@guanlin4924/devflow-pi 0.1.29 → 0.1.30

package/README.md

@@ -11,7 +11,7 @@ Devflow Pi 是一个面向项目研发交付的独立 OMP 产品入口，内置
 安装与启动：
 
 ```bash
-npm install -g @guanlin4924/devflow-pi@0.1.29
+npm install -g @guanlin4924/devflow-pi@0.1.30
 cd /path/to/your-project
 devflow-pi init
 devflow-pi doctor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guanlin4924/devflow-pi",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "type": "module",
   "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",
   "license": "UNLICENSED",

package/plugins/devflow-core/extensions/devflow-core.ts

@@ -1605,7 +1605,12 @@ export default function devflowCore(pi: ExtensionAPI) {
     // artifact metadata and never advances STATE, checkpoints, or ownership.
     const isRegistryReconciliation =
       toolName === "devflow_artifact" && toolInput?.action === "sync" && toolInput?.preserve === false;
-    if (isStateMutationTool(toolName) && !isRegistryReconciliation) {
+    const isUserConfirmedStepTransition =
+      toolName === "devflow_transition" &&
+      toolInput?.action === "complete-step" &&
+      toolInput?.confirm === true &&
+      ["waiting-user", "awaiting-approval"].includes(controlState.phase);
+    if (isStateMutationTool(toolName) && !isRegistryReconciliation && !isUserConfirmedStepTransition) {
       return {
         block: true,
         reason:
@@ -2427,7 +2432,21 @@ export default function devflowCore(pi: ExtensionAPI) {
         if (!params.step) {
           return renderResult({ ok: false, exitCode: 2, stdout: "", stderr: "step is required" });
         }
+        if (params.confirm !== true) {
+          return renderResult({ ok: false, exitCode: 2, stdout: "", stderr: "complete-step requires explicit user confirmation (confirm=true)" });
+        }
         const snapshot = parseJsonResult(await runRuby(ctx.cwd, "workflow-orchestrator/scripts/inspect_state.rb", ["--json"]));
+        const currentStep = snapshot?.current_step && typeof snapshot.current_step === "object"
+          ? (snapshot.current_step as Record<string, unknown>).id
+          : undefined;
+        if (snapshot?.revision !== params.expectedRevision || currentStep !== params.step) {
+          return renderResult({
+            ok: false,
+            exitCode: 2,
+            stdout: "",
+            stderr: `confirmed transition is stale or targets a different step (expected revision ${params.expectedRevision}, current revision ${String(snapshot?.revision)}, current step ${String(currentStep)})`,
+          });
+        }
         const feature = snapshot?.snapshot && typeof snapshot.snapshot === "object" ? (snapshot.snapshot as Record<string, unknown>).feature : undefined;
         if (typeof feature === "string" && feature) {
           const evidenceArgs = ["--feature", feature, "--step", params.step, "--write"];

package/src/constants.ts

@@ -1,5 +1,5 @@
 export const PRODUCT_NAME = "Devflow Pi";
-export const PRODUCT_VERSION = "0.1.29";
+export const PRODUCT_VERSION = "0.1.30";
 export const PROJECT_SCHEMA_VERSION = 1;
 export const OMP_RUNTIME_VERSION = "17.2.7";