release: bump version to 0.67.0

planet.sh

@@ -138,6 +138,7 @@ AI_PROVIDER_IMAGE_NAME="${AI_PROVIDER_IMAGE_NAME:-planet-aiprovider:latest}"
 AI_PROVIDER_CONTAINER_NAME="${AI_PROVIDER_CONTAINER_NAME:-planet_aiprovider}"
 PLANET_AI_PROVIDER_RUNTIME_ENV_FILE="${PLANET_AI_PROVIDER_RUNTIME_ENV_FILE:-$PLANET_STATE_DIR/aiprovider_runtime.env}"
 PLANET_EMPTY_UV_CONFIG_FILE="$PLANET_STATE_DIR/uv.empty.toml"
+PLANET_TUNA_UV_CONFIG_FILE="$PLANET_STATE_DIR/uv.tuna.toml"
 PLANET_UV_CONFIG_FILE="${PLANET_UV_CONFIG_FILE:-}"
 AI_PROVIDER_RECREATE_REQUIRED=0
 START_RUN_ACTIVE=0
@@ -1111,55 +1112,94 @@ run_with_retry() {
 
 run_uv_sync_with_mirror_fallback() {
     local log_file="$1"
+    local lock_digest_before
+    local sync_status
 
+    lock_digest_before="$(uv_lock_digest)"
     if run_with_retry \
         "$DEPENDENCY_INSTALL_MAX_RETRIES" \
         "$DEPENDENCY_INSTALL_RETRY_INTERVAL" \
         "uv sync 默认源失败，已重试 ${DEPENDENCY_INSTALL_MAX_RETRIES} 次，准备切换清华源" \
         "uv sync --frozen" \
         run_command_quiet_unless_verbose "$log_file" uv sync --frozen --group dev; then
+        assert_uv_lock_unchanged "$lock_digest_before" "uv sync --frozen"
         return 0
     fi
+    assert_uv_lock_unchanged "$lock_digest_before" "uv sync --frozen"
 
     configure_uv_tuna_index
-    set_wait_detail "已写入 uv.toml 清华源，重新执行 uv sync"
+    set_wait_detail "已准备临时清华源配置，重新执行 uv sync"
 
+    lock_digest_before="$(uv_lock_digest)"
     run_with_retry \
         "$DEPENDENCY_INSTALL_MAX_RETRIES" \
         "$DEPENDENCY_INSTALL_RETRY_INTERVAL" \
         "uv 环境初始化失败，清华源重试 ${DEPENDENCY_INSTALL_MAX_RETRIES} 次后仍失败" \
         "uv sync --frozen (清华源)" \
+        run_uv_sync_with_tuna_config "$log_file"
+    sync_status=$?
+    assert_uv_lock_unchanged "$lock_digest_before" "uv sync --frozen (清华源)"
+    return "$sync_status"
+}
+
+run_uv_sync_with_tuna_config() {
+    local log_file="$1"
+
+    UV_CONFIG_FILE="$PLANET_TUNA_UV_CONFIG_FILE" \
         run_command_quiet_unless_verbose "$log_file" uv sync --frozen --group dev
 }
 
 configure_uv_tuna_index() {
-    local uv_config="$SCRIPT_DIR/uv.toml"
+    local uv_config="$PLANET_TUNA_UV_CONFIG_FILE"
 
     if [ -f "$uv_config" ] &&
        grep -Fq 'name = "tsinghua"' "$uv_config" 2>/dev/null &&
        grep -Fq "$PLANET_UV_TUNA_INDEX_URL" "$uv_config" 2>/dev/null &&
        grep -Eq '^[[:space:]]*default[[:space:]]*=[[:space:]]*true' "$uv_config" 2>/dev/null; then
-        log_note "uv.toml 已配置清华源，直接重试 uv sync"
-        return 0
-    fi
-
-    if [ -f "$uv_config" ] && grep -Eq '^[[:space:]]*default[[:space:]]*=[[:space:]]*true' "$uv_config" 2>/dev/null; then
-        log_warn "uv.toml 已存在默认 index，未覆盖用户配置"
-        log_note "如需手动切换清华源，可添加 [[index]] name=\"tsinghua\" 并设置 default=true"
+        log_note "临时 uv 清华源配置已存在，直接重试 uv sync"
         return 0
     fi
 
     {
-        if [ -s "$uv_config" ]; then
-            printf "\n"
-        fi
         printf '[[index]]\n'
         printf 'name = "tsinghua"\n'
         printf 'url = "%s"\n' "$PLANET_UV_TUNA_INDEX_URL"
         printf 'default = true\n'
-    } >> "$uv_config"
+    } > "$uv_config"
 
-    log_note "已向 uv.toml 添加清华 PyPI 源: ${PLANET_UV_TUNA_INDEX_URL}"
+    chmod 600 "$uv_config" 2>/dev/null || true
+    log_note "已写入临时 uv 清华源配置: ${uv_config}"
+}
+
+uv_lock_digest() {
+    local lock_file="$SCRIPT_DIR/uv.lock"
+
+    if [ ! -f "$lock_file" ]; then
+        printf "missing\n"
+        return 0
+    fi
+
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum "$lock_file" | awk '{print $1}'
+        return 0
+    fi
+
+    cksum "$lock_file" | awk '{print $1 ":" $2}'
+}
+
+assert_uv_lock_unchanged() {
+    local expected_digest="$1"
+    local action_label="$2"
+    local current_digest
+
+    current_digest="$(uv_lock_digest)"
+    if [ "$current_digest" = "$expected_digest" ]; then
+        return 0
+    fi
+
+    log_error "${action_label} 修改了 uv.lock；新环境依赖安装不允许污染 lockfile"
+    log_note "请还原 uv.lock，并只在明确升级依赖时手动运行 uv lock"
+    exit 1
 }
 
 install_system_package() {