@stalfh233/omc-cli 0.4.36 → 0.4.37

package/dist/cli.js

@@ -14,31 +14,21 @@ import { CLI_EXIT_CODES, classifyResult, envelope, errorEnvelope, requestId } fr
 import { configureOutput, humanSummary, stripOutputFlags, writeEnvelope } from "./cli-output.js";
 import { beginUsage, completeUsage, usageReport } from "./usage-log.js";
 import { artifactFetchHint, artifactRoot, boundResult, emitInvalid, emitResult, emitTransportResult, outputBudget, readArtifact, withTransport, } from "./command-transport.js";
-import { CLI_DEFAULT_OUTPUT_BYTES, assertSafeOutputPath, createArtifact } from "./artifacts.js";
-import { jsonBytes, sha256, writeArtifact } from "./support.js";
-import { join, resolve } from "node:path";
-import { writeFileSync } from "node:fs";
+import { CLI_DEFAULT_OUTPUT_BYTES, assertSafeOutputPath } from "./artifacts.js";
+import { resolve } from "node:path";
 import { buildToolRegistry } from "./tools.js";
 import { acquireWriteLock } from "./write-lock.js";
 import { commandIndex, commandInventory, describeContract, describeContractFull, describeContractTool, describeExample, describeParam, describeSchemaOnly, describeTool, describeToolFull } from "./discovery.js";
 import { buildCapabilityOverview, capabilityDetail, compactCapabilities, executableCapabilityBundle, resolveCapabilityId, DISCOVERY_AUTHORITY } from "./capability-overview.js";
 import { goalRoute } from "./goal-routes.js";
 import { absencePointer } from "./capability-absences.js";
-import { intentConfigRoot, readIntentFile, validateIntentText, INTENT_COMPILER_VERSION } from "./intent/cli.js";
+import { intentConfigRoot, readIntentFile, validateIntentText } from "./intent/cli.js";
 import { intentSchemaBlock, intentExample, intentExampleIds } from "./intent/schema.js";
-import { baselineFingerprintOf, readBaseline } from "./intent/baseline.js";
-import { compileIntent } from "./intent/compiler.js";
-import { expectedRuleGraph } from "./intent/capabilities/businessrule.js";
-import { validateRuleNodeGraph, PLATFORM_TRIGGER_RULE_CODES, walkConditionLeaves } from "./lanes/rule-graph.js";
-import { buildPlan, verifyPlan } from "./intent/plan-file.js";
-import { compareWithLive, decodeBaseline } from "./intent/readback.js";
+import { planIntent, readbackIntent, applyIntent, intentWarnings } from "./intent/plan-apply.js";
 import { listSkills, readSkill, readSkillSection } from "./skills.js";
-import { parseToolInput, ToolInputError, ToolRefusalError } from "./tool-types.js";
+import { parseToolInput, ToolInputError } from "./tool-types.js";
 import { WireError, wireCall } from "./wire.js";
 import { ENDPOINTS } from "./endpoints.js";
-import { extractBizObjectPage } from "./lanes/runtime-data.js";
-import { makeToolContext } from "./context.js";
-import { SessionManager } from "./session-manager.js";
 async function ask(question) {
     const rl = createInterface({ input: stdin, output: process.stderr });
     try {
@@ -693,95 +683,49 @@ function intentDigest(intent) {
         ...(intent.reports !== undefined ? { reportCodes: intent.reports.map((report) => report.code) } : {}),
     };
 }
-/**
- * Warning-severity findings the declarative face must not swallow. The rule
- * dry-lint computes warnings (e.g. `rule-graph-cross-model-unverified`: a
- * cross-model UPDATE saves+publishes but was observed to write nothing at
- * runtime — bench50/52/53/55); `validateRuleNodeGraph` is the single source, so
- * this reuses it rather than re-deriving semantics.
- */
-function intentWarnings(intent) {
-    const warnings = [];
-    for (const model of intent.models) {
-        // Field-level data rules of type 3/4/5 (拼接/必填/只读) are PORTAL-FACING, but
-        // the platform stores them as bizdatarule rows and mirrors them only into the
-        // form control's `historyOpt` — while the runtime portal reads the control's
-        // `options`. So a datarule-only required/readonly renders/stays inert in the
-        // portal (live 2026-09-28: bench62 datarule type4 on order_note, published
-        // control had no requiredFormula; the live portal did not require it). The
-        // portal-facing condition must be declared in `fields[].options`.
