@stalfh233/omc-cli 0.4.102 → 0.5.1

package/dist/approval-token.js

@@ -0,0 +1,102 @@
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+export class ApprovalTokenRejectedError extends Error {
+    reason;
+    constructor(reason) {
+        super(`approval token rejected: ${reason}`);
+        this.reason = reason;
+    }
+}
+function canonical(value) {
+    return JSON.stringify(sort(value));
+}
+function sort(value) {
+    if (Array.isArray(value))
+        return value.map(sort);
+    if (value && typeof value === "object")
+        return Object.fromEntries(Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([k, v]) => [k, sort(v)]));
+    return value;
+}
+export function packageFingerprint(plan) {
+    return createHash("sha256")
+        .update(canonical({
+        environment: plan.environment,
+        environmentFingerprint: plan.environmentFingerprint,
+        actions: plan.actions.map((a) => ({ tool: a.tool, args: sort(a.args) })),
+    }))
+        .digest("hex");
+}
+export class ApprovalTokenService {
+    key;
+    ttlMs;
+    now;
+    used = new Set();
+    constructor(options) {
+        const key = Buffer.from(options.key, "base64");
+        if (key.length !== 32)
+            throw new Error("approval token key must be exactly 32 bytes (base64).");
+        this.key = key;
+        this.ttlMs = options.ttlMs ?? 10 * 60 * 1000;
+        this.now = options.now ?? Date.now;
+    }
+    requestApproval(plan) {
+        const approvalId = randomUUID();
+        const fingerprint = packageFingerprint(plan);
+        const issuedAt = this.now();
+        const expiresAt = issuedAt + this.ttlMs;
+        const payload = canonical({
+            v: 1,
+            approvalId,
+            packageFingerprint: fingerprint,
+            issuedAt,
+            expiresAt,
+        });
+        const sig = createHmac("sha256", this.key).update(payload).digest("base64url");
+        const token = Buffer.from(payload, "utf8").toString("base64url") + "." + sig;
+        return {
+            token,
+            approvalId,
+            packageFingerprint: fingerprint,
+            expiresAt: new Date(expiresAt).toISOString(),
+            ttlSeconds: Math.round(this.ttlMs / 1000),
+            singleUse: true,
+        };
+    }
+    verify(plan, token) {
+        const parts = token.split(".");
+        if (parts.length !== 2 || !parts[0] || !parts[1])
+            throw new ApprovalTokenRejectedError("token-malformed");
+        let payload;
+        try {
+            payload = Buffer.from(parts[0], "base64url").toString("utf8");
+        }
+        catch {
+            throw new ApprovalTokenRejectedError("token-malformed");
+        }
+        let decoded;
+        try {
+            decoded = JSON.parse(payload);
+        }
+        catch {
+            throw new ApprovalTokenRejectedError("token-malformed");
+        }
+        const expectedSig = createHmac("sha256", this.key).update(payload).digest("base64url");
+        if (!timingSafeEqualB64(parts[1], expectedSig))
+            throw new ApprovalTokenRejectedError("token-signature-invalid");
+        if (this.used.has(String(decoded.approvalId)))
+            throw new ApprovalTokenRejectedError("token-already-used");
+        if (Number(decoded.expiresAt) <= this.now())
+            throw new ApprovalTokenRejectedError("token-expired");
+        if (decoded.packageFingerprint !== packageFingerprint(plan))
+            throw new ApprovalTokenRejectedError("package-fingerprint-mismatch");
+        this.used.add(String(decoded.approvalId));
+        return { approvalId: String(decoded.approvalId) };
+    }
+}
+function timingSafeEqualB64(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    return ba.length === bb.length && timingSafeEqual(ba, bb);
+}
+//# sourceMappingURL=approval-token.js.map

package/dist/bench/discovery-cost-eval.js

@@ -128,6 +128,8 @@ async function runScenario(scenario) {
     };
 }
 export async function runDiscoveryCostBaseline() {
+    // r29（2026-10-29）：describe 重复提示读项目 ledger，组合测试顺序会改变它——测量面禁用保证字节确定性。
+    process.env.OMC_DESC_REPEAT_HINT = "0";
     const scenarios = [];
     for (const scenario of SCENARIOS)
         scenarios.push(await runScenario(scenario));

