@stalfh233/omc-cli 0.4.80 → 0.4.81

package/README.md

@@ -130,10 +130,11 @@ omc call discover_environment --env <env> --args '{}'   # 环境就绪（真实
 - **intent**：`partial` 表示该能力可声明式（`omc intent`）覆盖一部分——通常 create/update；
   `none` 表示只走 `omc call`。删除类、方法面、分类/连接池等仍走 `omc call` 逃生舱。
 
-## 近期能力（0.4.74 → 0.4.80）
+## 近期能力（0.4.74 → 0.4.81）
 
 | 版本 | 新增 / 修复 |
 |---|---|
+| 0.4.81 | **r11 真机探针修复**：`rule.save` 对 `AGGREGATION` 规则节点**写前 fail-closed**（平台会存进去、运行时 50000，真实路径是 `omc compute`/datarule type2）；`omc next "统计子表行数"` 路由补 `datarule` 阶梯与 `field-compute-subtable-sum` 配方；`org.user.search` 省略关键字时**按部门树列全员**（平台 `wd` 不支持空串，此前只能枚举 0–9）；`omc artifact get --jq` 无值回键清单（不再 commander 报错）；`usage` 的 `faces` 纳入 `--jq/--summary/--keys/--path-only/--extract`（此前读面投影完全不记账） |
 | 0.4.80 | **省 token 与用量账本**：`omc help <topic>` 默认只回节索引（约 1KB，含每节字节数），`--all` 才读整篇；`omc artifact get` 正文 >8KB 默认只回形状（`--full` 才整包）；`omc usage` 默认只回汇总（`byTool`/`redundancy`/`estimatedTokens`），`--records` 才展开；`omc script` 的**每行工具调用单独记账**（`script-call` + `parentId`）；未绑定环境的目录回落 `$OMC_CONFIG_HOME/usage/<cwd-hash>.jsonl` |
 | 0.4.79 | README 对齐 0.4.79 实际工具面（142 工具 / 16 能力） |
 | 0.4.78 | **按钮 JS 直接读写**：`listview.get --buttonCode/--buttons`、`listview.configure --buttonScripts`、`form.get --buttonScripts`、`form.publish --buttonScripts`，外加 `buttons[].script` 简写 |

package/dist/capability-overview.js

@@ -210,7 +210,14 @@ export const CAPABILITY_CUES = Object.freeze({
     // 日期) because no cue named the VALIDATION intent, so the agent went to the
     // rule graph and concluded "the platform has no today variable" — wrong, and
     // the form designer's 提交校验 (datarule type1/checkType2) is the real face.
+    // r11 (2026-10-24): "统计子表行数聚合 COUNT 写入主表字段" routed to `field`
+    // (it matched 子表+字段) and answered with the "create a child table" recipe,
+    // so the agent hand-built an AGGREGATION rule node — a shape the platform
+    // accepts and then fails at runtime. Row aggregation is a FIELD COMPUTE RULE
+    // (`omc compute` / datarule type2). These compound cues outscore field's
+    // 子表+字段 so the aggregate intent reaches the right ladder.
     datarule: ["字段级规则", "控件规则", "校验规则", "计算拼接", "显示规则", "规则", "type1", "type2", "type3",
+        "统计子表", "子表行数", "子表计数", "子表求和", "子表汇总", "行数统计", "计数写回", "汇总回主表", "求和回主表", "聚合计算",
         "不早于", "不能早于", "不晚于", "不能晚于", "早于今天", "晚于今天", "日期校验", "提交校验", "校验不通过", "必填校验", "正则校验", "重复校验", "长度校验"],
     // NOTE: bare "自动" was a cue (round 10 bug: "自动识别"/"自动发邮件" matched
     // businessrule and routed an UNSUPPORTED ask onto the write ladder). A business