-        for (const datarule of model.datarules ?? []) {
-            if ([3, 4, 5].includes(datarule.dataRuleType))
-                warnings.push({
-                    resource: `datarule:${model.code}.${datarule.propertyCode}`,
-                    code: "datarule-not-portal-facing",
-                    message: `字段级数据规则 type ${datarule.dataRuleType}（${datarule.dataRuleType === 4 ? "条件必填" : datarule.dataRuleType === 5 ? "条件只读" : "文本拼接"}）不驱动门户表单控件：平台把它存成 bizdatarule、只镜像进控件 historyOpt，而运行时门户读控件 options（真机复核：规则已存但发布控件无该字段、门户不拦）。要让门户生效，把条件写到字段的 options 里（fields[].options.requiredFormula / readonlyCondition / shortTextStitch）——这条路径已真机验证可穿透到发布控件；datarule 只留给服务端字段级引擎（校验/计算）。`,
-                });
-            // Dual-write advisory (dogfood R1): when the SAME field already declares
-            // the portal-facing condition in `fields[].options`, the datarule row is
-            // redundant. Surface it rather than silently writing both.
-            const field = model.fields.find((candidate) => candidate.code === datarule.propertyCode);
-            const fieldOptions = field?.options ?? {};
-            const duplicateKey = datarule.dataRuleType === 4 ? "requiredFormula" : datarule.dataRuleType === 5 ? "readonlyCondition" : undefined;
-            if (duplicateKey !== undefined && fieldOptions[duplicateKey] !== undefined)
-                warnings.push({
-                    resource: `datarule:${model.code}.${datarule.propertyCode}`,
-                    code: "datarule-duplicates-field-options",
-                    message: `字段 ${model.code}.${datarule.propertyCode} 同时在 fields[].options.${duplicateKey} 和 datarules[]（type ${datarule.dataRuleType}）声明了同一条件——门户只读 options，datarule 那条是冗余（服务端字段级引擎用）。若要门户生效保留 options 即可；datarule 仅在需要服务端强制时才必须保留。`,
-                });
+/** Ticket 118 — `omc intent plan <file> --env <env>`: read-only baseline -> compile -> immutable plan. */
+async function cmdIntentPlan(file, environment, planOut, transport) {
+    const read = readIntentOrInvalid(file, transport);
+    if (read.kind === "exit")
+        return read.code;
+    if (planOut !== undefined) {
+        try {
+            assertSafeOutputPath(intentConfigRoot(), planOut, "plan output file");
+        }
+        catch (error) {
+            return emitInvalid(transport, { message: error instanceof Error ? error.message : String(error) });
         }
-        for (const rule of model.rules ?? []) {
-            // Preset trigger rules are platform-managed: their `name` is a platform
-            // default (数据新增/数据更新/…). `rule.save` keeps the stored name for these
-            // codes, so a declared `name` is ignored — say so rather than silently
-            // dropping it (a caller who meant to rename would otherwise be confused).
-            if (PLATFORM_TRIGGER_RULE_CODES.has(rule.code) && rule.nameImplicit !== true)
-                warnings.push({
-                    resource: `rule:${model.code}.${rule.code}`,
-                    code: "rule-preset-name-ignored",
-                    message: `规则 ${rule.code} 是平台预置触发规则，其名称由平台维护（如 Create=数据新增）；声明的 name "${rule.name}" 不会生效（只有自定义规则的名称与节点名可改）——预置行可直接省略 name 以消除本警告；要改显示名请改 nodeGraph/actions 中节点的 nodeName。`,
-                });
-            let graph;
+    }
+    return emitResult(await planIntent(read.intent, environment, planOut), transport);
+}
+/** Ticket 120 — `omc intent readback <file> --env <env>`: decode the live baseline back into intent shape and verify equivalence. */
+async function cmdIntentReadback(file, environment, transport) {
+    const read = readIntentOrInvalid(file, transport);
+    if (read.kind === "exit")
+        return read.code;
+    return emitResult(await readbackIntent(read.intent, environment), transport);
+}
+/** Ticket 119 — `omc intent apply <plan-file>`: plan integrity + baseline drift gates, then serial execution through the EXISTING apply_changes machinery. */
+async function cmdIntentApply(planPath, options, transport) {
+    return applyIntent(planPath, options, {
+        emit: (result) => emitResult(result, transport),
+        invalid: (blocker, message, code = "invalid-input") => emitInvalid(transport, { message, blocker, code }),
+        readIntent: (file) => {
+            let outcome;
             try {
-                graph = expectedRuleGraph(rule, model.code);
+                outcome = validateIntentText(readIntentFile(intentConfigRoot(), file));
             }
             catch {
-                continue; // shape errors are surfaced by validate/plan already
+                return { kind: "exit", code: CLI_EXIT_CODES.invalidInput };
             }
-            // Round 16 (bench66): `filter` LOCATES the rows to update, so a same-model
-            // action whose filter uses only non-unique fields updates EVERY matching
-            // row, not just the submitted one. bench66 produced status=中额 for a
-            // 120000 order because the ladder's overlapping amount-filters each matched
-            // the one row and the last one won — and a real table would have had its
-            // other rows clobbered. Keep bulk expressible (warn, don't gate) but name
-            // both fixes: locate self with `filter: [{field:id, from:id}]`, or gate the
-            // action with `when:` (an execution-gate `dataCondition`).
