fix step 1

.ci-retigger-marker

@@ -1 +0,0 @@
-CI re-trigger after runner add-host/DNS fix. This file is harmless and not referenced.

.ci-retrigger

@@ -1 +0,0 @@
-re-trigger

.ci-trigger

@@ -1,2 +1 @@
-CI trigger file - safe to delete
-retrigger at 2026-09-15 20:31:24 UTC
+# CI trigger Fri Jun 26 09:53:28 PM CST 2026

.env.example

@@ -1,232 +1,60 @@
-# ============================================================
-# 小虾 SaaS 环境变量完整配置
-# ============================================================
-# 本文件列出所有可配置的环境变量及默认值。
-# 复制为 .env 后按需修改；生产环境务必覆盖所有密钥类配置。
-#
-# 配置读取规则（pydantic-settings，大小写不敏感）：
-#   1. 系统环境变量（最高优先级）
-#   2. .env.{APP_ENV} 文件（如 .env.staging）
-#   3. .env 文件
-#   4. 代码中的默认值（最低优先级）
-# ============================================================
+# 小虾 SaaS 环境变量配置
 
-
-# ==================== 应用基本配置 ====================
-
-# 应用名称
-APP_NAME=xiaoxia-saas
-
-# 应用版本号（展示用，代码中已内置默认）
-APP_VERSION=0.1.61
-
-# 环境标识：development / staging / production
-# 决定读取 .env.{APP_ENV} 还是 .env，也影响部分配置的严格校验
+# ==================== 应用配置 ====================
+APP_NAME=小虾 SaaS
+APP_BASE_URL=http://localhost:3000
 APP_ENV=development
 
-# 是否开启 Debug 模式（开发环境 true，生产环境 false）
-DEBUG=true
-
-# 应用基础 URL，用于生成认证邮件、回调链接等
-APP_BASE_URL=http://localhost:3000
-
-# API 服务监听地址（容器内绑定，外部暴露由 Docker/Nginx 控制）
-API_HOST=0.0.0.0
-
-# API 服务监听端口
-API_PORT=8000
-
-# 是否自动创建数据库表结构（开发环境可开启，生产环境用 alembic migration）
-AUTO_CREATE_SCHEMA=false
-
-
 # ==================== 数据库配置 ====================
+DATABASE_URL=postgresql://xiaoxia_user:your_password@localhost:5432/xiaoxia_saas
 
-# 数据库连接串（格式：postgresql+psycopg://user:password@host:port/dbname）
-DATABASE_URL=postgresql+psycopg://postgres:postgres@localhost:5432/xiaoxia_saas
-
-# 连接池大小（常驻连接数）
-DATABASE_POOL_SIZE=20
-
-# 连接池最大溢出连接数（pool_size + max_overflow = 最大并发连接数）
-DATABASE_MAX_OVERFLOW=10
-
-# 获取连接超时时间（秒）
-DATABASE_POOL_TIMEOUT=30
-
-# 连接回收时间（秒），防止数据库端主动断开导致的死连接
-DATABASE_POOL_RECYCLE=3600
-
-# 是否使用内存数据库（SQLite，仅开发/测试可用；生产务必 false）
-USE_IN_MEMORY_DB=false
+# 开发环境：使用内存数据库（不需要 PostgreSQL）
+USE_IN_MEMORY_DB=true
 
+# 生产环境：使用 PostgreSQL
+# USE_IN_MEMORY_DB=false
 
 # ==================== Redis 配置 ====================
-
-# Redis 连接 URL（格式：redis://[:password@]host:port/db）
 REDIS_URL=redis://localhost:6379/0
 
-# 是否使用 Redis 存储 Session（多实例部署时必须开启；开发可用内存存储）
-ENABLE_REDIS_SESSIONS=false
-
-
-# ==================== Celery 任务队列 ====================
-
-# Celery Broker（任务分发），默认用 Redis db0
-CELERY_BROKER_URL=redis://localhost:6379/0
-
-# Celery Result Backend（任务结果存储），默认用 Redis db1
-CELERY_RESULT_BACKEND=redis://localhost:6379/1
-
-
-# ==================== Worker 配置 ====================
-
-# Worker 进程名称
-WORKER_NAME=xiaoxia-saas-worker
-
-# Worker 并发数（同时执行的任务数）
-WORKER_CONCURRENCY=4
-
-# 每个子进程最多处理多少任务后重启（防止内存泄漏）
-WORKER_MAX_TASKS_PER_CHILD=1000
-
-
-# ==================== JWT 认证配置 ====================
-
-# JWT 签名密钥 — 生产环境必须设置为强随机字符串（至少32字符）
-# 内置不安全值会被拒绝：secret / changeme / password / your-secret-key 等
+# ==================== JWT 配置 ====================
 JWT_SECRET_KEY=your-super-secret-key-change-this-in-production-min-32-chars
-
-# JWT 签名算法
 JWT_ALGORITHM=HS256
-
-# Access Token 过期时间（分钟）
 JWT_ACCESS_TOKEN_EXPIRE_MINUTES=30
-
-# Refresh Token 过期时间（天）
 JWT_REFRESH_TOKEN_EXPIRE_DAYS=30
 
-
 # ==================== 邮件配置 ====================
-
-# 是否启用邮件投递（关闭时邮件内容打印到日志，开发调试用）
-ENABLE_EMAIL_DELIVERY=false
-
-# SMTP 服务器地址
 SMTP_HOST=smtp.gmail.com
-
-# SMTP 端口
 SMTP_PORT=587
-
-# SMTP 用户名
 SMTP_USER=your-email@gmail.com
-
-# SMTP 密码 / 应用专用密码
 SMTP_PASSWORD=your-app-specific-password
-
-# 发件人邮箱
 SMTP_FROM_EMAIL=noreply@xiaoxia-saas.com
-
-# 发件人显示名称
 SMTP_FROM_NAME=小虾 SaaS
 
-# 是否启用 TLS
-SMTP_USE_TLS=true
-
-
-# ==================== 阿里云 OSS 配置 ====================
-
-# OSS 区域 endpoint
-OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com
-
-# OSS Access Key ID — 非开发环境必须设置
-OSS_ACCESS_KEY_ID=your-access-key-id
-
-# OSS Access Key Secret — 非开发环境必须设置
-OSS_ACCESS_KEY_SECRET=your-access-key-secret
-
-# OSS Bucket 名称
-OSS_BUCKET_NAME=xiaoxia-autocut
-
-# 直传最大文件大小（MB）
-OSS_DIRECT_UPLOAD_MAX_MB=2000
-
-# 直传签名有效期（秒）
-OSS_DIRECT_UPLOAD_EXPIRE_SECONDS=900
-
+# ==================== 环境配置 ====================
+ENVIRONMENT=development
+DEBUG=true
 
 # ==================== CORS 配置 ====================
+# 逗号分隔的域名列表（Settings 读取 CORS_ORIGINS_RAW）
+CORS_ORIGINS_RAW=http://localhost:3000,http://localhost:5173
 
-# 允许跨域的前端域名列表，逗号分隔
-CORS_ORIGINS_RAW=http://localhost:3000,http://localhost:5173,http://localhost:8000
-
-
-# ==================== 渲染引擎配置 ====================
-
-# 渲染引擎选择：
-#   legacy   — 旧 VideoComposeService（稳定，功能完整）
-#   unified  — 新 UnifiedRenderService（新架构，部分场景仍在验证）
-RENDER_ENGINE=legacy
-
-
-# ==================== CosyVoice 语音合成 ====================
-# 阿里云百灵语音合成服务
-# 模型选择：
-#   cosyvoice-v3-flash  — 推荐，系统音色多，性价比高
-#   cosyvoice-v3-plus   — 高质量，系统音色少
-#   cosyvoice-v3.5-flash / cosyvoice-v3.5-plus — 仅支持克隆/设计音色，无系统音色
-# 音色：v3 系列系统音色带 _v3 后缀，如 longxiaochun_v3 / longxiaoxia_v3 / longanyang
+# ==================== 阿里云 OSS 配置 ====================
+OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com
+OSS_ACCESS_KEY_ID=your-access-key-id
+OSS_ACCESS_KEY_SECRET=your-access-key-secret
+OSS_BUCKET_NAME=xiaoxia-autocut
 
+# ==================== CosyVoice 语音合成配置 ====================
+# 注意：base_url 只需写到 /api/v1，具体路径由代码拼接
+# 模型: cosyvoice-v3-flash (推荐，支持系统音色，性价比高)
+#       cosyvoice-v3-plus (高质量，系统音色少)
+#       cosyvoice-v3.5-flash / cosyvoice-v3.5-plus (仅支持克隆/设计音色，无系统音色)
+# 音色: v3系列系统音色带 _v3 后缀，如 longxiaochun_v3, longxiaoxia_v3, longanyang (无后缀)
+# 注意：COSYVOICE_* 变量由 packages/shared/config.py 的 SharedSettings 读取
 COSYVOICE_API_KEY=your-cosyvoice-api-key
 COSYVOICE_BASE_URL=https://dashscope.aliyuncs.com/api/v1
 COSYVOICE_MODEL=cosyvoice-v3-flash
 COSYVOICE_VOICE=longxiaochun_v3
 COSYVOICE_SAMPLE_RATE=22050
 COSYVOICE_FORMAT=mp3
-
-# 音色克隆模型名（固定为 voice-enrollment，通常不需修改）
-COSYVOICE_CLONE_MODEL=voice-enrollment
-
-
-# ==================== 豆包大模型（火山引擎方舟） ====================
-# 用于 AI 文案生成、智能剪辑等需要大模型能力的场景
-
-DOUBAO_API_KEY=your-doubao-api-key
-DOUBAO_MODEL=doubao-seed-1-6-250615
-DOUBAO_BASE_URL=https://ark.cn-beijing.volces.com/api/v3
-DOUBAO_TIMEOUT=30
-DOUBAO_MAX_RETRIES=2
-
-# ==================== 积分/会员系统 (#1895) ====================
-# 积分扣点总开关：默认 false（对现有用户零影响）。
-# P2 阶段各业务路由逐个接入 @points_gate 时，用
-#   `if settings.points_enabled: ...`
-# 包裹扣点逻辑；所有路由接入完成并验证通过后再在 staging/prod 打开。
-POINTS_ENABLED=false
-
-# ==================== 抖音解析多源轮询 (#1963) ====================
-# 无需配置 Key 也可使用（P0 免费源可用），配置 Key 可增加兜底能力
-
-# TikHub API Key (https://tikhub.io) — $0.001/次起，注册送$0.05
-TIKHUB_API_KEY=
-
-# apizero.cn API Key (https://v1.apizero.cn) — 国内抖音解析服务
-APIZERO_API_KEY=
-
-# ==================== GPU MuseTalk Worker（反向轮询口型同步）====================
-# GPU Worker 长期鉴权 Token，Worker 端 .env 的 GPU_WORKER_TOKEN 必须与此一致
-# 留空时 development 环境允许匿名访问（仅本地调试），staging/production 必须配置
-GPU_WORKER_TOKEN=
-# 单任务超时（秒），processing 超过此时长无任务心跳才回退 pending 或标记 failed
-# #1970：RTX2060 6G 推理 720p 长视频需 5 分钟以上，默认 900
-GPU_TASK_TIMEOUT_SECONDS=900
-# 是否启用 GPU 口型同步（开关）。开启后需同时有 Worker 在心跳窗口内（5分钟）才会走 GPU 路径；
-# 开关关闭 / 无可用 Worker / GPU 任务失败或超时 → 自动回退现有 MediaKit 云端 lipsync
-USE_GPU_LIPSYNC=false
-# 业务侧轮询 GPU 任务结果的间隔（秒）
-GPU_LIPSYNC_POLL_INTERVAL=5
-# 业务侧等待 GPU 任务总超时（秒）；超时回退 MediaKit
-GPU_LIPSYNC_WAIT_TIMEOUT=1200
-# Worker 心跳新鲜度窗口（秒），last_heartbeat_at 在此窗口内视为在线
-GPU_WORKER_STALE_SECONDS=300
-

.env.production.example

@@ -5,6 +5,7 @@ APP_ENV=production
 ENVIRONMENT=production
 DEBUG=false
 USE_IN_MEMORY_DB=false
+LOG_LEVEL=WARNING
 
 # ==================== 数据库（必须修改）====================
 DATABASE_URL=postgresql://prod_user:CHANGE_THIS_PASSWORD@db-prod:5432/xiaoxia_prod

.flake8

@@ -0,0 +1,14 @@
+[flake8]
+max-line-length = 120
+exclude =
+    .git,
+    .cache,
+    __pycache__,
+    .venv,
+    venv,
+    node_modules,
+    alembic
+
+per-file-ignores =
+    tests/integration/*:F821
+    tests/unit/*:F821

.gitea/workflows/acr-cleanup.yml

@@ -1,161 +0,0 @@
-name: ACR Cleanup
-
-on:
-  schedule:
-    - cron: '0 19 * * *'  # UTC 19:00 = 北京时间凌晨3:00
-  workflow_dispatch:
-    inputs:
-      pr_sha:
-        description: "PR commit SHA（仅清理指定PR镜像，留空则全量清理）"
-        required: false
-        default: ""
-      dry_run:
-        description: "预览模式（dry-run），不实际删除"
-        required: false
-        default: "true"
-  pull_request_target:
-    types: [closed]
-    branches: [develop, main]
-
-concurrency:
-  group: acr-cleanup-${{ gitea.ref }}
-  cancel-in-progress: false
-
-jobs:
-  cleanup:
-    name: ACR Image Cleanup
-    runs-on: ci-l2
-    timeout-minutes: 20
-    permissions:
-      contents: read
-    env:
-      ACR_REGISTRY: xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com
-      ACR_NAMESPACE: xiaoxiakeji
-      ACR_SERVICE: registry.aliyuncs.com:cn-hangzhou:china:cri-fvec8o9q4mmxrkaa
-      GITEA_URL: https://git.xiaoxiajianji.com
-      GITEA_REPO: xiaoxia/xiaoxia-saas
-    steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"             | bash
-
-      # ====== Cron模式：获取staging运行中镜像作为白名单 ======
-      - name: Get staging running images (whitelist)
-        id: protected_images
-        if: gitea.event_name != 'pull_request_target' && !gitea.event.inputs.pr_sha
-        env:
-          STAGING_SSH_KEY: ${{ secrets.PREVIEW_SSH_KEY }}
-        run: |
-          set +e
-          echo "获取staging服务器运行中镜像作为白名单..."
-          mkdir -p ~/.ssh
-          echo "$STAGING_SSH_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-
-          staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
-          staging_port="${STAGING_SSH_PORT:-22222}"
-
-          ssh-keyscan -p "$staging_port" -H "$staging_host" >> ~/.ssh/known_hosts 2>/dev/null
-
-          # 获取所有运行容器的镜像，提取tag部分
-          IMAGES=$(ssh -p "$staging_port" -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no \
-            "root@$staging_host" "docker ps --format '{{.Image}}' 2>/dev/null" 2>/dev/null | grep -v "^$" | sort -u)
-
-          PROTECTED_TAGS=""
-          if [ -n "$IMAGES" ]; then
-            while IFS= read -r img; do
-              # 从完整镜像名中提取tag（最后一个冒号后）
-              tag=$(echo "$img" | rev | cut -d: -f1 | rev)
-              if [ -n "$tag" ] && [ "$tag" != "latest" ] && [ ${#tag} -gt 5 ]; then
-                if [ -z "$PROTECTED_TAGS" ]; then
-                  PROTECTED_TAGS="$tag"
-                else
-                  PROTECTED_TAGS="$PROTECTED_TAGS,$tag"
-                fi
-              fi
-            done <<< "$IMAGES"
-          fi
-
-          echo "staging运行中镜像tag: ${PROTECTED_TAGS:-（无）}"
-          echo "protected_tags=$PROTECTED_TAGS" >> $GITEA_OUTPUT
-
-      # ====== Docker登录 ======
-      - name: Docker login to ACR
-        env:
-          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
-        run: |
-          printf '%s' "$ACR_PASSWORD" | docker login "$ACR_REGISTRY" -u "$ACR_USERNAME" --password-stdin
-
-      # ====== 模式1：PR关闭时清理 ======
-      - name: Cleanup PR images (PR closed)
-        if: gitea.event_name == 'pull_request_target'
-        env:
-          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          PR_SHA: ${{ gitea.event.pull_request.head.sha }}
-          PR_NUMBER: ${{ gitea.event.pull_request.number }}
-        run: |
-          echo "============================================"
-          echo "  PR #$PR_NUMBER 已关闭，清理对应镜像"
-          echo "  Head SHA: ${PR_SHA::12}"
-          echo "============================================"
-          echo ""
-          python3 scripts/ci/acr_cleanup.py \
-            --pr-sha "$PR_SHA" \
-            --execute
-
-      # ====== 模式2：Cron全量清理 ======
-      - name: Full cleanup (cron / manual)
-        if: gitea.event_name != 'pull_request_target' && !gitea.event.inputs.pr_sha
-        env:
-          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          PROTECTED_TAGS: ${{ steps.protected_images.outputs.protected_tags }}
-          DRY_RUN_INPUT: ${{ gitea.event.inputs.dry_run }}
-        run: |
-          echo "============================================"
-          echo "  ACR 全量清理（${{ gitea.event_name }}）"
-          echo "============================================"
-          echo ""
-
-          # 决定是否dry-run
-          DRY_RUN_FLAG=""
-          if [ "$DRY_RUN_INPUT" = "true" ]; then
-            DRY_RUN_FLAG="--dry-run"
-            echo "模式: 预览模式 (dry-run)"
-          else
-            echo "模式: 执行模式"
-          fi
-          echo ""
-
-          python3 scripts/ci/acr_cleanup.py \
-            --keep 20 \
-            --protected-tags "$PROTECTED_TAGS" \
-            $DRY_RUN_FLAG
-
-      # ====== 模式3：手动指定PR SHA清理 ======
-      - name: Cleanup specific PR image (manual)
-        if: gitea.event_name == 'workflow_dispatch' && gitea.event.inputs.pr_sha
-        env:
-          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
-          PR_SHA: ${{ gitea.event.inputs.pr_sha }}
-          DRY_RUN_INPUT: ${{ gitea.event.inputs.dry_run }}
-        run: |
-          echo "手动清理PR镜像: ${PR_SHA::12}"
-          echo ""
-
-          DRY_RUN_FLAG=""
-          if [ "$DRY_RUN_INPUT" = "true" ]; then
-            DRY_RUN_FLAG="--dry-run"
-          fi
-
-          python3 scripts/ci/acr_cleanup.py \
-            --pr-sha "$PR_SHA" \
-            $DRY_RUN_FLAG

.gitea/workflows/add-ubuntu-2204-label.yml

@@ -0,0 +1,38 @@
+name: add-ubuntu-2204-label
+on:
+  workflow_dispatch:
+
+jobs:
+  fix:
+    runs-on: saas
+    steps:
+      - name: add-label-to-all-runners
+        run: |
+          docker run --rm --privileged --pid=host alpine nsenter -t 1 -m -u -n -i sh << 'HOSTCMD'
+          set -e
+          
+          DB="/var/lib/gitea/data/gitea.db"
+          
+          echo "=== BEFORE ==="
+          sqlite3 "$DB" "SELECT id, name, agent_labels FROM action_runner WHERE status=0 ORDER BY id;"
+          
+          echo ""
+          echo "=== Adding ubuntu-22.04 label ==="
+          sqlite3 "$DB" "
+          UPDATE action_runner
+          SET agent_labels = json_insert(agent_labels, '\$[#]', 'ubuntu-22.04')
+          WHERE status = 0
+            AND json_type(agent_labels) = 'array'
+            AND id NOT IN (
+              SELECT id FROM action_runner, json_each(agent_labels)
+              WHERE value = 'ubuntu-22.04'
+            );
+          "
+          
+          echo ""
+          echo "=== AFTER ==="
+          sqlite3 "$DB" "SELECT id, name, agent_labels FROM action_runner WHERE status=0 ORDER BY id;"
+          
+          echo ""
+          echo "=== DONE ==="
+          HOSTCMD

.gitea/workflows/api-base-image.yml

@@ -1,84 +0,0 @@
-name: API Base Image Build
-
-on:
-  push:
-    branches:
-      - develop
-      - main
-    paths:
-      - 'requirements-base.txt'
-      - 'requirements.txt'
-      - 'infra/docker/api-base.Dockerfile'
-  workflow_dispatch:
-
-jobs:
-  build-api-base:
-    name: Build API Base Image
-    runs-on: runtime-builder
-    timeout-minutes: 45
-    steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        curl -sH "Authorization: token $GITHUB_TOKEN" \
-          "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
-          | bash
-
-    - name: Docker login to Registry
-      shell: sh
-      env:
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
-        GITEA_REGISTRY_USER: xiaoxia
-        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-      run: |
-        set -eu
-        for i in 1 2 3; do
-          echo "=== Docker login 尝试 $i/3 ==="
-          if printf '%s' "${ACR_PASSWORD}" | docker login xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com -u "${ACR_USERNAME}" --password-stdin \
-              && docker login git.xiaoxiajianji.com -u "${GITEA_REGISTRY_USER}" -p "${GITEA_REGISTRY_TOKEN}"; then
-            echo "✅ Docker login successful"
-            break
-          fi
-          echo "❌ Docker login 失败（尝试 $i/3），5s 后重试..."
-          sleep 5
-        done
-
-    - name: Build and push API base image
-      shell: sh
-      run: |
-        set -eu
-        ACR_IMAGE="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/saas-api-base:latest"
-        GITEA_IMAGE="git.xiaoxiajianji.com/xiaoxia-saas/saas-api-base:latest"
-
-        echo "=== Building API base image ==="
-
-        # 使用普通 docker build（单平台不需要 buildx）
-        docker build \
-          -f infra/docker/api-base.Dockerfile \
-          -t "${ACR_IMAGE}" \
-          .
-
-        echo ""
-        echo "✅ Image built successfully"
-
-        # 推送到 ACR
-        echo "=== Pushing to ACR ==="
-        docker push "${ACR_IMAGE}"
-        echo "✅ Pushed to ACR"
-
-        # 打标签并推送到 Gitea Packages 作为备份
-        echo "=== Pushing to Gitea Packages ==="
-        docker tag "${ACR_IMAGE}" "${GITEA_IMAGE}"
-        docker push "${GITEA_IMAGE}" || echo "⚠️ Gitea Packages push failed (non-fatal)"
-        echo "✅ Gitea backup push completed"
-
-    - name: Cleanup
-      if: always()
-      shell: sh
-      run: |
-        ACR_IMAGE="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/saas-api-base:latest"
-        docker rmi "${ACR_IMAGE}" 2>/dev/null || true
-        echo "Cleanup done"

