fix: sync v4 runtime and fast inventory

DEPLOY_20260908.md

@@ -55,11 +55,22 @@ directory, and extract it there. In an administrator SSH session, run:
 ```bash
 cd /data0/zqyan/<new-app-directory>
 chmod +x start.sh deploy/restart-school.sh
+export PUBLIC_BASE_URL="https://subway-unbiased-barcode.ngrok-free.dev/marine"
 ./deploy/restart-school.sh --confirm-restart
 curl -fsS http://127.0.0.1:7861/api/status
 curl -fsS http://127.0.0.1:7861/marine/health
 ```
 
+`PUBLIC_BASE_URL` is required for browser-facing Ocean export links. Without
+it, the model can only see the private `127.0.0.1:8000` URL. The fixed ngrok
+endpoint proxies `/marine/*` to that private API, so the correct public link
+has the form `https://subway-unbiased-barcode.ngrok-free.dev/marine/download/<token>`.
+
+The school inventory is local-first. It returns the local mirror immediately
+when Hugging Face egress is blocked, and merges remote-only paths when HF is
+reachable; a blocked HF connection no longer holds a metadata-only chat until
+the request times out.
+
 The restart script automatically uses the known `squid_agent` Python 3.11 path
 instead of Ubuntu's legacy `python3`, and checks the existing runtime
 configuration from the currently running service *before* it stops that

DEPLOY_UNIFIED.md

@@ -14,6 +14,15 @@ caches: a same-path local file is preferred, while every missing file is read
 from the configured Hugging Face Dataset. Do not set different repository
 names on the two deployments.
 
+Set the browser-facing export base before restarting the school UI:
+
+```bash
+export PUBLIC_BASE_URL="https://subway-unbiased-barcode.ngrok-free.dev/marine"
+```
+
+This prevents localhost download links. Public exports then use
+`/marine/download/<token>` through the fixed ngrok UI endpoint.
+
 The public ngrok URL exposes the UI on `/` and the Marine API through
 `/marine/*`.  Therefore its health endpoint is `/marine/health`, not `/health`.
 

deploy/restart-school.sh

@@ -52,7 +52,7 @@ allowed = {
     "CODEX_HOME", "PORT", "PYTHONDONTWRITEBYTECODE", "ZAI_API_KEY",
     "GLM_API_KEY", "ZHIPU_API_KEY", "HF_TOKEN", "HF_SQUID_DATASET_REPO",
     "HF_TUNA_DATASET_REPO", "FISHERIES_EXPORT_ROOT", "HF_FISHERIES_CACHE_ROOT",
-    "MARINE_EXPORT_RANGE_MAX_DAYS",
+    "MARINE_EXPORT_RANGE_MAX_DAYS", "PUBLIC_BASE_URL", "MARINE_PUBLIC_BASE_URL",
 }
 with open(f"/proc/{pid}/environ", "rb") as stream:
     entries = stream.read().split(b"\0")

marine_mcp.py

@@ -15,6 +15,22 @@ from fisheries_hf import (
 API_URL = os.environ.get("MARINE_API_URL", "").strip().rstrip("/")
 if not API_URL:
     raise RuntimeError("MARINE_API_URL is not configured")
+# Browser-facing download URLs must not expose the private Marine API address.
+# On the school deployment this is set to the fixed UI proxy prefix, e.g.
+# https://subway-unbiased-barcode.ngrok-free.dev/marine.  If it is unset we
+# retain the old local URL for private/operator-only deployments.
+PUBLIC_BASE_URL = (
+    os.environ.get("MARINE_PUBLIC_BASE_URL")
+    or os.environ.get("PUBLIC_BASE_URL")
+    or ""
+).strip().rstrip("/")
+
+
+def _download_url(path: str) -> str:
+    path = str(path or "").strip()
+    if not path.startswith("/download/"):
+        return ""
+    return f"{PUBLIC_BASE_URL or API_URL}{path}"
 
 mcp = MCPServer(
     "Marine Data",
@@ -150,7 +166,7 @@ def marine_subset(
     result = _post("/data/export", payload)
     path = result.get("download_path")
     if isinstance(path, str) and path.startswith("/download/"):
-        result["download_url"] = f"{API_URL}{path}"
+        result["download_url"] = _download_url(path)
     return result
 
