@guanlin4924/devflow-pi 0.1.35 → 0.1.37

package/README.md

@@ -11,7 +11,7 @@ Devflow Pi 是一个面向项目研发交付的独立 OMP 产品入口，内置
 安装与启动：
 
 ```bash
-npm install -g @guanlin4924/devflow-pi@0.1.35
+npm install -g @guanlin4924/devflow-pi@0.1.37
 cd /path/to/your-project
 devflow-pi init
 devflow-pi doctor

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guanlin4924/devflow-pi",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "type": "module",
   "description": "Devflow 专项研发 Pi，基于固定版本 OMP Runtime 组装研发状态机、代码智能、设计、实现与质量门禁。",
   "license": "UNLICENSED",

package/plugins/devflow-core/extensions/devflow-core.ts

@@ -1346,11 +1346,25 @@ export default function devflowCore(pi: ExtensionAPI) {
     // transition, and only the already-recorded target may consume a claim.
     const rolloverResult = await runRuby(ctx.cwd, "workflow-orchestrator/scripts/session_rollover.rb", ["inspect", "--json"]);
     const rolloverState = parseJsonResult(rolloverResult);
-    const rollover = rolloverState?.rollover as Record<string, unknown> | undefined;
+    let rollover = rolloverState?.rollover as Record<string, unknown> | undefined;
     const currentSessionId = ctx.sessionManager.getSessionId();
-    if (rolloverState && typeof rolloverState.revision === "number" && rollover?.status === "prepared" && rollover.source_session_id === currentSessionId && typeof rollover.id === "string") {
+    if (
+      rolloverState && typeof rolloverState.revision === "number" && rollover?.status === "claimed" &&
+      rollover.target_session_id !== currentSessionId && typeof rollover.lease_expires_at === "string" &&
+      Date.parse(rollover.lease_expires_at) <= Date.now()
+    ) {
+      const recovered = await runRuby(ctx.cwd, "workflow-orchestrator/scripts/session_rollover.rb", [
+        "recover", "--write", "--json", "--expected-revision", String(rolloverState.revision),
+      ]);
+      if (recovered.ok) {
+        const refreshed = parseJsonResult(await runRuby(ctx.cwd, "workflow-orchestrator/scripts/session_rollover.rb", ["inspect", "--json"]));
+        rollover = refreshed?.rollover as Record<string, unknown> | undefined;
+      }
+    }
+    if (rolloverState && typeof rolloverState.revision === "number" && rollover?.status === "prepared" && typeof rollover.id === "string") {
       const workflow = await inspectWorkflow(ctx.cwd);
-      if (workflow.result.ok && workflow.snapshot) {
+      const expectedStateRevision = typeof rollover.expected_state_revision === "number" ? rollover.expected_state_revision : undefined;
+      if (workflow.result.ok && workflow.snapshot && expectedStateRevision !== undefined && expectedStateRevision + 1 === rolloverState.revision) {
         pendingRollover = { snapshot: workflow.snapshot, preparedRevision: rolloverState.revision, rolloverId: rollover.id };
         await enqueueControlledRolloverRequest(ctx.cwd, rollover.id, currentSessionId);
         ctx.ui.notify("已恢复待完成的受控会话交接；当前回合结束后将继续切换。", "info");
@@ -1380,10 +1394,15 @@ export default function devflowCore(pi: ExtensionAPI) {
     const pending = pendingRollover;
     const targetSessionId = ctx.sessionManager.getSessionId();
     const claimed = await runRuby(ctx.cwd, "workflow-orchestrator/scripts/session_rollover.rb", [
-      "claim", "--write", "--json", "--expected-revision", String(pending.preparedRevision), "--target-session-id", targetSessionId,
+      "claim", "--write", "--json", "--expected-revision", String(pending.preparedRevision), "--target-session-id", targetSessionId, "--lease-seconds", "60",
     ]);
     const claimedPayload = parseJsonResult(claimed);
     if (!claimed.ok || !claimedPayload || typeof claimedPayload.revision !== "number") {
+      if (claimedPayload?.reason === "rollover_lease_active" || claimedPayload?.reason === "handoff_integrity_failure") {
+        pendingRollover = undefined;
+      } else {