.gitea/workflows/ci-base-image.yml

@@ -1,105 +0,0 @@
-name: CI Base Image Build
-
-on:
-  push:
-    branches:
-      - develop
-      - main
-    paths:
-      - 'requirements-base.txt'
-      - 'requirements-dev.txt'
-      - 'infra/docker/ci.Dockerfile'
-  workflow_dispatch:
-    inputs:
-      reason:
-        description: "触发原因"
-        required: false
-        default: "手动触发 - ci-base 镜像重建"
-
-concurrency:
-  group: ci-base-image-build
-  cancel-in-progress: false
-
-jobs:
-  build-ci-base:
-    name: Build CI Base Image
-    runs-on: runtime-builder
-    timeout-minutes: 60
-    steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        curl -sH "Authorization: token $GITHUB_TOKEN" \
-          "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
-          | bash
-
-    - name: Docker login to Gitea Registry
-      shell: sh
-      env:
-        GITEA_REGISTRY_USER: xiaoxia
-        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-      run: |
-        set -eu
-        for i in 1 2 3; do
-          echo "=== Docker login 尝试 $i/3 ==="
-          if docker login git.xiaoxiajianji.com -u "${GITEA_REGISTRY_USER}" -p "${GITEA_REGISTRY_TOKEN}"; then
-            echo "✅ Docker login successful"
-            break
-          fi
-          echo "❌ Docker login 失败（尝试 $i/3），5s 后重试..."
-          sleep 5
-        done
-
-    - name: Build and push CI base image
-      shell: sh
-      run: |
-        set -eu
-        IMAGE="git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/ci-base"
-        VERSION_TAG="deps-$(date +%Y%m%d-%H%M)-${GITHUB_SHA::8}"
-
-        echo "=== Building CI base image (tags: latest, ${VERSION_TAG}) ==="
-        docker build --progress=plain \
-          -f infra/docker/ci.Dockerfile \
-          -t "${IMAGE}:latest" \
-          -t "${IMAGE}:${VERSION_TAG}" \
-          .
-        echo "✅ Image built successfully"
-
-        echo "=== Pushing ${VERSION_TAG} ==="
-        docker push "${IMAGE}:${VERSION_TAG}"
-        echo "=== Pushing latest ==="
-        docker push "${IMAGE}:latest"
-        echo "✅ Pushed to Gitea Registry"
-
-    - name: Verify image
-      shell: sh
-      run: |
-        set -eu
-        IMAGE="git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/ci-base:latest"
-        echo "=== Verifying pinned deps in fresh image ==="
-        docker run --rm "${IMAGE}" /opt/xiaoxia-ci-venv/bin/python -c \
-          "import httpcore, h2, numpy, httpx; print('VERSIONS:', httpcore.__version__, h2.__version__, numpy.__version__, httpx.__version__)"
-
-    - name: Notify result
-      if: always()
-      continue-on-error: true
-      shell: sh
-      env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
-      run: |
-        set +e
-        if [ "${{ job.status }}" = "success" ]; then
-          NOTIFY_MODE=success JOB_NAME="CI Base Image Build" python3 scripts/ci_notify.py
-        else
-          NOTIFY_MODE=failure JOB_NAME="CI Base Image Build" python3 scripts/ci_notify.py
-        fi
-
-    - name: Cleanup
-      if: always()
-      shell: sh
-      run: |
-        IMAGE="git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/ci-base"
-        docker rmi "${IMAGE}:latest" 2>/dev/null || true
-        echo "Cleanup done"

.gitea/workflows/ci-canary.yml

@@ -1,51 +0,0 @@
-name: CI Canary Check
-on:
-  schedule:
-    - cron: '*/30 * * * *'
-  workflow_dispatch:
-
-jobs:
-  canary:
-    runs-on: ci-l2
-    timeout-minutes: 10
-    steps:
-      - name: Canary (runner -> docker -> network -> gitea)
-        run: |
-          set -e
-          echo "== runner/container basic =="
-          date; hostname; whoami
-          echo "== gitea api reachability =="
-          code=$(curl -s -o /tmp/v.json -w '%{http_code}' -m 15 "$GITHUB_API_URL/version")
-          echo "gitea api http_code=$code"
-          [ "$code" = "200" ] || { echo "::error::Gitea API unreachable, http_code=$code"; exit 1; }
-          cat /tmp/v.json; echo
-          echo "== external egress =="
-          ext=$(curl -s -o /dev/null -w '%{http_code}' -m 15 https://www.baidu.com || echo 000)
-          echo "external http_code=$ext"
-          echo "== gitea domain resolves NOT to loopback =="
-          set -o pipefail
-          ip=$(getent hosts git.xiaoxiajianji.com | awk '{print $1}' | head -1)
-          echo "git.xiaoxiajianji.com -> $ip"
-          if [ -z "$ip" ]; then
-            echo "::error::DNS resolution failed, git.xiaoxiajianji.com unresolvable"; exit 1
-          fi
-          if [ "$ip" = "127.0.0.1" ] || [ "$ip" = "::1" ]; then
-            echo "::error::Gitea domain resolves to loopback inside job container (hosts/DNS leak)"; exit 1
-          fi
-          echo "CANARY OK"
-      - name: Notify failure
-        if: failure()
-        env:
-          CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
-        run: |
-          set +e
-          if [ -n "$CI_NOTIFY_WEBHOOK" ]; then
-            MSG="🚨 CI 金丝雀失败：runner->docker->网络->Gitea 链路异常，时间 $(date '+%Y-%m-%d %H:%M:%S')，请立即检查构建服务器"
-            python3 - "$CI_NOTIFY_WEBHOOK" "$MSG" <<'PY'
-          import json,sys,urllib.request
-          hook,msg=sys.argv[1],sys.argv[2]
-          data=json.dumps({"msg_type":"text","content":{"text":msg}}).encode()
-          urllib.request.urlopen(urllib.request.Request(hook,data=data,headers={"Content-Type":"application/json"}),timeout=10)
-          PY
-          fi
-          exit 0

.gitea/workflows/ci-failure-monitor.yml

@@ -1,78 +0,0 @@
-name: CI Failure Monitor
-
-on:
-  schedule:
-    - cron: '0 */6 * * *'  # 每6小时检查一次
-  workflow_dispatch:
-    inputs:
-      days:
-        description: '统计最近N天的失败'
-        required: false
-        default: '7'
-      fail_threshold:
-        description: '失败次数阈值'
-        required: false
-        default: '3'
-      fail_rate_threshold:
-        description: '失败率阈值(%)'
-        required: false
-        default: '30'
-
-permissions:
-  contents: read
-
-jobs:
-  monitor:
-    name: CI重复失败检测
-    runs-on: ci-l2
-    timeout-minutes: 10
-
-    steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        curl -sH "Authorization: token $GITHUB_TOKEN" \
-          "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
-          | bash
-
-    - name: Record job start time
-      shell: sh
-      run: bash scripts/ci/step_timer_start.sh
-
-    - name: Run failure detection
-      shell: sh
-      env:
-        GITEA_API_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
-        GITEA_URL: https://git.xiaoxiajianji.com
-        GITEA_REPO: xiaoxia/xiaoxia-saas
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
-        FAIL_CHECK_DAYS: ${{ inputs.days || 7 }}
-        FAIL_THRESHOLD: ${{ inputs.fail_threshold || 3 }}
-        FAIL_RATE_THRESHOLD: ${{ inputs.fail_rate_threshold || 30 }}
-      run: |
-        set +e
-        python3 scripts/ci/ci_repeated_failure_detector.py
-        EXIT_CODE=$?
-        echo "检测完成，退出码: $EXIT_CODE"
-        # 0=无异常, 1=有警告, 2=有严重问题
-        # 监控脚本永远不fail，避免告警风暴
-        exit 0
-
-    - name: Job duration summary
-      if: always()
-      shell: sh
-      run: bash scripts/ci/step_timer_end.sh
-
-    - name: Report CI trace
-      if: always()
-      shell: sh
-      env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-      run: |
-        STATUS="ok"
-        [ ${{ job.status }} = "success" ] || STATUS="error"
-        START_TIME=""
-        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true

.gitea/workflows/ci-health-daily.yml

@@ -1,103 +0,0 @@
-name: CI Health Daily Report
-on:
-  schedule:
-    - cron: '0 1 * * *'  # UTC 01:00 = 北京时间 09:00
-  workflow_dispatch:
-permissions:
-  contents: read
-jobs:
-  ci-health-report:
-    name: CI健康度每日巡检
-    runs-on: ci-l2
-    timeout-minutes: 15
-    steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        set -eu
-        python3 - <<'PY'
-        import io, os, tarfile, time, urllib.request, urllib.error
-        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-        last_err = None
-        for attempt in range(5):
-            try:
-                with urllib.request.urlopen(request, timeout=120) as response:
-                    archive = response.read()
-                break
-            except urllib.error.HTTPError as e:
-                last_err = e
-                if e.code >= 500 and attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-            except Exception as e:
-                last_err = e
-                if attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-        else:
-            raise last_err
-        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-            for member in tar.getmembers():
-                name = member.name
-                if name == root_prefix[:-1]:
-                    continue
-                if name.startswith(root_prefix):
-                    member.name = name[len(root_prefix):]
-                if member.name:
-                    tar.extract(member, '.')
-        PY
-
-    - name: Generate CI Dashboard HTML
-      shell: sh
-      env:
-        GITEA_TOKEN: ${{ github.token }}
-      run: |
-        set +e
-        echo "=== 生成 CI 健康度 HTML 看板 ==="
-        echo "时间: $(date '+%Y-%m-%d %H:%M:%S')"
-        echo ""
-        python3 scripts/ci/ci_dashboard.py --days 7 --html --html-output ci_dashboard.html
-        EXIT_CODE=$?
-        if [ $EXIT_CODE -eq 0 ] && [ -f ci_dashboard.html ]; then
-            HTML_SIZE=$(wc -c < ci_dashboard.html)
-            echo ""
-            echo "✅ HTML 看板生成成功 (${HTML_SIZE} bytes)"
-            echo "路径: $(pwd)/ci_dashboard.html"
-            # 输出文件内容前几行，方便在 Actions 日志中确认
-            echo ""
-            echo "--- 看板预览 (前 5 行) ---"
-            head -5 ci_dashboard.html
-            echo "...（完整内容见产物文件）"
-        else
-            echo "❌ HTML 看板生成失败 (exit code: $EXIT_CODE)"
-        fi
-        echo ""
-        # 永远成功，看板生成失败不影响主流程
-        exit 0
-
-    - name: Run CI health check and report
-      shell: sh
-      env:
-        GITEA_TOKEN: ${{ github.token }}
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
-      run: |
-        set +e
-        echo "=== CI健康度每日巡检 ==="
-        echo "时间: $(date '+%Y-%m-%d %H:%M:%S')"
-        echo ""
-        python3 scripts/ci/ci_health_report.py --limit 30
-        EXIT_CODE=$?
-        echo ""
-        echo "巡检完成 (exit code: $EXIT_CODE)"
-        # 永远成功，不影响CI状态（通知失败不应该标红）
-        exit 0

.gitea/workflows/ci-trigger-monitor.yml

@@ -1,52 +0,0 @@
-name: CI Trigger Monitor
-
-on:
-  schedule:
-    - cron: '*/10 * * * *'  # 每10分钟检查一次（与pr-auto-scan同步降频）
-  workflow_dispatch:
-    inputs:
-      stale_threshold:
-        description: 'CI未触发告警阈值（分钟）'
-        required: false
-        default: '10'
-
-permissions:
-  contents: read
-
-jobs:
-  monitor:
-    name: Monitor CI Trigger Reliability
-    runs-on: ci-l2
-    timeout-minutes: 5
-    steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"             | bash
-      
-      - name: Check CI trigger status for all open PRs
-        env:
-          GITEA_API_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
-          GITEA_URL: https://git.xiaoxiajianji.com
-          GITEA_REPO: xiaoxia/xiaoxia-saas
-          CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
-          STALE_THRESHOLD_MIN: ${{ inputs.stale_threshold || 5 }}
-        run: |
-          set +e
-          python3 scripts/ci_trigger_monitor.py
-          # 监控脚本永远不fail，避免告警风暴
-          exit 0
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ ${{ job.status }} = "success" ] || STATUS="error"
-          START_TIME=""
-          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-

.gitea/workflows/code-review.yml

@@ -1,79 +0,0 @@
-name: AI Code Review
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-
-# 同一个 PR 只跑一个 review，新的取消旧的
-concurrency:
-  group: code-review-${{ gitea.repository }}-${{ gitea.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  code-review:
-    name: AI Code Review
-    runs-on: ci-l2
-    # 跳过草稿 PR
-    if: ${{ !gitea.event.pull_request.draft }}
-
-    steps:
-      # actions/checkout 由 runner 在宿主机层面处理，不受容器网络影响
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"             | bash
-
-      - name: Install dependencies
-        run: |
-          # 确保 python3-pip 可用（兼容不同基础镜像）
-          if ! python3 -m pip --version >/dev/null 2>&1; then
-            apt-get update -qq && apt-get install -y -qq python3-pip python3-venv >/dev/null 2>&1
-          fi
-          # 部分镜像 ensurepip 方式兜底
-          if ! python3 -m pip --version >/dev/null 2>&1; then
-            python3 -m ensurepip --upgrade 2>/dev/null || curl -sS https://bootstrap.pypa.io/get-pip.py | python3
-          fi
-          python3 -m pip install --upgrade pip
-          python3 -m pip install requests
-
-      - name: Run AI Code Review
-        env:
-          # Gitea 配置（自动从运行环境获取）
-          GITEA_API_URL: ${{ gitea.server_url }}
-          GITEA_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
-          REPO_NAME: ${{ gitea.repository }}
-          PR_NUMBER: ${{ gitea.event.pull_request.number }}
-          PR_HEAD_SHA: ${{ gitea.event.pull_request.head.sha }}
-          # LLM 提供商: coze (扣子原生Bot) / openai (OpenAI兼容)
-          LLM_PROVIDER: "coze"
-          # 扣子模式配置（默认国内站 api.coze.cn）
-          LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
-          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
-          COZE_BOT_ID: ${{ secrets.COZE_BOT_ID }}
-          LLM_MODEL: ${{ secrets.LLM_MODEL }}
-          # 可选参数
-          MAX_DIFF_CHARS: "30000"
-          LLM_TIMEOUT: "120"
-        run: |
-          python3 scripts/ci_code_review.py
-        # 注意：脚本退出码决定job状态
-        # - 有阻塞级问题 → exit 1 → job失败 → 门禁拦截
-        # - 无阻塞级问题/LLM异常 → exit 0 → 通过（fail-open）
-
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ ${{ job.status }} = "success" ] || STATUS="error"
-          START_TIME=""
-          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-

.gitea/workflows/daily-check.yml

@@ -1,5 +1,4 @@
 name: Daily Health Check
-# 注意：使用 curl step_checkout.sh 方式以兼容 docker runner
 
 on:
   schedule:
@@ -13,7 +12,7 @@ jobs:
   # ── 1. 生产环境冒烟测试 ─────────────────────────────────────────────
   production-smoke:
     name: Production Smoke Test
-    runs-on: ci-l2
+    runs-on: saas
     timeout-minutes: 8
     outputs:
       report: ${{ steps.smoke.outputs.report }}
@@ -24,9 +23,47 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          curl -sH "Authorization: token $GITHUB_TOKEN" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
-            | bash
+          set -eu
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Production health check & smoke test
         id: smoke
         shell: sh
@@ -69,25 +106,13 @@ jobs:
           echo "======================================"
           exit $SMOKE_EXIT
 
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ ${{ job.status }} = "success" ] || STATUS="error"
-          START_TIME=""
-          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   # ── 2. Staging API 集成测试 ─────────────────────────────────────────
   staging-api-tests:
     name: Staging API Integration Tests
-    runs-on: ci-l2
+    runs-on: saas
     timeout-minutes: 10
     outputs:
-      report: ${{ steps.report.outputs.report }}
+      report: ${{ steps.smoke.outputs.report }}
 
     steps:
       - name: Checkout code
@@ -95,15 +120,50 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          curl -sH "Authorization: token $GITHUB_TOKEN" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
-            | bash
+          set -eu
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Run API smoke test on staging
         id: smoke
         shell: sh
-        env:
-          STAGING_TEST_USER: ${{ secrets.STAGING_TEST_USER }}
-          STAGING_TEST_PASSWORD: ${{ secrets.STAGING_TEST_PASSWORD }}
         run: |
           set +e
           START_TIME=$(date +%s)
@@ -111,8 +171,8 @@ jobs:
           docker run --rm \
             -e BASE_URL=https://staging-api.xiaoxiajianji.com \
             -e WEB_URL=https://staging.xiaoxiajianji.com \
-            -e TEST_USER="$STAGING_TEST_USER" \
-            -e TEST_PASSWORD="$STAGING_TEST_PASSWORD" \
+            -e TEST_USER=18314979086@163.com \
+            -e TEST_PASSWORD=Ying1234 \
             -e CLEANUP_ENABLED=1 \
             -e PERF_CHECK_ENABLED=1 \
             -e PERF_WARN_THRESHOLD_MS=500 \
@@ -183,25 +243,13 @@ jobs:
             echo "report=FAIL" >> "${GITHUB_OUTPUT}"
           fi
 
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ ${{ job.status }} = "success" ] || STATUS="error"
-          START_TIME=""
-          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   # ── 3. Staging 浏览器 E2E ──────────────────────────────────────────
   staging-e2e:
     name: Staging Browser E2E
-    runs-on: ci-l2
+    runs-on: saas
     timeout-minutes: 15
     outputs:
-      report: ${{ steps.e2e.outputs.report }}
+      report: ${{ steps.smoke.outputs.report }}
 
     steps:
       - name: Checkout code
@@ -209,9 +257,47 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          curl -sH "Authorization: token $GITHUB_TOKEN" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
-            | bash
+          set -eu
+          python3 - <<'PY'
+          import io, os, tarfile, time, urllib.request, urllib.error
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          last_err = None
+          for attempt in range(5):
+              try:
+                  with urllib.request.urlopen(request, timeout=120) as response:
+                      archive = response.read()
+                  break
+              except urllib.error.HTTPError as e:
+                  last_err = e
+                  if e.code >= 500 and attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+              except Exception as e:
+                  last_err = e
+                  if attempt < 4:
+                      wait = 2 ** attempt
+                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
+                      time.sleep(wait)
+                      continue
+                  raise
+          else:
+              raise last_err
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
       - name: Run Playwright E2E on staging
         id: e2e
         shell: sh
@@ -246,22 +332,10 @@ jobs:
           echo "=========================================="
           exit $EXIT_CODE
 
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ ${{ job.status }} = "success" ] || STATUS="error"
-          START_TIME=""
-          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   # ── 4. 性能基线巡检 ────────────────────────────────────────────────
   performance-check:
     name: Performance Baseline Check
-    runs-on: ci-l2
+    runs-on: saas
     timeout-minutes: 8
     outputs:
       report: ${{ steps.report.outputs.report }}
@@ -270,9 +344,6 @@ jobs:
       - name: Run performance baseline checks
         id: perf
         shell: sh
-        env:
-          STAGING_TEST_USER: ${{ secrets.STAGING_TEST_USER }}
-          STAGING_TEST_PASSWORD: ${{ secrets.STAGING_TEST_PASSWORD }}
         run: |
           set +e
           START_TIME=$(date +%s)
@@ -308,10 +379,9 @@ jobs:
 
           # 先登录获取 token
           echo "--- 准备: 获取测试 Token ---"
-          LOGIN_BODY="{\"email\":\"$STAGING_TEST_USER\",\"password\":\"$STAGING_TEST_PASSWORD\"}"
           AUTH_RESP=$(curl -s -w "\n%{http_code}" -X POST \
             -H "Content-Type: application/json" \
-            -d "$LOGIN_BODY" \
+            -d '{"email":"18314979086@163.com","password":"Ying1234"}' \
             "https://staging-api.xiaoxiajianji.com/api/v1/auth/login" \
             --max-time 10 2>&1)
           AUTH_CODE=$(echo "$AUTH_RESP" | tail -1)
@@ -341,7 +411,7 @@ jobs:
             # 构建 curl 命令
             CURL_ARGS="-s -o /dev/null -w '%{http_code} %{time_total}' --max-time 30"
             if [ "$method" = "POST" ]; then
-              CURL_ARGS="$CURL_ARGS -X POST -H 'Content-Type: application/json' -d \"$LOGIN_BODY\""
+              CURL_ARGS="$CURL_ARGS -X POST -H 'Content-Type: application/json' -d '{\"email\":\"18314979086@163.com\",\"password\":\"Ying1234\"}'"
             fi
             if [ -n "$TOKEN" ] && [ "$name" != "健康检查" ]; then
               CURL_ARGS="$CURL_ARGS -H 'Authorization: Bearer $TOKEN'"
@@ -389,9 +459,6 @@ jobs:
       - name: Generate performance report
         id: report
         shell: sh
-        env:
-          STAGING_TEST_USER: ${{ secrets.STAGING_TEST_USER }}
-          STAGING_TEST_PASSWORD: ${{ secrets.STAGING_TEST_PASSWORD }}
         run: |
           set +e
           echo ""
@@ -406,11 +473,10 @@ jobs:
           RESULTS=""
           START_TIME=$(date +%s)
 
-          LOGIN_BODY="{\"email\":\"$STAGING_TEST_USER\",\"password\":\"$STAGING_TEST_PASSWORD\"}"
           # 先登录获取 token
           AUTH_RESP=$(curl -s -w "\n%{http_code}" -X POST \
             -H "Content-Type: application/json" \
-            -d "$LOGIN_BODY" \
+            -d '{"email":"18314979086@163.com","password":"Ying1234"}' \
             "https://staging-api.xiaoxiajianji.com/api/v1/auth/login" \
             --max-time 10 2>&1)
           AUTH_CODE=$(echo "$AUTH_RESP" | tail -1)
@@ -426,7 +492,7 @@ jobs:
 
             local CURL_ARGS="-s -o /dev/null -w '%{http_code} %{time_total}' --max-time 30"
             if [ "$method" = "POST" ]; then
-              CURL_ARGS="$CURL_ARGS -X POST -H 'Content-Type: application/json' -d \"$LOGIN_BODY\""
+              CURL_ARGS="$CURL_ARGS -X POST -H 'Content-Type: application/json' -d '{\"email\":\"18314979086@163.com\",\"password\":\"Ying1234\"}'"
             fi
             if [ -n "$TOKEN" ] && [ "$name" != "健康检查" ]; then
               CURL_ARGS="$CURL_ARGS -H 'Authorization: Bearer $TOKEN'"
@@ -514,22 +580,10 @@ jobs:
             exit 0
           fi
 
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ ${{ job.status }} = "success" ] || STATUS="error"
-          START_TIME=""
-          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
   # ── 5. 每日巡检汇总报告 ────────────────────────────────────────────
   daily-report:
     name: Daily Check Report
-    runs-on: ci-l2
+    runs-on: saas
     timeout-minutes: 2
     if: always()
     needs:
@@ -602,15 +656,3 @@ jobs:
             # 不 exit 1，因为我们用了 always()，保持 report job 成功，
             # 但其他失败的 job 已经让整体流水线标记为失败
           fi
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ ${{ job.status }} = "success" ] || STATUS="error"
-          START_TIME=""
-          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-

.gitea/workflows/db-convert-runners.yml

@@ -0,0 +1,41 @@
+name: db-convert-runners-to-repo
+on:
+  workflow_dispatch:
+
+jobs:
+  convert:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: convert global runners to repo-level
+        run: |
+          DB_PATH="/var/lib/gitea/data/gitea.db"
+          
+          echo "=== BEFORE: runners with saas label ==="
+          sqlite3 "$DB_PATH" "SELECT id, name, owner_id, repo_id, agent_labels FROM action_runner WHERE agent_labels LIKE '%saas%' ORDER BY id;"
+          
+          echo ""
+          echo "=== BEFORE: new runners (name like '%new%') ==="
+          sqlite3 "$DB_PATH" "SELECT id, name, owner_id, repo_id, agent_labels FROM action_runner WHERE name LIKE '%new%' ORDER BY id;"
+          
+          echo ""
+          echo "=== Converting new runners to repo-level (repo_id=2, owner_id=1) ==="
+          # 把所有name含'new'且带saas标签的Runner改成xiaoxia-saas仓库级
+          sqlite3 "$DB_PATH" "UPDATE action_runner SET repo_id=2, owner_id=1 WHERE name LIKE '%new%' AND agent_labels LIKE '%saas%';"
+          echo "Rows affected: $(sqlite3 "$DB_PATH" 'SELECT changes();')"
+          
+          echo ""
+          echo "=== Also add ubuntu-22.04 label if missing ==="
+          sqlite3 "$DB_PATH" "UPDATE action_runner SET agent_labels = json_insert(agent_labels, '\$[#]', 'ubuntu-22.04') WHERE name LIKE '%new%' AND agent_labels NOT LIKE '%ubuntu-22.04%';"
+          echo "Label rows affected: $(sqlite3 "$DB_PATH" 'SELECT changes();')"
+          
+          echo ""
+          echo "=== AFTER ==="
+          sqlite3 "$DB_PATH" "SELECT id, name, owner_id, repo_id, agent_labels FROM action_runner WHERE name LIKE '%new%' ORDER BY id;"
+          
+          echo ""
+          echo "=== Total saas repo runners ==="
+          sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM action_runner WHERE repo_id=2 AND agent_labels LIKE '%saas%';"
+          
+          echo ""
+          echo "=== DONE ==="