package/dist/bench/fake-http-server.js

@@ -0,0 +1,65 @@
+import { createServer } from "node:http";
+import { FakeCloudPivot } from "../fake/index.js";
+export async function startFakeHttpServer() {
+    const server = createServer();
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address();
+    if (address === null || typeof address === "string") {
+        server.closeAllConnections?.();
+        await new Promise((resolve) => server.close(() => resolve()));
+        throw new Error("fake http server has no listen address");
+    }
+    const url = `http://127.0.0.1:${address.port}`;
+    const fake = new FakeCloudPivot({ version: "8.6.26", baseUrl: url });
+    server.on("request", (request, response) => {
+        const chunks = [];
+        request.on("data", (chunk) => chunks.push(chunk));
+        request.on("end", () => {
+            const target = new URL(request.url ?? "/", url);
+            const query = {};
+            for (const [key, value] of target.searchParams)
+                query[key] = value;
+            const raw = Buffer.concat(chunks);
+            const contentType = request.headers["content-type"] ?? "";
+            const body = raw.length === 0 ? undefined : contentType.includes("json") ? JSON.parse(raw.toString("utf8")) : raw.toString("utf8");
+            const headers = {};
+            for (const [key, value] of Object.entries(request.headers)) {
+                if (typeof value === "string") {
+                    const capitalized = key.replace(/\b\w/g, (c) => c.toUpperCase()).replace(/-(\w)/g, (_m, c) => `-${c.toUpperCase()}`);
+                    headers[capitalized] = value;
+                }
+            }
+            fake
+                .request({
+                path: target.pathname,
+                method: request.method === "POST" ? "POST" : "GET",
+                ...(Object.keys(query).length > 0 ? { query } : {}),
+                ...(body === undefined ? {} : { body }),
+                headers,
+            })
+                .then((result) => {
+                const payload = Buffer.isBuffer(result.body) ? result.body : JSON.stringify(result.body);
+                response.writeHead(result.status, Buffer.isBuffer(result.body) ? undefined : { "Content-Type": "application/json" });
+                response.end(payload);
+            })
+                .catch(() => {
+                response.writeHead(500, { "Content-Type": "application/json" });
+                response.end(JSON.stringify({ errcode: 500, errmsg: "fake transport failure", data: null }));
+            });
+        });
+    });
+    return {
+        fake,
+        url,
+        close: () => new Promise((resolve, reject) => {
+            server.closeAllConnections?.();
+            server.close((error) => (error ? reject(error) : resolve()));
+        }),
+    };
+}
+export function canonicalBusinessCalls(fake) {
+    return JSON.stringify(fake.state.callLog
+        .filter((entry) => !entry.path.startsWith("/user/") && !entry.path.startsWith("/api/public/") && !entry.path.startsWith("/api/api/organization/"))
+        .map((entry) => ({ path: entry.path, method: entry.method, body: entry.body ?? null, query: entry.query && Object.keys(entry.query).length > 0 ? entry.query : null })));
+}
+//# sourceMappingURL=fake-http-server.js.map