package/dist/cli.js

@@ -1231,8 +1231,13 @@ async function main() {
             console.error(`已清理 ${result.removed} 个读回产物，释放 ${formatBytes(result.freedBytes)}；保留 ${result.kept} 个（${formatBytes(result.keptBytes)}）`);
         commandExitCode = CLI_EXIT_CODES.ok;
     });
-    artifactCommand.command("get <id>").option("--jq <path>").option("--path-only").option("--summary").option("--keys [a,b]").option("--full", "整包返回正文（默认：正文超过 8KB 时只回形状 outline + fetch，按需 --jq/--keys 定向取值）").option("--max-output-bytes <bytes>").action(async (id, options) => {
-        commandExitCode = await withTransport(options, request, (transport) => cmdArtifactGet(id, transport, { ...(options.jq ? { jq: options.jq } : {}), pathOnly: options.pathOnly === true, summary: options.summary === true || options.keys === true, ...(typeof options.keys === "string" ? { keys: options.keys } : {}), full: options.full === true }));
+    artifactCommand.command("get <id>").option("--jq [path]").option("--path-only").option("--summary").option("--keys [a,b]").option("--full", "整包返回正文（默认：正文超过 8KB 时只回形状 outline + fetch，按需 --jq/--keys 定向取值）").option("--max-output-bytes <bytes>").action(async (id, options) => {
+        // A bare `--jq`/`--keys` is a key-inventory request, not a missing argument:
+        // commander's "argument missing" (invalid-input + retry) is a dead end the
+        // caller cannot fix without already knowing the flag takes a value (r11
+        // burned six rounds on `artifact get <id> --jq` before trying `--summary`).
+        const bareJq = options.jq === true;
+        commandExitCode = await withTransport(options, request, (transport) => cmdArtifactGet(id, transport, { ...(typeof options.jq === "string" ? { jq: options.jq } : {}), pathOnly: options.pathOnly === true, summary: options.summary === true || options.keys === true || bareJq, ...(typeof options.keys === "string" ? { keys: options.keys } : {}), full: options.full === true }));
     });
     command.command("bench").option("--live-sample").option("--env <environment>").action(async (options) => { commandExitCode = await cmdBench([...(options.liveSample ? ["--live-sample"] : []), ...(options.env ? ["--env", options.env] : [])]); });
     command.command("commands").option("--json").option("--compact").option("--filter <keyword>").option("--lane <id>").option("--max-output-bytes <bytes>").action(async (options) => { commandExitCode = await withTransport(options, request, (transport) => cmdDiscovery("commands", transport, undefined, { json: options.json === true, compact: options.compact === true, ...(options.filter ? { filter: options.filter } : {}), ...(options.lane ? { lane: options.lane } : {}) })); });

package/dist/lanes/rule-graph.js

@@ -1225,6 +1225,20 @@ export function validateDataAction(action, nodeCode, index) {
     const blockers = [];
     const where = `dataActions[${index}]`;
     const valueType = String(action.ruleValueType ?? "");
+    // 1.2 (r11 2026-10-24, 1.1.25): AGGREGATION on a rule node is a TRAP. The
+    // platform accepts it (save + publish + enable all answer ok) and then throws
+    // at runtime: the aggregate comes back as java.util.ArrayList and the scalar
+    // target field rejects it (DecimalBizField.fillClientContent → 50000 服务异常).
+    // Row aggregation is a FORMULA(100) FIELD feature, not a rule action. The r11
+    // probe burned 6 rule.save + 4 data.submit + 3 docker-log reads before finding
+    // the real path, and the only symptom the CLI ever showed was "服务异常".
+    if (valueType.toUpperCase() === "AGGREGATION")
+        return [{
+                code: "rule-graph-aggregation-is-a-field-feature",
+                nodeCode,
+                key: `dataActions[${index}].ruleValueType`,
+                message: `${nodeCode}: 规则节点不支持 AGGREGATION 赋值——平台会存进去并启用，但运行期聚合结果是集合（ArrayList），标量目标收到集合即 50000「服务异常」（DecimalBizField.fillClientContent）。**子表计数/求和/取最值回主表用字段计算规则**：目标字段建成普通数值字段，然后 \`omc compute --schema <主表> --target <目标字段> --formula 'COUNTIF({<子表code>.<子列code>},"异常")'\`（默认 dry-run，--apply 写入；等价 datarule.create dataRuleType:2，配方 \`field-compute-subtable-sum\`）。规则图里只做 FIXED/DYNAMIC/EXPRESSION 的直接赋值。注意计算由门户前端执行、API data.load 不回填（平台既有行为，见 FIELD_FORMULA_WIRE.runtimeVerification）：要 API 侧断言结果，请在测试数据里显式写预算值，不要用回读判定公式对错。来源：r11 巡检沙盒 2026-10-24（1.1.25）。`,
+            }];
     if (!RULE_VALUE_TYPES.includes(valueType))
         blockers.push({ code: "rule-graph-action-value-type", nodeCode, key: "ruleValueType", message: `${where}: ruleValueType "${valueType}" 不在 ${RULE_VALUE_TYPES.join("/")}` });
     if (typeof action.targetDataItem !== "string" || !action.targetDataItem.trim())