 @mcp.tool()
@@ -159,7 +175,7 @@ def marine_download(token: str) -> dict[str, Any]:
     token = token.strip()
     if not re.fullmatch(r"[A-Za-z0-9_-]{20,160}", token):
         raise ValueError("invalid download token")
-    return {"download_url": f"{API_URL}/download/{token}"}
+    return {"download_url": _download_url(f"/download/{token}")}
 
 
 
@@ -199,7 +215,7 @@ def marine_export(
     result = _post("/data/export", payload)
     path = result.get("download_path")
     if isinstance(path, str) and path.startswith("/download/"):
-        result["download_url"] = f"{API_URL}{path}"
+        result["download_url"] = _download_url(path)
     return result
 
 

services/chat_runtime.py

@@ -672,13 +672,20 @@ def _is_fisheries_inventory_prompt(prompt: str) -> bool:
     reads, analysis and exports on their normal guarded paths.
     """
     text = str(prompt or "").strip().lower()
-    if not _is_fisheries_prompt(text):
+    # Be explicit about the wording used by the school/HF comparison tests.
+    # These requests mention storage provenance rather than a named source
+    # such as GFW or FAO, but they are still metadata-only Squid/Tuna queries.
+    explicit_inventory = (
+        any(term in text for term in ("完整文件数", "总大小", "本地镜像", "回退读取"))
+        and any(term in text for term in ("squid", "鱿鱼", "柔鱼", "tuna", "金枪鱼"))
+    )
+    if not _is_fisheries_prompt(text) and not explicit_inventory:
         return False
     inventory_terms = (
         "可用数据集", "当前可用", "文件来源", "文件清单", "列出",
         "有哪些文件", "入库", "目录", "inventory", "catalog",
     )
-    if not any(term in text for term in inventory_terms):
+    if not any(term in text for term in inventory_terms) and not explicit_inventory:
         return False
     # “不读取文件内容” is explicitly a metadata-only request, rather than a
     # request to open a file.  Remove these negated phrases before testing for
@@ -885,7 +892,20 @@ async def dispatch_chat_stream(tid,prompt):
         return
 
     if _is_fisheries_inventory_prompt(prompt):
-        answer = await _direct_fisheries_inventory_answer(prompt)
+        # Never let a blocked HF connection or a malformed inventory response
+        # fall through to the 900-second Codex Harness timeout.  Metadata-only
+        # inventory is deterministic and must always terminate promptly.
+        log.info("direct fisheries inventory fast path: prompt_chars=%s", len(str(prompt or "")))
+        try:
+            answer = await asyncio.wait_for(
+                _direct_fisheries_inventory_answer(prompt),
+                timeout=float(os.environ.get("FISHERIES_INVENTORY_TIMEOUT", "45")),
+            )
+        except asyncio.TimeoutError:
+            answer = (
+                "学校服务器的 Squid 清单查询超过 45 秒，已停止等待模型调用。"
+                "请稍后重试；本次没有读取文件内容，也没有生成文件。"
+            )
         yield out("token", {"text": answer})
         yield out(
             "done",

services/ocean_batch.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import asyncio
 import calendar
 import json
+import os
 import re
 import secrets
 import time
@@ -138,6 +139,11 @@ class OceanBatchManager:
     def __init__(self,root:Path,api_url:str,concurrency:int=6):
         self.root=Path(root);self.root.mkdir(parents=True,exist_ok=True)
         self.api_url=str(api_url).rstrip("/")
+        self.public_base_url=(
+            os.environ.get("MARINE_PUBLIC_BASE_URL")
+            or os.environ.get("PUBLIC_BASE_URL")
+            or ""
+        ).strip().rstrip("/")
         self.concurrency=max(1,min(int(concurrency),12))
         self.running:dict[str,asyncio.Task]={}
         # Jobs interrupted by process restart are resumable, not falsely running.
@@ -152,6 +158,12 @@ class OceanBatchManager:
                 pass
 