package/dist/bench/intent-face-eval.js

@@ -122,24 +122,24 @@ function freshHome(url) {
     writeFileSync(join(home, "credentials"), JSON.stringify({ eval: { username: "tester", password: "eval-face-password" } }));
     return home;
 }
-const LADDER_INTENT = `intentVersion: 1
-models:
-  - code: eval_m1
-    name: 评测建模
-    fields:
-      - code: f_title
-        name: 标题
-        type: SHORT_TEXT
-      - code: f_amount
-        name: 金额
-        type: NUMERICAL
-        options:
-          scale: 3
-      - code: f_when
-        name: 日期
-        type: DATE
-    form:
-      publish: true
+const LADDER_INTENT = `intentVersion: 1
+models:
+  - code: eval_m1
+    name: 评测建模
+    fields:
+      - code: f_title
+        name: 标题
+        type: SHORT_TEXT
+      - code: f_amount
+        name: 金额
+        type: NUMERICAL
+        options:
+          scale: 3
+      - code: f_when
+        name: 日期
+        type: DATE
+    form:
+      publish: true
 `;
 export const INTENT_FACE_TASKS = [
     {
@@ -163,12 +163,12 @@ export const INTENT_FACE_TASKS = [
         id: "rule-backfill-ladder",
         description: "two models via intent + DYNAMIC backfill rule + enable + trigger row + verified target readback (mixed face: intent + escape hatch)",
         async run(agent, server) {
-            const modelsIntent = agent.writeIntent("models.yaml", `intentVersion: 1
-models:
-  - code: eval_rs
-    name: 回填源
-  - code: eval_rt
-    name: 回填目标
+            const modelsIntent = agent.writeIntent("models.yaml", `intentVersion: 1
+models:
+  - code: eval_rs
+    name: 回填源
+  - code: eval_rt
+    name: 回填目标
 `);
             await agent.intentValidate(modelsIntent);
             const { plan, planFile } = await agent.intentPlan(modelsIntent);
@@ -209,27 +209,27 @@ models:
         id: "input-error-recovery",
         description: "bad intent -> validate exit 10 with source location -> fix -> plan/apply -> idempotent re-plan/re-apply with zero duplicate wires",
         async run(agent, server) {
-            const bad = agent.writeIntent("intent.yaml", `intentVersion: 1
-models:
-  - code: eval_idem
-    name: 幂等模型
-    fields:
-      - code: f_bad
-        name: 坏类型
-        type: HOLOGRAM
+            const bad = agent.writeIntent("intent.yaml", `intentVersion: 1
+models:
+  - code: eval_idem
+    name: 幂等模型
+    fields:
+      - code: f_bad
+        name: 坏类型
+        type: HOLOGRAM
 `);
             const rejected = await agent.run(["intent", "validate", bad]);
             ok(rejected.code === 10 && rejected.envelope.error?.code === "invalid-input", `expected invalid-input exit 10, got ${String(rejected.code)}`);
             const first = rejected.envelope.result.errors[0];
             ok(first.code === "intent-field-type-unknown" && typeof first.line === "number", `located error: ${JSON.stringify(first).slice(0, 200)}`);
-            const fixed = agent.writeIntent("intent.yaml", `intentVersion: 1
-models:
-  - code: eval_idem
-    name: 幂等模型
-    fields:
-      - code: f_bad
-        name: 改正的字段
-        type: SHORT_TEXT
+            const fixed = agent.writeIntent("intent.yaml", `intentVersion: 1
+models:
+  - code: eval_idem
+    name: 幂等模型
+    fields:
+      - code: f_bad
+        name: 改正的字段
+        type: SHORT_TEXT
 `);
             const validated = await agent.intentValidate(fixed);
             ok(validated.valid === true, `fixed validate: ${JSON.stringify(validated).slice(0, 200)}`);

package/dist/cli-contract.js

@@ -39,15 +39,52 @@ export function asciiStdout() {
         return true;
     if (override === "0")
         return false;
+    // Do not spawn chcp on POSIX: it costs a process per invocation and can only
+    // ever answer "not a Windows code page here".
+    if (process.platform !== "win32")
+        return false;
     return asciiStdoutFor(process.platform, process.stdout.isTTY === true, activeCodePage());
 }
+/** Escape every non-ASCII code unit to `\uXXXX` (idempotent, JSON-safe). */
+export function escapeNonAscii(text) {
+    return text.replace(/[\u007f-\uffff]/g, (character) => `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/**
+ * Apply the SAME code-page policy to stderr diagnostics.
+ *
+ * stdout was made ASCII-safe years ago, but every human/diagnostic line goes
+ * through `console.error`/`process.stderr.write` as raw UTF-8. Under a legacy
+ * Windows pipe (`omc … 2>&1 | tee log`, `npm test`, an agent capturing output)
+ * that is cp936 vs UTF-8 — the user sees `����` instead of the message. Escaping
+ * the same way as the envelope keeps diagnostics decodable, and a real console
+ * (TTY) is untouched because Node writes UTF-16 through WriteConsoleW there.
+ *
+ * Gated on `asciiStdout()` so `OMC_ASCII_STDOUT=0` (what the test suite sets)
+ * still yields raw UTF-8 for assertions that match Chinese text.
+ */
+let stderrHardened = false;
+export function installCodePageSafeStderr() {
+    if (stderrHardened)
+        return;
+    stderrHardened = true;
+    if (!asciiStdout())
+        return;
+    const original = process.stderr.write.bind(process.stderr);
+    process.stderr.write = ((chunk, encodingOrCb, maybeCb) => {
+        if (typeof chunk !== "string")
+            return original(chunk, encodingOrCb, maybeCb);
+        return original(escapeNonAscii(chunk), encodingOrCb, maybeCb);
+    });
+}
 let cachedCodePage;
 function activeCodePage() {
     if (cachedCodePage !== undefined)
         return cachedCodePage;
     cachedCodePage = null;
     try {
-        const chcp = spawnSync("chcp.com", [], { encoding: "utf8" });
+        // windowsHide: a GUI host (editor task, shortcut) must not flash a console
+        // window for a probe; timeout: never hang a one-shot CLI on chcp.
+        const chcp = spawnSync("chcp.com", [], { encoding: "utf8", windowsHide: true, timeout: 2000 });
         cachedCodePage = /([0-9]{3,5})\s*$/.exec((chcp.stdout || "").trim().split("\n").pop() ?? "")?.[1] ?? null;
     }
     catch {