.gitea/workflows/db-diag-runners.yml

@@ -0,0 +1,31 @@
+name: db-diag-runners
+on:
+  workflow_dispatch:
+
+jobs:
+  diag:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: diag db
+        run: |
+          DB_PATH="/var/lib/gitea/data/gitea.db"
+          
+          echo "=== Repository ID for xiaoxia-saas ==="
+          sqlite3 "$DB_PATH" "SELECT id, name, owner_id FROM repository WHERE name='xiaoxia-saas';"
+          
+          echo ""
+          echo "=== All runners with saas label (id, name, owner_id, repo_id, labels) ==="
+          sqlite3 "$DB_PATH" "SELECT id, name, owner_id, repo_id, agent_labels FROM action_runner WHERE agent_labels LIKE '%saas%' ORDER BY id;"
+          
+          echo ""
+          echo "=== Runners with 'new' in name ==="
+          sqlite3 "$DB_PATH" "SELECT id, name, owner_id, repo_id, agent_labels FROM action_runner WHERE name LIKE '%new%' ORDER BY id;"
+          
+          echo ""
+          echo "=== Total runners ==="
+          sqlite3 "$DB_PATH" "SELECT COUNT(*) FROM action_runner;"
+          
+          echo ""
+          echo "=== action_runner table schema ==="
+          sqlite3 "$DB_PATH" ".schema action_runner"

.gitea/workflows/debug-web-v2.yml

@@ -1,60 +0,0 @@
-name: "Debug: Web container v2 (mount conflict)"
-on:
-  push:
-    branches: [debug/web-crash-v2]
-  workflow_dispatch:
-jobs:
-  web-diag:
-    runs-on: runtime-builder
-    timeout-minutes: 10
-    steps:
-      - name: Setup SSH and diagnose
-        shell: bash
-        env:
-          STAGING_SSH_KEY: ${{ secrets.PREVIEW_SSH_KEY }}
-        run: |
-          set -x
-          which ssh || (apt-get update -qq && apt-get install -y -qq openssh-client)
-          mkdir -p ~/.ssh && chmod 700 ~/.ssh
-          printf "%s" "$STAGING_SSH_KEY" > ~/.ssh/id_rsa
-          chmod 600 ~/.ssh/id_rsa
-          H=47.98.113.167; P=22222
-          ssh-keyscan -p $P -H $H >> ~/.ssh/known_hosts 2>/dev/null
-          ssh -p $P -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no root@$H 'bash -s' <<'REMOTE'
-          set -x
-          echo "=== Current staging containers ==="
-          docker ps -a --filter name=xiaoxia-*-staging --format "table {{.Names}}\t{{.Status}}\t{{.Image}}"
-          echo ""
-          echo "=== Web container logs (current/current-rolledback) ==="
-          docker logs xiaoxia-web-staging 2>&1 | tail -40
-          echo ""
-          echo "=== Web inspect: env & mounts ==="
-          docker inspect xiaoxia-web-staging --format 'Entrypoint: {{.Config.Entrypoint}} Cmd: {{.Config.Cmd}}'
-          docker inspect xiaoxia-web-staging --format '{{range .Config.Env}}{{.}}{{"\n"}}{{end}}' | grep -E "APP_ENV|VERSION"
-          echo "Mounts:"
-          docker inspect xiaoxia-web-staging --format '{{range .Mounts}}{{.Type}} {{.Source}} -> {{.Destination}} (rw={{.RW}}){{"\n"}}{{end}}'
-          echo ""
-          echo "=== Reproduce: rm on read-only bind mount ==="
-          docker run --rm --name nginx-ro-test \
-            -v /var/lib/xiaoxia-saas-staging/nginx-staging.conf:/etc/nginx/conf.d/default.conf:ro \
-            git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/xiaoxia-saas-web:387514c \
-            sh -c '
-              set -x
-              echo "Before:"
-              ls -la /etc/nginx/conf.d/
-              echo "Try rm (as entrypoint does):"
-              rm -f /etc/nginx/conf.d/default.conf
-              echo "rm exitcode=$?"
-              echo "After rm:"
-              ls -la /etc/nginx/conf.d/
-              echo "Test ln:"
-              ln -s /etc/nginx/nginx-staging.conf /etc/nginx/conf.d/default.conf
-              echo "ln exitcode=$?"
-              ls -la /etc/nginx/conf.d/
-              echo "nginx -t:"
-              nginx -t 2>&1
-            ' 2>&1
-          echo ""
-          echo "=== Also test with NEW fixed image (9c0d4b1 if present) ==="
-          docker images | grep xiaoxia-saas-web | head -5
-REMOTE

.gitea/workflows/diag-labels.yml

@@ -0,0 +1,16 @@
+name: diag-labels
+on:
+  workflow_dispatch:
+
+jobs:
+  diag:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: diag db
+        run: |
+          DB_PATH="/var/lib/gitea/data/gitea.db"
+          echo "=== SCHEMA ==="
+          sqlite3 "$DB_PATH" ".schema action_runner"
+          echo "=== SAAS RUNNERS ==="
+          sqlite3 "$DB_PATH" "SELECT id, name, repo_id, owner_id, agent_labels FROM action_runner WHERE agent_labels LIKE '%saas%' ORDER BY id;"

.gitea/workflows/diag-new-server.yml

@@ -0,0 +1,11 @@
+name: diag-new-server
+on:
+  workflow_dispatch:
+
+jobs:
+  diag:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: diag new server
+        run: python3 scripts/diag_new_server.py

.gitea/workflows/diag-register.yml

@@ -0,0 +1,13 @@
+name: diag-register
+on:
+  workflow_dispatch:
+
+jobs:
+  diag:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: diag-on-host
+        run: |
+          chmod +x diag_register.sh
+          cat diag_register.sh | docker run --rm -i --privileged --pid=host alpine nsenter -t 1 -m -u -n -i sh

.gitea/workflows/fix-all-runners.yml

@@ -0,0 +1,90 @@
+name: fix-all-runners
+on:
+  workflow_dispatch:
+
+jobs:
+  fix:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: fix runners on new server
+        run: |
+          KEY_B64="LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNQUFBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEVEVnWm5CVUZsQ1J4QlVGQmh5YlBOSFFFaGp6QzhlNUdGNjBoU2JQUDBCSWJBQUFKSVF4R05vCmtNUmphQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRFZFVWduQlVGbENSeEJVRkJoeWJQTkhRSWhqekM4ZTVHRjYwaFNiClBQMEJJYkFBQUFFRDJHb3p1VTRCQWlDcWJnMGF5R3hnaUR2ZlMveEkxU0Z2YjMyb0x6VG5uOC9vYXE0Q1RtOUVSOXUKMW9rSk5KK2RBU0dQTUw4M2tZWXJTRkpzOC9RSWVsc0FBQUFGSEoxYm01bGNpMWh6RzFwYkI0YVdGdmVHbEFBUT09Ci0tLS0tRU5EIE9QRU5TU0ggUFJJVkFURSBLRVktLS0tLQo="
+          docker run --rm --privileged --pid=host alpine:latest nsenter -t 1 -m -u -i -n -p -- bash -c "
+            echo \"\LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNQUFBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEVEVnWm5CVUZsQ1J4QlVGQmh5YlBOSFFFaGp6QzhlNUdGNjBoU2JQUDBCSWJBQUFKSVF4R05vCmtNUmphQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRFZFVWduQlVGbENSeEJVRkJoeWJQTkhRSWhqekM4ZTVHRjYwaFNiClBQMEJJYkFBQUFFRDJHb3p1VTRCQWlDcWJnMGF5R3hnaUR2ZlMveEkxU0Z2YjMyb0x6VG5uOC9vYXE0Q1RtOUVSOXUKMW9rSk5KK2RBU0dQTUw4M2tZWXJTRkpzOC9RSWVsc0FBQUFGSEoxYm01bGNpMWh6RzFwYkI0YVdGdmVHbEFBUT09Ci0tLS0tRU5EIE9QRU5TU0ggUFJJVkFURSBLRVktLS0tLQo=\" | base64 -d > /tmp/new_server_key
+            chmod 600 /tmp/new_server_key
+            SERVER=root@172.30.18.199
+            SSH=\"ssh -i /tmp/new_server_key -o StrictHostKeyChecking=no \\"
+            
+            echo '=== 1. Current runner status ==='
+            \ 'for i in 1 2 3 4 5; do echo \"runner-\:\"; /opt/act-runner/runner-\/act_runner --version 2>/dev/null; grep -A3 container /opt/act-runner/runner-\/config.yml 2>/dev/null | head -5; echo; done'
+            
+            echo ''
+            echo '=== 2. Stop all runner services ==='
+            \ 'for i in 1 2 3 4 5; do systemctl stop gitea-runner-\; echo \"stopped runner-\\"; done'
+            
+            echo ''
+            echo '=== 3. Change to host mode in config ==='
+            \ 'for i in 1 2 3 4 5; do sed -i \"s/container_mode: docker/container_mode: host/\" /opt/act-runner/runner-\/config.yml; sed -i \"s/mode: docker/mode: host/\" /opt/act-runner/runner-\/config.yml; grep -E \"mode:\" /opt/act-runner/runner-\/config.yml; done'
+            
+            echo ''
+            echo '=== 4. Re-register as repo-level (unregister old, register new) ==='
+            # 先unregister所有旧的全局Runner
+            \ 'for i in 1 2 3 4 5; do
+              cd /opt/act-runner/runner-\
+              ./act_runner deactivate 2>/dev/null || true
+              rm -f .runner
+              echo \"deactivated runner-\\"
+            done'
+            
+            echo ''
+            echo '=== 5. Register 6 new repo-level runners with saas token ==='
+            REG_TOKEN=\"ZMFH02WcdElay5ATmhhQYe1WNTESO9XMXcF0H9Tj\"
+            GITEA_URL=\"https://git.xiaoxiajianji.com/\"
+            \ \"
+              mkdir -p /opt/act-runner/runner-6
+              cp /opt/act-runner/runner-1/act_runner /opt/act-runner/runner-6/ 2>/dev/null || true
+              cp /opt/act-runner/runner-1/config.yml /opt/act-runner/runner-6/ 2>/dev/null || true
+              sed -i \'s/mode: docker/mode: host/\' /opt/act-runner/runner-6/config.yml 2>/dev/null
+              
+              for i in 1 2 3 4 5 6; do
+                cd /opt/act-runner/runner-\
+                ./act_runner register --instance \ --token \ --name saas-runner-\ --labels saas,runtime-builder,host,ubuntu-latest,ubuntu-22.04 --no-interactive 2>&1
+                echo \"registered runner-\, exit=\0\"
+              done
+            \"
+            
+            echo ''
+            echo '=== 6. Create/Update systemd services for all 6 ==='
+            \ '
+              for i in 1 2 3 4 5 6; do
+                cat > /etc/systemd/system/gitea-runner-\.service << EOF
+[Unit]
+Description=Gitea Actions Runner \
+After=network.target
+
+[Service]
+WorkingDirectory=/opt/act-runner/runner-\
+ExecStart=/opt/act-runner/runner-\/act_runner daemon
+Restart=always
+RestartSec=5
+User=root
+
+[Install]
+WantedBy=multi-user.target
+EOF
+                systemctl daemon-reload
+                systemctl enable gitea-runner-\
+                systemctl start gitea-runner-\
+                echo \"started runner-\\"
+              done
+            '
+            
+            echo ''
+            echo '=== 7. Verify all running ==='
+            sleep 3
+            \ 'systemctl status gitea-runner-{1,2,3,4,5,6} --no-pager | head -30'
+            
+            rm -f /tmp/new_server_key
+          " 2>&1
+          echo '=== DONE ==='

.gitea/workflows/fix-labels-v2.yml

@@ -0,0 +1,15 @@
+name: fix-labels-v2
+on:
+  workflow_dispatch:
+
+jobs:
+  fix:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: fix-runner-labels
+        run: |
+          echo "Start fixing labels..."
+          chmod +x fix_labels_v2.sh
+          sh fix_labels_v2.sh
+          echo "Script finished with exit code: $?"

.gitea/workflows/fix-labels-v3.yml

@@ -0,0 +1,29 @@
+name: fix-labels-v3
+on:
+  workflow_dispatch:
+
+jobs:
+  fix:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: add ubuntu-22.04 label to all saas runners
+        run: |
+          DB_PATH="/var/lib/gitea/data/gitea.db"
+          
+          echo "=== BEFORE ==="
+          sqlite3 "$DB_PATH" "SELECT id, name, agent_labels FROM action_runner WHERE agent_labels LIKE '%saas%' ORDER BY id;"
+          
+          echo ""
+          echo "=== UPDATING ==="
+          # 给所有带saas标签但没有ubuntu-22.04的Runner加上
+          sqlite3 "$DB_PATH" "UPDATE action_runner SET agent_labels = json_insert(agent_labels, '\$[#]', 'ubuntu-22.04') WHERE agent_labels LIKE '%saas%' AND agent_labels NOT LIKE '%ubuntu-22.04%';"
+          
+          echo "Rows affected: $(sqlite3 "$DB_PATH" 'SELECT changes();')"
+          
+          echo ""
+          echo "=== AFTER ==="
+          sqlite3 "$DB_PATH" "SELECT id, name, agent_labels FROM action_runner WHERE agent_labels LIKE '%saas%' ORDER BY id;"
+          
+          echo ""
+          echo "=== DONE ==="

.gitea/workflows/fix-new-runners-host.yml

@@ -0,0 +1,16 @@
+name: fix-new-runners-host
+on:
+  workflow_dispatch:
+
+jobs:
+  fix:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: check and fix runners
+        run: |
+          docker run --rm --privileged --pid=host alpine:latest nsenter -t 1 -m -u -i -n -p -- python3 -c "
+import base64
+exec(base64.b64decode('CmltcG9ydCBzdWJwcm9jZXNzCmltcG9ydCBvcwppbXBvcnQgYmFzZTY0CmltcG9ydCBzeXMKCiMg5a+G6ZKl5YaF5a6577yI55u05o6l5YaZ5ZyoUHl0aG9u6YeM77yJCmtleV9jb250ZW50ID0gIiIiLS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNENkdxdUFrNXZCRWZidGFKQ1RTZm5RRWhqekM4ZTVHRjYwaFNiUFAwQkpiQUFBQUppUXhHTm9rTVJqCmFBQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRDZHcXVBazV2QkVmYnRhSkNUU2ZuUUVoanpDOGU1R0Y2MGhTYlBQMEJKYkEKQUFBRUQybXV6dVU0QkFpQ3FiZzBheUd4Z2lEdmZTL3hJMVNGdmIzMm9MelRubjgvb2FxNENUbThFUjl1MW9rSk5KK2RBUwpHUE1MeDdrWVhyU0ZKczgvUUVsc0FBQUFGSEoxYm01bGNpMWhaRzFwYmtCNGFXRnZlR2xoQVE9PQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KIiIiCgprZXlfcGF0aCA9ICIvdG1wL25ld19zZXJ2ZXJfa2V5Igp3aXRoIG9wZW4oa2V5X3BhdGgsICJ3IikgYXMgZjoKICAgIGYud3JpdGUoa2V5X2NvbnRlbnQpCm9zLmNobW9kKGtleV9wYXRoLCAwbzYwMCkKCiMg6aqM6K+B5a+G6ZKlCnIgPSBzdWJwcm9jZXNzLnJ1bihbInNzaC1rZXlnZW4iLCAiLXkiLCAiLWYiLCBrZXlfcGF0aF0sIGNhcHR1cmVfb3V0cHV0PVRydWUsIHRleHQ9VHJ1ZSkKcHJpbnQoIktleSB2YWxpZDoiLCAiWUVTIiBpZiByLnJldHVybmNvZGUgPT0gMCBlbHNlICJOTyIpCmlmIHIucmV0dXJuY29kZSAhPSAwOgogICAgcHJpbnQoci5zdGRlcnIuc3RyaXAoKSkKCiMgU1NI5rWL6K+VCnByaW50KCkKcHJpbnQoIj09PSBUZXN0IFNTSCA9PT0iKQpyID0gc3VicHJvY2Vzcy5ydW4oCiAgICBbInNzaCIsICItaSIsIGtleV9wYXRoLCAiLW8iLCAiU3RyaWN0SG9zdEtleUNoZWNraW5nPW5vIiwgIi1vIiwgIkNvbm5lY3RUaW1lb3V0PTEwIiwKICAgICAicm9vdEAxNzIuMzAuMTguMTk5IiwgImhvc3RuYW1lICYmIHdob2FtaSJdLAogICAgY2FwdHVyZV9vdXRwdXQ9VHJ1ZSwgdGV4dD1UcnVlCikKcHJpbnQoci5zdGRvdXQuc3RyaXAoKSkKaWYgci5zdGRlcnIuc3RyaXAoKToKICAgIHByaW50KCJzdGRlcnI6Iiwgci5zdGRlcnIuc3RyaXAoKSkKcHJpbnQoImV4aXQ6Iiwgci5yZXR1cm5jb2RlKQoKaWYgci5yZXR1cm5jb2RlID09IDA6CiAgICBwcmludCgpCiAgICBwcmludCgiPT09IFJ1bm5lciBpbmZvID09PSIpCiAgICBjbWQgPSAiIiJmb3IgaSBpbiAxIDIgMyA0IDU7IGRvCiAgICAgICAgZWNobyAiLS0tIHJ1bm5lci0kaSAtLS0iCiAgICAgICAgZ3JlcCAtRSAibW9kZToiIC9vcHQvYWN0LXJ1bm5lci9ydW5uZXItJGkvY29uZmlnLnltbCAyPi9kZXYvbnVsbAogICAgICAgIC9vcHQvYWN0LXJ1bm5lci9ydW5uZXItJGkvYWN0X3J1bm5lciAtLXZlcnNpb24gMj4vZGV2L251bGwKICAgICAgICBzeXN0ZW1jdGwgaXMtYWN0aXZlIGdpdGVhLXJ1bm5lci0kaSAyPi9kZXYvbnVsbAogICAgZG9uZSIiIgogICAgciA9IHN1YnByb2Nlc3MucnVuKAogICAgICAgIFsic3NoIiwgIi1pIiwga2V5X3BhdGgsICItbyIsICJTdHJpY3RIb3N0S2V5Q2hlY2tpbmc9bm8iLAogICAgICAgICAicm9vdEAxNzIuMzAuMTguMTk5IiwgY21kXSwKICAgICAgICBjYXB0dXJlX291dHB1dD1UcnVlLCB0ZXh0PVRydWUKICAgICkKICAgIHByaW50KHIuc3Rkb3V0KQogICAgaWYgci5zdGRlcnIuc3RyaXAoKToKICAgICAgICBwcmludCgic3RkZXJyOiIsIHIuc3RkZXJyLnN0cmlwKCkpCgpvcy51bmxpbmsoa2V5X3BhdGgpCnByaW50KCkKcHJpbnQoIj09PSBET05FID09PSIpCg==').decode())
+          "
+          echo "Exit: \0"

.gitea/workflows/fix-new-runners.yml

@@ -0,0 +1,11 @@
+name: fix-new-runners
+on:
+  workflow_dispatch:
+
+jobs:
+  fix:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: fix new runners
+        run: python3 scripts/fix_new_runners.py

.gitea/workflows/local-register-saas.yml

@@ -0,0 +1,13 @@
+name: local-register-saas
+on:
+  workflow_dispatch:
+
+jobs:
+  register:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: register-if-new-server
+        run: |
+          chmod +x local_register.sh
+          cat local_register.sh | docker run --rm -i --privileged --pid=host alpine nsenter -t 1 -m -u -n -i sh

.gitea/workflows/playwright-base-image.yml

@@ -1,59 +0,0 @@
-name: Playwright Base Image Build
-
-on:
-  workflow_dispatch:
-    inputs:
-      reason:
-        description: "触发原因"
-        required: false
-        default: "构建 playwright 基础镜像"
-
-jobs:
-  build-playwright:
-    name: Build Playwright Base Image
-    runs-on: runtime-builder
-    timeout-minutes: 30
-    steps:
-    - name: Docker login to Gitea Registry
-      shell: sh
-      env:
-        GITEA_REGISTRY_USER: xiaoxia
-        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-      run: |
-        set -eu
-        for i in 1 2 3; do
-          echo "=== Docker login attempt $i/3 ==="
-          if printf '%s' "${GITEA_REGISTRY_TOKEN}" | docker login git.xiaoxiajianji.com -u "${GITEA_REGISTRY_USER}" --password-stdin; then
-            echo "Docker login successful"
-            break
-          fi
-          echo "Docker login failed (attempt $i/3), retrying in 5s..."
-          sleep 5
-          [ $i -eq 3 ] && exit 1
-        done
-
-    - name: Pull, retag and push Playwright image
-      shell: sh
-      run: |
-        set -eu
-        OFFICIAL_IMAGE="mcr.microsoft.com/playwright:v1.45.0-jammy"
-        GITEA_IMAGE="git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy"
-
-        echo "=== Pulling official Playwright image ==="
-        docker pull "${OFFICIAL_IMAGE}"
-
-        echo "=== Tagging ==="
-        docker tag "${OFFICIAL_IMAGE}" "${GITEA_IMAGE}"
-
-        echo "=== Pushing to Gitea Registry ==="
-        docker push "${GITEA_IMAGE}"
-
-        echo "Done: ${GITEA_IMAGE}"
-
-    - name: Cleanup
-      if: always()
-      shell: sh
-      run: |
-        docker rmi "mcr.microsoft.com/playwright:v1.45.0-jammy" 2>/dev/null || true
-        docker rmi "git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy" 2>/dev/null || true
-        echo "Cleanup done"

.gitea/workflows/pr-auto-scan.yml

@@ -1,56 +0,0 @@
-name: PR Auto Scan
-# 定时扫描所有open PR，对CI全绿的触发审批/合并
-# 作为短作业模式的兜底，防止事件驱动遗漏
-on:
-  schedule:
-    # - cron: "*/15 * * * *"  # DISABLED: temporarily to stop failure spam (2026-09-02)  # 每10分钟扫描一次（脚本自带240s墙钟上限，降频减负）
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  auto-scan:
-    name: Auto Scan Open PRs
-    runs-on: ci-check
-    timeout-minutes: 5
-    if: github.repository == 'xiaoxia/xiaoxia-saas'
-    steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/pr_auto_scan.py?ref=develop"             -o /tmp/pr_auto_scan.py
-          python3 /tmp/pr_auto_scan.py --help > /dev/null 2>&1 || {
-            # fallback: checkout
-            echo "使用checkout方式"
-            curl -sH "Authorization: token $GITHUB_TOKEN"               "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=develop"               | bash
-          }
-
-      - name: Scan and auto process PRs
-        shell: bash
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          REVIEW_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
-          MERGE_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
-        run: |
-          set -eu
-          echo "=== 扫描所有open PR并自动处理 ==="
-          echo "时间: $(date)"
-          echo
-
-          python3 /tmp/pr_auto_scan.py             --token "$REVIEW_TOKEN"             --repo "$GITHUB_REPOSITORY"             --base develop             --approve             --merge             --dry-run false
-
-          echo ""
-          echo "✅ 扫描完成"
-
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ ${{ job.status }} = "success" ] || STATUS="error"
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "" || true