-            for (const node of graph.nodes ?? []) {
-                if (String(node.nodeType ?? "") !== "UPDATE")
-                    continue;
-                const target = String(node.targetObjectCode ?? "");
-                const sameModel = target === model.code || target.startsWith(`${model.code}.`);
-                if (!sameModel)
-                    continue;
-                const leaves = [];
-                walkConditionLeaves(node.filterCondition, (leaf) => leaves.push(leaf));
-                if (leaves.length === 0)
-                    continue; // no filter = default self-identity, safe
-                if (leaves.some((leaf) => String(leaf.targetSchemaDataItem) === "id"))
-                    continue;
-                warnings.push({
-                    resource: `rule:${model.code}.${rule.code}`,
-                    code: "rule-locator-not-unique",
-                    message: `规则 ${rule.code} 的 UPDATE 节点定位条件（filterCondition）未用唯一键 id：filter 是「定位要更新哪些行」，用非唯一字段（如金额/状态）会命中并更新**多条**记录（真机 bench66：金额分级误配导致多行互相覆盖）。只更新当前这条用 filter: [{field: id, from: id}]（省略 filter 时同模型动作已默认按自身 id 定位）；「输入数据满足条件才执行该节点」是执行门，用 when: [{field: <字段>, gt: <值>}]（编译到 dataCondition），与 filter 是两码事。确属批量更新可忽略本告警。`,
-                });
+            if (!outcome.valid || outcome.intent === undefined) {
+                for (const error of outcome.errors)
+                    console.error(`intent ${file}:${error.line}:${error.column} [${error.code}] ${error.message}`);
+                return { kind: "exit", code: CLI_EXIT_CODES.invalidInput };
             }
-            for (const finding of validateRuleNodeGraph(graph, rule.code, model.code)) {
-                if (finding.severity === "warning")
-                    warnings.push({ resource: `rule:${model.code}.${rule.code}`, code: finding.code, message: finding.message });
-            }
-        }
-    }
-    return warnings;
+            return { kind: "ok", intent: outcome.intent };
+        },
+    });
 }
 /** Ticket 117 — `omc intent validate <file>`: offline, zero environment contact. */
 function cmdIntentValidate(file, transport, showIntent = false) {
@@ -808,486 +752,6 @@ function cmdIntentSchema(transport, example, exampleRequested) {
     }
     return emitResult(intentSchemaBlock(), transport);
 }
-/** Context-cost guard: an inline plan whose JSON exceeds this (or whose decoded baseline does) is externalized to a file (see cmdIntentPlan). A populated environment's baseline is ~53 KB; a rich greenfield intent's plan is ~20 KB — both charged on every later turn. */
-const INTENT_PLAN_INLINE_CEILING_BYTES = 16384;
-/** Ticket 118 — `omc intent plan <file> --env <env>`: read-only baseline -> compile -> immutable plan. */
-async function cmdIntentPlan(file, environment, planOut, transport) {
-    const read = readIntentOrInvalid(file, transport);
-    if (read.kind === "exit")
-        return read.code;
-    const intent = read.intent;
-    // Validate the optional plan output path BEFORE any environment contact, so a
-    // bad path is a clean invalid-input (exit 10), never a wire attempt.
-    let outPath;
-    if (planOut !== undefined) {
-        try {
-            outPath = assertSafeOutputPath(intentConfigRoot(), planOut, "plan output file");
-        }
-        catch (error) {
-            return emitInvalid(transport, { message: error instanceof Error ? error.message : String(error) });
-        }
-    }
-    let result;
-    try {
-        const context = makeToolContext({ sessions: new SessionManager(new ConfigStore(defaultPaths())) });
-        const session = await context.sessions.session(environment);
-        const baseline = await readBaseline(session, intent);
-        const compiled = compileIntent(intent, baseline);
-        const plan = buildPlan({
-            environment: session.environmentName,
-            environmentFingerprint: session.environmentFingerprint(),
-            compiler: INTENT_COMPILER_VERSION,
-            baseline,
-            intent,
-            compiled,
-        });
-        const planJson = JSON.stringify(plan, null, 2) + "\n";
-        const artifact = createArtifact(artifactRoot(), planJson);
-        const warnings = intentWarnings(intent);
-        // r39: a destructive plan that deletes a model carrying runtime data got
-        // ZERO warning — the approval object must surface the blast radius. One
-        // cheap total-only query per declared-absent model (never blocks the plan:
-        // an unreadable runtime face just means no count to show).