package/dist/cli-output.js

@@ -82,8 +82,14 @@ function emitAsciiBannerOnce() {
         return;
     asciiBannerEmitted = true;
     // r73 win32 实测：管道 + 非 UTF-8 代码页时输出被 ASCII 转义（\uXXXX），用户视为乱码。
-    // 横幅走 stderr（不进管道、不破坏单信封契约），在痛点时刻给出两个解法。
-    process.stderr.write("[omc] 当前控制台代码页非 UTF-8，中文已 ASCII 转义防乱码。要原样中文：本次调用加 --utf8，或 chcp 65001 后重跑，或设 OMC_ASCII_STDOUT=0。\n");
+    // 横幅走 stderr（不进管道、不破坏单信封契约），在痛点时刻给出解法。
+    // 只有「自动判定」成 ascii 时才提示：调用方显式设了 OMC_ASCII_STDOUT/--utf8
+    // 说明已知情，再提示就是每次调用多两行噪音。
+    // 注意：ascii 模式下 stderr 本身也会被转义，所以横幅必须是纯 ASCII。
+    if (process.env.OMC_ASCII_STDOUT !== undefined)
+        return;
+    process.stderr.write("[omc] non-UTF-8 console code page: non-ASCII is \\u-escaped to survive the pipe. "
+        + "Raw text: add --utf8, or `chcp 65001`, or set OMC_ASCII_STDOUT=0.\n");
 }
 /**
  * Attach a repeat warning to a refusal that repeats the previous one. Refusal