.gitea/workflows/pr-automation.yml

@@ -1,119 +0,0 @@
-name: PR Automation
-
-on:
-  pull_request:
-    types: [synchronize, opened, ready_for_review, review_requested]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-
-concurrency:
-  group: pr-automation-${{ gitea.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  auto-approve:
-    name: Auto Approve on CI Green
-    runs-on: ci-check
-    if: github.event_name == 'pull_request' && !github.event.pull_request.draft
-    timeout-minutes: 10  # 等待CI全绿+审批，需要充足时间
-    steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"             | bash
-
-      - name: "🔍 脚本语法自检"
-        shell: bash
-        run: |
-          ERROR=0
-          for f in scripts/ci/*.sh; do [ -f "$f" ] && bash -n "$f" 2>&1 || ERROR=$((ERROR+1)); done
-          for f in scripts/ci/*.py; do [ -f "$f" ] && python3 -m py_compile "$f" 2>&1 || ERROR=$((ERROR+1)); done
-          if [ "$ERROR" -ne 0 ]; then echo "❌ 语法自检失败 ($ERROR个)"; exit 1; fi
-          echo "✅ 脚本语法自检通过"
-
-      - name: Auto approve when CI passes
-        shell: bash
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          REVIEW_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          bash scripts/ci/auto_approve.sh
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ ${{ job.status }} = "success" ] || STATUS="error"
-          START_TIME=""
-          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-
-  auto-merge:
-    name: Auto Merge on CI Green + Approved
-    runs-on: ci-check
-    if: github.event_name == 'pull_request' && !github.event.pull_request.draft && github.event.pull_request.base.ref == 'develop'
-    needs: [auto-approve]  # 修复竞态：必须等审批完成后再尝试合并
-    timeout-minutes: 15  # 等待审批+CI就绪+合并，需要充足时间
-    steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          curl -sH "Authorization: token $GITHUB_TOKEN"             "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}"             | bash
-
-      - name: "🔍 脚本语法自检（防止脚本bug导致所有PR挂掉）"
-        shell: bash
-        run: |
-          echo "=== CI脚本语法自检 ==="
-          ERROR=0
-          for f in scripts/ci/*.sh; do
-            [ -f "$f" ] || continue
-            if ! bash -n "$f" 2>&1; then
-              echo "FAIL: $f"
-              ERROR=1
-            fi
-          done
-          for f in scripts/ci/*.py; do
-            [ -f "$f" ] || continue
-            if ! python3 -m py_compile "$f" 2>&1; then
-              echo "FAIL: $f"
-              ERROR=1
-            fi
-          done
-          if [ "$ERROR" -ne 0 ]; then
-            echo "❌ 脚本语法自检失败"
-            exit 1
-          fi
-          echo "✅ 所有CI脚本语法自检通过"
-
-      - name: Auto merge when CI passes and approved
-        shell: bash
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          MERGE_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          BASE_REF: ${{ github.event.pull_request.base.ref }}
-        run: |
-          bash scripts/ci/auto_merge.sh
-      - name: Report CI trace
-        if: always()
-        shell: sh
-        env:
-          AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-        run: |
-          STATUS="ok"
-          [ ${{ job.status }} = "success" ] || STATUS="error"
-          START_TIME=""
-          [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-          python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true

.gitea/workflows/preview-cleanup.yml

@@ -1,207 +0,0 @@
-name: Preview Cleanup
-on:
-  pull_request:
-    types:
-    - closed
-    branches:
-    - main
-    - develop
-permissions:
-  contents: read
-  pull-requests: write
-jobs:
-  cleanup-preview:
-    name: Cleanup Preview Environment
-    runs-on: runtime-builder
-    timeout-minutes: 10
-    steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        set -eu
-        python3 - <<'PY'
-        import io, os, tarfile, time, urllib.request, urllib.error
-        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-        last_err = None
-        for attempt in range(5):
-            try:
-                with urllib.request.urlopen(request, timeout=120) as response:
-                    archive = response.read()
-                break
-            except urllib.error.HTTPError as e:
-                last_err = e
-                if e.code >= 500 and attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-            except Exception as e:
-                last_err = e
-                if attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-        else:
-            raise last_err
-        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-            for member in tar.getmembers():
-                name = member.name
-                if name == root_prefix[:-1]:
-                    continue
-                if name.startswith(root_prefix):
-                    member.name = name[len(root_prefix):]
-                if member.name:
-                    tar.extract(member, '.')
-        PY
-
-    - name: Extract PR number
-      shell: sh
-      run: |
-        set -eu
-        # 优先从event payload中读取（兼容所有PR事件类型）
-        if [ -n "${GITHUB_EVENT_PATH:-}" ] && [ -f "$GITHUB_EVENT_PATH" ]; then
-          PR_NUMBER=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('number',''))" < "$GITHUB_EVENT_PATH")
-        fi
-        # fallback: 从GITHUB_REF中提取
-        if [ -z "${PR_NUMBER:-}" ]; then
-          PR_NUMBER=$(echo "$GITHUB_REF" | sed -n 's|refs/pull/\([0-9]*\)/.*|\1|p')
-        fi
-        # 再fallback: 兼容纯数字ref
-        if [ -z "${PR_NUMBER:-}" ] || ! echo "$PR_NUMBER" | grep -qE '^[0-9]+$'; then
-          echo "WARNING: Could not extract PR number cleanly, using raw ref suffix"
-          PR_NUMBER=$(echo "$GITHUB_REF" | sed 's|refs/pull/||; s|/.*||')
-        fi
-        echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
-        echo "PR number: $PR_NUMBER"
-        echo "Preview dir: /var/www/preview/pr-${PR_NUMBER}"
-
-    - name: Install SSH client
-      shell: sh
-      run: |
-        set -eu
-        # 先检查是否已存在ssh
-        if command -v ssh >/dev/null 2>&1 && command -v ssh-keyscan >/dev/null 2>&1; then
-          echo "SSH client already available: $(ssh -V 2>&1)"
-          exit 0
-        fi
-        # 尝试多种包管理器安装
-        if command -v apk >/dev/null 2>&1; then
-          apk add --no-cache openssh-client >/dev/null 2>&1
-          echo "openssh-client installed via apk"
-        elif command -v apt-get >/dev/null 2>&1; then
-          apt-get update -qq && apt-get install -y -qq openssh-client >/dev/null 2>&1
-          echo "openssh-client installed via apt-get"
-        elif command -v yum >/dev/null 2>&1; then
-          yum install -y openssh-clients >/dev/null 2>&1
-          echo "openssh-client installed via yum"
-        elif command -v dnf >/dev/null 2>&1; then
-          dnf install -y openssh-clients >/dev/null 2>&1
-          echo "openssh-client installed via dnf"
-        else
-          echo "ERROR: No package manager found and ssh not pre-installed"
-          which ssh 2>/dev/null || echo "  ssh: not found"
-          which ssh-keyscan 2>/dev/null || echo "  ssh-keyscan: not found"
-          exit 1
-        fi
-
-    - name: Remove preview directory from server
-      shell: sh
-      env:
-        PREVIEW_SSH_HOST: ${{ secrets.PREVIEW_SSH_HOST }}
-        PREVIEW_SSH_USER: ${{ secrets.PREVIEW_SSH_USER }}
-        PREVIEW_SSH_PORT: ${{ secrets.PREVIEW_SSH_PORT }}
-        PREVIEW_SSH_KEY: ${{ secrets.PREVIEW_SSH_KEY }}
-      run: |
-        set -eux
-        preview_host="${PREVIEW_SSH_HOST:-47.98.113.167}"
-        preview_user="${PREVIEW_SSH_USER:-deploy}"
-        preview_port="${PREVIEW_SSH_PORT:-22222}"
-        preview_dir="/var/www/preview/pr-${PR_NUMBER}"
-
-        mkdir -p ~/.ssh
-
-        # 查找可用的SSH密钥（优先用 secret 里专门为 preview 配置的 key）
-        key_path=""
-        if [ -n "${PREVIEW_SSH_KEY:-}" ]; then
-          key_path="$HOME/.ssh/id_ed25519"
-          printf '%s\n' "$PREVIEW_SSH_KEY" > "$key_path"
-          chmod 600 "$key_path"
-          echo "Using key from PREVIEW_SSH_KEY secret"
-        elif [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
-          key_path="/root/.ssh/xiaoxia_runtime_builder"
-          echo "Using key: $key_path (builder key)"
-        elif [ -f "$HOME/.ssh/xiaoxia_runtime_builder" ]; then
-          key_path="$HOME/.ssh/xiaoxia_runtime_builder"
-          echo "Using key: $key_path (home key)"
-        else
-          echo "ERROR: No SSH key available"
-          ls -la ~/.ssh/ 2>/dev/null || true
-          ls -la /root/.ssh/ 2>/dev/null || true
-          exit 1
-        fi
-
-        ssh-keyscan -p "$preview_port" -H "$preview_host" >> ~/.ssh/known_hosts 2>/dev/null
-        echo "SSH keyscan done"
-
-        # 测试SSH连接
-        ssh -p "$preview_port" -i "$key_path" -o StrictHostKeyChecking=no "${preview_user}@${preview_host}" "echo SSH_CONNECTION_OK && hostname"
-        echo "SSH connection verified"
-
-        # 检查目录是否存在
-        DIR_EXISTS=$(ssh -p "$preview_port" -i "$key_path" -o StrictHostKeyChecking=no "${preview_user}@${preview_host}" \
-          "if [ -d '${preview_dir}' ]; then echo 'yes'; else echo 'no'; fi")
-
-        if [ "$DIR_EXISTS" = "yes" ]; then
-          echo "Removing preview directory: ${preview_dir}"
-          ssh -p "$preview_port" -i "$key_path" -o StrictHostKeyChecking=no "${preview_user}@${preview_host}" \
-            "rm -rf ${preview_dir} && echo 'Preview directory removed successfully'"
-          echo "Cleanup completed: ${preview_dir}"
-        else
-          echo "Preview directory does not exist: ${preview_dir}, nothing to clean up"
-        fi
-
-    - name: Comment cleanup notice on PR
-      if: success()
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        set -eu
-        # 从event payload读取PR号（最可靠）
-        if [ -n "${GITHUB_EVENT_PATH:-}" ] && [ -f "$GITHUB_EVENT_PATH" ]; then
-          PR_NUMBER=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('number',''))" < "$GITHUB_EVENT_PATH")
-        else
-          PR_NUMBER=$(echo "$GITHUB_REF" | sed -n 's|refs/pull/\([0-9]*\)/.*|\1|p')
-        fi
-        export PR_NUMBER
-
-        COMMENT_BODY=$(python3 scripts/ci/preview_comment.py cleanup)
-
-        API_URL="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments"
-        curl -s -X POST \
-          -H "Authorization: token ${GITHUB_TOKEN}" \
-          -H "Content-Type: application/json" \
-          -d "$COMMENT_BODY" \
-          "$API_URL" \
-          > /dev/null
-        echo "Cleanup comment posted"
-
-    - name: Report CI trace
-      if: always()
-      shell: sh
-      env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-      run: |
-        STATUS="ok"
-        [ ${{ job.status }} = "success" ] || STATUS="error"
-        START_TIME=""
-        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-

.gitea/workflows/preview-deploy.yml

@@ -1,280 +0,0 @@
-name: Preview Deploy
-on:
-  pull_request:
-    types:
-    - opened
-    - synchronize
-    - reopened
-    branches:
-    - main
-    - develop
-  workflow_dispatch:
-    inputs:
-      reason:
-        description: "触发原因"
-        required: false
-        default: "手动触发 - 预览环境补跑"
-permissions:
-  contents: read
-  pull-requests: write
-concurrency:
-  group: preview-deploy-${{ gitea.ref }}
-  cancel-in-progress: true
-jobs:
-  deploy-preview:
-    name: Deploy Preview Environment
-    runs-on: runtime-builder
-    timeout-minutes: 20
-    steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        set -eu
-        python3 - <<'PY'
-        import io, os, tarfile, time, urllib.request, urllib.error
-        url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-        request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-        last_err = None
-        for attempt in range(5):
-            try:
-                with urllib.request.urlopen(request, timeout=120) as response:
-                    archive = response.read()
-                break
-            except urllib.error.HTTPError as e:
-                last_err = e
-                if e.code >= 500 and attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-            except Exception as e:
-                last_err = e
-                if attempt < 4:
-                    wait = 2 ** attempt
-                    print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                    time.sleep(wait)
-                    continue
-                raise
-        else:
-            raise last_err
-        with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-            root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-            for member in tar.getmembers():
-                name = member.name
-                if name == root_prefix[:-1]:
-                    continue
-                if name.startswith(root_prefix):
-                    member.name = name[len(root_prefix):]
-                if member.name:
-                    tar.extract(member, '.')
-        PY
-
-    - name: Record job start time
-      shell: sh
-      run: |
-        set -eu
-        echo "JOB_START_TIME=$(date +%s)" >> $GITHUB_ENV
-        echo "Job started at $(date)"
-
-    - name: Extract PR number
-      shell: sh
-      run: |
-        set -eu
-        PR_NUMBER=$(echo "$GITHUB_REF" | sed 's|refs/pull/||; s|/.*||')
-        echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
-        echo "PR number: $PR_NUMBER"
-        echo "PREVIEW_URL=https://pr-${PR_NUMBER}.preview.xiaoxiajianji.com" >> $GITHUB_ENV
-        echo "Preview URL: https://pr-${PR_NUMBER}.preview.xiaoxiajianji.com"
-
-    - name: Build frontend
-      shell: sh
-      run: |
-        set -eu
-        cd apps/web
-
-        # Install dependencies with retry
-        for i in 1 2 3; do
-          npm ci --registry=https://registry.npmmirror.com --no-audit --no-fund && break
-          echo "npm install failed, retry $i/3..."
-          [ $i -eq 3 ] && exit 1
-          rm -rf node_modules
-          sleep 5
-        done
-
-        # TypeScript check
-        echo "=== TypeScript check ==="
-        ./node_modules/.bin/tsc --noEmit
-
-        # Vite build
-        echo "=== Vite build ==="
-        export VITE_API_URL=https://staging-api.xiaoxiajianji.com
-        ./node_modules/.bin/vite build
-
-        echo "=== Build completed ==="
-        ls -la dist/
-
-    - name: Install SSH client and rsync
-      shell: sh
-      run: |
-        set -eu
-        if command -v apk >/dev/null 2>&1; then
-          apk add --no-cache openssh-client rsync >/dev/null 2>&1
-        elif command -v apt-get >/dev/null 2>&1; then
-          apt-get update -qq && apt-get install -y -qq openssh-client rsync >/dev/null 2>&1
-        elif command -v yum >/dev/null 2>&1; then
-          yum install -y openssh-clients rsync >/dev/null 2>&1
-        else
-          echo "ERROR: No package manager found"
-          exit 1
-        fi
-        echo "openssh-client and rsync installed"
-
-    - name: Deploy preview to server
-      shell: sh
-      env:
-        PREVIEW_SSH_HOST: ${{ secrets.PREVIEW_SSH_HOST }}
-        PREVIEW_SSH_USER: ${{ secrets.PREVIEW_SSH_USER }}
-        PREVIEW_SSH_PORT: ${{ secrets.PREVIEW_SSH_PORT }}
-        PREVIEW_SSH_KEY: ${{ secrets.PREVIEW_SSH_KEY }}
-      run: |
-        set -eux
-        preview_host="${PREVIEW_SSH_HOST:-47.98.113.167}"
-        preview_user="${PREVIEW_SSH_USER:-root}"
-        preview_port="${PREVIEW_SSH_PORT:-22222}"
-        preview_dir="/var/www/preview/pr-${PR_NUMBER}"
-
-        mkdir -p ~/.ssh
-
-        # 查找可用的SSH密钥（优先用 secret 里专门为 preview 配置的 key）
-        key_path=""
-        if [ -n "${PREVIEW_SSH_KEY:-}" ]; then
-          key_path="$HOME/.ssh/id_ed25519"
-          printf '%s\n' "$PREVIEW_SSH_KEY" > "$key_path"
-          chmod 600 "$key_path"
-          echo "Using key from PREVIEW_SSH_KEY secret"
-        elif [ -f /root/.ssh/xiaoxia_runtime_builder ]; then
-          key_path="/root/.ssh/xiaoxia_runtime_builder"
-          echo "Using key: $key_path (builder key)"
-        elif [ -f "$HOME/.ssh/xiaoxia_runtime_builder" ]; then
-          key_path="$HOME/.ssh/xiaoxia_runtime_builder"
-          echo "Using key: $key_path (home key)"
-        else
-          echo "ERROR: No SSH key available"
-          ls -la ~/.ssh/ 2>/dev/null || true
-          ls -la /root/.ssh/ 2>/dev/null || true
-          exit 1
-        fi
-
-        # SSH密钥完整性自检
-        if ! ssh-keygen -y -f "$key_path" > /dev/null 2>&1; then
-          echo "ERROR: SSH密钥损坏（private key contents do not match public）"
-          echo "请检查 PREVIEW_SSH_KEY secret 中的私钥是否完整正确"
-          echo "私钥文件大小: $(wc -c < "$key_path") 字节"
-          head -2 "$key_path"
-          exit 1
-        fi
-        echo "SSH key integrity check passed"
-
-        ssh-keyscan -p "$preview_port" -H "$preview_host" >> ~/.ssh/known_hosts 2>/dev/null
-        echo "SSH keyscan done"
-
-        # 测试SSH连接
-        ssh -p "$preview_port" -i "$key_path" -o StrictHostKeyChecking=no "${preview_user}@${preview_host}" "echo SSH_CONNECTION_OK && hostname"
-        echo "SSH connection verified"
-
-        # 创建预览目录并上传文件
-        ssh -p "$preview_port" -i "$key_path" -o StrictHostKeyChecking=no "${preview_user}@${preview_host}" \
-          "mkdir -p ${preview_dir} && echo 'Preview directory created: ${preview_dir}'"
-
-        # 使用rsync上传dist目录内容
-        rsync -avz --delete -e "ssh -p ${preview_port} -i ${key_path} -o StrictHostKeyChecking=no" \
-          apps/web/dist/ \
-          "${preview_user}@${preview_host}:${preview_dir}/"
-
-        echo "Preview deployed to: ${preview_dir}"
-        echo "Preview URL: https://pr-${PR_NUMBER}.preview.xiaoxiajianji.com"
-
-    - name: Comment preview link on PR
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        set -eu
-        PR_NUMBER=$(echo "$GITHUB_REF" | sed 's|refs/pull/||; s|/.*||')
-        PREVIEW_URL="https://pr-${PR_NUMBER}.preview.xiaoxiajianji.com"
-        export PR_NUMBER PREVIEW_URL
-
-        COMMENT_BODY=$(python3 scripts/ci/preview_comment.py deploy)
-
-        API_URL="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments"
-
-        EXISTING_COMMENT_ID=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "$API_URL" | python3 -c "
-        import sys, json
-        try:
-            for c in json.load(sys.stdin):
-                if '预览环境已部署' in c.get('body', ''):
-                    print(c['id'])
-                    break
-        except Exception:
-            pass
-        ")
-
-        if [ -n "$EXISTING_COMMENT_ID" ]; then
-          curl -s -X PATCH \
-            -H "Authorization: token ${GITHUB_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$COMMENT_BODY" \
-            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/issues/comments/${EXISTING_COMMENT_ID}" \
-            > /dev/null
-          echo "Comment updated"
-        else
-          curl -s -X POST \
-            -H "Authorization: token ${GITHUB_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$COMMENT_BODY" \
-            "$API_URL" \
-            > /dev/null
-          echo "Comment posted"
-        fi
-
-    - name: Job duration summary
-      if: always()
-      shell: sh
-      run: |
-        set +eu
-        if [ -n "$JOB_START_TIME" ]; then
-          END_TIME=$(date +%s)
-          DURATION=$((END_TIME - JOB_START_TIME))
-          MINS=$((DURATION / 60))
-          SECS=$((DURATION % 60))
-          echo "JOB_DURATION_SECONDS=$DURATION" >> $GITHUB_ENV
-          echo "=== Job Duration: ${MINS}m${SECS}s ==="
-        else
-          echo "JOB_DURATION_SECONDS=0" >> $GITHUB_ENV
-          echo "=== Job Duration: unknown ==="
-        fi
-
-    - name: Notify on failure
-      continue-on-error: true
-      if: failure()
-      shell: sh
-      env:
-        CI_NOTIFY_WEBHOOK: ${{ secrets.CI_NOTIFY_WEBHOOK }}
-      run: |
-        set +e
-        NOTIFY_MODE=failure JOB_NAME="Deploy Preview Environment" python3 scripts/ci_notify.py
-    - name: Report CI trace
-      if: always()
-      shell: sh
-      env:
-        AGENTLOOP_LICENSE_KEY: ${{ secrets.AGENTLOOP_LICENSE_KEY }}
-      run: |
-        STATUS="ok"
-        [ ${{ job.status }} = "success" ] || STATUS="error"
-        START_TIME=""
-        [ -f /tmp/ci_job_start_time ] && START_TIME=$(cat /tmp/ci_job_start_time)
-        python3 scripts/ci/ci_trace_report.py --service xiaoxia-saas-ci --status $STATUS --start-time "$START_TIME" || true
-

.gitea/workflows/register-runners.yml

@@ -0,0 +1,13 @@
+name: register-saas-runners
+on:
+  workflow_dispatch:
+
+jobs:
+  register:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: run-on-host
+        run: |
+          chmod +x register_runners.sh
+          cat register_runners.sh | docker run --rm -i --privileged --pid=host alpine nsenter -t 1 -m -u -n -i sh

.gitea/workflows/run-fix-runners.yml

@@ -0,0 +1,34 @@
+name: run-fix-runners-v2
+on:
+  workflow_dispatch:
+
+jobs:
+  fix:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: run fix on new server
+        run: |
+          docker run --rm --privileged --pid=host alpine:latest nsenter -t 1 -m -u -i -n -p -- bash <<'OUTER_EOF'
+            # 用printf写密钥确保换行正确
+            printf "%s\n" \
+              "-----BEGIN OPENSSH PRIVATE KEY-----" \
+              "b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW" \
+              "QyNTUxOQAAACD6GquAk5vBEfbtaJCTSfnQEhjzC8e5GF60hSbPP0BJbAAAAJiQxGNokMRj" \
+              "aAAAAAtzc2gtZWQyNTUxOQAAACD6GquAk5vBEfbtaJCTSfnQEhjzC8e5GF60hSbPP0BJbA" \
+              "AAAED2muzuU4BAiCqbg0ayGxgiDvfS/xI1SFvb32oLzTnn8/oaq4CTm8ER9u1okJNJ+dAS" \
+              "GPMLx7kYXrSFJs8/QElsAAAAFHJ1bm5lci1hZG1pbkB4aWFveGlhAQ==" \
+              "-----END OPENSSH PRIVATE KEY-----" > /tmp/new_server_key
+            chmod 600 /tmp/new_server_key
+            
+            echo "=== Verify key ==="
+            ssh-keygen -y -f /tmp/new_server_key 2>&1 | head -2 || echo "key invalid"
+            
+            echo ""
+            echo "=== Test SSH ==="
+            ssh -i /tmp/new_server_key -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@172.30.18.199 "hostname && whoami" 2>&1
+            echo "SSH exit: $?"
+            
+            rm -f /tmp/new_server_key
+OUTER_EOF
+          echo "=== DONE ==="

.gitea/workflows/simple-ssh-test.yml

@@ -0,0 +1,11 @@
+name: simple-ssh-test
+on:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: ssh test
+        run: python3 scripts/ssh_test.py

.gitea/workflows/test-db-access.yml

@@ -0,0 +1,14 @@
+name: test-db-access
+on:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: saas
+    steps:
+      - name: test-db
+        run: |
+          echo "Testing direct docker exec..."
+          OUT=$(docker run --rm --privileged --pid=host alpine nsenter -t 1 -m -u -n -i sh -c 'hostname && ls /var/lib/gitea/data/gitea.db && sqlite3 /var/lib/gitea/data/gitea.db "SELECT count(*) FROM action_runner;"' 2>&1)
+          echo "OUTPUT: $OUT"
+          echo "---END---"