+        await enqueueControlledRolloverRequest(ctx.cwd, pending.rolloverId, targetSessionId);
+      }
       ctx.ui.notify(`Devflow 会话交接认领失败；工作流保持冻结：${claimed.stderr || claimed.stdout}`, "error");
       return;
     }
@@ -1391,6 +1410,11 @@ export default function devflowCore(pi: ExtensionAPI) {
       "consume", "--write", "--json", "--expected-revision", String(claimedPayload.revision), "--target-session-id", targetSessionId,
     ]);
     if (!consumed.ok) {
+      if (parseJsonResult(consumed)?.reason === "rollover_transition_failed") {
+        await enqueueControlledRolloverRequest(ctx.cwd, pending.rolloverId, targetSessionId);
+      } else {
+        pendingRollover = undefined;
+      }
       ctx.ui.notify(`Devflow 会话交接消费失败；工作流保持冻结：${consumed.stderr || consumed.stdout}`, "error");
       return;
     }
@@ -1444,6 +1468,30 @@ export default function devflowCore(pi: ExtensionAPI) {
         return { handled: true };
       }
     }
+    // A step transition can succeed before the runtime manages to prepare the
+    // fresh-session handoff. Keep approval useful in this recovery state, but
+    // retry only the handoff; never repeat the already-persisted transition.
+    if (controlState.phase === "blocked" && controlState.label === "会话轮换准备失败" && controlAction === "approve") {
+      const inspected = await inspectWorkflow(ctx.cwd);
+      if (!inspected.result.ok || !inspected.snapshot) {
+        ctx.ui.notify(`会话交接重试失败：${inspected.result.stderr || inspected.result.stdout || "invalid inspector JSON"}`, "error");
+        return { handled: true };
+      }
+      if (inspected.snapshot.action === "workflow_complete") {
+        setControlState(ctx, initialControlState());
+        ctx.ui.notify("工作流已完成。", "info");
+        return { handled: true };
+      }
+      setControlState(ctx, waitingUserState("正在重试干净会话交接"));
+      try {
+        await requestControlledRollover(ctx, inspected.snapshot);
+        ctx.ui.notify("已重新登记会话交接；当前回合结束后将自动切换到下一节点。", "info");
+      } catch (error) {
+        setControlState(ctx, { intent: "workflow-execute", phase: "blocked", label: "会话轮换准备失败" });
+        ctx.ui.notify(`会话交接仍未完成：${String(error)}`, "error");
+      }
+      return { handled: true };
+    }
     if (controlState.phase === "awaiting-approval" || controlState.phase === "waiting-user") {
       if (controlAction === "reject") {
         ctx.ui.notify("已保留当前步骤和产物。请直接说明需要修改的内容；未执行任何推进。", "info");

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/advance_state.rb

@@ -508,14 +508,6 @@ result =
       next_intent_requested = false
       current_revision = Integer(state.fetch("revision", 0))
 
-      if state.dig("rollover", "status") && %w[prepared claimed].include?(state.dig("rollover", "status"))
-        result = fail_result(
-          "session_rollover_in_progress",
-          "rollover" => state["rollover"],
-          "message" => "Workflow transitions are frozen until the controlled session handoff is consumed or explicitly recovered."
-        )
-      end
-
       if result.nil? && !options[:expected_revision].nil? && current_revision != options[:expected_revision]
         result = fail_result(
           "stale_revision",
@@ -556,6 +548,18 @@ result =
         end
       end
 
+      # Cancellation is the explicit, user-confirmed escape hatch for an
+      # interrupted handoff. It must run before the normal rollover freeze;
+      # otherwise a prepared/claimed handoff makes the feature impossible to
+      # abandon and permanently occupies the project.
+      if result.nil? && state.dig("rollover", "status") && %w[prepared claimed].include?(state.dig("rollover", "status"))
+        result = fail_result(
+          "session_rollover_in_progress",
+          "rollover" => state["rollover"],
+          "message" => "Workflow transitions are frozen until the controlled session handoff is consumed or explicitly recovered."