-        for (const model of intent.models) {
-            if (model.absent !== true)
-                continue;
-            try {
-                const query = await wireCall(session, { path: ENDPOINTS.runtimeQueryList, method: "POST", body: { schemaCode: model.code, queryCode: model.code, filters: [], mobile: false, page: 0, size: 1, queryVersion: 1, showTotal: true } });
-                const total = extractBizObjectPage(query.data).total;
-                if (total > 0)
-                    warnings.push({ resource: `model:${model.code}`, code: "destructive-with-data", message: `模型 ${model.code} 含 ${total} 条运行数据，absent:true 删除将一并销毁（不可恢复）——确认后再 apply` });
-            }
-            catch {
-                // 运行面不可读（模型/视图未就绪等）= 无法计数，不阻塞 plan
-            }
-        }
-        const toolCounts = new Map();
-        for (const change of compiled.changes)
-            toolCounts.set(change.tool, (toolCounts.get(change.tool) ?? 0) + 1);
-        const changeSummary = [...toolCounts.entries()].map(([tool, count]) => ({ tool, count }));
-        const changePhrase = changeSummary.map(({ tool, count }) => (count > 1 ? `${tool}×${count}` : tool)).join("、") || "无";
-        console.error(`intent plan ${plan.planHash.slice(0, 12)}：${compiled.changes.length} 项变更（${changePhrase}），${compiled.skipped.length} 项已达标跳过，风险=${compiled.riskClass}；环境=${plan.environment}`);
-        if (planOut !== undefined) {
-            // Lean route (2026-09-27): the plan is the immutable approval object and
-            // its full JSON is ~11 KB for a real requirement — inlining it charges the
-            // agent's window on every later turn. Write the byte-identical plan to a
-            // file inside the config root (so `intent apply` can read it) and return
-            // only the decision fields + the path.
-            writeFileSync(outPath, planJson, { encoding: "utf8", mode: 0o600 });
-            result = {
-                status: "ok",
-                planId: plan.planHash.slice(0, 12),
-                planHash: plan.planHash,
-                // Echo the caller's own path string: an absolute host path would be
-                // redacted by the envelope, and the caller already knows the name.
-                planFile: planOut,
-                changesCount: compiled.changes.length,
-                skippedCount: compiled.skipped.length,
-                riskClass: compiled.riskClass,
-                changeSummary,
-                planArtifactId: artifact.artifactId,
-                planArtifactSha256: artifact.sha256,
-                ...(warnings.length > 0 ? { warnings } : {}),
-                nextAction: `omc intent apply ${planOut}`,
-            };
-        }
-        else {
-            // Context-cost guard (round 15): a populated environment's decoded
-            // baseline makes the inline plan 50–60 KB, and a rich greenfield intent's
-            // plan is ~20 KB — either is the single largest payload any read face
-            // emits, charged on every later turn. Above the ceiling, externalize the
-            // (byte-identical) immutable plan to the config root, which `intent apply`
-            // can read, and return only decision fields + the path. Small plans stay
-            // inline (deterministic on size).
-            const baselineBytes = jsonBytes(baseline);
-            const overCeiling = planJson.length > INTENT_PLAN_INLINE_CEILING_BYTES || baselineBytes > INTENT_PLAN_INLINE_CEILING_BYTES;
-            // If the config root is not writable, fall back to the inline plan (the
-            // pre-existing behaviour) rather than turning a read-only cwd into a
-            // failure.
-            let externalized = false;
-            let planFileName = "";
-            if (overCeiling) {
-                planFileName = `intent-plan-${plan.planHash.slice(0, 12)}.json`;
-                try {
-                    writeFileSync(join(intentConfigRoot(), planFileName), planJson, { encoding: "utf8", mode: 0o600 });
-                    externalized = true;
-                }
-                catch {
-                    externalized = false;
-                }
-            }
-            if (externalized) {
-                result = {
-                    status: "ok",
-                    planId: plan.planHash.slice(0, 12),
-                    planHash: plan.planHash,
-                    planFile: planFileName,
-                    changesCount: compiled.changes.length,
-                    skippedCount: compiled.skipped.length,
-                    riskClass: compiled.riskClass,
-                    changeSummary,
-                    planArtifactId: artifact.artifactId,
-                    planArtifactSha256: artifact.sha256,
-                    planExternalized: true,
-                    ...(warnings.length > 0 ? { warnings } : {}),
-                    note: `plan ${planJson.length}B（基线 ${baselineBytes}B）超过内联上限 ${INTENT_PLAN_INLINE_CEILING_BYTES}B，未内联，已写入 ${planFileName}；直接 ${"`omc intent apply " + planFileName + "`"}`,
-                    nextAction: `omc intent apply ${planFileName}`,
-                };
-            }
-            else {
-                result = {
-                    status: "ok",
-                    planId: plan.planHash.slice(0, 12),
-                    planHash: plan.planHash,
-                    changesCount: compiled.changes.length,
-                    skippedCount: compiled.skipped.length,
-                    riskClass: compiled.riskClass,
-                    plan,
-                    planArtifactId: artifact.artifactId,
-                    planArtifactSha256: artifact.sha256,
-                    ...(warnings.length > 0 ? { warnings } : {}),
-                };
-            }
-        }
-    }
-    catch (error) {
-        if (error instanceof ToolRefusalError)
-            result = error.payload;
-        else if (error instanceof WireError)
-            result = { status: "refused", blocker: `wire-${error.kind}`, errcode: error.errcode, message: error.message };
-        else
-            result = { status: "error", message: error instanceof Error ? error.message : String(error) };
-    }
-    return emitResult(result, transport);
-}
-/**
- * Spec 107 readback core: decode the authoritative live baseline back into
- * intent shape and compare it to the source intent. Shared by `intent readback`
- * (equivalent:false is a legitimate not-yet-applied state, exit 0) and, since
- * ticket 123, by `intent apply` as the final confirmation step, where a
- * mismatch must not be reported as plain success.