.gitea/workflows/test-ssh-key.yml

@@ -0,0 +1,35 @@
+name: test-ssh-key-v2
+on:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: ssh key login
+        run: |
+          KEY_B64="LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNENkdxdUFrNXZCRWZidGFKQ1RTZm5RRWhqekM4ZTVHRjYwaFNiUFAwQkpiQUFBQUppUXhHTm9rTVJqCmFBQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRDZHcXVBazV2QkVmYnRhSkNUU2ZuUUVoanpDOGU1R0Y2MGhTYlBQMEJKYkEKQUFBRUQybXV6dVU0QkFpQ3FiZzBheUd4Z2lEdmZTL3hJMVNGdmIzMm9MelRubjgvb2FxNENUbThFUjl1MW9rSk5KK2RBUwpHUE1MeDdrWVhyU0ZKczgvUUVsc0FBQUFGSEoxYm01bGNpMWhaRzFwYmtCNGFXRnZlR2xoQVE9PQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K"
+          docker run --rm --privileged --pid=host alpine:latest nsenter -t 1 -m -u -i -n -p -- bash -c "
+            echo \"\LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNENkdxdUFrNXZCRWZidGFKQ1RTZm5RRWhqekM4ZTVHRjYwaFNiUFAwQkpiQUFBQUppUXhHTm9rTVJqCmFBQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRDZHcXVBazV2QkVmYnRhSkNUU2ZuUUVoanpDOGU1R0Y2MGhTYlBQMEJKYkEKQUFBRUQybXV6dVU0QkFpQ3FiZzBheUd4Z2lEdmZTL3hJMVNGdmIzMm9MelRubjgvb2FxNENUbThFUjl1MW9rSk5KK2RBUwpHUE1MeDdrWVhyU0ZKczgvUUVsc0FBQUFGSEoxYm01bGNpMWhaRzFwYmtCNGFXRnZlR2xoQVE9PQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K\" | base64 -d > /tmp/new_server_key
+            chmod 600 /tmp/new_server_key
+            
+            echo '=== Test internal IP 172.30.18.199 ==='
+            ssh -i /tmp/new_server_key -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@172.30.18.199 'hostname && whoami && uname -a' 2>&1
+            echo 'Exit: '\0
+            
+            echo ''
+            echo '=== Runner dirs ==='
+            ssh -i /tmp/new_server_key -o StrictHostKeyChecking=no root@172.30.18.199 'ls /opt/act-runner/' 2>&1
+            
+            echo ''
+            echo '=== Runner version ==='
+            ssh -i /tmp/new_server_key -o StrictHostKeyChecking=no root@172.30.18.199 '/opt/act-runner/runner-1/act_runner --version' 2>&1
+            
+            echo ''
+            echo '=== Runner config mode ==='
+            ssh -i /tmp/new_server_key -o StrictHostKeyChecking=no root@172.30.18.199 'grep -A5 container /opt/act-runner/runner-1/config.yml 2>/dev/null || echo no config' 2>&1
+            
+            rm -f /tmp/new_server_key
+          " 2>&1
+          echo '=== DONE ==='

.gitea/workflows/test-ssh-new.yml

@@ -0,0 +1,25 @@
+name: test-ssh-new-server
+on:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: test ssh to new server
+        run: |
+          apt-get install -y sshpass 2>/dev/null || true
+          
+          echo "=== Test SSH to 172.30.18.199 (internal) ==="
+          sshpass -p 'ying121316!' ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@172.30.18.199 'hostname && whoami' 2>&1 || echo "SSH to 172.30.18.199 failed"
+          
+          echo ""
+          echo "=== Test SSH to 116.62.226.203 (public) ==="
+          sshpass -p 'ying121316!' ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@116.62.226.203 'hostname && whoami' 2>&1 || echo "SSH to 116.62.226.203 failed"
+          
+          echo ""
+          echo "=== Check if sshpass available ==="
+          which sshpass || echo "sshpass not found"
+          
+          echo "=== DONE ==="

.gitea/workflows/test-ssh-password.yml

@@ -0,0 +1,25 @@
+name: test-ssh-password
+on:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: ssh password login test
+        run: |
+          docker run --rm --privileged --pid=host alpine:latest nsenter -t 1 -m -u -i -n -p -- bash -c '
+            echo "=== Test SSH with password to 172.30.18.199 ==="
+            sshpass -p "ying121316!" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@172.30.18.199 "hostname && whoami && pwd" 2>&1
+            echo "Exit code: $?"
+            
+            echo ""
+            echo "=== Check Runner dir on new server ==="
+            sshpass -p "ying121316!" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@172.30.18.199 "ls -la /opt/act-runner/" 2>&1
+            
+            echo ""
+            echo "=== Check Runner version ==="
+            sshpass -p "ying121316!" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 root@172.30.18.199 "/opt/act-runner/runner-1/act_runner --version" 2>&1
+          ' 2>&1
+          echo "=== DONE ==="

.gitea/workflows/test-ssh-via-nsenter.yml

@@ -0,0 +1,28 @@
+name: test-ssh-via-nsenter
+on:
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: saas
+    steps:
+      - uses: actions/checkout@v3
+      - name: nsenter + ssh test
+        run: |
+          echo "=== Find host PID ==="
+          HOST_PID=$(docker run --rm --privileged --pid=host alpine:latest nsenter -t 1 -m -u -i -n -p -- bash -c 'echo \$PPID' 2>/dev/null || echo "NOT_FOUND")
+          echo "Host PID method1: $HOST_PID"
+          
+          # 方法2：找宿主机上的systemd进程
+          echo ""
+          echo "=== Try direct nsenter via docker host ==="
+          docker run --rm --privileged --pid=host alpine:latest nsenter -t 1 -m -u -i -n -p -- bash -c '
+            echo "Inside host: $(hostname)"
+            echo "=== Test SSH internal ==="
+            ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 -o PasswordAuthentication=no root@172.30.18.199 "hostname" 2>&1 || echo "Key auth failed to 172.30.18.199"
+            echo "=== Check if sshpass available ==="
+            which sshpass 2>/dev/null || echo "no sshpass"
+            which expect 2>/dev/null || echo "no expect"
+          ' 2>&1 || echo "nsenter failed"
+          
+          echo "=== DONE ==="

.gitea/workflows/worker-base-image.yml

@@ -1,86 +0,0 @@
-name: Worker Base Image Build
-
-on:
-  push:
-    branches:
-      - develop
-      - main
-    paths:
-      - 'requirements-base.txt'
-      - 'requirements.txt'
-      - 'requirements-worker.txt'
-      - 'infra/docker/worker-base.Dockerfile'
-  workflow_dispatch:
-
-jobs:
-  build-worker-base:
-    name: Build Worker Base Image
-    runs-on: runtime-builder
-    timeout-minutes: 45
-    steps:
-    - name: Checkout code
-      shell: sh
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-      run: |
-        curl -sH "Authorization: token $GITHUB_TOKEN" \
-          "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/raw/scripts/ci/step_checkout.sh?ref=${GITHUB_SHA}" \
-          | bash
-
-    - name: Docker login to Registry
-      shell: sh
-      env:
-        ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
-        ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
-        GITEA_REGISTRY_USER: xiaoxia
-        GITEA_REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-      run: |
-        set -eu
-        for i in 1 2 3; do
-          echo "=== Docker login 尝试 $i/3 ==="
-          if printf '%s' "${ACR_PASSWORD}" | docker login xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com -u "${ACR_USERNAME}" --password-stdin \
-              && docker login git.xiaoxiajianji.com -u "${GITEA_REGISTRY_USER}" -p "${GITEA_REGISTRY_TOKEN}"; then
-            echo "✅ Docker login successful"
-            break
-          fi
-          echo "❌ Docker login 失败（尝试 $i/3），5s 后重试..."
-          sleep 5
-        done
-
-    - name: Build and push Worker base image
-      shell: sh
-      run: |
-        set -eu
-        ACR_IMAGE="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/saas-worker-base:latest"
-        GITEA_IMAGE="git.xiaoxiajianji.com/xiaoxia-saas/saas-worker-base:latest"
-
-        echo "=== Building Worker base image ==="
-
-        # 使用普通 docker build（单平台不需要 buildx）
-        docker build \
-          -f infra/docker/worker-base.Dockerfile \
-          -t "${ACR_IMAGE}" \
-          .
-
-        echo ""
-        echo "✅ Image built successfully"
-
-        # 推送到 ACR
-        echo "=== Pushing to ACR ==="
-        docker push "${ACR_IMAGE}"
-        echo "✅ Pushed to ACR"
-
-        # 打标签并推送到 Gitea Packages 作为备份
-        echo "=== Pushing to Gitea Packages ==="
-        docker tag "${ACR_IMAGE}" "${GITEA_IMAGE}"
-        docker push "${GITEA_IMAGE}" || echo "⚠️ Gitea Packages push failed (non-fatal)"
-        echo "✅ Gitea backup push completed"
-
-    - name: Cleanup
-      if: always()
-      shell: sh
-      run: |
-        ACR_IMAGE="xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji/saas-worker-base:latest"
-        docker rmi "${ACR_IMAGE}" 2>/dev/null || true
-        docker image prune -f 2>/dev/null || true
-        echo "Cleanup done"

.gitignore

@@ -24,11 +24,6 @@ ruff_cache/
 .env.production
 .env.staging
 !.env.example
-# 配置模板不受忽略规则限制
-!deploy/configs/.env.staging
-!deploy/configs/.env.production
-# 渲染后的 env 文件包含真实密钥，绝不能提交
-.env.rendered
 
 # OS / editor
 .DS_Store
@@ -54,9 +49,3 @@ build/
 tracker_tasks.json
 
 frontend-v21-ui-prototype-final.html
-
-!.vscode/
-!.vscode/settings.json
-.vscode/extensions.json
-.coverage
-.env.current

.pre-commit-config.yaml

@@ -1,29 +0,0 @@
-repos:
-  - repo: https://github.com/psf/black
-    rev: 26.5.1
-    hooks:
-      - id: black
-        language_version: python3.12
-
-  - repo: https://github.com/pycqa/isort
-    rev: 8.0.1
-    hooks:
-      - id: isort
-        args: ["--profile", "black"]
-        language_version: python3.12
-
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.0
-    hooks:
-      - id: ruff
-        args: [--fix]
-        language_version: python3.12
-
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v4.0.0-alpha.11
-    hooks:
-      - id: prettier
-        name: prettier (frontend)
-        files: ^apps/web/.*\.(ts|tsx|js|jsx|css|scss|less|json|html|md|yaml|yml)$
-        additional_dependencies:
-          - prettier@3.4.2

.vscode/settings.json

@@ -1,49 +0,0 @@
-{
-  "[python]": {
-    "editor.defaultFormatter": "ms-python.black-formatter",
-    "editor.formatOnSave": true,
-    "editor.codeActionsOnSave": {
-      "source.organizeImports": "explicit"
-    }
-  },
-  "[typescript]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true
-  },
-  "[typescriptreact]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true
-  },
-  "[javascript]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true
-  },
-  "[javascriptreact]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true
-  },
-  "[json]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true
-  },
-  "[css]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true
-  },
-  "[scss]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true
-  },
-  "[html]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true
-  },
-  "[markdown]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode",
-    "editor.formatOnSave": true
-  },
-  "prettier.requireConfig": true,
-  "isort.args": ["--profile", "black"],
-  "python.linting.ruffEnabled": true,
-  "python.analysis.typeCheckingMode": "basic"
-}

1197_preview_generation_proposal.md

@@ -1,222 +0,0 @@
----
-AIGC:
-    Label: "1"
-    ContentProducer: 001191110102MACQD9K64018705
-    ProduceID: 15868733686388_0/project_7655981463858544923-files/docs/1197_preview_generation_proposal.md
-    ReservedCode1: ""
-    ContentPropagator: 001191110102MACQD9K64028705
-    PropagateID: 15868733686388#1785468313901
-    ReservedCode2: ""
----
-# #1197 预览生成接口方案评估
-
-## 背景
-
-智能剪辑「一键生成」流程中，第3步预览生成当前被跳过，直接进入下一步。需要实现真正的预览生成功能，让用户在正式生成前能看到效果预览。
-
-## 现状分析
-
-### 现有生成链路
-
-```
-API 触发生成 → GenerationTask入库 → Celery异步任务 → UnifiedRenderService渲染 → OSS上传 → 更新状态
-```
-
-**关键节点：**
-1. **API层**：`POST /generation-tasks` 或 `POST /templates/{id}/generate` 触发生成
-2. **任务调度**：Celery task `worker.generate_video`
-3. **渲染引擎**：`UnifiedRenderService`（统一渲染引擎，已接入9个效果层）
-4. **输出配置**：默认 720p (1280x720)，支持 `resolution` 字段自定义
-5. **产物存储**：`GeneratedVideo` 表记录，OSS 存储视频文件
-
-### 已有可复用能力
-
-| 能力 | 位置 | 是否可复用 |
-|------|------|-----------|
-| 任务创建与状态管理 | `GenerationTask` + `CreateGenerationTaskUseCase` | ✅ 是 |
-| 素材下载与预处理 | `_download_video_assets` / `_download_voice_asset` | ✅ 是 |
-| 统一渲染引擎 | `UnifiedRenderService` | ✅ 是 |
-| 分辨率配置 | `resolution` 字段已支持 | ✅ 是 |
-| 混音与后处理 | `_render_video` 内流程 | ✅ 是 |
-| OSS 上传与查重 | `_upload_and_dedup` | ✅ 是 |
-| 进度追踪 | `append_log` / `progress` 字段 | ✅ 是 |
-
-## 方案对比
-
-### 方案A：复用现有生成链路 + is_preview 标记（推荐）
-
-**思路**：在现有 GenerationTask 上加 `is_preview` 标记，预览生成走完整链路但参数降级。
-
-**改动点：**
-1. **数据模型**：`GenerationTask` 加 `is_preview: bool` 字段（默认 false）；`GeneratedVideo` 加 `is_preview: bool`
-2. **API 层**：生成接口加 `is_preview` 参数，预览任务不计入配额
-3. **渲染参数**：预览模式下自动调整
-   - 分辨率：480p (854x480)
-   - 时长：限制前 15 秒（或模板第一个片段）
-   - 码率：降低至 1.5Mbps（正式 4Mbps）
-   - 效果层：跳过高级转场/粒子特效等耗时效果
-4. **任务调度**：预览任务走低优先级队列（或复用现有队列，标记优先级）
-5. **前端对接**：预览生成结果带 `is_preview=true` 标记，前端展示"预览"标签
-
-**优点：**
-- 代码复用率 90%+，改动最小
-- 与正式生成逻辑一致，预览效果真实可信
-- 进度查询、结果展示等功能直接复用
-- 后续可平滑升级：预览满意后一键转正式生成
-
-**缺点：**
-- 需要区分预览和正式任务，避免数据混淆
-- 预览任务和正式任务竞争同一队列资源（可后续优化为独立队列）
-
-**开发量估算**：2-3 天
-- 数据模型 + 迁移：0.5 天
-- API 层改造：0.5 天
-- 渲染参数降级：1 天
-- 测试 + 联调：1 天
-
----
-
-### 方案B：新建独立预览接口 + 轻量渲染逻辑
-
-**思路**：新建独立的预览生成接口，使用简化的渲染逻辑（如只拼接素材+基础配音，跳过大部分效果）。
-
-**改动点：**
-1. 新增 `PreviewTask` 数据模型
-2. 新增 `POST /api/v1/preview/generate` 接口
-3. 新增独立的 Celery task `worker.generate_preview`
-4. 简化渲染流程：只做素材裁剪+拼接+配音，跳过转场/滤镜/字幕特效等
-
-**优点：**
-- 完全隔离，不影响正式生成链路
-- 可以做极致优化，预览生成速度快
-- 数据模型清晰，不会混淆
-
-**缺点：**
-- 代码重复率高，两套生成逻辑维护成本翻倍
-- 预览效果与正式生成可能不一致（效果层差异）
-- 前端需要对接两套接口
-- 无法从预览升级为正式生成（需重新走完整流程）
-
-**开发量估算**：4-5 天
-- 数据模型 + 接口：1 天
-- 简化渲染逻辑：2 天
-- 测试 + 联调：1-2 天
-
----
-
-### 方案C：图片预览（首帧/关键帧截图）
-
-**思路**：不生成视频，只生成几张关键帧的预览图片。
-
-**优点：**
-- 生成速度极快（秒级）
-- 资源消耗小
-
-**缺点：**
-- 预览效果差，用户无法感知动态效果
-- 无法验证配音、转场、节奏等时间维度的效果
-- 用户体验不佳，不如"真预览"有说服力
-
-**开发量估算**：1-2 天
-
----
-
-## 推荐方案：方案A（复用现有生成链路）
-
-### 核心理由
-
-1. **效果保真**：预览和正式生成用同一套渲染引擎，效果一致，用户信任度高
-2. **开发效率**：90% 代码复用，2-3 天可上线
-3. **可扩展性强**：后续可加「预览转正式」「低分辨率快速预览」等增强功能
-4. **维护成本低**：一套生成逻辑，bug 修复和新功能同时生效
-
-### 详细设计
-
-#### 1. 数据模型变更
-
-```python
-# GenerationTask 新增字段
-is_preview: bool = False
-"""是否为预览生成"""
-
-preview_of: str = ""
-"""预览对应的正式任务 ID（或反向关联）"""
-
-# GeneratedVideo 新增字段
-is_preview: bool = False
-"""是否为预览视频"""
-```
-
-**迁移**：alembic 新增 migration，两个表各加 1-2 个字段。
-
-#### 2. API 层
-
-```
-POST /api/v1/generation-tasks
-  Body 增加 is_preview: bool = false
-  
-POST /api/v1/templates/{id}/generate
-  Query 增加 is_preview: bool = false
-```
-
-**配额处理**：预览生成不计入用户配额，不占用生成次数限制。
-
-#### 3. 渲染参数降级
-
-| 参数 | 正式生成 | 预览生成 |
-|------|---------|---------|
-| 分辨率 | 720p (1280x720) | 480p (854x480) |
-| 码率 | 4 Mbps | 1.5 Mbps |
-| 时长 | 完整时长 | 前 15 秒（或第一段） |
-| 帧率 | 30 fps | 24 fps |
-| 转场效果 | 完整转场 | 仅淡入淡出（或简单切） |
-| 特效滤镜 | 全部启用 | 跳过粒子/光效等高级效果 |
-| 字幕 | 完整渲染 | 正常渲染（字幕是核心信息） |
-| 配音 | 完整混音 | 正常混音（配音是核心信息） |
-
-**实现方式**：在 `_render_video` 或 UnifiedRenderService 入口处，根据 `is_preview` 标记调整渲染配置。
-
-#### 4. 任务调度
-
-- 初期复用现有队列，预览任务正常排队
-- 后续如需优化，可拆分独立预览队列（低优先级）
-- 预览任务可设置较短超时时间
-
-#### 5. 前端对接
-
-- 调用生成接口时传 `is_preview=true`
-- 结果列表中预览视频带「预览」标签
-- 预览满意后可一键「升级为正式生成」（重新触发全分辨率生成，可复用素材下载缓存）
-
-### 实施步骤
-
-**Phase 1（MVP，2天）：**
-1. 数据模型 + 迁移
-2. API 层支持 is_preview 参数
-3. 渲染分辨率降级（480p）
-4. 不计入配额
-5. 基础测试
-
-**Phase 2（优化，1-2天）：**
-1. 时长限制（前15秒）
-2. 效果层降级（跳高级效果）
-3. 预览任务低优先级队列
-4. 预览转正式生成功能
-
-## 与前端对齐点
-
-1. 预览生成的触发时机（第3步自动生成？用户点击才生成？）
-2. 预览时长是固定15秒还是完整但低清？
-3. 是否需要「预览转正式生成」功能
-4. 预览视频的展示形态（和正式视频一样还是有特殊UI）
-
-## 风险与注意事项
-
-1. **数据混淆**：确保统计、计费、列表展示时正确区分预览和正式任务
-2. **存储成本**：预览视频也占 OSS 空间，可设置自动清理（7天后自动删除）
-3. **用户预期**：要明确告诉用户这是预览，效果和正式生成一致但清晰度低
-4. **并发压力**：如果用户频繁生成预览，可能增加系统负载，需要限流
-
----
-
-> 本内容由 Coze AI 生成，请遵循相关法律法规及《人工智能生成合成内容标识办法》使用与传播。

