fix: wait safely for apt locks

deploy_QMD.yml

@@ -3,7 +3,9 @@
   hosts: "{{ qmd_hosts | default('all') }}"
   become: true
   gather_facts: true
+  module_defaults:
+    ansible.builtin.apt:
+      lock_timeout: "{{ ai_workspace_apt_lock_timeout | default(900) | int }}"
   roles:
     - role: roles/vhosts/qmd/
       tags: [qmd]
-

deploy_gateway_openclaw.yml

@@ -3,6 +3,9 @@
   hosts: "{{ gateway_openclaw_hosts | default('all') }}"
   become: true
   gather_facts: true
+  module_defaults:
+    ansible.builtin.apt:
+      lock_timeout: "{{ ai_workspace_apt_lock_timeout | default(900) | int }}"
   roles:
     - role: roles/vhosts/gateway_openclaw/
       tags: [gateway_openclaw, openclaw]

deploy_xworkmate_bridge_vhosts.yml

@@ -10,6 +10,9 @@
   hosts: "{{ xworkmate_bridge_hosts | default('all') }}"
   become: true
   gather_facts: true
+  module_defaults:
+    ansible.builtin.apt:
+      lock_timeout: "{{ ai_workspace_apt_lock_timeout | default(900) | int }}"
   roles:
     - role: roles/vhosts/acp_server_codex/
       tags: [acp_codex]

docs/setup-ai-workspace-all-in-one.md

@@ -37,9 +37,10 @@
 
 ## TODO
 
-- [ ] 等待并核对 `xworkspace-console` 的离线包 GitHub Actions 发布链路，确认 `publish-release` 完整结束且 release 产物上传成功。
+- [x] 等待并核对 `xworkspace-console` 的离线包 GitHub Actions 发布链路，确认 `publish-release` 完整结束且 release 产物上传成功。
 - [ ] 继续核对 `root@acp-bridge.onwalk.net` 的远程部署进度，确认 `setup-ai-workspace-all-in-one.sh` 最终完成并输出统一摘要。
-- [ ] `setup-ai-workspace-all-in-one.sh` 在目标主机上优先使用离线安装包加速部署，减少在线拉取与安装耗时。
+- [x] `setup-ai-workspace-all-in-one.sh` 在目标主机上优先使用离线安装包加速部署，减少在线拉取与安装耗时。
+- [ ] 验证 `setup-ai-workspace-all-in-one.sh` 幂等性：同一主机连续执行两次均成功，复用凭据、离线包缓存与已导入镜像，并安全等待部署/APT 锁。
 - [ ] 完成最终验收核对：Bridge 对外可达、其余服务默认仅本地监听、`acp-codex` / `opencode` / `gemini` / `hermes` / `qmd` / `litellm` 状态正常。
 - [ ] 记录最终提交哈希与远端验证结果，回填到本计划的交付结果部分。
 

setup-ai-agent-skills.yml

@@ -3,6 +3,9 @@
   hosts: all
   become: true
   gather_facts: true
+  module_defaults:
+    ansible.builtin.apt:
+      lock_timeout: "{{ ai_workspace_apt_lock_timeout | default(900) | int }}"
   roles:
     - role: roles/ai_agent_runtime/
       when: ai_agent_runtime_enabled | default(true) | bool

setup-nodejs.yml

@@ -2,5 +2,8 @@
   hosts: all
   become: true
   gather_facts: true
+  module_defaults:
+    ansible.builtin.apt:
+      lock_timeout: "{{ ai_workspace_apt_lock_timeout | default(900) | int }}"
   roles:
     - roles/vhosts/nodejs/

setup-postgres-standalone.yaml

@@ -3,6 +3,9 @@
   hosts: all
   become: true
   gather_facts: true
+  module_defaults:
+    ansible.builtin.apt:
+      lock_timeout: "{{ ai_workspace_apt_lock_timeout | default(900) | int }}"
   roles:
     - role: roles/vhosts/postgres
       tags: [postgresql]

setup-vault.yaml

@@ -3,6 +3,9 @@
   hosts: all
   become: true
   gather_facts: true
+  module_defaults:
+    ansible.builtin.apt:
+      lock_timeout: "{{ ai_workspace_apt_lock_timeout | default(900) | int }}"
   roles:
     - role: roles/vhosts/vault/
       tags: [vault]

setup-xfce-xrdp.yaml

@@ -3,6 +3,9 @@
   hosts: all
   become: true
   gather_facts: true
+  module_defaults:
+    ansible.builtin.apt:
+      lock_timeout: "{{ ai_workspace_apt_lock_timeout | default(900) | int }}"
   vars:
     xworkspace_console_enable_xrdp: false
   tasks:

setup-xworkspace-console.yaml

@@ -3,6 +3,9 @@
   hosts: "{{ xworkspace_console_hosts | default('all') }}"
   become: true
   gather_facts: true
+  module_defaults:
+    ansible.builtin.apt:
+      lock_timeout: "{{ ai_workspace_apt_lock_timeout | default(900) | int }}"
   vars:
     xworkspace_console_user: ubuntu
     xworkspace_console_public_access: false