+        )
+      end
+
       if result.nil? && options[:complete_step]
         step_id = options[:complete_step]
         step = step_by_id[step_id]

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/session_rollover.rb

@@ -14,7 +14,8 @@ require "time"
 require "yaml"
 require_relative "control_io"
 
-options = { json: false, write: false }
+DEFAULT_LEASE_SECONDS = 60
+options = { json: false, write: false, lease_seconds: DEFAULT_LEASE_SECONDS }
 parser = OptionParser.new do |opts|
   opts.banner = "Usage: session_rollover.rb prepare|claim|consume|inspect [options]"
   opts.on("--write", "Apply the requested transition") { options[:write] = true }
@@ -23,6 +24,7 @@ parser = OptionParser.new do |opts|
   opts.on("--source-session-id ID", "Source OMP session id") { |v| options[:source_session_id] = v }
   opts.on("--target-session-id ID", "Target OMP session id") { |v| options[:target_session_id] = v }
   opts.on("--reason TEXT", "Auditable rollover reason") { |v| options[:reason] = v }
+  opts.on("--lease-seconds N", Integer, "Claim lease duration") { |v| options[:lease_seconds] = v }
 end
 action = ARGV.shift
 parser.parse!
@@ -52,6 +54,10 @@ def iso_now
   Time.now.utc.iso8601(3)
 end
 
+def lease_expiry(seconds)
+  [[seconds.to_i, 5].max, 3600].min.then { |duration| (Time.now.utc + duration).iso8601(3) }
+end
+
 root = Dir.pwd
 state_path, = DevflowControlIO.resolve_control_path(root, ".planning/STATE.md", :state)
 result = catch(:transition_done) do
@@ -77,7 +83,38 @@ result = catch(:transition_done) do
       result = fail_result("invalid_source_session_id")
       throw :transition_done, result
     end
-    if rollover && %w[prepared claimed].include?(rollover["status"])
+    if rollover && rollover["status"] == "prepared"
+      # Preparing a handoff is retried after an interrupted runtime turn. The
+      # existing prepared handoff is the durable idempotency key; reusing it
+      # is safe only when it belongs to this exact STATE revision and its
+      # content hash still verifies.
+      expected_state_revision = rollover["expected_state_revision"]
+      if expected_state_revision == revision || (expected_state_revision.is_a?(Integer) && expected_state_revision + 1 == revision)
+        existing_path, = DevflowControlIO.resolve_control_path(root, rollover["handoff_path"], :handoff)
+        if File.exist?(existing_path) && Digest::SHA256.hexdigest(File.binread(existing_path)) == rollover["handoff_sha256"]
+          result = { "ok" => true, "written" => false, "reused" => true, "rollover" => rollover, "revision" => revision }
+          throw :transition_done, result
+        end
+        result = fail_result("handoff_integrity_failure", "rollover" => rollover)
+        throw :transition_done, result
+      end
+      if expected_state_revision.is_a?(Integer) && expected_state_revision < revision - 1
+        # The state has moved beyond the revision captured by this prepared
+        # handoff. It is an orphan from an interrupted/retried runtime turn,
+        # not an active lock. Verify its immutable evidence, preserve the
+        # handoff file on disk, and replace the STATE pointer with a handoff
+        # for the current revision.