- */
-async function verifyIntentLive(session, intent) {
-    const baseline = await readBaseline(session, intent);
-    const live = decodeBaseline(baseline, intent);
-    const report = compareWithLive(intent, live);
-    return {
-        environment: session.environmentName,
-        environmentFingerprint: session.environmentFingerprint(),
-        baselineFingerprint: baselineFingerprintOf(baseline),
-        equivalent: report.equivalent,
-        differences: report.differences,
-        ignoredOutsideIntent: report.ignoredOutsideIntent,
-        live,
-    };
-}
-/**
- * Route the decoded `live` blob to an artifact once it exceeds the inline
- * ceiling, keeping only the decision fields (equivalent / differences /
- * counts). Real requirements decode to tens of KB: round 9 (sandbox 43) an
- * `intent readback` was 62 KB × ~10 calls because it inlined the full live
- * state, and the agent redirected each to a file to avoid the context cost.
- * Same diet as governedRead's full ceiling (src/read.ts) and the same
- * reachability guarantee: the blob stays fully available via the artifact.
- */
-const INTENT_LIVE_INLINE_CEILING_BYTES = 8192;
-/**
- * Context-cost (round 15): `ignoredOutsideIntent` lists every resource outside
- * the intent (ownership-ignored, never a difference). A real model carries ~40
- * system fields, so a 3-model intent reported 212 entries = ~5.7 KB of pure
- * noise on every readback — twice per task. Inline a bounded sample plus the
- * true count; the list is informational, so nothing decision-making is lost.
- */
-const INTENT_IGNORED_INLINE_LIMIT = 20;
-function capIgnoredOutsideIntent(verification) {
-    const ignored = verification.ignoredOutsideIntent;
-    if (!Array.isArray(ignored) || ignored.length <= INTENT_IGNORED_INLINE_LIMIT)
-        return {};
-    return {
-        ignoredOutsideIntent: ignored.slice(0, INTENT_IGNORED_INLINE_LIMIT),
-        ignoredOutsideIntentCount: ignored.length,
-        ignoredOutsideIntentHint: `意图外资源共 ${ignored.length} 项（按所有权忽略，不是差异）；此处只内联前 ${INTENT_IGNORED_INLINE_LIMIT} 项`,
-    };
-}
-function dietIntentLive(verification, context) {
-    const capped = capIgnoredOutsideIntent(verification);
-    const live = verification.live;
-    if (live === undefined)
-        return { ...verification, ...capped };
-    const bytes = jsonBytes(live);
-    if (bytes <= INTENT_LIVE_INLINE_CEILING_BYTES)
-        return { ...verification, ...capped };
-    const { live: _omitted, ...rest } = verification;
-    const ref = writeArtifact(context, `intent-live-${sha256(JSON.stringify(live)).slice(0, 16)}.json`, live);
-    return {
-        ...rest,
-        ...capped,
-        liveOmitted: true,
-        liveBytes: bytes,
-        liveArtifactHint: `权威 live 状态 ${bytes}B 超过内联上限 ${INTENT_LIVE_INLINE_CEILING_BYTES}B，已外置；上面的 equivalent/differences 已是决策所需，需要原生状态用 \`omc artifact get <detailArtifactId>\`（可 --jq <path>）定向取回`,
-        detailFile: ref.detailFile,
-        detailSha256: ref.detailSha256,
-    };
-}
-/**
- * Ticket 120 — `omc intent readback <file> --env <env>`: decode the live
- * baseline back into intent shape and verify equivalence. equivalent:false
- * stays exit 0 — it is a legitimate not-yet-applied state the agent decides
- * on (re-plan is the repair path).
