@arcships/morula-runtime 0.1.0-alpha.12 → 0.1.0-alpha.14

package/dist/index.js

@@ -740,7 +740,7 @@ var BUILD_ID, BUILD_CONTEXTS, BUILD_DEFAULT_CONTEXT;
 var init_build_env = __esm({
   "../morula-cli-core/dist/build-env.js"() {
     "use strict";
-    BUILD_ID = "20260922142838.0c791f70";
+    BUILD_ID = "20260923140226.31d77ab2";
     BUILD_CONTEXTS = {
       "local": "http://localhost:8080/api",
       "test": "https://morula.basecastle.com/api",
@@ -951,6 +951,22 @@ var init_ci = __esm({
       testReport(runId) {
         return this.client.get(`/vcs/runs/${encodeURIComponent(requiredId2(runId, "run id"))}/test-report`);
       }
+      /** 触发新流水线（D2）。ref 门禁在服务端（集成分支 ∪ 生产分支）。非幂等。 */
+      triggerPipeline(connectionId, ref) {
+        return this.client.post(`/vcs/connections/${encodeURIComponent(requiredId2(connectionId, "connection id"))}/pipelines`, { ref });
+      }
+      /** 重跑整条流水线的失败 job（D2）。只允许 failure / cancelled。非幂等。 */
+      retryRun(runId) {
+        return this.client.post(`/vcs/runs/${encodeURIComponent(requiredId2(runId, "run id"))}/retry`);
+      }
+      /** 重跑单个 job（D2）。只允许 failure / cancelled。非幂等。 */
+      retryJob(jobId) {
+        return this.client.post(`/vcs/jobs/${encodeURIComponent(requiredId2(jobId, "job id"))}/retry`);
+      }
+      /** 触发手动 job（D2，仅人面）。非幂等。 */
+      playJob(jobId) {
+        return this.client.post(`/vcs/jobs/${encodeURIComponent(requiredId2(jobId, "job id"))}/play`);
+      }
     };
   }
 });
@@ -4408,7 +4424,7 @@ init_dist2();
 init_dist2();
 
 // src/build-env.ts
-var BUILD_VERSION2 = "0.1.0-alpha.12";
+var BUILD_VERSION2 = "0.1.0-alpha.14";
 
