAX_AUDIT - 1):] + [entry]
+
+
+def _bump_state():
+    try:
+        from . import store
+        store.bump_state()
+    except Exception:
+        pass
+
+
+def mode():
+    with _LOCK:
+        return _load()["mode"]
+
+
+def set_mode(value):
+    if value not in _MODES:
+        raise ValueError("mode 必须是 legacy/restricted")
+    with _LOCK:
+        state = _load()
+        changed = state["mode"] != value
+        state["mode"] = value
+        _persist(state)
+        if changed:
+            for request in _PENDING.values():
+                request["decision"] = {"allowed": False, "reason": "policy_changed"}
+                request["event"].set()
+    if changed:
+        _bump_state()
+    return value
+
+
+def _make_rule(command, scope, match, run_id, workdir, prefix=None):
+    if scope not in ("run", "project", "global"):
+        raise ValueError("持久规则 scope 必须是 run/project/global")
+    if match not in _MATCHES:
+        raise ValueError("match 必须是 exact/prefix/any")
+    if scope == "run" and not run_id:
+        raise ValueError("当前运行授权缺少 run_id")
+    if scope == "project" and not workdir:
+        raise ValueError("项目授权缺少工作目录")
+    rule = {"id": uuid.uuid4().hex[:16], "scope": scope,
+            "scope_key": _scope_key(scope, run_id, workdir), "match": match,
+            "command_preview": scrub_text(command if match != "any" else "*", 180),
+            "created_at": time.time()}
+    if match == "exact":
+        rule["command_hash"] = _hash(command)
+    elif match == "prefix":
+        raw_prefix = str(prefix or command or "").strip()
+        if not raw_prefix or _SHELL_META.search(raw_prefix) or _SHELL_META.search(command):
+            raise ValueError("前缀授权只支持不含 shell 控制符的单条命令")
+        tokens = _prefix_tokens(raw_prefix)
+        if not tokens or len(tokens) > len(_prefix_tokens(command)):
+            raise ValueError("授权前缀必须是本次请求命令的前缀")
+        if _prefix_tokens(command)[:len(tokens)] != tokens:
+            raise ValueError("授权前缀必须与本次请求命令开头一致")
+        rule["prefix_hashes"] = [_hash(token) for token in tokens]
+        rule["command_preview"] = scrub_text(raw_prefix, 180)
+    return rule
+
+
+def authorize(command, *, run_id="", workdir="", timeout_s=None,
+              deadline=None, cancel_event=None, source="run_command"):
+    command = str(command or "").strip()
+    if not command:
+        return {"allowed": False, "reason": "empty_command"}
+    with _LOCK:
+        state = _load()
+        if state["mode"] == "legacy":
+            return {"allowed": True, "reason": "legacy"}
+        matched = next((rule for rule in reversed(state["rules"])
+                       if _rule_matches(rule, command, run_id, workdir)), None)
+        if matched:
+            _audit(state, "allowed_by_rule", command,
+                   scope=matched.get("scope"), match=matched.get("match"))
+            _persist(state)
+            return {"allowed": True, "reason": "rule", "rule_id": matched.get("id")}
+        wait_s = _WAIT_SECONDS if timeout_s is None else max(0.0, float(timeout_s))
+        if deadline is not None:
+            wait_s = min(wait_s, max(0.0, float(deadline) - time.monotonic()))
+        if wait_s <= 0 or (cancel_event is not None and cancel_event.is_set()):
+            reason = "cancelled" if cancel_event is not None and cancel_event.is_set() else "timeout"
+            _audit(state, reason, command)
+            _persist(state)
+            return {"allowed": False, "reason": reason}
+        request_id = uuid.uuid4().hex[:16]
+        request = {"id": request_id, "command": command, "run_id": str(run_id or ""),
+                   "workdir": str(workdir or ""), "source": str(source or "")[:40],
+                   "created_at": time.time(), "event": threading.Event(), "decision": None}
+        _PENDING[request_id] = request
+        _audit(state, "requested", command, request_id=request_id)
+        _persist(state)
+    _bump_state()
+    expires = time.monotonic() + wait_s
+    decision = None
+    while time.monotonic() < expires:
+        if cancel_event is not None and cancel_event.is_set():
+            decision = {"allowed": False, "reason": "cancelled"}
+            break
+        if request["event"].wait(min(0.2, max(0.0, expires - time.monotonic()))):
+            decision = request.get("decision")
+            break
+    if decision is None:
+        decision = {"allowed": False, "reason": "timeout"}
+    with _LOCK:
+        _PENDING.pop(request_id, None)
+        state = _load()
+        _audit(state, decision.get("reason") or "denied", command,
+               request_id=request_id, scope=decision.get("scope", ""),
+               match=decision.get("match", ""))
+        _persist(state)
+    _bump_state()
+    return decision
+
+
+def pending_requests():
+    with _LOCK:
+        rows = []
+        for request in _PENDING.values():
+            rows.append({"id": request["id"], "command": scrub_text(request["command"], 500),
+                         "run_id": request["run_id"], "source": request["source"],
+                         "created_at": request["created_at"]})
+        return sorted(rows, key=lambda row: row["created_at"])
+
+
+def decide(request_id, *, approve, scope="once", match="exact", prefix=None):
+    if not isinstance(approve, bool):
+        raise ValueError("approve 必須是布尔值")
+    with _LOCK:
+        request = _PENDING.get(str(request_id or ""))
+        if request is None:
+            raise KeyError("命令授权请求不存在或已结束")
+        state = _load()
+        if approve:
+            if scope not in _SCOPES:
+                raise ValueError("scope 必须是 once/run/project/global")
+            if scope == "once":
+                rule = None
+            else:
+                rule = _make_rule(request["command"], scope, match,
+                                  request["run_id"], request["workdir"], prefix=prefix)
+                state["rules"].append(rule)
+            request["decision"] = {"allowed": True, "reason": "approved",
+                                   "rule_id": rule.get("id") if rule else "",
+                                   "scope": scope, "match": match}
+            _audit(state, "approved", request["command"], request_id=request["id"],
+                   scope=scope, match=match)
+        else:
+            request["decision"] = {"allowed": False, "reason": "denied"}
+            _audit(state, "denied_by_user", request["command"],
+                   request_id=request["id"])
+        _persist(state)
+        request["event"].set()
+    _bump_state()
+    return {"ok": True}
+
+
+def revoke(rule_id):
+    with _LOCK:
+        state = _load()
+        remaining = [rule for rule in state["rules"] if rule.get("id") != str(rule_id or "")]
+        if len(remaining) == len(state["rules"]):
+            raise KeyError("授权规则不存在")
+        state["rules"] = remaining
+        _audit(state, "revoked", "", request_id=str(rule_id or ""))
+        _persist(state)
+    _bump_state()
+    return True
+
+
+def view():
+    with _LOCK:
+        state = _load()
+        return {"mode": state["mode"], "rules": [dict(rule) for rule in state["rules"]],
+                "pending": pending_requests(),
+                "audit": [dict(row) for row in state["audit"][-100:]]}