- */
-async function cmdIntentReadback(file, environment, transport) {
-    const read = readIntentOrInvalid(file, transport);
-    if (read.kind === "exit")
-        return read.code;
-    const intent = read.intent;
-    let result;
-    try {
-        const context = makeToolContext({ sessions: new SessionManager(new ConfigStore(defaultPaths())) });
-        const session = await context.sessions.session(environment);
-        const verification = dietIntentLive(await verifyIntentLive(session, intent), context);
-        const equivalent = verification.equivalent === true;
-        const ignoredCount = Number(verification.ignoredOutsideIntentCount ?? verification.ignoredOutsideIntent?.length ?? 0);
-        console.error(`intent readback：${equivalent ? "等价 ✓" : `${verification.differences.length} 项差异`}${ignoredCount > 0 ? `（意图外资源 ${ignoredCount} 项按所有权忽略）` : ""}`);
-        result = { status: "ok", ...verification };
-    }
-    catch (error) {
-        if (error instanceof ToolRefusalError)
-            result = error.payload;
-        else if (error instanceof WireError)
-            result = { status: "refused", blocker: `wire-${error.kind}`, errcode: error.errcode, message: error.message };
-        else
-            result = { status: "error", message: error instanceof Error ? error.message : String(error) };
-    }
-    return emitResult(result, transport);
-}
-/**
- * Ticket 119 — `omc intent apply <plan-file>`: plan integrity + baseline
- * drift gates, then serial execution through the EXISTING apply_changes
- * machinery (one master approval, per-step readback, first-failure stop).
- * No write logic is forked here — the compiled changes drive the same
- * governed pipeline `omc call` uses.
- */
-async function cmdIntentApply(planPath, options, transport) {
-    const emit = (result) => emitResult(result, transport);
-    const invalid = (blocker, message, code = "invalid-input") => emitInvalid(transport, { message, blocker, code });
-    let planText;
-    try {
-        planText = readIntentFile(intentConfigRoot(), planPath);
-    }
-    catch (fileError) {
-        // The plan for a large intent is externalized: `intent plan` returns
-        // `planFile` AND an artifactId. Callers read the id in the result and try
-        // `intent apply <artifactId>`, which used to fail with a bare "intent file
-        // does not exist" (bench40). Accept the artifact id directly, and otherwise
-        // name both recovery paths.
-        try {
-            planText = readArtifact(artifactRoot(), planPath).content.toString("utf8");
-        }
-        catch {
-            const hint = planPath.endsWith(".json") || planPath.includes("/") || planPath.includes("\\")
-                ? "plan 文件不存在或不在配置根内；plan 产物里有 planFile/artifactId 两种引用，直接给 planFile 或 artifactId 均可"
-                : `plan 找不到 "${planPath}"。大 plan 会外置——用 intent plan 结果里的 planFile 路径或 artifactId（可直接 \`omc intent apply <artifactId>\`）；小 plan 内联在 result.plan，先落成 .json 再传入`;
-            return invalid(undefined, `${hint}（原错误：${fileError instanceof Error ? fileError.message : String(fileError)}）`);
-        }
-    }
-    let parsed;
-    let autoPlanned = false;
-    try {
-        parsed = JSON.parse(planText);
-    }
-    catch (error) {
-        // r17 finding (two delegated agents, same wall): `intent apply <file>` read
-        // as "apply this intent file", but only a compiled plan JSON was accepted —
-        // each agent paid a help round-trip to discover plan --plan-out. Accept the
-        // SOURCE intent YAML directly: compile it in-process (same pipeline as
-        // `intent plan`) and apply the resulting plan.
-        const read = readIntentOrInvalid(planPath, transport);
-        if (read.kind !== "exit") {
-            try {
-                const context = makeToolContext({ sessions: new SessionManager(new ConfigStore(defaultPaths())) });
-                const session = await context.sessions.session(options.env);
-                const baseline = await readBaseline(session, read.intent);
-                const compiled = compileIntent(read.intent, baseline);
-                parsed = buildPlan({
-                    environment: session.environmentName,
-                    environmentFingerprint: session.environmentFingerprint(),
-                    compiler: INTENT_COMPILER_VERSION,
-                    baseline,
-                    intent: read.intent,
-                    compiled,
-                });
-                autoPlanned = true;
-            }
-            catch (planError) {
-                return invalid(undefined, `文件既不是合法 plan JSON，也不能编译为意图计划：${planError instanceof Error ? planError.message : String(planError)}（若想先看计划再应用：intent plan <yaml> --env <env> --plan-out <plan.json>）`);
-            }
-        }
-        else {
-            return invalid(undefined, `plan 文件不是合法 JSON：${error instanceof Error ? error.message : String(error)}；意图 YAML 请先 intent plan <yaml> --plan-out <plan.json>，或直接 intent apply <yaml> --env <env>（自动编译）`);
-        }
-    }
-    const verified = verifyPlan(parsed);
-    if (!verified.ok)
-        return invalid(verified.code, verified.reason);
-    const plan = verified.plan;
-    const planId = plan.planHash.slice(0, 12);
-    if (options.env !== undefined && options.env !== plan.environment)
-        return invalid("intent-plan-environment-mismatch", `--env ${options.env} 与 plan 环境不一致（plan 属于 ${plan.environment}；plan 是不可变审批对象，不跨环境迁移）`);
-    if (options.dryRun === true) {
-        const toolCounts = new Map();
-        for (const change of plan.changes)
-            toolCounts.set(change.tool, (toolCounts.get(change.tool) ?? 0) + 1);
-        // r25 finding: this hint taught `intent apply <planId>` — apply only
-        // accepts a plan FILE / JSON / the source YAML (planId is a hash for
-        // reference, not an apply input). Point at the real re-entry.