 // src/commands/daemon.ts
 init_dist();
@@ -8661,7 +8677,6 @@ var SessionHost = class {
       env,
       turnNo: 0,
       promptInFlight: null,
-      cancelRequested: false,
       // resume 成功 → dim 会话里已有上一进程注入的管家指令，不重复前置
       instructed: resumed,
       appliedConfig: { ...appliedConfig, permission },
@@ -8694,7 +8709,6 @@ var SessionHost = class {
     if (!cmd.prompt?.trim())
       return { ok: false, error: "SESSION_PROMPT_EMPTY" };
     managed.turnNo += 1;
-    managed.cancelRequested = false;
     this.touch(managed);
     const turnNo = managed.turnNo;
     const mapper = new AcpEventMapper();
@@ -8890,12 +8904,16 @@ ${fileRefs.join("\n")}` : text }];
     }
     return { blocks, fileRefs };
   }
-  /** 取消当前回合（ACP session/cancel；会话保持打开——长驻语义） */
+  /**
+   * 取消当前回合（ACP `session/cancel` 通知；会话保持打开——长驻语义）。
+   *
+   * **软中断**：dim 在安全点（step 之间）生效，不是硬杀进程；daemon 只负责把通知发出去，
+   * 本轮的终态仍由 ACP `session/prompt` 响应驱动（`cancelled` → `turn_completed`）。
+   */
   cancel(cmd) {
     const managed = this.sessions.get(cmd.sessionId);
     if (!managed)
       return { ok: false, error: "SESSION_NOT_OPEN" };
-    managed.cancelRequested = true;
     managed.conn.cancel(managed.dimSessionId);
     this.touch(managed);
     return { ok: true };
@@ -10091,16 +10109,25 @@ var DaemonRunner = class {
   /**
    * 会话宿主命令分发。
    *
-   * 两道闸：
+   * 三道闸：
    * ① **runtimeId + daemonId 自过滤**（tenant 广播 → 只有归属设备处理；字段缺失时不过滤，兼容旧服务端）。
    *    daemonId 是**实例**维度（issues/duplicate-daemon-same-runtime-double-execution.md）：同机多实例
    *    注册时会复用同一行 AgentRuntime（同一 runtimeId），缺了它两个实例会各自 `open` 同一 sessionId
    *    并各跑一轮 prompt（实测：同一轮两份正文事件、两个 daemon 都「会话已打开」）；
-   * ② **按会话串行**：服务端每轮 prompt 前会补发 `open` 做兜底，而 socket.io 只保证「送达有序」，
-   *    不保证「异步处理有序」——`void handleSessionCommand()` 会让 open/prompt 交错执行，
-   *    prompt 可能先于 open 完成而拿到 SESSION_NOT_OPEN。故按 sessionId 串成一条 promise 链。
+   * ② **按会话串行**（open / prompt / config）：服务端每轮 prompt 前会补发 `open` 做兜底，而 socket.io
+   *    只保证「送达有序」，不保证「异步处理有序」——`void handleSessionCommand()` 会让 open/prompt
+   *    交错执行，prompt 可能先于 open 完成而拿到 SESSION_NOT_OPEN。故按 sessionId 串成一条 promise 链。
+   * ③ **抢占类命令（cancel / close）不进链**：`prompt` 的 promise 直到本轮 `end_turn` 才 resolve
+   *    （`session-host.prompt()` await 的是 ACP `session/prompt` 响应），排在它后面 = 取消永远发生在
+   *    回合结束之后，用户看到的是「点了停止但没停」（issues/steward-session-cancel-queued-behind-prompt.md）。
+   *    它们只等该会话的 **open 门**——open 未完成时会话还不存在，取消只会拿到 SESSION_NOT_OPEN。
    */
   sessionCommandChains = /* @__PURE__ */ new Map();
+  /**
+   * 各会话**在飞 `open` 命令**的完成信号（抢占类命令的唯一前置门）。
+   * 只在 open 入链时登记，open 落定即清理——它表达的是「会话在设备上就绪」，与后续 prompt 无关。
+   */
+  sessionOpenGates = /* @__PURE__ */ new Map();
   handleSessionCommand(kind, payload) {
     const runtimeId = typeof payload.runtimeId === "string" ? payload.runtimeId : void 0;
     if (runtimeId && this.runtimeId && runtimeId !== this.runtimeId)
@@ -10113,15 +10140,25 @@ var DaemonRunner = class {
       this.log(`[daemon] \u4F1A\u8BDD\u547D\u4EE4 ${kind} \u7F3A\u5C11 sessionId\uFF08\u5FFD\u7565\uFF09`);
       return Promise.resolve();
     }
+    const logFailure = (err) => {
+      this.log(`[daemon] \u4F1A\u8BDD\u547D\u4EE4 ${kind} \u6267\u884C\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
+    };
+    if (kind === "cancel" || kind === "close") {
+      const gate = this.sessionOpenGates.get(sessionId) ?? Promise.resolve();
+      return gate.catch(() => {
+      }).then(() => this.runSessionCommand(kind, payload)).catch(logFailure);
+    }
     const prev = this.sessionCommandChains.get(sessionId) ?? Promise.resolve();
     const next = prev.catch(() => {
-    }).then(() => this.runSessionCommand(kind, payload)).catch((err) => {
-      this.log(`[daemon] \u4F1A\u8BDD\u547D\u4EE4 ${kind} \u6267\u884C\u5931\u8D25: ${err instanceof Error ? err.message : String(err)}`);
-    });
+    }).then(() => this.runSessionCommand(kind, payload)).catch(logFailure);
     this.sessionCommandChains.set(sessionId, next);
+    if (kind === "open")
+      this.sessionOpenGates.set(sessionId, next);
     void next.finally(() => {
       if (this.sessionCommandChains.get(sessionId) === next)
         this.sessionCommandChains.delete(sessionId);
+      if (this.sessionOpenGates.get(sessionId) === next)
+        this.sessionOpenGates.delete(sessionId);
     });
     return next;
   }
@@ -10137,9 +10174,13 @@ var DaemonRunner = class {
         await host.open(payload);
       else if (kind === "prompt")
         await host.prompt(payload);
-      else if (kind === "cancel")
-        host.cancel(payload);
-      else if (kind === "config")
+      else if (kind === "cancel") {
+        const res = host.cancel(payload);
+        if (res.ok)
+          this.log(`[daemon] \u4F1A\u8BDD ${String(payload.sessionId ?? "")} \u53D6\u6D88\u5DF2\u4E0B\u53D1\uFF08ACP session/cancel\uFF09`);
+        else
+          this.log(`[daemon] \u4F1A\u8BDD ${String(payload.sessionId ?? "")} \u53D6\u6D88\u5931\u8D25: ${res.error ?? "UNKNOWN"}`);
+      } else if (kind === "config")
         await host.config(payload);
       else if (kind === "close")
         await host.close(payload);