package/app/core/gitmod.py

@@ -29,8 +29,12 @@ def valid_rev(rev):
 
 
 def _git(workdir, *args, timeout=20):
-    r = runner.run_process(argv=["git", *args], cwd=str(workdir), timeout=timeout)
-    return r
+    # fetch/pull/push 走 HTTPS 远端与安装链同根因：GitHub 的 HTTP/2 常被中间
+    # 设备掐断（"Error in the HTTP2 framing layer"），统一强制 HTTP/1.1；
+    # 本地命令不受该配置影响。延迟 import 防 L2 层内环。
+    from . import manager
+    return runner.run_process(argv=["git", *args], cwd=str(workdir), timeout=timeout,
+                              env=manager.git_http11_env())
 
 
 def _gh(workdir, *args, timeout=60):

package/app/core/jobs.py

@@ -56,6 +56,8 @@ AI_REPAIR_PROMPT = """你是环境工程师。在 __OS__ 上执行下面的安
 硬性约束：command 只能是本机包管理器的安装命令，前缀必须是 __ALLOW__ 之一，且不要带 sudo
 （命令非交互执行，sudo 会挂死；brew/npm 本身也拒绝 sudo）。
 给不出符合约束的安全命令时，safe 设为 false 且 command 留空。
+优先沿用失败命令的包管理器与安装形态（如原命令是 uv tool install 就继续用 uv，
+不要另起 pip 换安装面）；git 拉取类的网络抖动直接给原命令即可，传输层兜底由执行方处理。
 
 ## 失败的命令
 __CMD__
@@ -1180,8 +1182,7 @@ def _ai_repair(run_id, entry, ev, failed_cmd, orig_log):
                           summary="AI 建议命令未过白名单，需人工执行：%s（诊断：%s）" % (cmd, diagnosis))
         return False
     from . import paths
-    fix = runner.run_process(shell_cmd=cmd, cwd=str(paths.ROOT), timeout=1800,
-                             cancel_event=ev, log_path=str(log_abs))
+    fix = manager.run_install_cmd(cmd, cancel_event=ev, log_path=str(log_abs))
     manager.detect_all(force=True)
     with manager._LOCK:
         manager._STATE["versions"].pop(entry["id"], None)

package/app/core/manager.py

@@ -2019,6 +2019,64 @@ def _cmd_head_is_uv(cmd):
     return os.path.basename(stripped.split()[0]).lower() in ("uv", "uv.exe")
 