+        existing_path, = DevflowControlIO.resolve_control_path(root, rollover["handoff_path"], :handoff)
+        unless File.exist?(existing_path) && Digest::SHA256.hexdigest(File.binread(existing_path)) == rollover["handoff_sha256"]
+          result = fail_result("handoff_integrity_failure", "rollover" => rollover)
+          throw :transition_done, result
+        end
+        rollover = nil
+      else
+        result = fail_result("rollover_in_progress", "rollover" => rollover)
+        throw :transition_done, result
+      end
+    elsif rollover && rollover["status"] == "claimed"
       result = fail_result("rollover_in_progress", "rollover" => rollover)
       throw :transition_done, result
     end
@@ -117,6 +154,15 @@ result = catch(:transition_done) do
     end
     result = { "ok" => true, "written" => options[:write], "rollover" => options[:write] ? state["rollover"] : payload.merge("handoff_sha256" => digest), "revision" => options[:write] ? revision + 1 : revision }
   when "claim"
+    if rollover.is_a?(Hash) && %w[claimed consumed].include?(rollover["status"]) && rollover["target_session_id"] == options[:target_session_id]
+      path, = DevflowControlIO.resolve_control_path(root, rollover["handoff_path"], :handoff)
+      if File.exist?(path) && Digest::SHA256.hexdigest(File.binread(path)) == rollover["handoff_sha256"]
+        result = { "ok" => true, "written" => false, "reused" => true, "rollover" => rollover, "revision" => revision }
+        throw :transition_done, result
+      end
+      result = fail_result("handoff_integrity_failure", "rollover" => rollover)
+      throw :transition_done, result
+    end
     unless rollover.is_a?(Hash) && rollover["status"] == "prepared"
       result = fail_result("rollover_not_prepared", "rollover" => rollover)
       throw :transition_done, result
@@ -131,11 +177,51 @@ result = catch(:transition_done) do
       throw :transition_done, result
     end
     if options[:write]
-      rollover["status"] = "claimed"; rollover["target_session_id"] = options[:target_session_id]; rollover["claimed_at"] = iso_now
+      rollover["status"] = "claimed"; rollover["target_session_id"] = options[:target_session_id]; rollover["claimed_at"] = iso_now; rollover["lease_expires_at"] = lease_expiry(options[:lease_seconds])
+      state["rollover"] = rollover; state["revision"] = revision + 1; write_state(state_path, state, raw)
+    end
+    result = { "ok" => true, "written" => options[:write], "rollover" => rollover, "revision" => options[:write] ? revision + 1 : revision }
+  when "renew"
+    unless rollover.is_a?(Hash) && rollover["status"] == "claimed" && valid_session_id?(options[:target_session_id]) && rollover["target_session_id"] == options[:target_session_id]
+      result = fail_result("rollover_not_owned_by_target", "rollover" => rollover)
+      throw :transition_done, result
+    end
+    expiry = rollover["lease_expires_at"]
+    if expiry.is_a?(String) && Time.parse(expiry) <= Time.now.utc
+      result = fail_result("rollover_lease_expired", "rollover" => rollover)
+      throw :transition_done, result
+    end
+    if options[:write]
+      rollover["lease_expires_at"] = lease_expiry(options[:lease_seconds])
+      rollover["last_renewed_at"] = iso_now
+      state["rollover"] = rollover; state["revision"] = revision + 1; write_state(state_path, state, raw)
+    end
+    result = { "ok" => true, "written" => options[:write], "rollover" => rollover, "revision" => options[:write] ? revision + 1 : revision }
+  when "recover"
+    unless rollover.is_a?(Hash) && rollover["status"] == "claimed"
+      result = fail_result("rollover_not_claimed", "rollover" => rollover)
+      throw :transition_done, result
+    end
+    expiry = rollover["lease_expires_at"]
+    if !expiry.is_a?(String) || Time.parse(expiry) > Time.now.utc
+      result = fail_result("rollover_lease_active", "rollover" => rollover)
+      throw :transition_done, result
+    end
+    path, = DevflowControlIO.resolve_control_path(root, rollover["handoff_path"], :handoff)
+    unless File.exist?(path) && Digest::SHA256.hexdigest(File.binread(path)) == rollover["handoff_sha256"]
+      result = fail_result("handoff_integrity_failure", "rollover" => rollover)
+      throw :transition_done, result
+    end
+    if options[:write]
+      rollover["status"] = "prepared"; rollover["target_session_id"] = nil; rollover["claimed_at"] = nil; rollover.delete("lease_expires_at"); rollover.delete("last_renewed_at")
       state["rollover"] = rollover; state["revision"] = revision + 1; write_state(state_path, state, raw)
     end
     result = { "ok" => true, "written" => options[:write], "rollover" => rollover, "revision" => options[:write] ? revision + 1 : revision }
   when "consume"
+    if rollover.is_a?(Hash) && rollover["status"] == "consumed" && rollover["target_session_id"] == options[:target_session_id]
+      result = { "ok" => true, "written" => false, "reused" => true, "rollover" => rollover, "revision" => revision }
+      throw :transition_done, result
+    end
     unless rollover.is_a?(Hash) && rollover["status"] == "claimed" && valid_session_id?(options[:target_session_id]) && rollover["target_session_id"] == options[:target_session_id]
       result = fail_result("rollover_not_owned_by_target", "rollover" => rollover)
       throw :transition_done, result

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/validate_state.rb

@@ -132,7 +132,7 @@ module WorkflowStateValidator
       return
     end
     status = rollover["status"]
-    unless %w[prepared claimed consumed failed].include?(status)
+unless %w[prepared claimed consumed superseded failed].include?(status)
       issues << issue("error", "invalid_rollover_status", "STATE.rollover.status is invalid", status: status)
       return
     end

package/src/constants.ts

@@ -1,5 +1,5 @@
 export const PRODUCT_NAME = "Devflow Pi";
-export const PRODUCT_VERSION = "0.1.35";
+export const PRODUCT_VERSION = "0.1.37";
 export const PROJECT_SCHEMA_VERSION = 1;
 export const OMP_RUNTIME_VERSION = "17.2.7";
 

package/src/runtime.ts

@@ -186,11 +186,17 @@ export async function runInteractiveRuntime(project: ProjectContext, options: Ru
   // authority remains STATE.rollover, which the extension verifies and claims
   // during session_switch before it starts the next workflow turn.