package/dist/morula.js

@@ -704,8 +704,8 @@ function page(ok, message) {
 }
 
 // ../morula-cli-core/dist/build-env.js
-var BUILD_VERSION = "0.1.0-alpha.12";
-var BUILD_ID = "20260922142838.0c791f70";
+var BUILD_VERSION = "0.1.0-alpha.14";
+var BUILD_ID = "20260923140226.31d77ab2";
 var BUILD_CONTEXTS = {
   "local": "http://localhost:8080/api",
   "test": "https://morula.basecastle.com/api",
@@ -880,6 +880,22 @@ var CiApi = class {
   testReport(runId) {
     return this.client.get(`/vcs/runs/${encodeURIComponent(requiredId2(runId, "run id"))}/test-report`);
   }
+  /** 触发新流水线（D2）。ref 门禁在服务端（集成分支 ∪ 生产分支）。非幂等。 */
+  triggerPipeline(connectionId, ref) {
+    return this.client.post(`/vcs/connections/${encodeURIComponent(requiredId2(connectionId, "connection id"))}/pipelines`, { ref });
+  }
+  /** 重跑整条流水线的失败 job（D2）。只允许 failure / cancelled。非幂等。 */
+  retryRun(runId) {
+    return this.client.post(`/vcs/runs/${encodeURIComponent(requiredId2(runId, "run id"))}/retry`);
+  }
+  /** 重跑单个 job（D2）。只允许 failure / cancelled。非幂等。 */
+  retryJob(jobId) {
+    return this.client.post(`/vcs/jobs/${encodeURIComponent(requiredId2(jobId, "job id"))}/retry`);
+  }
+  /** 触发手动 job（D2，仅人面）。非幂等。 */
+  playJob(jobId) {
+    return this.client.post(`/vcs/jobs/${encodeURIComponent(requiredId2(jobId, "job id"))}/play`);
+  }
 };
 function requiredId2(id, label) {
   const normalized = id.trim();
@@ -2209,7 +2225,13 @@ async function ciCommand(context) {
     return ciDeployments(context);
   if (action === "test-report")
     return ciTestReport(context);
-  throw usage("usage: morula ci <status|log|deployments|test-report>");
+  if (action === "retry")
+    return ciRetry(context);
+  if (action === "trigger")
+    return ciTrigger(context);
+  if (action === "play")
+    return ciPlay(context);
+  throw usage("usage: morula ci <status|log|deployments|test-report|retry|trigger|play>");
 }
 async function ciStatus(context) {
   const { positionals, flags } = context.parsed;
@@ -2289,6 +2311,76 @@ async function ciTestReport(context) {
     throw ciFailure(result);
   return result;
 }
+async function ciTrigger(context) {
+  const { flags } = context.parsed;
+  rejectUnknownFlags(flags, ["space", "ref"]);
+  const spaceId = flagString(flags, "space");
+  const ref = flagString(flags, "ref");
+  if (!spaceId)
+    throw usage("usage: morula ci trigger --space <spaceId> --ref <ref>");
+  if (!ref)
+    throw usage("--ref \u5FC5\u586B\uFF1A\u8981\u89E6\u53D1\u6D41\u6C34\u7EBF\u7684\u5206\u652F\u540D");
+  const view = await context.client.ci.spaceView(spaceId, { limit: 1 });
+  if (view.ok === false)
+    throw ciFailure(view);
+  const connectionId = view.repos?.[0]?.connectionId;
+  if (!connectionId) {
+    throw new CliError("NO_CONNECTION", EXIT.OTHER, `\u7A7A\u95F4 ${spaceId} \u6CA1\u6709\u7ED1\u5B9A\u7684\u4ED3\u5E93\u8FDE\u63A5\uFF0C\u65E0\u6CD5\u89E6\u53D1\u6D41\u6C34\u7EBF`);
+  }
+  const result = await context.client.ci.triggerPipeline(connectionId, ref);
+  if (result.ok === false)
+    throw ciFailure(result, "\u64CD\u4F5C");
+  return result;
+}
+async function ciPlay(context) {
+  const { flags } = context.parsed;
+  rejectUnknownFlags(flags, ["job"]);
+  const jobId = flagString(flags, "job");
+  if (!jobId)
+    throw usage("usage: morula ci play --job <jobId>");
+  const result = await context.client.ci.playJob(jobId);
+  if (result.ok === false)
+    throw ciFailure(result, "\u64CD\u4F5C");
+  return result;
+}
+async function ciRetry(context) {
+  const { positionals, flags } = context.parsed;
+  rejectUnknownFlags(flags, ["space", "run", "job"]);
+  const usageHint = "usage: morula ci retry --space <spaceId> [--run <runId>] [--job <jobId>]";
+  if (positionals.length)
+    throw usage(`\u91CD\u8DD1\u53EA\u5728\u7A7A\u95F4\u9762\u5F00\u653E\uFF1A\u8BF7\u7528 --space <spaceId>\u3002${usageHint}`);
+  const runId = flagString(flags, "run");