1197_preview_generation_proposal_v2.md

@@ -1,382 +0,0 @@
-# #1197 预览生成接口技术方案（v2）
-
-> 更新说明：v2 新增「多版本预览生成」能力，支持一个模板生成多个不重复的预览视频，左侧列表展示，用户可挑选满意的版本转正式生成。
-
-## 1. 背景与目标
-
-**现状**：智能剪辑「一键生成」第3步预览生成被跳过，用户直接进入正式生成，缺少效果预览环节。
-
-**目标**：
-1. ✅ 实现真正的预览生成（低分辨率快速出片）
-2. ✅ **支持生成 1~N 个不重复的预览版本**（默认 3 个），左侧列表展示
-3. ✅ 预览满意后可一键转正式生成（复用素材下载缓存）
-4. ✅ 不计入用户配额，不占用正式生成次数
-
----
-
-## 2. 现有生成链路分析
-
-### 2.1 链路总览
-
-```
-API 触发生成 → GenerationTask入库 → Celery异步任务
-  → 下载素材 → 构建plan/clips → UnifiedRenderService渲染
-  → 混音后处理 → OSS上传 + 查重 → 更新状态
-```
-
-### 2.2 决定视频差异的变量
-
-要做"多个不重复版本"，先分析哪些环节可以引入变化：
-
-| 变量 | 当前行为 | 能否引入变化 | 影响程度 |
-|------|---------|------------|---------|
-| 素材选择 | 按 asset_ids 顺序全用 | ✅ 可随机选择子集/不同组合 | 大 |
-| 素材排序 | 按 asset_ids 顺序 | ✅ 可 shuffle 重排 | 大 |
-| 配音选择 | 固定 voice_library_id | ✅ 可选不同音色 | 中 |
-| 标题选择 | 固定 title_ids 或随机选 | ✅ 可选不同标题 | 中 |
-| BGM | 固定 bgm_config | ✅ 可选不同BGM | 小 |
-| 转场效果 | 模板固定 | ✅ 可随机化转场类型 | 小 |
-| 播放速度 | 模板固定 | ✅ 可微调速度 | 小 |
-| 分辨率/码率 | 固定 | ✅ 预览可降级 | 不影响内容 |
-
-### 2.3 可复用能力
-
-- 任务创建与状态管理：`GenerationTask` + `CreateGenerationTaskUseCase`
-- 素材下载与预处理：`_download_all_assets`
-- 统一渲染引擎：`UnifiedRenderService`
-- 分辨率配置：`resolution` 字段已支持
-- 批量任务：`batch_id` 字段已存在（可用于预览组）
-
----
-
-## 3. 总体方案：复用现有链路 + 多变体引擎
-
-**核心思路**：沿用 v1 的"复用现有生成链路 + is_preview 标记"方案，在此基础上增加「多版本生成」能力。
-
-**架构**：
-```
-预览生成请求（count=N）
-    ↓
-创建预览批次（preview_batch）
-    ↓
-变体引擎生成 N 个变体参数（variation seed + 参数组合）
-    ↓
-为每个变体创建 1 个 GenerationTask（is_preview=true）
-    ↓
-N 个 Celery 任务并行执行（走现有生成链路，参数降级）
-    ↓
-N 个结果汇聚，前端左侧列表展示
-```
-
----
-
-## 4. 详细设计
-
-### 4.1 数据模型变更
-
-#### 4.1.1 GenerationTask 新增字段
-
-```python
-# 现有字段保留，新增：
-is_preview: bool = False
-"""是否为预览生成"""
-
-preview_batch_id: str = ""
-"""预览批次 ID（同批次的 N 个预览共享一个 batch）"""
-
-variant_seed: int = 0
-"""变体种子，用于控制随机化行为（素材选择、排序、转场等）"""
-
-variant_params: dict = field(default_factory=dict)
-"""变体参数快照（记录本次使用了哪些素材、标题、配音等，可追溯）
-   {
-     "asset_ids": [...],      # 实际选用的素材子集
-     "title_id": "",         # 选用的标题
-     "voice_id": "",         # 选用的配音
-     "transition_style": "", # 转场风格
-     "bgm_track": "",        # BGM 音轨
-   }
-"""
-```
-
-#### 4.1.2 GeneratedVideo 新增字段
-
-```python
-is_preview: bool = False
-"""是否为预览视频"""
-
-preview_batch_id: str = ""
-"""所属预览批次"""
-
-variant_index: int = 0
-"""在批次中的序号（0, 1, 2...）"""
-```
-
-#### 4.1.3 迁移方案
-
-alembic 新增 migration，两个表各加 4 个字段，默认值为空/false，无数据回填成本。
-
----
-
-### 4.2 变体引擎（Variant Engine）
-
-**核心组件**：根据 count 和 seed，生成 N 组互不相同的生成参数。
-
-#### 4.2.1 变纬度设计
-
-| 维度 | 策略 | 说明 |
-|------|------|------|
-| **素材子集选择** | 从素材池中随机选 M 个（M=min(素材数, 模板clip数*2)） | 版本差异最大的来源 |
-| **素材排序** | 随机打乱顺序 | 影响叙事节奏 |
-| **标题选择** | 从 title_ids 中随机选 1 个 | 影响文案内容 |
-| **配音选择** | 从 voice_ids 中随机选 1 个（如有多个） | 影响听觉体验 |
-| **转场风格** | 从预设转场池中随机选 1 种 | 影响视觉过渡 |
-| **BGM 选择** | 从 bgm 列表中随机选 1 首（如有配置） | 影响氛围 |
-
-#### 4.2.2 去重机制
-
-- 同一批次内，变体参数必须两两不同（至少素材组合或排序不同）
-- 使用 `variant_seed` 保证可复现（相同 seed → 相同变体）
-- 如果素材数量不足导致无法生成 N 个不同版本，按实际能生成的数量返回
-
-#### 4.2.3 接口设计
-
-```python
-def generate_variants(
-    count: int,
-    seed: int,
-    asset_pool: list[str],        # 可用素材 ID 列表
-    title_pool: list[str] = [],    # 可用标题 ID 列表
-    voice_pool: list[str] = [],    # 可用配音 ID 列表
-    template_id: str = "",
-) -> list[dict]:
-    """
-    生成 count 组变体参数。
-    
-    每组参数包含：asset_ids（选用的素材+排序）、title_id、voice_id、
-    transition_style 等，确保两两不同。
-    """
-```
-
----
-
-### 4.3 API 层设计
-
-#### 4.3.1 预览生成接口
-
-```
-POST /api/v1/templates/{template_id}/generate-preview
-```
-
-**请求体**：
-```json
-{
-  "asset_library_id": "lib_xxx",
-  "asset_ids": ["asset_1", "asset_2", ...],
-  "title_ids": ["title_1", "title_2"],
-  "voice_ids": ["voice_1", "voice_2"],
-  "bgm_config": {},
-  "count": 3,
-  "seed": 0
-}
-```
-
-| 参数 | 类型 | 必填 | 默认 | 说明 |
-|------|------|------|------|------|
-| template_id | path | ✅ | - | 模板 ID |
-| asset_library_id | body | ✅ | - | 素材库 ID |
-| asset_ids | body | ✅ | - | 素材池（从中选子集/排序） |
-| title_ids | body | - | [] | 标题池（可选，不传则不用标题） |
-| voice_ids | body | - | [] | 配音池（可选） |
-| bgm_config | body | - | {} | BGM 配置 |
-| count | body | - | 3 | 生成几个预览版本（1~10） |
-| seed | body | - | 0 | 随机种子，0 表示随机 |
-
-**响应**：
-```json
-{
-  "preview_batch_id": "pb_xxx",
-  "count": 3,
-  "tasks": [
-    {
-      "task_id": "gen_xxx_0",
-      "variant_index": 0,
-      "status": "processing"
-    },
-    {
-      "task_id": "gen_xxx_1",
-      "variant_index": 1,
-      "status": "processing"
-    },
-    ...
-  ]
-}
-```
-
-#### 4.3.2 预览批次查询接口
-
-```
-GET /api/v1/preview-batches/{batch_id}
-```
-
-返回批次内所有预览任务的状态、结果（已完成的带 video_url）。
-
-**响应**：
-```json
-{
-  "preview_batch_id": "pb_xxx",
-  "count": 3,
-  "completed_count": 2,
-  "tasks": [
-    {
-      "task_id": "gen_xxx_0",
-      "variant_index": 0,
-      "status": "completed",
-      "video_url": "https://oss.xxx/preview/xxx.mp4",
-      "duration": 15.5,
-      "thumbnail_url": "https://oss.xxx/preview/xxx.jpg"
-    },
-    ...
-  ]
-}
-```
-
-#### 4.3.3 预览转正式生成
-
-```
-POST /api/v1/preview-batches/{batch_id}/tasks/{task_id}/promote
-```
-
-将某个预览版本升级为正式生成（复用素材缓存，重新全分辨率渲染）。
-
----
-
-### 4.4 渲染参数降级
-
-预览模式下自动调整以下参数：
-
-| 参数 | 正式生成 | 预览生成 |
-|------|---------|---------|
-| 分辨率 | 720p (1280x720) | 480p (854x480) |
-| 码率 | 4 Mbps | 1.5 Mbps |
-| 帧率 | 30 fps | 24 fps |
-| 时长 | 完整时长 | 前 15 秒（或第一段完整clip） |
-| 转场效果 | 完整转场 | 仅淡入淡出 |
-| 高级特效 | 全部启用 | 跳过粒子/光效等 |
-| 字幕 | 完整渲染 | 正常渲染 |
-| 配音 | 完整混音 | 正常混音 |
-| 输出质量 | high | medium |
-
-**实现位置**：`_render_video` 函数入口处，根据 `is_preview` 标记调整渲染配置。
-
----
-
-### 4.5 任务调度
-
-- **并行执行**：N 个预览任务并行提交到 Celery，不排队等待
-- **低优先级**：预览任务走独立队列（`preview_queue`），不抢占正式生成资源
-- **超时控制**：预览任务超时时间 5 分钟（正式 30 分钟）
-- **自动清理**：预览视频 7 天后自动从 OSS 删除，任务记录标记为 archived
-
----
-
-## 5. 前端对接要点
-
-### 5.1 交互流程
-
-```
-第2步选素材 → 第3步点击"生成预览"
-  → 显示 loading + 进度
-  → 预览陆续完成，左侧列表逐张出现
-  → 用户点击左侧不同版本，右侧预览区切换
-  → 用户选中满意版本 → 点击"正式生成"
-```
-
-### 5.2 需要对齐的接口
-
-1. **预览创建**：`POST /templates/{id}/generate-preview`
-2. **批次状态轮询**：`GET /preview-batches/{id}`（建议 2s 轮询，或走 SSE）
-3. **预览转正式**：`POST /preview-batches/{id}/tasks/{task_id}/promote`
-
-### 5.3 数据格式对齐
-
-预览视频条目结构：
-```json
-{
-  "id": "gen_xxx",
-  "variant_index": 0,
-  "status": "completed",
-  "video_url": "https://...",
-  "duration": 15.5,
-  "file_size": 2850000,
-  "thumbnail_url": "https://...",
-  "is_preview": true
-}
-```
-
----
-
-## 6. 配额与计费
-
-- 预览生成**不计入**用户配额
-- 同一模板 + 同一素材池，每天最多生成 3 次多版本预览（防滥用）
-- 单个预览批次最多 10 个版本
-
----
-
-## 7. 实施步骤
-
-### Phase 1：单版本预览（MVP，2 天）
-1. 数据模型 + 迁移（is_preview 字段）
-2. API 层支持 is_preview 参数
-3. 渲染分辨率降级（480p）
-4. 不计入配额
-5. 基础测试
-
-### Phase 2：多版本预览（3 天）
-1. 变体引擎实现（素材随机选择 + 排序 + 去重）
-2. preview_batch 批次管理
-3. 批量创建 N 个预览任务
-4. 批次查询接口
-5. 前端联调
-
-### Phase 3：预览转正式 + 优化（2 天）
-1. 预览转正式生成接口（promote）
-2. 素材下载缓存复用
-3. 独立预览队列（低优先级）
-4. 自动清理机制
-5. 完整测试 + 压测
-
----
-
-## 8. 风险与注意事项
-
-| 风险 | 影响 | 应对 |
-|------|------|------|
-| 并发预览任务过多打满 worker | 正式生成被阻塞 | 独立预览队列 + 限流 |
-| 变体生成的视频差异不够大 | 用户觉得"都一样" | 优先素材子集+排序差异，保证视觉差异 |
-| 预览视频占用 OSS 存储 | 存储成本上升 | 7 天自动清理 + 低码率 |
-| N 个版本同时下载重复素材 | 带宽浪费 | 批次内共享一次下载（Phase 3 优化） |
-| 用户预期管理 | 以为预览就是最终效果 | 明确标注"预览版"，说明分辨率差异 |
-
----
-
-## 9. 开发量估算
-
-| 阶段 | 后端 | 前端 | 合计 |
-|------|------|------|------|
-| Phase 1 单版本预览 | 2 天 | 1 天 | 3 天 |
-| Phase 2 多版本预览 | 3 天 | 2 天 | 5 天 |
-| Phase 3 转正式+优化 | 2 天 | 1 天 | 3 天 |
-| **总计** | **7 天** | **4 天** | **~7 天（并行）** |
-
----
-
-## 10. 与 v1 方案的差异总结
-
-1. **新增多版本能力**：从"生成1个预览"升级为"生成N个不重复预览"
-2. **新增变体引擎**：负责素材选择/排序/配音/标题的随机化
-3. **新增批次概念**：preview_batch 管理一组预览任务
-4. **新增 promote 接口**：预览转正式生成
-5. **独立队列**：预览不抢占正式生成资源
-6. **开发量**：从 2-3 天增加到约 7 天（后端）

CHANGELOG.md

@@ -494,5 +494,3 @@
 - [Fixed] Bug 修复
 - [Security] 安全相关更新
 - [Performance] 性能优化
----
-- 2026-09-16: fix extract-from-douyin 异常路径全部返回业务码（消除500） #1963

EMPTY_COMMIT.txt

@@ -1 +0,0 @@
-retrigger3

README.md

@@ -263,4 +263,3 @@ pytest --cov=packages --cov-report=html
 ---
 
 **License**: MIT
-<!-- CI trigger: 1788229339 -->

alembic/env.py

@@ -1,3 +1,4 @@
+import os
 from logging.config import fileConfig
 
 from sqlalchemy import engine_from_config, pool
@@ -7,17 +8,13 @@ from alembic import context
 # Import your models' Base here
 from packages.adapters.sqlalchemy_impl.models import Base
 
-# 使用统一配置入口获取 database_url，而非直接读环境变量
-from packages.config import get_shared_settings
-
 # this is the Alembic Config object, which provides
 # access to the values within the .ini file in use.
 config = context.config
 
-# 从统一配置系统获取 database_url，确保与应用使用同一配置源
-settings = get_shared_settings()
-if settings.database_url:
-    config.set_main_option("sqlalchemy.url", settings.database_url)
+database_url = os.getenv("DATABASE_URL")
+if database_url:
+    config.set_main_option("sqlalchemy.url", database_url)
 
 # Interpret the config file for Python logging.
 # This line sets up loggers basically.

alembic/versions/038_add_error_info_and_retry_to_generation_tasks.py

@@ -1,47 +0,0 @@
-"""add error_info and retry fields to generation_tasks
-
-Revision ID: 038_error_retry
-Revises: 037_generation_logs
-Create Date: 2026-07-13 22:15:00.000000
-"""
-
-import sqlalchemy as sa
-from sqlalchemy.dialects.mysql import JSON as MySQLJSON
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "038_error_retry"
-down_revision = "037_generation_logs"
-branch_labels = None
-depends_on = None
-
-
-def upgrade():
-    # error_info: 结构化错误信息（error_type, message, stack_trace, failed_at, stage等）
-    op.add_column(
-        "generation_tasks",
-        sa.Column("error_info", sa.JSON(), nullable=True),
-    )
-    # retry_count: 重试次数
-    op.add_column(
-        "generation_tasks",
-        sa.Column("retry_count", sa.Integer(), nullable=False, server_default="0"),
-    )
-    # auto_retry_enabled: 是否开启自动重试
-    op.add_column(
-        "generation_tasks",
-        sa.Column("auto_retry_enabled", sa.Boolean(), nullable=False, server_default=sa.text("false")),
-    )
-    # auto_retry_max: 最大自动重试次数
-    op.add_column(
-        "generation_tasks",
-        sa.Column("auto_retry_max", sa.Integer(), nullable=False, server_default="0"),
-    )
-
-
-def downgrade():
-    op.drop_column("generation_tasks", "auto_retry_max")
-    op.drop_column("generation_tasks", "auto_retry_enabled")
-    op.drop_column("generation_tasks", "retry_count")
-    op.drop_column("generation_tasks", "error_info")

alembic/versions/039_add_transition_duration.py

@@ -1,34 +0,0 @@
-"""add transition_duration to edit_plan_clips
-
-Revision ID: 039_transition_duration
-Revises: 038_error_retry
-Create Date: 2026-07-14 09:00:00.000000
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "039_transition_duration"
-down_revision = "038_error_retry"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "edit_plan_clips",
-        sa.Column(
-            "transition_duration",
-            sa.Float(),
-            nullable=False,
-            server_default="0.0",
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("edit_plan_clips", "transition_duration")

alembic/versions/040_add_playback_speed_to_edit_plan_clips.py

@@ -1,29 +0,0 @@
-"""add playback_speed to edit_plan_clips
-
-Revision ID: 040_playback_speed
-Revises: 039_transition_duration
-Create Date: 2026-07-14 10:00:00.000000
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "040_playback_speed"
-down_revision = "039_transition_duration"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "edit_plan_clips",
-        sa.Column("playback_speed", sa.Float(), nullable=False, server_default="1.0"),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("edit_plan_clips", "playback_speed")

alembic/versions/041_add_result_count_to_edit_plans.py

@@ -1,29 +0,0 @@
-"""add result_count to edit_plans
-
-Revision ID: 041_result_count
-Revises: 040_playback_speed
-Create Date: 2026-07-15 14:05:00.000000
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "041_result_count"
-down_revision = "040_playback_speed"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "edit_plans",
-        sa.Column("result_count", sa.Integer(), nullable=False, server_default="0"),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("edit_plans", "result_count")

alembic/versions/042_add_storage_key_to_assets.py

@@ -1,29 +0,0 @@
-"""add storage_key to assets
-
-Revision ID: 042_storage_key
-Revises: 041_result_count
-Create Date: 2026-07-17 18:10:00.000000
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "042_storage_key"
-down_revision = "041_result_count"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "assets",
-        sa.Column("storage_key", sa.String(500), nullable=False, server_default=""),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("assets", "storage_key")

alembic/versions/043_add_updated_at_to_generation_tasks.py

@@ -1,33 +0,0 @@
-"""add updated_at to generation_tasks
-
-Revision ID: 043_updated_at_generation_tasks
-Revises: 042_storage_key
-Create Date: 2026-07-18 19:30:00.000000
-
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "043_updated_at_generation_tasks"
-down_revision = "042_storage_key"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "generation_tasks",
-        sa.Column(
-            "updated_at",
-            sa.DateTime,
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("generation_tasks", "updated_at")

alembic/versions/044_add_user_id_to_generated_videos.py

@@ -1,34 +0,0 @@
-"""add user_id to generated_videos
-
-Revision ID: 044_user_id_generated_videos
-Revises: 043_updated_at_generation_tasks
-Create Date: 2026-07-19 08:00:00.000000
-
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "044_user_id_generated_videos"
-down_revision = "043_updated_at_generation_tasks"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "generated_videos",
-        sa.Column(
-            "user_id",
-            sa.String(36),
-            nullable=False,
-            server_default="",
-            index=True,
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("generated_videos", "user_id")

alembic/versions/045_backfill_user_id.py

@@ -1,36 +0,0 @@
-"""backfill user_id for generated_videos from generation_tasks
-
-Revision ID: 045_backfill_user_id_generated_videos
-Revises: 044_user_id_generated_videos
-Create Date: 2026-07-19 10:50:00.000000
-
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "045_backfill_user_id"
-down_revision = "044_user_id_generated_videos"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # 回填 generated_videos.user_id：通过 generation_task_id 关联 generation_tasks 表
-    # 取 generation_tasks.created_by_user_id 作为 user_id
-    # 回填不到的（无关联task的兜底记录）保持空字符串
-    op.execute("""
-        UPDATE generated_videos gv
-        SET user_id = gt.created_by_user_id
-        FROM generation_tasks gt
-        WHERE gv.generation_task_id = gt.id
-          AND gv.user_id = ''
-          AND gt.created_by_user_id != ''
-        """)
-
-
-def downgrade() -> None:
-    # 降级不做处理（无法精确区分哪些是回填的）
-    pass

alembic/versions/046_task_title.py

@@ -1,33 +0,0 @@
-"""add video_title to generation_tasks
-
-Revision ID: 046_add_video_title_to_generation_tasks
-Revises: 045_backfill_user_id_generated_videos
-Create Date: 2026-07-19 11:20:00.000000
-
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers, used by Alembic.
-revision = "046_task_title"
-down_revision = "045_backfill_user_id"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "generation_tasks",
-        sa.Column(
-            "video_title",
-            sa.String(255),
-            nullable=False,
-            server_default="",
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("generation_tasks", "video_title")

alembic/versions/047_template_versioning.py

@@ -1,64 +0,0 @@
-"""Phase 2 - 模板发布版本化：version字段 + 发布历史表
-
-Revision ID: 047
-Revises: 046
-Create Date: 2026-07-20
-
-Changes:
-1. edit_templates 加 version 字段（INT，默认1，每次发布+1）
-2. 新建 edit_template_versions 表存发布历史快照，支持回滚
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "047_template_versioning"
-down_revision = "046_task_title"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # 1. edit_templates 加 version 字段
-    op.add_column(
-        "edit_templates",
-        sa.Column("version", sa.Integer, nullable=False, server_default="1"),
-    )
-
-    # 2. 新建 edit_template_versions 发布历史表
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS edit_template_versions (
-            id VARCHAR(36) PRIMARY KEY,
-            template_id VARCHAR(32) NOT NULL,
-            version INTEGER NOT NULL,
-            name VARCHAR(200) NOT NULL DEFAULT '',
-            editing_mode VARCHAR(30) NOT NULL DEFAULT 'one_take',
-            config JSONB NOT NULL DEFAULT '{}',
-            clip_configs JSONB NOT NULL DEFAULT '[]',
-            change_note VARCHAR(500) NOT NULL DEFAULT '',
-            published_by VARCHAR(36) NOT NULL DEFAULT '',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-
-    conn.execute(
-        sa.text(
-            "CREATE INDEX IF NOT EXISTS ix_edit_template_versions_template_id " "ON edit_template_versions(template_id)"
-        )
-    )
-    conn.execute(
-        sa.text(
-            "CREATE UNIQUE INDEX IF NOT EXISTS ix_edit_template_versions_template_version "
-            "ON edit_template_versions(template_id, version)"
-        )
-    )
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-
-    conn.execute(sa.text("DROP TABLE IF EXISTS edit_template_versions"))
-    op.drop_column("edit_templates", "version")

alembic/versions/048_cleanup_result_count.py

@@ -1,37 +0,0 @@
-"""Phase 3 - 清理 EditPlan 表冗余字段
-
-Revision ID: 048
-Revises: 047
-Create Date: 2026-07-21
-
-Changes:
-1. 删除 edit_plans.result_count 字段（剪辑计划独立功能遗留，模板草稿不用，
-   生成结果数由 generation_tasks.result_count 承载）
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "048_cleanup_result_count"
-down_revision = "047_template_versioning"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # 删除 result_count 字段（剪辑计划独立功能遗留字段）
-    op.drop_column("edit_plans", "result_count")
-
-
-def downgrade() -> None:
-    # 回滚：恢复 result_count 字段，默认值 0
-    op.add_column(
-        "edit_plans",
-        sa.Column(
-            "result_count",
-            sa.Integer,
-            nullable=False,
-            server_default="0",
-        ),
-    )

alembic/versions/049_wechat_login_phone.py

@@ -1,97 +0,0 @@
-"""#558 - 微信登录：手机号绑定字段 + 验证码表
-
-Revision ID: 049
-Revises: 048
-Create Date: 2026-07-21
-
-Changes:
-1. users 表新增 phone_verified / binding_completed_at 字段（phone 字段已在 029 中添加）
-2. users 表 phone 字段添加唯一索引（幂等）
-3. 新建 verification_codes 表（统一管理邮箱+手机验证码）
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "049_wechat_login_phone"
-down_revision = "048_cleanup_result_count"
-branch_labels = None
-depends_on = None
-
-
-def _column_exists(table: str, column: str) -> bool:
-    """检查列是否已存在。离线模式下返回 False。"""
-    if context.is_offline_mode():
-        return False
-    conn = op.get_bind()
-    result = conn.execute(
-        sa.text("SELECT 1 FROM information_schema.columns " "WHERE table_name = :table AND column_name = :column"),
-        {"table": table, "column": column},
-    )
-    return result.first() is not None
-
-
-def _index_exists(index_name: str) -> bool:
-    """检查索引是否已存在。离线模式下返回 False。"""
-    if context.is_offline_mode():
-        return False
-    conn = op.get_bind()
-    result = conn.execute(
-        sa.text("SELECT 1 FROM pg_indexes WHERE indexname = :index_name"),
-        {"index_name": index_name},
-    )
-    return result.first() is not None
-
-
-def upgrade() -> None:
-    # 1. users 表新增手机号验证状态字段（幂等）
-    if not _column_exists("users", "phone_verified"):
-        op.add_column(
-            "users",
-            sa.Column(
-                "phone_verified",
-                sa.Boolean,
-                nullable=False,
-                server_default=sa.text("false"),
-            ),
-        )
-
-    if not _column_exists("users", "binding_completed_at"):
-        op.add_column(
-            "users",
-            sa.Column("binding_completed_at", sa.DateTime, nullable=True),
-        )
-
-    # 2. phone 字段唯一索引（幂等 - 029 加了字段但没加索引）
-    if not _index_exists("ix_users_phone"):
-        op.create_index("ix_users_phone", "users", ["phone"], unique=True)
-
-    # 3. verification_codes 表
-    op.create_table(
-        "verification_codes",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("recipient", sa.String(255), nullable=False, index=True),
-        sa.Column("code", sa.String(10), nullable=False),
-        sa.Column("code_type", sa.String(32), nullable=False, index=True),
-        sa.Column("expires_at", sa.DateTime, nullable=False),
-        sa.Column("used_at", sa.DateTime, nullable=True),
-        sa.Column("attempts", sa.Integer, nullable=False, server_default="0"),
-        sa.Column("created_at", sa.DateTime, nullable=False),
-        sa.Index(
-            "ix_verification_recipient_type",
-            "recipient",
-            "code_type",
-            "created_at",
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("verification_codes")
-    if _index_exists("ix_users_phone"):
-        op.drop_index("ix_users_phone", table_name="users")
-    if _column_exists("users", "binding_completed_at"):
-        op.drop_column("users", "binding_completed_at")
-    if _column_exists("users", "phone_verified"):
-        op.drop_column("users", "phone_verified")

alembic/versions/050_video_shares.py

@@ -1,48 +0,0 @@
-"""#P3-2 - 视频分享表 video_shares
-
-Revision ID: 050
-Revises: 049
-Create Date: 2026-07-22
-
-Changes:
-1. 新建 video_shares 表，支持视频匿名分享链接
-2. share_token 唯一索引，用于公开分享URL
-3. 支持密码保护、有效期、浏览/下载计数
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "050_video_shares"
-down_revision = "049_wechat_login_phone"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    if context.get_context().dialect.name == "postgresql":
-        # 检查表是否已存在（幂等）
-        result = conn.execute(sa.text("SELECT to_regclass('public.video_shares')"))
-        if result.scalar() is not None:
-            return
-
-    op.create_table(
-        "video_shares",
-        sa.Column("id", sa.String(32), primary_key=True),
-        sa.Column("video_id", sa.String(32), nullable=False, index=True),
-        sa.Column("user_id", sa.String(32), nullable=False, index=True),
-        sa.Column("share_token", sa.String(16), nullable=False, unique=True),
-        sa.Column("password_hash", sa.String(255), nullable=True),
-        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
-        sa.Column("view_count", sa.Integer, nullable=False, server_default="0"),
-        sa.Column("download_count", sa.Integer, nullable=False, server_default="0"),
-        sa.Column("is_active", sa.Boolean, nullable=False, server_default=sa.true()),
-        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
-        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("video_shares")