package/dist/cli.js

@@ -15,10 +15,10 @@ import { BATCH_MAX_ENTRIES, runBatchCall } from "./batch-call.js";
 import { cmdModelScaffold } from "./model-scaffold.js";
 import { cmdModelPurge } from "./model-purge.js";
 import { environmentWritable, requiresProductionConfirmation } from "./environment-policy.js";
-import { CLI_EXIT_CODES, classifyResult, envelope, errorEnvelope, refusalText, requestId } from "./cli-contract.js";
+import { CLI_EXIT_CODES, classifyResult, envelope, errorEnvelope, installCodePageSafeStderr, refusalText, requestId } from "./cli-contract.js";
 import { configureOutput, humanSummary, stripOutputFlags, writeEnvelope } from "./cli-output.js";
-import { beginUsage, completeUsage, ensureProjectIgnore, recordUsageOutput, usageReport } from "./usage-log.js";
-import { artifactFetchHint, artifactRoot, boundResult, emitInvalid, emitResult, emitTransportResult, outputBudget, readArtifact, withTransport, } from "./command-transport.js";
+import { beginUsage, completeUsage, currentUsageArgsDigest, ensureProjectIgnore, priorIdenticalSuccess, recordUsageOutput, usageReport } from "./usage-log.js";
+import { artifactFetchHint, artifactRoot, boundResult, emitInvalid, emitResult, emitThrown, emitTransportResult, outputBudget, readArtifact, withTransport, } from "./command-transport.js";
 import { CLI_DEFAULT_OUTPUT_BYTES, assertSafeOutputPath, pruneArtifacts } from "./artifacts.js";
 import { projectJsonPath, projectJsonPathFanout, projectResultExtract } from "./path-projection.js";
 import { basename, join, resolve } from "node:path";
@@ -44,8 +44,11 @@ import { planIntent, readbackIntent, applyIntent, intentWarnings } from "./inten
 import { listSkills, readSkill, readSkillOutline, readSkillSection, searchSkills } from "./skills.js";
 import { parseToolInput, ToolInputError } from "./tool-types.js";
 import { WireError, wireCall } from "./wire.js";
+import { DEFAULT_PULL_CONCURRENCY, GraphIndexAbsentError, GraphPullLockHeldError, MAX_PULL_CONCURRENCY, impactGraph, publishGraphPull, queryGraphReferences, readGraphStatus, searchGraphRules, } from "./graph.js";
 import { ENDPOINTS } from "./endpoints.js";
+import { makeToolContext } from "./context.js";
 import { cmdRollbackList, cmdRollbackPlan, cmdRollbackApply } from "./rollback.js";
+import { SessionManager } from "./session-manager.js";
 async function ask(question) {
     const rl = createInterface({ input: stdin, output: process.stderr });
     try {
@@ -171,6 +174,11 @@ async function cmdDoctor(store, environment, serviceCode) {
         const session = new CloudPivotSession(resolved.name, resolved.profile, credential);
         await session.login();
         steps.push(`登录      ok  企业=${session.enterpriseId()} 管理员=${session.administrator()}`);
+        // A deployment whose system/config `client` blob is absent/unreadable still
+        // logs in (client_secret is optional on 8.x). Say so as a WARN: it used to
+        // abort the login and report env-unreachable on a perfectly usable box.
+        for (const note of session.loginNotes())
+            steps.push(`OAuth 配置  WARN ${note}`);
         const version = session.detectedVersion();
         if (!version) {
             steps.push(`版本      WARN 无版本证据；写入将保守拒绝（fail closed）`);
@@ -879,8 +887,20 @@ function cmdDiscovery(kind, transport, value, options = {}) {
         // second identical read returns an artifact reference instead of the body.
         result = full ? (repeatFullDescribe(value ?? "", full) ?? full) : full;
     }
-    else
+    else {
         result = describeTool(registry, value ?? "");
+        // r28b 账本（2026-10-28）：describe rule.save×11 / form.publish×9——firstCall 教学后
+        // 仍反复全量 describe。同参数近期已 ok 时附降载提示，引导 --param/--example 精准取。
+        // 无项目 ledger（golden/repo 测试/一次性运行）时 priorIdenticalSuccess 返回
+        // undefined，输出保持 byte-stable。
+        if (result) {
+            const digest = currentUsageArgsDigest();
+            const prior = digest === undefined ? undefined : priorIdenticalSuccess(`describe ${String(value ?? "")}`, digest);
+            if (prior !== undefined && prior.count >= 1)
+                result.describeRepeatHint =
+                    `同参数 describe 近期已执行过 ${prior.count + 1} 次（含本次）。在找单个参数：omc describe ${String(value ?? "")} --param <参数名>（几百字节）；找可抄的完整例子：--example <配方id>；都不必重读整面`;
+        }
+    }
     if (!result) {
         // Name the closest candidates so a near-miss tool name does not cost a
         // guess-and-retry call (round-4 dogfood: `form.create` / `data.create` /
@@ -1029,6 +1049,106 @@ async function cmdIntentReadback(file, environment, transport) {
         return read.code;
     return emitResult(await readbackIntent(read.intent, environment), transport);
 }
+/**
+ * ADR-0008 — `omc graph` family: the local derived rule-graph index. A CLI
+ * management face like `intent`/`rollback`: NOT a call tool, not in the tool