package/dist/lanes/workflow-contract.js

@@ -192,7 +192,7 @@ export const WORKFLOW_LANE_CONTRACT = Object.freeze({
         }),
         "org.user.search": Object.freeze({
             scope: "workflow participant resolution",
-            description: "按关键字搜索用户（`POST /api/api/organization/user/search`，body `{wd,page,size,filterType?}`；`wd` 必填，缺失报 10005 关键字不能为空；**空字符串也被工具参数校验拒绝（`String must contain at least 1 character`），无法用它列全员——列某部门的人请用 `org.department.users`，全量检索没有读面**），返回 {id,name,username,userId,departmentId,corpId,status}。用于把「张三」这类姓名解析成真实用户 id/username 再构造参与者对象（`[{\"code\":\"<username|userId>\",\"corpId\":\"<corpId|other>\",\"id\":\"<userId>\",\"name\":\"<姓名>\",\"type\":3}]`，type 3=用户 / 2=角色 / 多个用 `+` 连接）；角色用 org.role.list、部门用 org.department.list。",
+            description: "按关键字搜索用户（`POST /api/api/organization/user/search`，body `{wd,page,size,filterType?}`，返回 {id,name,username,userId,departmentId,corpId,status}）。平台 `wd` 必填、空串报 10005，所以**省略 wd 时不打 user/search**：工具改为遍历部门树（`organization/department/tree` + `department/list_user`）聚合成全员清单（返回 `keyword:null` 与 `departmentsScanned`；>200 部门会带 `truncated`）。用于把「张三」解析成真实用户 id/username 再构造参与者对象（`[{\"code\":\"<username|userId>\",\"corpId\":\"<corpId|other>\",\"id\":\"<userId>\",\"name\":\"<姓名>\",\"type\":3}]`，type 3=用户 / 2=角色 / 多个用 `+` 连接）；只要某部门的人用 org.department.users，角色用 org.role.list。",
         }),
         "workitem.list": Object.freeze({
             scope: "runtime workflow work-item query",

package/dist/lanes/workflow.js

@@ -2819,9 +2819,9 @@ export function registerWorkflowLane(tools) {
             // `wd` is the platform's own key; `keyword`/`q` are accepted aliases so a
             // caller that reaches for the natural word is not bounced with
             // "wd: Required" (round 10: an agent sent `keyword` and burned a retry).
-            wd: z.string().min(1).optional().describe("搜索关键字（用户姓名或账号用户名）；平台 \"关键字不能为空\" 即缺它。可用 keyword/q 作别名"),
-            keyword: z.string().min(1).optional().describe("`wd` 的别名"),
-            q: z.string().min(1).optional().describe("`wd` 的别名"),
+            wd: z.string().optional().describe("搜索关键字（用户姓名或账号用户名）；**省略则列出全部员工**（工具按部门树聚合，见 description）。可用 keyword/q 作别名"),
+            keyword: z.string().optional().describe("`wd` 的别名"),
+            q: z.string().optional().describe("`wd` 的别名"),
             page: z.number().int().min(0).optional().describe("页号，默认 0"),
             size: z.number().int().min(1).optional().describe("每页条数，默认 100"),
             filterType: z.string().optional().describe("admin=只搜当前应用管理员可见范围（可省）"),
@@ -2829,8 +2829,71 @@ export function registerWorkflowLane(tools) {
         },
         handler: async (ctx, args, self) => {
             const keyword = args.wd ?? args.keyword ?? args.q;
-            if (!keyword)
-                throw new ToolInputError({ status: "error", blocker: "tool-input-invalid", tool: "org.user.search", message: "需要 wd（关键字）；keyword/q 亦可" });
+            // 0.4.81 (r11 2026-10-24): no keyword used to be a hard refusal, and the
+            // platform rejects an empty `wd` (10005), so the r11 probe enumerated
+            // `wd` = 0..9 to discover users — 11 calls, ~16 KB, to learn a roster the
+            // platform can already answer. Omitted keyword now aggregates
+            // `department/list_user` over the department tree (one tool call).
+            if (!keyword) {
+                return governedRead(ctx, self, args, async (session) => {
+                    const orgQuery = { corpId: session.enterpriseId() };
+                    const seenDepartments = new Set();
+                    const order = [];
+                    const pushRows = (rows) => {
+                        for (const row of rows) {
+                            const id = String(row.id ?? "");
+                            if (id === "" || seenDepartments.has(id))
+                                continue;
+                            seenDepartments.add(id);
+                            order.push(id);
+                        }
+                    };
+                    // `/department/tree` answers `{departmentList:[...]}`, not a bare array;
+                    // `wireRows` only understands arrays/page envelopes.
+                    const treeRows = async (deptId) => {
+                        const data = (await wireCall(session, {
+                            path: ENDPOINTS.organizationDepartmentTree,
+                            query: deptId === undefined ? orgQuery : { ...orgQuery, deptIds: deptId },
+                        })).data;
+                        return Array.isArray(data?.departmentList) ? data.departmentList : [];
+                    };
+                    pushRows(await treeRows());
+                    // `deptIds` returns the subtree BELOW that department; walk the roots.
+                    for (const rootId of [...order]) {
+                        if (order.length >= 200)
+                            break;
+                        pushRows(await treeRows(rootId));
+                    }
+                    const seenUsers = new Map();
+                    let departmentsScanned = 0;
+                    for (const deptId of order.slice(0, 200)) {
+                        departmentsScanned += 1;
+                        for (const row of wireRows((await wireCall(session, { path: ENDPOINTS.organizationDepartmentUsers, query: { ...orgQuery, deptId } })).data)) {
+                            const id = String(row.id ?? row.userId ?? "");
+                            if (id === "" || seenUsers.has(id))
+                                continue;
+                            seenUsers.set(id, {
+                                id: row.id ?? row.userId ?? null,
+                                name: row.name ?? null,
+                                username: row.username ?? null,
+                                userId: row.userId ?? null,
+                                departmentId: row.departmentId ?? deptId,
+                                mobile: row.mobile ?? null,
+                            });
+                        }
+                    }
+                    const users = [...seenUsers.values()];
+                    return {
+                        keyword: null,
+                        count: users.length,
+                        total: users.length,
+                        departmentsScanned,
+                        ...(order.length > 200 ? { truncated: true, note: `部门树超过 200 个，只聚合了前 200 个；用 wd 关键字精确检索` } : {}),
+                        users,
+                        hint: "无关键字=列全员（按部门树聚合）。平台 user/search 的 wd 不支持空串（10005），所以这条路径走 department/list_user；只要某部门的人用 org.department.users。",
+                    };
+                });
+            }
             return governedRead(ctx, self, { ...args, wd: keyword }, async (session) => {
                 const body = { wd: keyword, page: args.page ?? 0, size: args.size ?? 100 };
                 if (args.filterType !== undefined)