-        console.error(`intent apply <意图.yaml> --env ${plan.environment} --dry-run：${plan.changes.length} 项变更预览，零环境写入（apply 收文件/YAML，不收 planId）`);
-        return emit({
-            status: "dry-run",
-            wouldChange: plan.changes.length > 0,
-            planId,
-            changes: plan.changes,
-            skippedCount: plan.skipped.length,
-            riskClass: plan.riskClass,
-            preview: [...toolCounts.entries()].map(([tool, count]) => (count > 1 ? `${tool}×${count}` : tool)).join("、") || "无变更",
-        });
-    }
-    // The whole apply holds the same cross-process write lock `omc call`
-    // acquires per write — one writer per environment across every face.
-    const lock = await acquireWriteLock(plan.environment);
-    if (!lock.held) {
-        const conflict = {
-            status: "refused",
-            blocker: "write-lock-held",
-            environment: plan.environment,
-            owner: lock.owner,
-            recovery: lock.recovery,
-            message: lock.recovery[0],
-        };
-        console.error(`write lock conflict: ${JSON.stringify(lock.owner)}`);
-        return emit(conflict);
-    }
-    try {
-        const context = makeToolContext({ sessions: new SessionManager(new ConfigStore(defaultPaths())) });
-        const session = await context.sessions.session(plan.environment);
-        if (session.environmentFingerprint() !== plan.environmentFingerprint)
-            return emit({
-                status: "refused",
-                blocker: "intent-plan-environment-mismatch",
-                environment: session.environmentName,
-                message: "环境指纹与 plan 不一致——plan 不跨环境迁移；在目标环境重新 intent plan",
-            });
-        // Baseline drift gate (CONTEXT.md Configuration baseline): a fingerprint
-        // change after planning invalidates the plan and requires replanning.
-        const currentBaseline = await readBaseline(session, plan.intent);
-        if (baselineFingerprintOf(currentBaseline) !== plan.baselineFingerprint)
-            return emit({
-                status: "refused",
-                blocker: "intent-baseline-drifted",
-                environment: session.environmentName,
-                message: "plan 之后环境已变化（baseline fingerprint 不一致）——按配置基线契约，写入前必须重新 intent plan；绝不盲用过期 plan",
-            });
-        // Ticket 123 — the final confirmation: after the writes (or on an
-        // already-converged no-op) decode the authoritative live state back into
-        // intent shape and compare. A mismatch is NEVER reported as plain success
-        // (blocker intent-readback-mismatch + refusal exit); it means delivery is
-        // incomplete or drifted and the agent must re-plan, not retry blindly.
-        const confirmReadback = async (base) => {
-            if (options.verify === false)
-                return autoPlanned ? { ...base, plannedFrom: "intent-yaml" } : base;
-            let verification;
-            // r39: a destructive (absent:true) delete tears the model down in
-            // stages — fields/views drop first, the model shell lags a moment. An
-            // immediate readback then reports a phantom mismatch. Retry the live
-            // verification briefly (bounded) before declaring failure.