+ * registry or `commands --json`. Results are candidate pointers only — plan /
+ * apply / readback keep reading the live baseline.
+ */
+async function cmdGraphPull(environment, concurrency, transport) {
+    const workers = concurrency ?? DEFAULT_PULL_CONCURRENCY;
+    if (!Number.isSafeInteger(workers) || workers < 1 || workers > MAX_PULL_CONCURRENCY)
+        return emitInvalid(transport, { message: `--concurrency 必须是 1–${MAX_PULL_CONCURRENCY} 的整数（平台负载有界；默认 ${DEFAULT_PULL_CONCURRENCY}）` });
+    const context = makeToolContext({ sessions: new SessionManager(new ConfigStore(defaultPaths())) });
+    try {
+        const session = await context.sessions.session(environment);
+        const data = await publishGraphPull(session, workers);
+        const edgesByKind = {};
+        for (const edge of data.edges)
+            edgesByKind[edge.kind] = (edgesByKind[edge.kind] ?? 0) + 1;
+        const gapsByKind = {};
+        for (const gap of data.gaps)
+            gapsByKind[gap.kind] = (gapsByKind[gap.kind] ?? 0) + 1;
+        return emitResult({
+            status: "ok",
+            environment: data.meta.environmentName,
+            applicationCode: data.meta.applicationCode,
+            identityFingerprint: data.meta.identityFingerprint,
+            pulledAtIso: data.meta.pulledAtIso,
+            scope: data.meta.scope,
+            freshness: data.gaps.length === 0 ? "complete" : "partial",
+            scanned: { models: data.scanned.models, rules: data.scanned.rules, datarules: data.scanned.datarules, views: data.scanned.views, ...(data.scanned.parseFailures > 0 ? { parseFailures: data.scanned.parseFailures } : {}) },
+            edges: edgesByKind,
+            ...(data.gaps.length > 0 ? { gaps: { count: data.gaps.length, byKind: gapsByKind } } : {}),
+            dbBytes: data.dbBytes,
+            timings: data.timings,
+            nextCommand: "omc graph references <kind> <code>",
+        }, transport);
+    }
+    catch (error) {
+        if (error instanceof GraphPullLockHeldError)
+            return emitResult({ status: "refused", blocker: "graph-pull-lock-held", message: error.message, nextCommand: "omc graph status" }, transport);
+        if (error instanceof WireError)
+            return emitResult({ status: "uncertain", reason: "wire-transport", message: `graph pull 中断（${error.message}）；索引未发布，重跑 omc graph pull --env <env>` }, transport);
+        return emitThrown(error, transport);
+    }
+}
+function cmdGraphReferences(kind, code, transport) {
+    if (!["service", "model", "field"].includes(kind))
+        return emitInvalid(transport, { message: "kind 必须是 service / model / field（同 rule.references 第一版边界）" });
+    try {
+        const result = queryGraphReferences(kind, code);
+        return emitResult({
+            status: "ok",
+            kind: result.kind,
+            code: result.code,
+            matches: result.matches,
+            index: result.index,
+            ...(result.note !== undefined ? { note: result.note } : {}),
+            ...(result.gapWarning !== undefined ? { gapWarning: result.gapWarning } : {}),
+        }, transport);
+    }
+    catch (error) {
+        if (error instanceof GraphIndexAbsentError)
+            return emitResult({ status: "refused", blocker: "graph-index-absent", message: error.message, nextCommand: "omc graph pull --env <env>" }, transport);
+        return emitThrown(error, transport);
+    }
+}
+function cmdGraphStatus(transport) {
+    try {
+        const status = readGraphStatus();
+        return emitResult({ status: "ok", index: status.index, dbBytes: status.dbBytes, gaps: status.gaps }, transport);
+    }
+    catch (error) {
+        if (error instanceof GraphIndexAbsentError)
+            return emitResult({ status: "refused", blocker: "graph-index-absent", message: error.message, nextCommand: "omc graph pull --env <env>" }, transport);
+        return emitThrown(error, transport);
+    }
+}
+function cmdGraphImpact(kind, code, transport) {
+    if (!["service", "model", "field"].includes(kind))
+        return emitInvalid(transport, { message: "kind 必须是 service / model / field（同 rule.references 第一版边界）" });
+    try {
+        const result = impactGraph(kind, code);
+        return emitResult({ status: "ok", ...result }, transport);
+    }
+    catch (error) {
+        if (error instanceof GraphIndexAbsentError)
+            return emitResult({ status: "refused", blocker: "graph-index-absent", message: error.message, nextCommand: "omc graph pull --env <env>" }, transport);
+        return emitThrown(error, transport);
+    }
+}
+function cmdGraphSearch(term, transport) {
+    try {
+        const result = searchGraphRules(term);
+        return emitResult({ status: "ok", ...result }, transport);
+    }
+    catch (error) {