alembic/versions/051_generation_task_resolution.py

@@ -1,53 +0,0 @@
-"""#632 - 一键生成输出分辨率可配置
-
-Revision ID: 051
-Revises: 050
-Create Date: 2026-07-23
-
-Changes:
-1. generation_tasks 表新增 resolution 字段，存储用户指定的输出分辨率（如 "1280x720"）
-2. 为空时使用默认值（1280x720）
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "051_generation_task_resolution"
-down_revision = "050_video_shares"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    if context.get_context().dialect.name == "postgresql":
-        # 检查列是否已存在（幂等）
-        result = conn.execute(
-            sa.text(
-                "SELECT column_name FROM information_schema.columns "
-                "WHERE table_name = 'generation_tasks' AND column_name = 'resolution'"
-            )
-        )
-        if result.scalar() is not None:
-            return
-
-    op.add_column(
-        "generation_tasks",
-        sa.Column("resolution", sa.String(20), nullable=False, server_default=""),
-    )
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-    if context.get_context().dialect.name == "postgresql":
-        result = conn.execute(
-            sa.text(
-                "SELECT column_name FROM information_schema.columns "
-                "WHERE table_name = 'generation_tasks' AND column_name = 'resolution'"
-            )
-        )
-        if result.scalar() is None:
-            return
-
-    op.drop_column("generation_tasks", "resolution")

alembic/versions/052_generation_task_bgm_config.py

@@ -1,64 +0,0 @@
-"""#642 - 生成任务新增 bgm_config 字段
-
-Revision ID: 052_generation_task_bgm_config
-Revises: 051_generation_task_resolution
-Create Date: 2026-07-25
-
-Changes:
-1. generation_tasks 表新增 bgm_config 字段（JSON类型），存储用户自定义BGM配置
-2. 为空时使用默认空字典
-
-背景：
-#642 一键生成支持自定义BGM 功能在 SQLAlchemy 模型中加了 bgm_config 字段，
-但遗漏了 alembic migration，导致 staging 环境数据库没有该列，
-创建生成任务时直接 500。
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "052_generation_task_bgm_config"
-down_revision = "051_generation_task_resolution"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    if context.get_context().dialect.name == "postgresql":
-        # 检查列是否已存在（幂等）
-        result = conn.execute(
-            sa.text(
-                "SELECT column_name FROM information_schema.columns "
-                "WHERE table_name = 'generation_tasks' AND column_name = 'bgm_config'"
-            )
-        )
-        if result.scalar() is not None:
-            return
-
-    op.add_column(
-        "generation_tasks",
-        sa.Column(
-            "bgm_config",
-            sa.JSON,
-            nullable=False,
-            server_default=sa.text("'{}'::json"),
-        ),
-    )
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-    if context.get_context().dialect.name == "postgresql":
-        # 检查列是否存在（幂等）
-        result = conn.execute(
-            sa.text(
-                "SELECT column_name FROM information_schema.columns "
-                "WHERE table_name = 'generation_tasks' AND column_name = 'bgm_config'"
-            )
-        )
-        if result.scalar() is None:
-            return
-
-    op.drop_column("generation_tasks", "bgm_config")

alembic/versions/053_generation_task_is_preview.py

@@ -1,61 +0,0 @@
-"""#1197 - 预览生成：generation_tasks 表新增 is_preview 字段
-
-Revision ID: 053
-Revises: 052
-Create Date: 2026-08-15
-
-Changes:
-1. generation_tasks 表新增 is_preview 字段，标记是否为预览生成任务（低清 480p）
-2. 默认 False，与现有正式生成任务兼容
-3. 加索引以支持按预览/正式任务筛选
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "053_generation_task_is_preview"
-down_revision = "052_generation_task_bgm_config"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    if context.get_context().dialect.name == "postgresql":
-        # 检查列是否已存在（幂等）
-        result = conn.execute(
-            sa.text(
-                "SELECT column_name FROM information_schema.columns "
-                "WHERE table_name = 'generation_tasks' AND column_name = 'is_preview'"
-            )
-        )
-        if result.scalar() is not None:
-            return
-
-    op.add_column(
-        "generation_tasks",
-        sa.Column("is_preview", sa.Boolean, nullable=False, server_default=sa.text("false")),
-    )
-    # 加索引
-    op.create_index(
-        "ix_generation_tasks_is_preview",
-        "generation_tasks",
-        ["is_preview"],
-    )
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-    if context.get_context().dialect.name == "postgresql":
-        result = conn.execute(
-            sa.text(
-                "SELECT column_name FROM information_schema.columns "
-                "WHERE table_name = 'generation_tasks' AND column_name = 'is_preview'"
-            )
-        )
-        if result.scalar() is None:
-            return
-
-    op.drop_index("ix_generation_tasks_is_preview", table_name="generation_tasks")
-    op.drop_column("generation_tasks", "is_preview")

alembic/versions/054_confirm_gen_fields.py

@@ -1,82 +0,0 @@
-"""确认生成 API 改造：为 generation_tasks 表添加 source_task_id、output_width、output_height、cover_url、custom_title 字段
-
-Revision ID: 054_confirm_gen_fields
-Revises: 053_generation_task_is_preview
-Create Date: 2026-08-16
-
-Changes:
-1. generation_tasks 表新增 source_task_id（来源预览任务 ID，带索引）
-2. generation_tasks 表新增 output_width / output_height（动态输出分辨率）
-3. generation_tasks 表新增 cover_url / custom_title（自定义封面和标题）
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "054_confirm_gen_fields"
-down_revision = "053_generation_task_is_preview"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    is_pg = conn.dialect.name == "postgresql"
-
-    if is_pg:
-        # 幂等检查：source_task_id 列是否已存在
-        result = conn.execute(
-            sa.text(
-                "SELECT column_name FROM information_schema.columns "
-                "WHERE table_name = 'generation_tasks' AND column_name = 'source_task_id'"
-            )
-        )
-        if result.scalar() is not None:
-            return
-
-    # source_task_id
-    op.add_column(
-        "generation_tasks",
-        sa.Column("source_task_id", sa.String(32), nullable=False, server_default=""),
-    )
-
-    # output_width
-    op.add_column(
-        "generation_tasks",
-        sa.Column("output_width", sa.Integer, nullable=False, server_default=sa.text("1280")),
-    )
-
-    # output_height
-    op.add_column(
-        "generation_tasks",
-        sa.Column("output_height", sa.Integer, nullable=False, server_default=sa.text("720")),
-    )
-
-    # cover_url
-    op.add_column(
-        "generation_tasks",
-        sa.Column("cover_url", sa.String(1000), nullable=False, server_default=""),
-    )
-
-    # custom_title
-    op.add_column(
-        "generation_tasks",
-        sa.Column("custom_title", sa.String(500), nullable=False, server_default=""),
-    )
-
-    # 索引
-    op.create_index(
-        "ix_generation_tasks_source_task_id",
-        "generation_tasks",
-        ["source_task_id"],
-    )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_generation_tasks_source_task_id", table_name="generation_tasks")
-    op.drop_column("generation_tasks", "custom_title")
-    op.drop_column("generation_tasks", "cover_url")
-    op.drop_column("generation_tasks", "output_height")
-    op.drop_column("generation_tasks", "output_width")
-    op.drop_column("generation_tasks", "source_task_id")

alembic/versions/055_cover_templates.py

@@ -1,82 +0,0 @@
-"""封面模板表 cover_templates
-
-Revision ID: 055_cover_templates
-Revises: 054_confirm_gen_fields
-Create Date: 2026-08-09
-
-Changes:
-1. 新建 cover_templates 表，支持系统预置和用户自定义封面模板
-2. user_id 为 NULL 表示系统模板，is_system 标记区分
-3. config 为 JSON 字段，存储封面配置信息
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "055_cover_templates"
-down_revision = "054_confirm_gen_fields"
-branch_labels = None
-depends_on = None
-
-SYSTEM_TEMPLATES = [
-    ("a8b0120fd98e44788f5a6590f983d327", "默认模板", {}),
-    ("6d8c501b11424432b3df3a45ae89b1a9", "大胆红", {"background_color": "#ef4444"}),
-    ("04937fb57fea4bad95e7883e71a6b246", "优雅黑", {"background_color": "#111827"}),
-    ("3ff9cc821174437ca53931073e7f536e", "渐变蓝", {"background_color": "#3b82f6"}),
-    ("db51b3ea8f1a4f4caa94bf2d51f27d11", "渐变紫", {"background_color": "#8b5cf6"}),
-    ("5027d113432a4f798a3b4ee1644d66af", "暖橙", {"background_color": "#f97316"}),
-    ("0e10def2b5a148d686416494474726c2", "清新绿", {"background_color": "#22c55e"}),
-    ("38ea98ac00c04bada064006d880546f0", "科技蓝", {"background_color": "#06b6d4"}),
-]
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    if context.get_context().dialect.name == "postgresql":
-        result = conn.execute(sa.text("SELECT to_regclass('public.cover_templates')"))
-        if result.scalar() is not None:
-            return
-
-    op.create_table(
-        "cover_templates",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.String(36), nullable=True, index=True),
-        sa.Column("name", sa.String(200), nullable=False),
-        sa.Column("thumbnail_url", sa.String(1000), nullable=False, server_default=""),
-        sa.Column("is_system", sa.Boolean, nullable=False, server_default=sa.false(), index=True),
-        sa.Column("config", sa.JSON, nullable=False, server_default="{}"),
-        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
-        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
-    )
-
-    # 预置系统模板 seed 数据
-    cover_templates = sa.table(
-        "cover_templates",
-        sa.column("id", sa.String),
-        sa.column("user_id", sa.String),
-        sa.column("name", sa.String),
-        sa.column("thumbnail_url", sa.String),
-        sa.column("is_system", sa.Boolean),
-        sa.column("config", sa.JSON),
-        sa.column("created_at", sa.DateTime),
-        sa.column("updated_at", sa.DateTime),
-    )
-
-    for tid, name, config in SYSTEM_TEMPLATES:
-        conn.execute(
-            cover_templates.insert().values(
-                id=tid,
-                user_id=None,
-                name=name,
-                thumbnail_url="",
-                is_system=True,
-                config=config,
-                created_at=sa.func.now(),
-                updated_at=sa.func.now(),
-            )
-        )
-
-
-def downgrade() -> None:
-    op.drop_table("cover_templates")

alembic/versions/056_fix_cover_templates_config.py

@@ -1,39 +0,0 @@
-"""修复 cover_templates.config 双重序列化
-
-Revision ID: 056_fix_cover_templates_config
-Revises: 055_cover_templates
-Create Date: 2026-08-13
-
-问题: 055 迁移 seed 数据时 json.dumps(config) 导致 config 被双重序列化为 JSON 字符串
-例如 "{}"（字符串）而不是 {}（对象），导致 Pydantic CoverTemplateResponse 校验失败 500。
-
-修复: 从 JSON 字符串中提取文本值，再 cast 回 json 对象类型。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "056_fix_cover_templates_config"
-down_revision = "055_cover_templates"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # PostgreSQL: 从 JSON string scalar 中提取文本内容，cast 为 json object
-    # 例如: JSON string "{}" -> text "{}" -> JSON object {}
-    if conn.dialect.name == "postgresql":
-        conn.execute(
-            sa.text(
-                "UPDATE cover_templates SET config = (config#>>'{}')::json "
-                "WHERE jsonb_typeof(config::jsonb) = 'string'"
-            )
-        )
-
-
-def downgrade() -> None:
-    # No safe rollback — the original data was incorrect
-    pass

alembic/versions/057_add_title_config_to_generation_tasks.py

@@ -1,26 +0,0 @@
-"""Add title_config to generation_tasks
-
-Revision ID: 057_title_config
-Revises: 056_fix_cover_templates_config
-Create Date: 2026-08-23
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "057_title_config"
-down_revision = "056_fix_cover_templates_config"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "generation_tasks",
-        sa.Column("title_config", sa.JSON(), nullable=False, server_default="{}"),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("generation_tasks", "title_config")

alembic/versions/058_uq_asset_lib_project_kind.py

@@ -1,49 +0,0 @@
-"""Add unique index on asset_libraries(project_id, kind)
-
-Revision ID: 058_uq_asset_lib_project_kind
-Revises: 057_title_config
-Create Date: 2026-08-30
-
-同一项目下同 kind 的素材库业务上唯一（前端 getOrCreate 语义、TTS 保存自动建库）。
-加唯一索引兜底并发创建竞态，避免重复素材库。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "058_uq_asset_lib_project_kind"
-down_revision = "057_title_config"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # 建唯一索引前清洗历史重复：同 (project_id, kind) 只保留 created_at 最新的一条。
-    # project_id 为 NULL 的系统级行不参与去重（NULL 在唯一索引中互不冲突）。
-    op.execute("""
-        DELETE FROM asset_libraries
-        WHERE id IN (
-            SELECT id FROM (
-                SELECT id,
-                       ROW_NUMBER() OVER (
-                           PARTITION BY project_id, kind
-                           ORDER BY created_at DESC, id DESC
-                       ) AS rn
-                FROM asset_libraries
-                WHERE project_id IS NOT NULL
-            ) t
-            WHERE t.rn > 1
-        )
-        """)
-    # 与 model 的 UniqueConstraint 定义保持一致（pg_constraint + pg_index 同时注册），
-    # 避免 Alembic autogenerate 检测到 schema drift
-    op.create_unique_constraint(
-        "uq_asset_libraries_project_kind",
-        "asset_libraries",
-        ["project_id", "kind"],
-    )
-
-
-def downgrade() -> None:
-    op.drop_constraint("uq_asset_libraries_project_kind", "asset_libraries", type_="unique")

alembic/versions/059_add_duplicate_rate_to_generated_videos.py

@@ -1,23 +0,0 @@
-"""add duplicate_rate to generated_videos
-
-Revision ID: 059_duplicate_rate
-Revises: 058_uq_asset_lib_project_kind
-Create Date: 2026-08-31
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "059_duplicate_rate"
-down_revision = "058_uq_asset_lib_project_kind"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column("generated_videos", sa.Column("duplicate_rate", sa.Float(), nullable=True))
-
-
-def downgrade() -> None:
-    op.drop_column("generated_videos", "duplicate_rate")

alembic/versions/060_migrate_template_segments_to_clip_configs.py

@@ -1,57 +0,0 @@
-"""migrate template_segments data to template_clip_configs
-
-Revision ID: 060_migrate_segments
-Revises: 059_duplicate_rate
-Create Date: 2026-08-31
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "060_migrate_segments"
-down_revision = "059_duplicate_rate"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    dialect = op.get_bind().dialect.name
-
-    if dialect == "postgresql":
-        config_expr = (
-            "CASE WHEN s.material_type IS NOT NULL AND s.material_type != '' "
-            "THEN json_build_object('material_type', s.material_type)::jsonb "
-            "ELSE '{}'::jsonb END"
-        )
-        empty_json = "'{}'::jsonb"
-    else:
-        config_expr = (
-            "CASE WHEN s.material_type IS NOT NULL AND s.material_type != '' "
-            "THEN JSON_OBJECT('material_type', s.material_type) "
-            "ELSE '{}' END"
-        )
-        empty_json = "'{}'"
-
-    sql_str = (
-        "INSERT INTO template_clip_configs "
-        '(id, template_id, clip_type, "order", min_duration, max_duration, '
-        "text_template, material_requirements, transition_effect, config, "
-        "created_at, updated_at) "
-        "SELECT "
-        "s.id, s.template_id, 'main', s.segment_order, "
-        "s.duration_min, s.duration_max, "
-        "'', " + empty_json + ", "
-        "'cut', " + config_expr + ", "
-        "s.created_at, s.updated_at "
-        "FROM template_segments s "
-        "WHERE NOT EXISTS ("
-        "  SELECT 1 FROM template_clip_configs c "
-        "  WHERE c.template_id = s.template_id"
-        ")"
-    )
-    op.execute(sa.text(sql_str))
-
-
-def downgrade() -> None:
-    pass

alembic/versions/061_add_sort_order_to_template_categories.py

@@ -1,26 +0,0 @@
-"""add sort_order to template_categories
-
-Revision ID: 061_sort_order
-Revises: 060_migrate_segments
-Create Date: 2026-09-02
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "061_sort_order"
-down_revision = "060_migrate_segments"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "template_categories",
-        sa.Column("sort_order", sa.Integer, nullable=False, server_default="0"),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("template_categories", "sort_order")

alembic/versions/062_readd_edit_plan_id_to_generation_tasks.py

@@ -1,28 +0,0 @@
-"""re-add edit_plan_id to generation_tasks (align staging with production)
-
-Revision ID: 062_edit_plan_id
-Revises: 061_sort_order
-Create Date: 2026-09-02
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "062_edit_plan_id"
-down_revision = "061_sort_order"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "generation_tasks",
-        sa.Column("edit_plan_id", sa.String(36), nullable=True),
-    )
-    op.create_index("ix_generation_tasks_edit_plan_id_2", "generation_tasks", ["edit_plan_id"])
-
-
-def downgrade() -> None:
-    op.drop_index("ix_generation_tasks_edit_plan_id_2", table_name="generation_tasks")
-    op.drop_column("generation_tasks", "edit_plan_id")

alembic/versions/063_add_video_fingerprint_chunks.py

@@ -1,46 +0,0 @@
-"""add video_fingerprint_chunks table for per-chunk fingerprint storage
-
-Revision ID: 063_fingerprint_chunks
-Revises: 062_edit_plan_id
-Create Date: 2026-09-03
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "063_fingerprint_chunks"
-down_revision = "062_edit_plan_id"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "video_fingerprint_chunks",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("video_id", sa.String(36), nullable=False),
-        sa.Column("project_id", sa.String(36), nullable=False),
-        sa.Column("user_id", sa.String(36), nullable=False, server_default=""),
-        sa.Column("start_time_ms", sa.Integer, nullable=False),
-        sa.Column("end_time_ms", sa.Integer, nullable=False),
-        sa.Column("phash_binary", sa.String(16), nullable=False),
-        sa.Column("color_histogram", sa.JSON, nullable=False),
-        sa.Column("frame_count", sa.Integer, nullable=False, server_default="1"),
-        sa.Column(
-            "created_at",
-            sa.DateTime,
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-    )
-    op.create_index("ix_vfc_video_id", "video_fingerprint_chunks", ["video_id"])
-    op.create_index("ix_vfc_project_id", "video_fingerprint_chunks", ["project_id"])
-    op.create_index("ix_vfc_user_id", "video_fingerprint_chunks", ["user_id"])
-
-
-def downgrade() -> None:
-    op.drop_index("ix_vfc_user_id", table_name="video_fingerprint_chunks")
-    op.drop_index("ix_vfc_project_id", table_name="video_fingerprint_chunks")
-    op.drop_index("ix_vfc_video_id", table_name="video_fingerprint_chunks")
-    op.drop_table("video_fingerprint_chunks")

alembic/versions/064_add_match_count_visual_similarity.py

@@ -1,25 +0,0 @@
-"""add match_count and visual_similarity to generated_videos
-
-Revision ID: 064_match_count_visual_sim
-Revises: 063_fingerprint_chunks
-Create Date: 2026-09-03
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "064_match_count_visual_sim"
-down_revision = "063_fingerprint_chunks"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column("generated_videos", sa.Column("match_count", sa.Integer(), nullable=True, server_default="0"))
-    op.add_column("generated_videos", sa.Column("visual_similarity", sa.Float(), nullable=True, server_default="0.0"))
-
-
-def downgrade() -> None:
-    op.drop_column("generated_videos", "visual_similarity")
-    op.drop_column("generated_videos", "match_count")

alembic/versions/065_add_visual_similarity_match_count_duplication.py

@@ -1,25 +0,0 @@
-"""add visual_similarity and match_count to duplication_records
-
-Revision ID: 065_dup_record_sim_match
-Revises: 064_match_count_visual_sim
-Create Date: 2026-09-04
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "065_dup_record_sim_match"
-down_revision = "064_match_count_visual_sim"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column("duplication_records", sa.Column("visual_similarity", sa.Float(), nullable=True))
-    op.add_column("duplication_records", sa.Column("match_count", sa.Integer(), nullable=True))
-
-
-def downgrade() -> None:
-    op.drop_column("duplication_records", "match_count")
-    op.drop_column("duplication_records", "visual_similarity")

alembic/versions/066_asset_client_upload_id_ingest_job_asset_id.py

@@ -1,34 +0,0 @@
-"""add client_upload_id to assets and asset_id to ingest_jobs
-
-Issue #1714：上传 complete 幂等 + worker 转码回写关联。
-- assets.client_upload_id：客户端幂等 token（complete 去重）
-- ingest_jobs.asset_id：complete 阶段创建的占位 asset id（worker 回写关联，
-  防止 HEVC 转码改写 storage_key 后找不到占位而兜底新建 READY 记录）
-
-Revision ID: 066_upload_idempotency
-Revises: 065_dup_record_sim_match
-Create Date: 2026-09-05
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "066_upload_idempotency"
-down_revision = "065_dup_record_sim_match"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column("assets", sa.Column("client_upload_id", sa.String(64), nullable=True))
-    op.create_index("ix_assets_client_upload_id", "assets", ["client_upload_id"])
-    op.add_column("ingest_jobs", sa.Column("asset_id", sa.String(36), nullable=False, server_default=""))
-    op.create_index("ix_ingest_jobs_asset_id", "ingest_jobs", ["asset_id"])
-
-
-def downgrade() -> None:
-    op.drop_index("ix_ingest_jobs_asset_id", table_name="ingest_jobs")
-    op.drop_column("ingest_jobs", "asset_id")
-    op.drop_index("ix_assets_client_upload_id", table_name="assets")
-    op.drop_column("assets", "client_upload_id")

alembic/versions/067_celery_task_id_revoke.py

@@ -1,35 +0,0 @@
-"""add celery_task_id to generation_tasks and ingest_jobs
-
-Issue #1714：孤儿恢复/超时清理撤销队列消息。
-- generation_tasks.celery_task_id：入队时记录的 Celery 消息 ID，清理时 revoke
-- ingest_jobs.celery_task_id：同上（素材转码任务）
-
-Revision ID: 067_celery_task_id
-Revises: 066_upload_idempotency
-Create Date: 2026-09-05
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "067_celery_task_id"
-down_revision = "066_upload_idempotency"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "generation_tasks",
-        sa.Column("celery_task_id", sa.String(64), nullable=False, server_default=""),
-    )
-    op.add_column(
-        "ingest_jobs",
-        sa.Column("celery_task_id", sa.String(64), nullable=False, server_default=""),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("ingest_jobs", "celery_task_id")
-    op.drop_column("generation_tasks", "celery_task_id")

alembic/versions/068_user_profile_completed.py

@@ -1,26 +0,0 @@
-"""add profile_completed to users
-
-Issue #1718：微信新用户首次登录需设置昵称（PATCH /auth/me）。
-- users.profile_completed：资料是否已完善；存量行默认 True（不触发引导），
-  微信新建用户在应用层置 False。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "068_user_profile_completed"
-down_revision = "067_celery_task_id"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "users",
-        sa.Column("profile_completed", sa.Boolean(), nullable=False, server_default=sa.text("true")),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("users", "profile_completed")