-            const declaresAbsence = plan.intent.models.some((model) => model.absent === true);
-            const attempts = declaresAbsence ? 3 : 1;
-            for (let attempt = 1;; attempt++) {
-                try {
-                    const report = await verifyIntentLive(session, plan.intent);
-                    verification = { ...dietIntentLive(report, context), status: report.equivalent === true ? "ok" : "verification-failed" };
-                }
-                catch (error) {
-                    verification = { status: "error", equivalent: false, error: error instanceof Error ? error.message : String(error) };
-                }
-                if (verification.equivalent === true || attempt >= attempts)
-                    break;
-                console.error(`intent apply ${planId}：删除后读回暂不等价（第 ${attempt}/${attempts} 次）——疑似删除传播中，${attempt === attempts - 1 ? "最后" : "1s"}后再核`);
-                await new Promise((resolve) => setTimeout(resolve, 1000));
-            }
-            if (verification.equivalent === true) {
-                console.error(`intent apply ${planId}：最终读回等价 ✓（意图 ${plan.intent.models.length} 个模型）`);
-                return { ...base, verification, ...(autoPlanned ? { plannedFrom: "intent-yaml" } : {}) };
-            }
-            console.error(`intent apply ${planId}：最终读回不等价——${Array.isArray(verification.differences) ? `${verification.differences.length} 项差异` : String(verification.error ?? "读回失败")}；不得当作成功`);
-            return {
-                ...base,
-                status: "refused",
-                blocker: "intent-readback-mismatch",
-                verification,
-                ...(declaresAbsence
-                    ? {
-                        note: "本变更含 absent:true 删除：平台删除分阶段传播（字段/视图先撤、模型壳后撤），已做 3 次间隔读回仍不等价——先用 model.inspect 的 modelPresent 独立复核再判定；若 modelPresent:false 则删除实际已生效",
-                    }
-                    : {}),
-                message: "变更已执行，但最终权威读回与意图不等价：交付可能不完整或环境已漂移。按 differences 定位后重新 intent plan（不要盲重试）",
-                nextAction: "inspect verification.differences, then re-run intent plan against the live baseline",
-            };
-        };
-        if (plan.changes.length === 0) {
-            console.error(`intent apply ${planId}：零变更（环境已达标），无审批无写入`);
-            return emit(await confirmReadback({ status: "ok", planId, intentHash: plan.intentHash, applied: 0, skipped: plan.skipped, message: "环境已达标：零变更零审批" }));
-        }
-        const registry = buildToolRegistry();
-        const applyChanges = registry.find((definition) => definition.name === "apply_changes");
-        if (!applyChanges)
-            return emit({ status: "error", message: "apply_changes 工具不可用" });
-        const changes = plan.changes.map((change) => ({ tool: change.tool, args: change.args }));
-        const toolCounts = new Map();
-        for (const change of changes)
-            toolCounts.set(change.tool, (toolCounts.get(change.tool) ?? 0) + 1);
-        const summary = `intent apply ${planId}：${changes.length} 项变更（${[...toolCounts.entries()].map(([tool, count]) => (count > 1 ? `${tool}×${count}` : tool)).join("、")}）`;
-        let result;
-        try {
-            result = (await applyChanges.handler(context, parseToolInput(applyChanges, {
-                changes,
-                environment: plan.environment,
-                summary,
-                ...(options.confirmProduction === true ? { confirmProduction: true } : {}),
-            }), applyChanges));
-        }
-        catch (error) {
-            if (error instanceof ToolInputError)
-                result = error.payload;
-            else if (error instanceof ToolRefusalError)
-                result = error.payload;
-            else if (error instanceof WireError)
-                result = { status: "refused", blocker: `wire-${error.kind}`, errcode: error.errcode, message: error.message };
-            else
-                result = { status: "error", message: error instanceof Error ? error.message : String(error) };
-        }
-        if (result.blocker === "production-confirmation-required")
-            console.error(`intent apply ${planId}：目标环境是生产环境——确认这是高危操作后，用 --confirm-production 重跑 apply（一次确认覆盖全部 ${changes.length} 步）`);
-        else
-            console.error(`intent apply ${planId}：${String(result.status)}（${changes.length} 项变更）`);
-        const applied = Array.isArray(result.steps) ? result.steps.length : undefined;
-        // Context-cost (round 15): the intent ladder's per-step `performed`/`readback`
-        // is redundant with the final intent readback-equivalence (the authority), and
-        // for a complex model it is ~17 KB of the envelope (listview columns, field
-        // publishCodes, datarule rows). Emit the step IDENTITY only; the full per-step
-        // bodies stay in the package/progress artifact (result.readback.progressFile).
-        const steps = Array.isArray(result.steps)
-            ? result.steps.map((step) => ({ step: step.step, index: step.index, status: step.status }))
-            : result.steps;
-        const delivered = { ...result, steps, planId, intentHash: plan.intentHash, ...(applied !== undefined && result.status === "ok" ? { applied } : {}) };
-        // Only a genuinely delivered package earns the final readback; a partial /
-        // refused / uncertain outcome already reports its own status and must not
-        // be papered over by a second read.
-        return emit(result.status === "ok" ? await confirmReadback(delivered) : delivered);
-    }
-    finally {
-        await lock.release();
-    }
-}
 /**
  * Ticket 122 — `omc help [topic]`: the methodology layer, reachable exactly
  * like `git help <concept>`. The command list is the "what"; these topics are