   const consumeControlledRollover = async (): Promise<void> => {
+    if (rolloverConsumptionInFlight) return;
+    rolloverConsumptionInFlight = true;
+    try {
     const requestPath = path.join(project.root, ".planning", "rollover-request.json");
     let request: { schema_version?: number; rollover_id?: string; source_session_id?: string };
+    let originalRequest: string;
     try {
-      request = JSON.parse(await readFile(requestPath, "utf8")) as typeof request;
+      originalRequest = await readFile(requestPath, "utf8");
+      request = JSON.parse(originalRequest) as typeof request;
     } catch {
+      rolloverConsumptionInFlight = false;
       return;
     }
     if (
@@ -201,6 +207,7 @@ export async function runInteractiveRuntime(project: ProjectContext, options: Ru
     ) {
       await rm(requestPath, { force: true });
       mode.showWarning("已忽略无效或陈旧的 Devflow 会话轮换请求；STATE 未被修改。");
+      rolloverConsumptionInFlight = false;
       return;
     }
     // Session creation can briefly be unavailable while the interactive mode
@@ -213,10 +220,39 @@ export async function runInteractiveRuntime(project: ProjectContext, options: Ru
     }
     if (!switched) {
       mode.showWarning("Devflow 会话轮换被运行时取消；当前会话保持不变。请检查控制面状态后重试。");
+      scheduleControlledRolloverRetry();
+      rolloverConsumptionInFlight = false;
       return;
     }
-    await rm(requestPath, { force: true });
+    let requestAfterSwitch = "";
+    try { requestAfterSwitch = await readFile(requestPath, "utf8"); } catch { /* success path normally has no replacement request */ }
+    if (!requestAfterSwitch || requestAfterSwitch === originalRequest) {
+      await rm(requestPath, { force: true });
+    } else {
+      scheduleControlledRolloverRetry();
+    }
+    rolloverConsumptionInFlight = false;
+    } catch (error) {
+      rolloverConsumptionInFlight = false;
+      mode.showWarning(`Devflow 会话轮换运行时异常，将自动重试：${String(error)}`);
+      scheduleControlledRolloverRetry();
+    }
+  };
+  let rolloverConsumptionInFlight = false;
+  let rolloverRetryTimer: ReturnType<typeof setTimeout> | undefined;
+  let rolloverRetryAttempt = 0;
+  const scheduleControlledRolloverRetry = () => {
+    if (rolloverRetryTimer) return;
+    const delay = Math.min(30_000, 1_000 * 2 ** Math.min(rolloverRetryAttempt, 5));
+    rolloverRetryAttempt += 1;
+    rolloverRetryTimer = setTimeout(() => {
+      rolloverRetryTimer = undefined;
+      void consumeControlledRollover();
+    }, delay);
   };
+  // A prepared handoff is a durable runtime request, not something that
+  // should wait for the user to type another command after a restart.
+  await consumeControlledRollover();
   while (true) {
     const input = await mode.getUserInput();
     await omp.submitInteractiveInput(mode, runtime.session, input);