 
+# pip/uv 的 git+ 直装要从 GitHub 拉源码，国内链路对 GitHub 的 HTTP/2 常被中间设备
+# 掐断（git 报 "Error in the HTTP2 framing layer"，exit 128）——强制 HTTP/1.1 是
+# 标准绕法。用 GIT_CONFIG_* 环境变量注入，不动用户全局 git 配置；老 git 不识别
+# 这组变量时静默忽略，无害。
+_GIT_FLAKE_MARKERS = ("HTTP2 framing layer", "unable to access", "RPC failed",
+                      "Connection reset", "connection was reset", "Recv failure")
+
+
+def git_http11_env():
+    """git HTTPS 传输层 HTTP/1.1 兜底 env（返回新字典，调用方可自由合并）。
+
+    本模块是安装/工作台/git 插件拉取各执行面的共享源；L0 的 tlsctx 够不着
+    （L2 不准反向 import L0），runner 又在并行在制品里，故落在 manager。"""
+    return {"GIT_CONFIG_COUNT": "1",
+            "GIT_CONFIG_KEY_0": "http.version",
+            "GIT_CONFIG_VALUE_0": "HTTP/1.1"}
+
+
+def _git_safe_env(cmd):
+    """命令涉及 git+ 远端拉取时的 git 传输层兜底 env（只加键，不覆盖既有）。"""
+    if "git+" not in str(cmd or ""):
+        return {}
+    return git_http11_env()
+
+
+def _git_transport_flake(res):
+    """安装失败输出是否为 git 传输层抖动类错误（值得原地重试一次的那种）。
+
+    接受 run_process 结果字典，也接受纯文本 blob（gitmod/market_remote 的
+    subprocess 输出直接传字符串）。"""
+    if not isinstance(res, str):
+        res = "%s%s" % ((res or {}).get("stderr") or "", (res or {}).get("stdout") or "")
+    return any(m in res for m in _GIT_FLAKE_MARKERS)
+
+
+def run_install_cmd(cmd, cancel_event=None, log_path=None):
+    """安装类命令（目录页 install/upgrade 与 AI 修复命令）的统一执行面。
+
+    - uv 系挂镜像兜底（_uv_mirror_env，只补缺不覆盖）
+    - 带 git+ 拉取的命令强制 git 走 HTTP/1.1
+    - git 传输层抖动失败自动同命令重试一次——链路瞬断不值得烧一轮 AI 诊断
+    """
+    env = {}
+    if _cmd_head_is_uv(cmd):
+        env.update(_uv_mirror_env())
+    env.update(_git_safe_env(cmd))
+    res = runner.run_process(shell_cmd=cmd, cwd=str(paths.ROOT), timeout=1800,
+                             cancel_event=cancel_event, log_path=log_path,
+                             env=env or None)
+    if not res["ok"] and not res.get("cancelled") and _git_transport_flake(res):
+        res = runner.run_process(shell_cmd=cmd, cwd=str(paths.ROOT), timeout=1800,
+                                 cancel_event=cancel_event, log_path=log_path,
+                                 env=env or None,
+                                 audit_notes=["首跑 git 传输层抖动，同命令自动重试一次"])
+        res["retried"] = True
+    return res
+
+
 def _bootstrap_uv(cancel_event=None, log_path=None):
     """uv 不在本机时自动补装一个——安装按钮「点了就该装上」的契约兜底。
 
@@ -2096,10 +2154,7 @@ def run_mgmt_command(entry, op, cancel_event=None, log_path=None):
                     "error": "自动安装 uv 未成功（%s）。请手动安装：%s；"
                              "装完重启 CodeBee，再点一次安装。"
                              % (boot["detail"], _uv_install_hint())}
-    # uv 全家桶命令挂镜像兜底：Python 独立构建/包索引国内直连常断（只补缺不覆盖）
-    res = runner.run_process(shell_cmd=cmd, cwd=str(paths.ROOT),
-                             timeout=1800, cancel_event=cancel_event, log_path=log_path,
-                             env=_uv_mirror_env() if _cmd_head_is_uv(cmd) else None)
+    res = run_install_cmd(cmd, cancel_event=cancel_event, log_path=log_path)
     winget_noop = _winget_already_ok(cmd, op, res)
     detect_all(force=True)
     with _LOCK:

package/app/core/market_remote.py

@@ -843,13 +843,26 @@ def _download_git(entry, tmp):
     if inst.get("ref"):
         cmd += ["--branch", inst["ref"]]
     cmd += [inst["url"], str(dst)]
-    try:
-        proc = subprocess.run(cmd, capture_output=True, timeout=300,
-                              text=True, encoding="utf-8", errors="replace")
-    except subprocess.TimeoutExpired:
-        raise ValueError("git 克隆超时: %s" % inst["url"])
-    if proc.returncode != 0:
-        raise ValueError("git 克隆失败: %s" % (proc.stderr or "").strip()[-200:])
+    # git 走 HTTPS 拉远端与安装链同根因：国内链路对 GitHub 的 HTTP/2 常被中间
+    # 设备掐断（"Error in the HTTP2 framing layer"），manager.git_http11_env()
+    # 强制 HTTP/1.1；clone 已是最后一个下载通道，传输层抖动原地重试一次。
+    # 延迟 import：模块级挂 L2 重依赖会拖累 market 链加载。
+    from . import manager
+    env = os.environ.copy()
+    env.update(manager.git_http11_env())
+    for attempt in (1, 2):
+        try:
+            proc = subprocess.run(cmd, capture_output=True, timeout=300,
+                                  text=True, encoding="utf-8", errors="replace",
+                                  env=env)
+        except subprocess.TimeoutExpired:
+            raise ValueError("git 克隆超时: %s" % inst["url"])
+        if proc.returncode == 0:
+            break
+        err = (proc.stderr or "").strip()[-200:]
+        if attempt == 1 and manager._git_transport_flake(err):
+            continue
+        raise ValueError("git 克隆失败: %s" % err)
     root = dst / sub if sub else dst
     # 双保险：解析后必须仍在克隆目录内（防符号链接等绕过）
     if dst.resolve() != root.resolve() and dst.resolve() not in root.resolve().parents:

package/app/core/modelhub.py

@@ -2177,6 +2177,20 @@ def _model_bindable(prov, model):
     return True
 
 
+def _usable_default_model(prov, model=""):
+    """默认模型键位（model / model_easy / model_hard / 编排者配置）对账启用名单。
+
+    默认/难度模型是自由文本，与 models[] 的启停开关互不联动——键位指向已
+    停用/已删除的模型时不能冒充可用：回落该厂商启用名单首个；全停用返回
+    空串（调用方按「无默认模型」处理）。空键位本身合法（用网关默认），
+    也返回空。"""
+    model = (model or "").strip()
+    if model and _model_bindable(prov, model):
+        return model
+    names = [m.get("name") for m in _enabled_models(prov) if m.get("name")]
+    return names[0] if names else ""
+
+
 def _model_image_in(prov, model):
     """模型是否声明支持图片输入：models[] 条目 image_in；缺省/查不到=False（纯文本）。"""
     for m in ((prov or {}).get("models") or []):
@@ -2591,7 +2605,7 @@ def resolve_binding(agent_kind_or_id, difficulty="default"):
                 if len(entries) >= MAX_CHAIN_ATTEMPTS:
                     break
                 entries.append(_chain_entry_env(
-                    prov, model or prov.get("model") or "",
+                    prov, model or _usable_default_model(prov, prov.get("model")),
                     target=agent_kind_or_id, endpoint=ep, key=kk["key"],
                     key_id=kk.get("id") or "", provider_id=pid))
             if len(entries) >= MAX_CHAIN_ATTEMPTS:
@@ -2662,6 +2676,8 @@ def resolve_binding(agent_kind_or_id, difficulty="default"):
     model = prov.get("model_" + tier) or "" if (routing and tier) else ""
     if not model:
         model = prov.get("model") or ""
+    if model and not _model_bindable(prov, model):
+        model = ""   # 默认/难度模型键位指向停用或已删模型：不冒充可用，回落启用名单
     if not model and names:
         model = names[0] if (not routing or difficulty != "easy") else names[-1]
     if not _evaluation_is_usable(pid, model):
@@ -2724,7 +2740,9 @@ def recommend_binding(agent_kind_or_id, difficulty="default", task_type="", role
         names = [m.get("name") for m in _enabled_models(prov)
                  if isinstance(m, dict) and m.get("name")]
         if not names and prov.get("model"):
-            names = [str(prov.get("model"))]
+            dflt = str(prov.get("model"))
+            if _model_bindable(prov, dflt):   # 默认模型被停用时不再充作唯一候选
+                names = [dflt]
         # 候选阶段不能先截前三个：便宜档往往排在供应商列表后面，easy 任务
         # 需要看到完整启用列表后再按成本与档位评分。最终调用链仍受上限约束。
         for model in names:
@@ -3618,9 +3636,7 @@ def resolve_orchestrator():
     if not prov or not prov.get("enabled", True) or not prov.get("api_key"):
         return None
     model = (cfg.get("model") or "").strip() or prov.get("model") or ""
-    if not model:
-        names = _enabled_models(prov)
-        model = names[0]["name"] if names else ""
+    model = _usable_default_model(prov, model)   # 配置的模型被停用时回落启用名单，不冒充可用
     if not model:
         return None
     if not _evaluation_is_usable(pid, model):