+        if (error instanceof GraphIndexAbsentError)
+            return emitResult({ status: "refused", blocker: "graph-index-absent", message: error.message, nextCommand: "omc graph pull --env <env>" }, transport);
+        return emitThrown(error, transport);
+    }
+}
 /** Ticket 119 — `omc intent apply <plan-file>`: plan integrity + baseline drift gates, then serial execution through the EXISTING apply_changes machinery. */
 async function cmdIntentApply(planPath, options, transport) {
     return applyIntent(planPath, options, {
@@ -1341,6 +1461,9 @@ function joinSplitFlagValues(raw, flags) {
 }
 async function main() {
     let commandExitCode = 0;
+    // stderr is the diagnostics stream: apply the same Windows code-page policy
+    // as stdout before ANY message is written (banner, doctor, refusals).
+    installCodePageSafeStderr();
     beginUsage(argv);
     const command = new Command();
     const ownPackageVersion = () => {
@@ -1714,6 +1837,25 @@ async function main() {
     intentCommand.command("readback <file>").option("--env <environment>").option("--max-output-bytes <bytes>").action(async (file, options) => {
         commandExitCode = await withTransport(options, request, (transport) => cmdIntentReadback(file, options.env, transport));
     });
+    // ADR-0008: local derived rule-graph index — CLI management face, not a call
+    // tool (so it stays out of `commands --json`/coverage by construction).
+    const graphCommand = command.command("graph").description("本地派生规则图索引（ADR-0008）：pull 全量重建（有界并发）/ references 离线引用 / impact 影响面 / search 规则全文 / status 完整性与新鲜度。候选定位器——不进 baseline/plan/写门禁");
+    graphCommand.command("pull").option("--env <environment>").option("--environment <environment>").option("--concurrency <n>", "并发 wire 读数（1–32，默认 16）：拉取已流水线化，墙钟 ≈ max(模型面,规则面)/并发 × 延迟；过高可能触发平台限流形成缺口").option("--max-output-bytes <bytes>").addHelpText("after", "\n只读远端（model.list → 每模型 rule.list+datarule.list → 每规则 rule.get，统一任务池流水线并发）+ 本地原子重建；不写环境、不占环境写锁。新鲜度随结果回报（complete|partial），查询走 graph references / impact / search。\n").action(async (options) => {
+        const parsed = options.concurrency === undefined ? undefined : Number.parseInt(String(options.concurrency), 10);
+        commandExitCode = await withTransport(options, request, (transport) => cmdGraphPull(options.environment ?? options.env, parsed, transport));
+    });
+    graphCommand.command("references <kind> <code>").option("--max-output-bytes <bytes>").addHelpText("after", "\n离线查询（零 wire）：kind = service|model|field，语义同 rule.references 第一版边界；结果带索引新鲜度与扫描缺口（有缺口时零命中不构成「无引用」证明）。\n").action(async (kind, code, options) => {
+        commandExitCode = await withTransport(options, request, (transport) => cmdGraphReferences(kind, code, transport));
+    });
+    graphCommand.command("impact <kind> <code>").option("--max-output-bytes <bytes>").addHelpText("after", "\n影响面（离线）：跳1=引用该编码的规则（同 references），跳2=这些规则还读写哪些 service/model/field——改前看爆炸半径。截断上限 50 规则×每类 20 码。\n").action(async (kind, code, options) => {
+        commandExitCode = await withTransport(options, request, (transport) => cmdGraphImpact(kind, code, transport));
+    });
+    graphCommand.command("search <term...>").option("--max-output-bytes <bytes>").addHelpText("after", "\n规则全文检索（code+name，FTS5，末词前缀匹配）：找到\"关于 X 的规则\"拿 code，再走 references/impact。中文需给全词或词首（如 报名*）。\n").action(async (term, options) => {
+        commandExitCode = await withTransport(options, request, (transport) => cmdGraphSearch(term.join(" "), transport));
+    });
+    graphCommand.command("status").option("--max-output-bytes <bytes>").action(async (options) => {
+        commandExitCode = await withTransport(options, request, (transport) => cmdGraphStatus(transport));
+    });
     // `--jq` expressions the shell split arrive as several tokens; re-join them.
     await command.parseAsync(joinSplitFlagValues(stripOutputFlags(argv), ["--jq"]));
     return commandExitCode;
@@ -1742,7 +1884,7 @@ main().then((code) => {
     // envelope (or, for `env --json`, their own JSON) and were printing a second
     // empty envelope after it (live 2026-10-23: `omc rollback apply` answered two
     // lines, violating the one-envelope stdout contract).
-    const ownsStdout = ["call", "script", "artifact", "commands", "describe", "contract", "capabilities", "capability", "next", "usage", "intent", "help", "form-default", "compute", "rule-when", "approval-flow", "model-scaffold", "model-purge", "rollback", "env", "--version", "-V"];
+    const ownsStdout = ["call", "script", "artifact", "commands", "describe", "contract", "capabilities", "capability", "next", "usage", "intent", "help", "form-default", "compute", "rule-when", "approval-flow", "model-scaffold", "model-purge", "rollback", "env", "graph", "--version", "-V"];
     if (ownsStdout.includes(argv[2] ?? "")) {
         completeUsage(code);
         finish(code);