package/dist/usage-log.js

@@ -222,7 +222,12 @@ function facesOf(argv) {
     // (bounded index vs full catalogue) but `commandOf` drops every flag, so
     // without this they were indistinguishable in the log and byte attribution
     // was ambiguous (round 10).
-    const faces = ["--full", "--compact", "--json", "--schema-only", "--param", "--example", "--section", "--sections", "--out", "--quiet"];
+    // Read projections count as faces too. r11 (2026-10-24) reported `--jq`/`--summary`/
+    // `--keys` usage as 0 because only the `describe`/`call` flags were listed:
+    // `omc artifact get <id> --jq <path>` showed up as a bare `artifact get` with
+    // empty argKeys, so the cost report could not tell a 200 B projection from a
+    // 44 KB pull — precisely the read path these flags exist to make cheap.
+    const faces = ["--full", "--compact", "--json", "--schema-only", "--param", "--example", "--section", "--sections", "--out", "--quiet", "--jq", "--summary", "--keys", "--path-only", "--extract", "--extract-keys", "--records"];
     return faces.filter((face) => argv.includes(face));
 }
 const safeArgumentKeys = new Set(["schemaCode", "propertyCode", "code", "workflowCode", "ruleCode", "sheetCode", "id", "dataRuleType", "propertyType", "published", "handler"]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.80",
+  "version": "0.4.81",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -50,9 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.80",
+    "@stalfh233/omc-fake-platform": "0.4.81",
     "commander": "14.0.3",
-    "omc-core": "0.4.80",
+    "omc-core": "0.4.81",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",

package/skills/omc-requirement-vocabulary.md

@@ -44,8 +44,12 @@ capability's coverage/tools/boundaries from `omc-capabilities`.
 Coverage status and boundaries for every capability (including 权限/子表/聚合/
 上线/内联/OCR) live in **`omc-capabilities`** — its 能力索引 table and
 [边界] section are the authority; read the relevant section there rather than a
-copy here. In particular, **跨模型/子表聚合、汇总、求和是配置能力**（表单「计算」
-FORMULA），不要当二开。
+copy here. In particular, **跨模型/子表聚合、汇总、求和是配置能力**，不要当二开。
+落点是**字段计算规则**：`omc compute --schema <主表> --target <目标字段> --formula 'COUNTIF({<子表code>.<子列code>},"异常")'`
+（等价 `datarule.create` `dataRuleType:2`，配方 `field-compute-subtable-sum` / `field-compute-child-column`）。
+**不要**在规则图（`rule.save`）里用 `ruleValueType:"AGGREGATION"` —— 平台会存进去并启用，运行期聚合结果是集合，
+标量目标收到集合即 50000「服务异常」（r11 巡检沙盒 2026-10-24，1.1.25；OMC 现已写前 fail-closed）。
+计算由门户前端执行、API `data.load` 不回填，属平台既有行为：要断言结果请在测试数据里写预算值。
 
 Cue → capability is a starting point, never a substitute for 定面. A cue that
 could name two faces is resolved by the 定面表 in the parent skill.