     def _path(self,jid):return self.root/f"{jid}.json"
+
+    def _download_url(self,path):
+        path=str(path or "").strip()
+        if not path.startswith("/download/"):
+            return ""
+        return f"{self.public_base_url or self.api_url}{path}"
     def _read(self,jid):
         p=self._path(jid)
         if not p.exists():return None
@@ -249,7 +261,7 @@ class OceanBatchManager:
             sub=next((x for x in job["subtasks"] if x["subtask_id"]==subtask_id),None)
             if not sub:return
             if isinstance(result,dict) and result.get("download_path") and not result.get("download_url"):
-                result["download_url"]=self.api_url+str(result["download_path"])
+                result["download_url"]=self._download_url(result["download_path"])
             if isinstance(result,dict) and result.get("download_url"):
                 sub["status"]="completed"
                 sub["download_url"]=str(result["download_url"])
@@ -386,7 +398,7 @@ class OceanBatchManager:
                 detail=str(exc)[:500]
             if attempt<2:await asyncio.sleep(1.0*(2**attempt))
         if isinstance(result,dict) and result.get("download_path") and not result.get("download_url"):
-            result["download_url"]=self.api_url+str(result["download_path"])
+            result["download_url"]=self._download_url(result["download_path"])
         if not isinstance(result,dict) or not result.get("download_url"):
             raise RuntimeError(detail or "无法刷新 Ocean 下载链接")
         job=self._read(jid)

start.sh

@@ -121,6 +121,7 @@ env = {
     ),
     "HF_TUNA_DATASET_REVISION": os.environ.get("HF_TUNA_DATASET_REVISION", ""),
     "PUBLIC_BASE_URL": os.environ.get("PUBLIC_BASE_URL", ""),
+    "MARINE_PUBLIC_BASE_URL": os.environ.get("MARINE_PUBLIC_BASE_URL", ""),
     "MARINE_EXPORT_RANGE_MAX_DAYS": os.environ.get("MARINE_EXPORT_RANGE_MAX_DAYS", "31"),
 }
 
@@ -179,6 +180,7 @@ marine_env = {
     "FISHERIES_EXPORT_ROOT": os.environ.get("FISHERIES_EXPORT_ROOT", "/tmp/squid_fisheries_exports"),
     "HF_FISHERIES_CACHE_ROOT": os.environ.get("HF_FISHERIES_CACHE_ROOT", "/tmp/squid_hf_fisheries_cache"),
     "PUBLIC_BASE_URL": os.environ.get("PUBLIC_BASE_URL", ""),
+    "MARINE_PUBLIC_BASE_URL": os.environ.get("MARINE_PUBLIC_BASE_URL", ""),
     "MARINE_EXPORT_RANGE_MAX_DAYS": os.environ.get("MARINE_EXPORT_RANGE_MAX_DAYS", "31"),
 }
 for name in ("HF_TOKEN", "HF_SQUID_DATASET_REVISION", "HF_TUNA_DATASET_REVISION"):

ui_server.py

@@ -1984,8 +1984,18 @@ async def hf_live_tree(repo: str | None = None, force: bool = False) -> list[dic
     items: list[dict] = []
     tree_error = ""
 
+    # A local mirror is the school server's first data plane.  Use a short
+    # remote probe there: a blocked Hugging Face egress must fall back to the
+    # local metadata instead of holding the chat open for 40+ seconds.
+    local_probe = bool(local_items)
+    remote_timeout = httpx.Timeout(
+        connect=3 if local_probe else 10,
+        read=5 if local_probe else 30,
+        write=10 if local_probe else 20,
+        pool=10 if local_probe else 20,
+    )
     async with httpx.AsyncClient(
-        timeout=httpx.Timeout(connect=10, read=30, write=20, pool=20),
+        timeout=remote_timeout,
         follow_redirects=True,
     ) as c:
         next_url = tree_url
@@ -2017,7 +2027,15 @@ async def hf_live_tree(repo: str | None = None, force: bool = False) -> list[dic
 
         # Reliable fallback: dataset metadata contains repository siblings.
         if not _hf_live_files(items):
-            r = await c.get(info_url, headers=headers)
+            try:
+                r = await c.get(info_url, headers=headers)
+            except Exception as exc:
+                if local_items:
+                    return merge_local_with_remote_tree([], repo)
+                detail = tree_error or str(exc)[:300]
+                raise RuntimeError(
+                    f"Hugging Face Dataset 暂时不可达 ({repo})：{detail}"
+                ) from exc
             if r.status_code in {401, 403}:
                 if local_items:
                     return merge_local_with_remote_tree([], repo)