+  const jobId = flagString(flags, "job");
+  if (runId && jobId)
+    throw usage(`--run \u4E0E --job \u4E92\u65A5\uFF0C\u53EA\u80FD\u7ED9\u4E00\u4E2A\uFF08${usageHint}\uFF09`);
+  const spaceId = flagString(flags, "space");
+  if (!spaceId)
+    throw usage(usageHint);
+  if (jobId) {
+    const result2 = await context.client.ci.retryJob(jobId);
+    if (result2.ok === false)
+      throw ciFailure(result2, "\u64CD\u4F5C");
+    return result2;
+  }
+  let targetRunId = runId;
+  if (!targetRunId) {
+    const view = await context.client.ci.spaceView(spaceId, { failed: true });
+    if (view.ok === false)
+      throw ciFailure(view);
+    targetRunId = view.runs[0]?.id;
+    if (!targetRunId) {
+      throw new CliError(
+        "CI_RUN_NOT_FOUND",
+        EXIT.NOT_FOUND,
+        `\u7A7A\u95F4 ${spaceId} \u6CA1\u6709\u5931\u8D25\u7684\u6D41\u6C34\u7EBF\u8FD0\u884C\u53EF\u91CD\u8DD1\uFF08\u53EF\u5148\u7528 morula ci status --space ${spaceId} --failed \u786E\u8BA4\uFF09`
+      );
+    }
+  }
+  const result = await context.client.ci.retryRun(targetRunId);
+  if (result.ok === false)
+    throw ciFailure(result, "\u64CD\u4F5C");
+  return result;
+}
 function resolveFace(context, usageHint) {
   const taskId = context.parsed.positionals[0]?.trim();
   const spaceId = flagString(context.parsed.flags, "space");
@@ -2298,11 +2390,11 @@ function resolveFace(context, usageHint) {
     throw usage(usageHint);
   return taskId ? { kind: "task", taskId } : { kind: "space", spaceId };
 }
-function ciFailure(failure) {
+function ciFailure(failure, label = "\u67E5\u8BE2") {
   return new CliError(
     failure.code,
     exitForCiCode(failure.code),
-    `CI \u67E5\u8BE2\u5931\u8D25: ${failure.message || "\u672A\u77E5\u539F\u56E0"}\uFF08${failure.code}\uFF09`
+    `CI ${label}\u5931\u8D25: ${failure.message || "\u672A\u77E5\u539F\u56E0"}\uFF08${failure.code}\uFF09`
   );
 }
 function exitForCiCode(code) {
@@ -3787,7 +3879,7 @@ var SPEC = {
     },
     {
       resource: "ci",
-      summary: "CI/CD pipeline facts (read-only): pipeline runs / job logs / deployments / failed test cases. Read faces share one command surface \u2014 task face `<taskId>` (AgentTask credential, self-check your MR pipeline) vs space face `--space <spaceId>` (steward/session credential, space-wide inspection); the two are mutually exclusive. Write operations (retry / play / trigger) were removed on 2026-09-22 (CI panel is read-only): operate pipelines directly in the VCS platform instead",
+      summary: "CI/CD pipeline facts + write operations: pipeline runs / job logs / deployments / failed test cases / trigger pipeline / retry / play manual job. Read faces share one command surface \u2014 task face `<taskId>` (AgentTask credential, self-check your MR pipeline) vs space face `--space <spaceId>` (steward/session credential, space-wide inspection); the two are mutually exclusive. Write ops (trigger / retry / play) are ONLY open on the space face (not task face); agent_session tokens are read-only for CI (AgentSessionScopeGuard does not whitelist these endpoints). D2: retry of the newest FAILED run is the default when --run is omitted",
       actions: [
         {
           action: "status",
@@ -3843,11 +3935,47 @@ var SPEC = {
           writes: "none",
           idempotent: true,
           emits: ["ok", "runId", "report"]
+        },
+        {
+          action: "trigger",
+          summary: "trigger a new pipeline on the space's first active connection for the given ref (space face ONLY; ref must be in the connection's integration branch or production branches, or the server rejects with CI_REF_NOT_ALLOWED; NOT idempotent)",
+          flags: [
+            { name: "space", type: "string", valueHint: "<id>", description: "\u7A7A\u95F4 ID\uFF08\u5FC5\u586B\uFF09", required: true },