alembic/versions/069_project_is_default_idempotent.py

@@ -1,72 +0,0 @@
-"""Projects is_default + partial unique index for idempotent default project (Issue #1775)
-
-Revision ID: 069_project_is_default
-Revises: 068_user_profile_completed
-Create Date: 2026-09-08
-
-背景：
-小程序端 getOrCreateDefaultProject 在重试/并发/前端重复调用下，
-仅靠应用层"先查再插"不保证幂等，会给同一用户重复创建默认项目。
-
-改动：
-1. projects 表新增 is_default 布尔列（默认 false）
-2. 部分唯一索引 uq_projects_owner_default：(owner_user_id) WHERE is_default = true
-   —— 保证每个用户至多一个默认项目
-3. 存量数据回填：把名为"默认项目"的存量项目按创建时间最早者标记为 is_default=true
-   （只标记不删除；存量重复项目的清理另行确认后单独执行）
-
-注意：部分唯一索引依赖 PostgreSQL，不支持 downgrade 到其他方言。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "069_project_is_default"
-down_revision = "068_user_profile_completed"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # 1. 新增 is_default 列
-    op.add_column(
-        "projects",
-        sa.Column(
-            "is_default",
-            sa.Boolean(),
-            nullable=False,
-            server_default=sa.text("false"),
-        ),
-    )
-
-    # 2. 存量回填：每个拥有"默认项目"的用户，只把最早创建的那一个标记为默认。
-    #    用 ROW_NUMBER() 取每组第一条；非"默认项目"命名的项目不标记（保守，不动用户自建项目）。
-    op.execute("""
-        UPDATE projects p
-        SET is_default = true
-        WHERE p.id IN (
-            SELECT id FROM (
-                SELECT id,
-                       ROW_NUMBER() OVER (
-                           PARTITION BY owner_user_id
-                           ORDER BY created_at ASC, id ASC
-                       ) AS rn
-                FROM projects
-                WHERE name = '默认项目'
-            ) t
-            WHERE t.rn = 1
-        )
-        """)
-
-    # 3. 部分唯一索引：每用户至多一个默认项目（只约束 is_default = true 的行）
-    op.execute("""
-        CREATE UNIQUE INDEX uq_projects_owner_default
-        ON projects (owner_user_id)
-        WHERE is_default = true
-        """)
-
-
-def downgrade() -> None:
-    op.execute("DROP INDEX IF EXISTS uq_projects_owner_default")
-    op.drop_column("projects", "is_default")

alembic/versions/070_add_scripts_table.py

@@ -1,48 +0,0 @@
-"""Add scripts table for oral broadcast script library (Issue #1795)
-
-Revision ID: 070_add_scripts
-Revises: 069_project_is_default
-Create Date: 2026-09-08
-
-新建 scripts 表，支持口播文案 CRUD + 分段存储。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "070_add_scripts"
-down_revision = "069_project_is_default"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "scripts",
-        sa.Column("id", sa.String(36), nullable=False),
-        sa.Column("user_id", sa.String(36), nullable=False),
-        sa.Column("title", sa.String(255), nullable=False),
-        sa.Column("content", sa.Text(), nullable=False, server_default=""),
-        sa.Column("segments", sa.JSON(), nullable=False, server_default="[]"),
-        sa.Column("tags", sa.JSON(), nullable=False, server_default="[]"),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-        sa.PrimaryKeyConstraint("id"),
-    )
-    op.create_index("ix_scripts_user_id", "scripts", ["user_id"])
-
-
-def downgrade() -> None:
-    op.drop_index("ix_scripts_user_id", table_name="scripts")
-    op.drop_table("scripts")

alembic/versions/071_add_lipsync_jobs_table.py

@@ -1,47 +0,0 @@
-"""add lipsync jobs table
-
-Revision ID: 071_add_lipsync_jobs
-Revises: 070_add_scripts
-Create Date: 2026-09-08
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "071_add_lipsync_jobs"
-down_revision = "070_add_scripts"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "lipsync_jobs",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.String(36), nullable=False, index=True),
-        sa.Column("project_id", sa.String(36), nullable=False, server_default=""),
-        sa.Column("video_url", sa.Text(), nullable=False),
-        sa.Column("audio_url", sa.Text(), nullable=False),
-        sa.Column("enable_video_loop", sa.Boolean(), nullable=False, server_default=sa.text("false")),
-        sa.Column("mediakit_task_id", sa.String(200), nullable=False, server_default="", index=True),
-        sa.Column("status", sa.String(20), nullable=False, server_default="pending", index=True),
-        sa.Column("output_video_url", sa.Text(), nullable=False, server_default=""),
-        sa.Column("output_duration", sa.Float(), nullable=False, server_default=sa.text("0.0")),
-        sa.Column("error_message", sa.Text(), nullable=False, server_default=""),
-        sa.Column("error_code", sa.String(100), nullable=False, server_default=""),
-        sa.Column("submitted_at", sa.DateTime(), nullable=True),
-        sa.Column("completed_at", sa.DateTime(), nullable=True),
-        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.now()),
-        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.now()),
-    )
-    # 复合索引：用户 + 状态（列表查询常用）
-    op.create_index("ix_lipsync_jobs_user_status", "lipsync_jobs", ["user_id", "status"])
-    # 项目 + 用户（项目维度查询）
-    op.create_index("ix_lipsync_jobs_project_user", "lipsync_jobs", ["project_id", "user_id"])
-
-
-def downgrade() -> None:
-    op.drop_index("ix_lipsync_jobs_project_user", table_name="lipsync_jobs")
-    op.drop_index("ix_lipsync_jobs_user_status", table_name="lipsync_jobs")
-    op.drop_table("lipsync_jobs")

alembic/versions/072_add_ai_avatar_render_jobs_table.py

@@ -1,48 +0,0 @@
-"""add ai avatar render jobs table
-
-Revision ID: 072_add_ai_avatar_render
-Revises: 071_add_lipsync_jobs
-Create Date: 2026-09-09
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "072_add_ai_avatar_render"
-down_revision = "071_add_lipsync_jobs"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "ai_avatar_render_jobs",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.String(36), nullable=False, index=True),
-        sa.Column("project_id", sa.String(36), nullable=False, server_default=""),
-        sa.Column("lipsync_job_id", sa.String(36), nullable=False),
-        sa.Column("script_id", sa.String(36), nullable=False),
-        sa.Column("b_roll_segments", sa.JSON(), nullable=False, server_default="[]"),
-        sa.Column("title_config", sa.JSON(), nullable=False, server_default="{}"),
-        sa.Column("cover_config", sa.JSON(), nullable=False, server_default="{}"),
-        sa.Column("status", sa.String(20), nullable=False, server_default="pending", index=True),
-        sa.Column("progress", sa.Integer(), nullable=False, server_default=sa.text("0")),
-        sa.Column("output_video_url", sa.Text(), nullable=False, server_default=""),
-        sa.Column("output_cover_url", sa.Text(), nullable=False, server_default=""),
-        sa.Column("output_duration", sa.Float(), nullable=False, server_default=sa.text("0.0")),
-        sa.Column("error_message", sa.Text(), nullable=False, server_default=""),
-        sa.Column("submitted_at", sa.DateTime(), nullable=True),
-        sa.Column("started_at", sa.DateTime(), nullable=True),
-        sa.Column("completed_at", sa.DateTime(), nullable=True),
-        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.now()),
-        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.now()),
-    )
-    op.create_index("ix_ai_avatar_render_user_status", "ai_avatar_render_jobs", ["user_id", "status"])
-    op.create_index("ix_ai_avatar_render_project_user", "ai_avatar_render_jobs", ["project_id", "user_id"])
-
-
-def downgrade() -> None:
-    op.drop_index("ix_ai_avatar_render_project_user", table_name="ai_avatar_render_jobs")
-    op.drop_index("ix_ai_avatar_render_user_status", table_name="ai_avatar_render_jobs")
-    op.drop_table("ai_avatar_render_jobs")

alembic/versions/073_add_lipsync_tts_fields.py

@@ -1,45 +0,0 @@
-"""lipsync_jobs 增加 TTS 直生字段（voice_id/script_text/speed/emotion）
-
-Revision ID: 073_add_lipsync_tts_fields
-Revises: 072_add_ai_avatar_render
-Create Date: 2026-09-09
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "073_add_lipsync_tts_fields"
-down_revision = "072_add_ai_avatar_render"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # 对口型支持「传音色 + 文案直接生成」：后端内部先 TTS 合成音频再提交对口型
-    op.add_column(
-        "lipsync_jobs",
-        sa.Column("voice_id", sa.String(200), nullable=False, server_default=""),
-    )
-    op.add_column(
-        "lipsync_jobs",
-        sa.Column("script_text", sa.Text(), nullable=False, server_default=""),
-    )
-    op.add_column(
-        "lipsync_jobs",
-        sa.Column("speed", sa.Float(), nullable=False, server_default=sa.text("1.0")),
-    )
-    op.add_column(
-        "lipsync_jobs",
-        sa.Column("emotion", sa.String(20), nullable=False, server_default=""),
-    )
-    # audio_url 改为可空：直生模式下音频由后端 TTS 合成后回填
-    op.alter_column("lipsync_jobs", "audio_url", existing_type=sa.Text(), nullable=True)
-
-
-def downgrade() -> None:
-    op.alter_column("lipsync_jobs", "audio_url", existing_type=sa.Text(), nullable=False)
-    op.drop_column("lipsync_jobs", "emotion")
-    op.drop_column("lipsync_jobs", "speed")
-    op.drop_column("lipsync_jobs", "script_text")
-    op.drop_column("lipsync_jobs", "voice_id")

alembic/versions/074_ai_avatar_render_script_id_optional.py

@@ -1,36 +0,0 @@
-"""ai_avatar_render_jobs.script_id 放宽为可空串（手动文案直生场景不关联文案库）
-
-Revision ID: 074_render_script_id_optional
-Revises: 073_add_lipsync_tts_fields
-Create Date: 2026-09-09
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "074_render_script_id_optional"
-down_revision = "073_add_lipsync_tts_fields"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # 列保持 NOT NULL（空串占位），仅应用层允许不传；这里显式补 server_default 防止历史约束歧义
-    with op.batch_alter_table("ai_avatar_render_jobs") as batch:
-        batch.alter_column(
-            "script_id",
-            existing_type=sa.String(length=36),
-            nullable=False,
-            server_default="",
-        )
-
-
-def downgrade() -> None:
-    with op.batch_alter_table("ai_avatar_render_jobs") as batch:
-        batch.alter_column(
-            "script_id",
-            existing_type=sa.String(length=36),
-            nullable=False,
-            server_default=None,
-        )

alembic/versions/075_add_sentence_timings.py

@@ -1,27 +0,0 @@
-"""add sentence_timings to lipsync_jobs
-
-Revision ID: 075_add_sentence_timings
-Revises: 074_ai_avatar_render_script_id_optional
-Create Date: 2026-09-12
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "075_add_sentence_timings"
-down_revision = "074_render_script_id_optional"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    with op.batch_alter_table("lipsync_jobs") as batch:
-        batch.add_column(
-            sa.Column("sentence_timings", sa.JSON(), nullable=True),
-        )
-
-
-def downgrade() -> None:
-    with op.batch_alter_table("lipsync_jobs") as batch:
-        batch.drop_column("sentence_timings")

alembic/versions/076_membership_points.py

@@ -1,133 +0,0 @@
-"""add membership & points system
-
-Revision ID: 076_membership_points
-Revises: 075_add_sentence_timings
-Create Date: 2026-09-15
-"""
-
-import sqlalchemy as sa
-from sqlalchemy import text
-
-from alembic import op
-
-revision = "076_membership_points"
-down_revision = "075_add_sentence_timings"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # 1. users 表新增字段
-    with op.batch_alter_table("users") as batch:
-        batch.add_column(
-            sa.Column("is_member", sa.Boolean(), nullable=False, server_default=sa.text("false")),
-        )
-        batch.add_column(
-            sa.Column("member_type", sa.String(20), nullable=True),
-        )
-        batch.add_column(
-            sa.Column("member_expires_at", sa.DateTime(), nullable=True),
-        )
-        batch.add_column(
-            sa.Column("points_balance", sa.Integer(), nullable=False, server_default=sa.text("0")),
-        )
-
-    # 2. points_accounts 积分账户表
-    op.create_table(
-        "points_accounts",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.String(36), nullable=False, unique=True, index=True),
-        sa.Column("balance", sa.Integer(), nullable=False, server_default=sa.text("0")),
-        sa.Column("total_earned", sa.Integer(), nullable=False, server_default=sa.text("0")),
-        sa.Column("total_spent", sa.Integer(), nullable=False, server_default=sa.text("0")),
-        sa.Column(
-            "created_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.text("NOW()"),
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.text("NOW()"),
-        ),
-    )
-
-    # 3. points_transactions 积分流水表
-    op.create_table(
-        "points_transactions",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.String(36), nullable=False, index=True),
-        sa.Column("account_id", sa.String(36), nullable=False, index=True),
-        sa.Column("type", sa.String(20), nullable=False, index=True),
-        sa.Column("source", sa.String(50), nullable=False, index=True),
-        sa.Column("amount", sa.Integer(), nullable=False),
-        sa.Column("balance_after", sa.Integer(), nullable=False),
-        sa.Column("description", sa.String(255), nullable=False, server_default=""),
-        sa.Column("ref_id", sa.String(100), nullable=False, server_default=""),
-        sa.Column(
-            "created_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.text("NOW()"),
-        ),
-    )
-
-    # 4. points_orders 积分/会员订单表
-    op.create_table(
-        "points_orders",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.String(36), nullable=False, index=True),
-        sa.Column("order_type", sa.String(20), nullable=False),
-        sa.Column("product_code", sa.String(50), nullable=False),
-        sa.Column("amount_cents", sa.Integer(), nullable=False),
-        sa.Column("original_amount_cents", sa.Integer(), nullable=False, server_default=sa.text("0")),
-        sa.Column("discount", sa.Float(), nullable=False, server_default=sa.text("1.0")),
-        sa.Column("points_amount", sa.Integer(), nullable=False, server_default=sa.text("0")),
-        sa.Column("status", sa.String(20), nullable=False, server_default="pending", index=True),
-        sa.Column("payment_method", sa.String(50), nullable=True),
-        sa.Column("payment_id", sa.String(100), nullable=True),
-        sa.Column("paid_at", sa.DateTime(), nullable=True),
-        sa.Column(
-            "created_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.text("NOW()"),
-        ),
-    )
-
-    # 5. daily_usage_records 每日使用记录表
-    op.create_table(
-        "daily_usage_records",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.String(36), nullable=False, index=True),
-        sa.Column("usage_date", sa.DateTime(), nullable=False),
-        sa.Column("usage_type", sa.String(50), nullable=False, server_default="free_clip"),
-        sa.Column("count", sa.Integer(), nullable=False, server_default=sa.text("0")),
-        sa.Column(
-            "updated_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.text("NOW()"),
-        ),
-        sa.UniqueConstraint(
-            "user_id",
-            "usage_date",
-            "usage_type",
-            name="uq_daily_usage_user_date_type",
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("daily_usage_records")
-    op.drop_table("points_orders")
-    op.drop_table("points_transactions")
-    op.drop_table("points_accounts")
-
-    with op.batch_alter_table("users") as batch:
-        batch.drop_column("points_balance")
-        batch.drop_column("member_expires_at")
-        batch.drop_column("member_type")
-        batch.drop_column("is_member")

alembic/versions/077_merge_title_libs.py

@@ -1,67 +0,0 @@
-"""#1894: merge title_libraries into scripts — add title_text/title_category/title_config
-
-Revision ID: 077_merge_title_libs
-Revises: 076_membership_points
-Create Date: 2026-09-15
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "077_merge_title_libs"
-down_revision = "076_membership_points"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    with op.batch_alter_table("scripts") as batch:
-        batch.add_column(
-            sa.Column("title_text", sa.String(500), nullable=False, server_default=""),
-        )
-        batch.add_column(
-            sa.Column("title_category", sa.String(50), nullable=False, server_default=""),
-        )
-        batch.add_column(
-            sa.Column("title_config", sa.JSON, nullable=False, server_default="{}"),
-        )
-
-    if context.get_context().dialect.name == "postgresql":
-        conn = op.get_bind()
-        result = conn.execute(sa.text("SELECT to_regclass('public.title_libraries')"))
-        if result.scalar() is not None:
-            conn.execute(sa.text("""
-                    INSERT INTO scripts
-                        (id, user_id, title, content, segments, tags,
-                         title_text, title_category, title_config,
-                         created_at, updated_at)
-                    SELECT
-                        gen_random_uuid()::TEXT,
-                        tl.user_id,
-                        COALESCE(tl.name, '迁移标题'),
-                        COALESCE(tl.text, ''),
-                        '[]'::JSONB,
-                        COALESCE(tl.tags, '[]'::JSONB),
-                        COALESCE(tl.text, ''),
-                        COALESCE(tl.category, ''),
-                        COALESCE(tl."metadata", '{}'::JSONB),
-                        tl.created_at,
-                        tl.updated_at
-                    FROM title_libraries tl
-                    WHERE tl.is_active = true
-                      AND NOT EXISTS (
-                        SELECT 1 FROM scripts s
-                        WHERE s.user_id = tl.user_id
-                          AND s.title_text = COALESCE(tl.text, '')
-                          AND s.title_category = COALESCE(tl.category, '')
-                          AND s.created_at = tl.created_at
-                      )
-                    """))
-
-
-def downgrade() -> None:
-    with op.batch_alter_table("scripts") as batch:
-        batch.drop_column("title_config")
-        batch.drop_column("title_category")
-        batch.drop_column("title_text")

alembic/versions/078_drop_script_title_fields.py

@@ -1,33 +0,0 @@
-"""#1894: drop obsolete script title fields (title_text/title_category/title_config)
-
-Revision ID: 078_drop_script_title_fields
-Revises: 077_merge_title_libs
-Create Date: 2026-09-16
-
-口播文案（scripts）不再自带配套标题、标题分类和标题样式字段。
-智能剪辑 / AI 数字人等生成场景各自通过入参配置标题，不再从文案读取。
-保留字段：title（名称）、content（正文）、segments（分段）、tags（标签）。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "078_drop_script_title_fields"
-down_revision = "077_merge_title_libs"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    with op.batch_alter_table("scripts") as batch:
-        batch.drop_column("title_config")
-        batch.drop_column("title_category")
-        batch.drop_column("title_text")
-
-
-def downgrade() -> None:
-    with op.batch_alter_table("scripts") as batch:
-        batch.add_column(sa.Column("title_text", sa.String(500), nullable=False, server_default=""))
-        batch.add_column(sa.Column("title_category", sa.String(50), nullable=False, server_default=""))
-        batch.add_column(sa.Column("title_config", sa.JSON, nullable=False, server_default="{}"))

alembic/versions/079_asset_atom_clips.py

@@ -1,58 +0,0 @@
-"""add asset_atom_clips table
-
-Revision ID: 079_asset_atom_clips
-Revises: 078_drop_script_title_fields
-Create Date: 2026-09-17
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "079_asset_atom_clips"
-down_revision = "078_drop_script_title_fields"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "asset_atom_clips",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column(
-            "asset_id",
-            sa.String(36),
-            sa.ForeignKey("assets.id", ondelete="CASCADE"),
-            nullable=False,
-        ),
-        sa.Column("start_time", sa.Float(), nullable=False),
-        sa.Column("end_time", sa.Float(), nullable=False),
-        sa.Column("duration", sa.Float(), nullable=False),
-        sa.Column("clip_index", sa.Integer(), nullable=False),
-        sa.Column("tags", sa.JSON(), nullable=False, server_default=sa.text("'[]'")),
-        sa.Column("scene_change_at", sa.Float(), nullable=True),
-        sa.Column(
-            "is_fallback",
-            sa.Boolean(),
-            nullable=False,
-            server_default=sa.text("false"),
-        ),
-        sa.Column(
-            "created_at",
-            sa.DateTime(timezone=True),
-            nullable=False,
-            server_default=sa.text("NOW()"),
-        ),
-    )
-    # 按素材查片段并按索引排序（复合索引前缀可独立用于 asset_id 过滤）
-    op.create_index(
-        "ix_asset_atom_clips_asset_index",
-        "asset_atom_clips",
-        ["asset_id", "clip_index"],
-        unique=True,
-    )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_asset_atom_clips_asset_index", table_name="asset_atom_clips")
-    op.drop_table("asset_atom_clips")

alembic/versions/080_edit_plan_clips_atom_clip_id.py

@@ -1,37 +0,0 @@
-"""add edit_plan_clips.atom_clip_id for #1970
-
-Revision ID: 080_edit_plan_clips_atom_clip_id
-Revises: 079_asset_atom_clips
-Create Date: 2026-09-17
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "080_edit_plan_clips_atom_clip_id"
-down_revision = "079_asset_atom_clips"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "edit_plan_clips",
-        sa.Column(
-            "atom_clip_id",
-            sa.String(36),
-            nullable=False,
-            server_default=sa.text("''"),
-        ),
-    )
-    op.create_index(
-        "ix_edit_plan_clips_atom_clip_id",
-        "edit_plan_clips",
-        ["atom_clip_id"],
-    )
-
-
-def downgrade() -> None:
-    op.drop_index("ix_edit_plan_clips_atom_clip_id", table_name="edit_plan_clips")
-    op.drop_column("edit_plan_clips", "atom_clip_id")

alembic/versions/081_add_gpu_lipsync_tasks.py

@@ -1,58 +0,0 @@
-"""add gpu_lipsync_tasks and gpu_workers tables for MuseTalk reverse-poll worker
-
-Revision ID: 081_add_gpu_lipsync
-Revises: 080_edit_plan_clips_atom_clip_id
-Create Date: 2026-09-18
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "081_add_gpu_lipsync"
-down_revision = "080_edit_plan_clips_atom_clip_id"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # GPU Worker 注册表
-    op.create_table(
-        "gpu_workers",
-        sa.Column("worker_id", sa.String(100), primary_key=True),
-        sa.Column("hostname", sa.String(200), nullable=False, server_default=""),
-        sa.Column("gpu_name", sa.String(200), nullable=False, server_default=""),
-        sa.Column("free_vram_mb", sa.Integer(), nullable=False, server_default=sa.text("0")),
-        sa.Column("capabilities", sa.String(500), nullable=False, server_default=""),
-        sa.Column("last_heartbeat_at", sa.DateTime(), nullable=True, index=True),
-        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.now()),
-    )
-
-    # GPU 口型同步任务表
-    op.create_table(
-        "gpu_lipsync_tasks",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("lipsync_job_id", sa.String(36), nullable=False, server_default="", index=True),
-        sa.Column("user_id", sa.String(36), nullable=False, server_default="", index=True),
-        sa.Column("project_id", sa.String(36), nullable=False, server_default="", index=True),
-        sa.Column("video_url", sa.Text(), nullable=False),
-        sa.Column("audio_url", sa.Text(), nullable=False),
-        sa.Column("result_url", sa.Text(), nullable=False, server_default=""),
-        sa.Column("result_duration", sa.Float(), nullable=False, server_default=sa.text("0.0")),
-        sa.Column("status", sa.String(20), nullable=False, server_default="pending", index=True),
-        sa.Column("worker_id", sa.String(100), nullable=False, server_default="", index=True),
-        sa.Column("attempt", sa.Integer(), nullable=False, server_default=sa.text("0")),
-        sa.Column("error_msg", sa.Text(), nullable=False, server_default=""),
-        sa.Column("created_at", sa.DateTime(), nullable=False, server_default=sa.func.now()),
-        sa.Column("started_at", sa.DateTime(), nullable=True),
-        sa.Column("finished_at", sa.DateTime(), nullable=True),
-        sa.Column("updated_at", sa.DateTime(), nullable=False, server_default=sa.func.now()),
-        sa.Column("last_heartbeat_at", sa.DateTime(), nullable=True),
-    )
-    op.create_index("ix_gpu_lipsync_status_created", "gpu_lipsync_tasks", ["status", "created_at"])
-
-
-def downgrade() -> None:
-    op.drop_index("ix_gpu_lipsync_status_created", table_name="gpu_lipsync_tasks")
-    op.drop_table("gpu_lipsync_tasks")
-    op.drop_table("gpu_workers")

alembic/versions/082_atom_clip_ai_tags.py

@@ -1,26 +0,0 @@
-"""add ai_tags to asset_atom_clips for #1970 fragment-level AI tagging
-
-Revision ID: 082_atom_clip_ai_tags
-Revises: 081_add_gpu_lipsync
-Create Date: 2026-09-18
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "082_atom_clip_ai_tags"
-down_revision = "081_add_gpu_lipsync"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "asset_atom_clips",
-        sa.Column("ai_tags", sa.JSON(), nullable=True),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("asset_atom_clips", "ai_tags")