+            { name: "ref", type: "string", valueHint: "<ref>", description: "\u8981\u89E6\u53D1\u6D41\u6C34\u7EBF\u7684\u5206\u652F\u540D\uFF08\u5FC5\u586B\uFF09", required: true }
+          ],
+          examples: ["morula ci trigger --space <id> --ref dev"],
+          writes: "remote",
+          idempotent: false,
+          emits: ["ok", "action", "runId", "jobId", "externalId", "ref", "webUrl", "acceptedAt"]
+        },
+        {
+          action: "play",
+          summary: "trigger a manual job (space face ONLY \u2014 job id lookup is stateless; NOT idempotent; only manual jobs \u2014 status=manual \u2014 can be played, others get CI_JOB_NOT_MANUAL)",
+          flags: [
+            { name: "job", type: "string", valueHint: "<jobId>", description: "\u5E73\u53F0 job ID\uFF08\u5FC5\u586B\uFF1B\u6765\u81EA ci status \u7684 jobs[].id\uFF0C\u987B\u4E3A\u624B\u52A8 job\uFF09", required: true }
+          ],
+          examples: ["morula ci play --job <jobId>"],
+          writes: "remote",
+          idempotent: false,
+          emits: ["ok", "action", "runId", "jobId", "externalId", "ref", "acceptedAt"]
+        },
+        {
+          action: "retry",
+          summary: "re-run a failed pipeline (space face ONLY \u2014 a positional <taskId> is a usage error, retry is not open to the task face; person + steward, and a steward must go through an elicitation confirm card). Omit both --run and --job to retry the newest FAILED run of the space (no failed run at all \u2192 CI_RUN_NOT_FOUND exit 3). Only failure/cancelled runs or jobs can be retried (CI_RETRY_NOT_ALLOWED exit 6). NOT idempotent: every call starts another platform re-run",
+          flags: [
+            { name: "space", type: "string", valueHint: "<id>", description: "\u7A7A\u95F4 ID\uFF08\u5FC5\u586B\uFF09", required: true },
+            { name: "run", type: "string", valueHint: "<runId>", description: "\u8981\u91CD\u8DD1\u7684\u8FD0\u884C ID\uFF08\u4E0E --job \u4E92\u65A5\uFF1B\u7F3A\u7701 = \u8BE5\u7A7A\u95F4\u6700\u65B0\u4E00\u6761\u5931\u8D25\u8FD0\u884C\uFF09" },
+            { name: "job", type: "string", valueHint: "<jobId>", description: "\u8981\u91CD\u8DD1\u7684\u5355\u4E2A job ID\uFF08\u4E0E --run \u4E92\u65A5\uFF1B\u6765\u81EA ci status \u7684 jobs[].id\uFF09" }
+          ],
+          examples: ["morula ci retry --space <id>", "morula ci retry --space <id> --job <jobId>"],
+          writes: "remote",
+          idempotent: false,
+          emits: ["ok", "action", "runId", "jobId", "externalId", "ref", "acceptedAt"]
         }
       ],
       notes: [
         "\u4E24\u4E2A\u9762\uFF08\u4EFB\u52A1\u9762 <taskId> / \u7A7A\u95F4\u9762 --space <spaceId>\uFF09\u4E92\u65A5\uFF1A\u540C\u65F6\u7ED9 \u2192 usage error(2)\uFF0C\u90FD\u4E0D\u7ED9\u540C\u6837 usage error\u3002\u51ED\u8BC1\u4E0E\u4F5C\u7528\u57DF\u4E0D\u540C\uFF0C\u731C\u9519\u4F1A\u53D8\u6210\u9759\u9ED8\u8D8A\u6743\u6216\u9759\u9ED8\u5931\u8D25",
-        "CI \u547D\u4EE4\u9762\u7EAF\u53EA\u8BFB\uFF08\u5199\u64CD\u4F5C\u5DF2\u79FB\u9664\uFF0C2026-09-22 \u5B9A\u6848\uFF09\uFF1Astatus / log / deployments / test-report \u5168\u90E8 writes: none\uFF1B\u91CD\u8DD1 / \u89E6\u53D1\u6D41\u6C34\u7EBF\u8BF7\u5728 VCS \u5E73\u53F0\uFF08GitLab/GitHub\uFF09\u4E0A\u76F4\u63A5\u64CD\u4F5C",
+        "D2 \u5199\u64CD\u4F5C\uFF08trigger / play / retry\uFF09\u53EA\u5728\u7A7A\u95F4\u9762\u5F00\u653E\uFF1Aagent_session \u51ED\u8BC1\uFF08\u7BA1\u7406\u5458\uFF09\u6743\u9650\u53EA\u8BFB\uFF0C\u4E0D\u767B\u8BB0 AgentSessionScopeGuard \u5199\u9762\u767D\u540D\u5355\u2014\u2014retry \u8D70\u7BA1\u5BB6 elicitation \u786E\u8BA4\u5361\uFF0Cplay \u4EC5\u5728 web \u4EBA\u9762\u4F7F\u7528",
         "\u670D\u52A1\u7AEF\u4E1A\u52A1\u5931\u8D25\u662F HTTP 200 + `{ ok:false, code, message }`\uFF1ACI_JOB_NOT_FOUND / CI_RUN_NOT_FOUND / TASK_NOT_FOUND / OBJECT_NOT_FOUND \u2192 exit 3\uFF1BCAPABILITY_UNSUPPORTED / NO_CONNECTION / \u5176\u4F59 \u2192 exit 1"
       ]
     },

package/dist/plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "morula-cli",
-  "version": "0.1.0-alpha.12",
+  "version": "0.1.0-alpha.14",
   "description": "Use Morula CLI task management from DimCode.",
   "interface": {
     "displayName": "Morula CLI",

package/dist/plugin/skills/morula-cli/references/commands.md

@@ -1401,10 +1401,10 @@ morula repo mr diff <taskId> --mr <iid>
 
 ## `morula ci`
 
-CI/CD pipeline facts (read-only): pipeline runs / job logs / deployments / failed test cases. Read faces share one command surface — task face `<taskId>` (AgentTask credential, self-check your MR pipeline) vs space face `--space <spaceId>` (steward/session credential, space-wide inspection); the two are mutually exclusive. Write operations (retry / play / trigger) were removed on 2026-09-22 (CI panel is read-only): operate pipelines directly in the VCS platform instead
+CI/CD pipeline facts + write operations: pipeline runs / job logs / deployments / failed test cases / trigger pipeline / retry / play manual job. Read faces share one command surface — task face `<taskId>` (AgentTask credential, self-check your MR pipeline) vs space face `--space <spaceId>` (steward/session credential, space-wide inspection); the two are mutually exclusive. Write ops (trigger / retry / play) are ONLY open on the space face (not task face); agent_session tokens are read-only for CI (AgentSessionScopeGuard does not whitelist these endpoints). D2: retry of the newest FAILED run is the default when --run is omitted
 
 > 两个面（任务面 <taskId> / 空间面 --space <spaceId>）互斥：同时给 → usage error(2)，都不给同样 usage error。凭证与作用域不同，猜错会变成静默越权或静默失败
-> CI 命令面纯只读（写操作已移除，2026-09-22 定案）：status / log / deployments / test-report 全部 writes: none；重跑 / 触发流水线请在 VCS 平台（GitLab/GitHub）上直接操作
+> D2 写操作（trigger / play / retry）只在空间面开放：agent_session 凭证（管理员）权限只读，不登记 AgentSessionScopeGuard 写面白名单——retry 走管家 elicitation 确认卡，play 仅在 web 人面使用
 > 服务端业务失败是 HTTP 200 + `{ ok:false, code, message }`：CI_JOB_NOT_FOUND / CI_RUN_NOT_FOUND / TASK_NOT_FOUND / OBJECT_NOT_FOUND → exit 3；CAPABILITY_UNSUPPORTED / NO_CONNECTION / 其余 → exit 1
 
 ### `morula ci status`
@@ -1503,6 +1503,64 @@ morula ci test-report <taskId>
 
 > `writes: none` · `interactive: no` · `idempotent: yes` · `emits: ok, runId, report`
 
+### `morula ci trigger`
+
+**用法**：`morula ci trigger [--space <id>] [--ref <ref>]`
+
+trigger a new pipeline on the space's first active connection for the given ref (space face ONLY; ref must be in the connection's integration branch or production branches, or the server rejects with CI_REF_NOT_ALLOWED; NOT idempotent)
+
+| Flag | 类型 | 必填 | 取值 | 默认 | 说明 |
+|---|---|---|---|---|---|
+| `--space <id>` | string | 是 | - | - | 空间 ID（必填） |
+| `--ref <ref>` | string | 是 | - | - | 要触发流水线的分支名（必填） |
+
+**示例**
+
+```bash
+morula ci trigger --space <id> --ref dev
+```
+
+> `writes: remote` · `interactive: no` · `idempotent: no` · `emits: ok, action, runId, jobId, externalId, ref, webUrl, acceptedAt`
+
+### `morula ci play`
+
+**用法**：`morula ci play [--job <jobId>]`
+
+trigger a manual job (space face ONLY — job id lookup is stateless; NOT idempotent; only manual jobs — status=manual — can be played, others get CI_JOB_NOT_MANUAL)
+
+| Flag | 类型 | 必填 | 取值 | 默认 | 说明 |
+|---|---|---|---|---|---|
+| `--job <jobId>` | string | 是 | - | - | 平台 job ID（必填；来自 ci status 的 jobs[].id，须为手动 job） |
+
+**示例**
+
+```bash
+morula ci play --job <jobId>
+```
+
+> `writes: remote` · `interactive: no` · `idempotent: no` · `emits: ok, action, runId, jobId, externalId, ref, acceptedAt`
+
+### `morula ci retry`
+
+**用法**：`morula ci retry [--space <id>] [--run <runId>] [--job <jobId>]`
+
+re-run a failed pipeline (space face ONLY — a positional <taskId> is a usage error, retry is not open to the task face; person + steward, and a steward must go through an elicitation confirm card). Omit both --run and --job to retry the newest FAILED run of the space (no failed run at all → CI_RUN_NOT_FOUND exit 3). Only failure/cancelled runs or jobs can be retried (CI_RETRY_NOT_ALLOWED exit 6). NOT idempotent: every call starts another platform re-run
+
+| Flag | 类型 | 必填 | 取值 | 默认 | 说明 |
+|---|---|---|---|---|---|
+| `--space <id>` | string | 是 | - | - | 空间 ID（必填） |
+| `--run <runId>` | string | - | - | - | 要重跑的运行 ID（与 --job 互斥；缺省 = 该空间最新一条失败运行） |
+| `--job <jobId>` | string | - | - | - | 要重跑的单个 job ID（与 --run 互斥；来自 ci status 的 jobs[].id） |
+
+**示例**
+
+```bash
+morula ci retry --space <id>
+morula ci retry --space <id> --job <jobId>
+```
+
+> `writes: remote` · `interactive: no` · `idempotent: no` · `emits: ok, action, runId, jobId, externalId, ref, acceptedAt`
+
 <!-- hand:start ci -->
 <!-- hand:end ci -->
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@arcships/morula-runtime",
   "type": "module",
-  "version": "0.1.0-alpha.12",
+  "version": "0.1.0-alpha.14",
   "description": "Device-level CLI for the Morula local agent runtime (daemon/portal/models/auth) and the Morula business CLI (morula), distributed via npm",
   "bin": {
     "morula-runtime": "./bin/morula-runtime.js",