@stalfh233/omc-cli 0.4.84 → 0.4.86

package/README.md

@@ -130,10 +130,11 @@ omc call discover_environment --env <env> --args '{}'   # 环境就绪（真实
 - **intent**：`partial` 表示该能力可声明式（`omc intent`）覆盖一部分——通常 create/update；
   `none` 表示只走 `omc call`。删除类、方法面、分类/连接池等仍走 `omc call` 逃生舱。
 
-## 近期能力（0.4.74 → 0.4.84）
+## 近期能力（0.4.74 → 0.4.86）
 
 | 版本 | 新增 / 修复 |
 |---|---|
+| 0.4.86 | **r13 真机探针修复**：`omc next` 增加 **composer 路由**（含建模型+字段/审批流/计算/条件规则/表单默认值 → 直接给出对应一条命令；读面仍走 ladder，条件分支流程仍走 recipe）——r13 读了文档里那行 `model-scaffold` 却仍调 26 次 `field.create`，说明「写进文档」不等于「能被发现」。`data.submit` 审批提交**写前校验身份**：非本人在办的待办直接回 `submit-workitem-not-mine`（带待办持有者 + 三条出路），不再让平台回一个 `40005 权限不足`让 agent 猜 |
 | 0.4.84 | **回合数优化（从省字节转向省往返）**：新增 `omc model-scaffold`（一条命令建模型+N 字段+子表+发布+表单，先 dry-run 预检零写入）与 `omc call <tool> --args-list`（同工具 N 次、逐条执行、回汇总）。修三个真 bug：键名提示自相矛盾（`workflow.delete` 两边互指）、`--dry-run` 与真写对 NUMERICAL 判定不一致（两套真相）、`runToolCall` 的 dry-run 被判失败 |
 | 0.4.83 | **r12 真机探针修正（最重要：文档纠错）**：字段计算规则（`datarule` type2）**由服务端在 `data.submit`/`data.update` 时计算并回填，且覆盖传入值**——此前 skills/describe 六处写的「API 不回填、服务端聚合需二开」是错的（旧证据只覆盖 `FORMULA(100)` 字段）。另：`omc compute` 新增 `--where "<子列> = <值>"`（编译 COUNTIF/SUMIF）并**拒绝无条件子表聚合**（`--allow-unfiltered` 显式放行）；`model.delete` 把「孤儿模型」死锁变成一次明确回答——先复查读缓存，仍存在则回 `model-orphaned-record` 并给平台侧出路 |
 | 0.4.82 | **流程发起权限（40009）**：新增 `workflow.permissions` / `workflow.addPermission` / `workflow.removePermission`（`/workflow/list_permission`、`create_permission`、`delete_permission`，unitType 线上为枚举序号 1=部门 2=角色 3=用户）。`data.submit`/`data.save+workflowCode` 的 40009 现在直接回 `workflow-start-permission-denied`：带上该流程的权限行现状、两种成因（无权限行 / 发起人部门记录已失效）与可粘贴的修复命令，不再是「流程发起权限不足」五个字 |

package/dist/batch-call.js

@@ -18,6 +18,7 @@
  * the write lock, the writable gate, the production acknowledgement and every
  * per-tool preflight apply exactly as they do for a single call.
  */
+import { refusalText } from "./cli-contract.js";
 import { runScript } from "./script.js";
 /** Cap mirrors `omc script`: a runaway list should be a refusal, not a 20-min hang. */
 export const BATCH_MAX_ENTRIES = 200;
@@ -70,7 +71,7 @@ export async function runBatchCall(options) {
         index: entry.index,
         status: String(entry.result.status ?? "failed"),
         blocker: entry.result.blocker ?? null,
-        message: typeof entry.result.message === "string" ? entry.result.message : null,
+        message: refusalText(entry.result),
         ...(Array.isArray(entry.result.issues) ? { issues: entry.result.issues } : {}),
     }));
     const executed = entries.length;

package/dist/cli-contract.js

@@ -117,4 +117,24 @@ export function errorEnvelope(error, code, exitCode, request) {
     const message = error instanceof Error ? error.message : String(error);
     return { envelope: envelope("error", {}, request, { code, message, retryable: false }), exitCode };
 }
+/**
+ * The human-readable reason of a refusal. Ordinary refusals carry `message`;
+ * capability-gate refusals (`capability-out-of-coverage`) put the real reason in
+ * `citation.message` and leave `message` absent — reading only `message` made a
+ * batch report `message: null` for the failures that most need explaining
+ * (r13 2026-10-24: NUMERICAL without options.scale).
+ */
+export function refusalText(result) {
+    const direct = typeof result.message === "string" && result.message.length > 0 ? result.message : "";
+    if (direct)
+        return direct;
+    const citation = result.citation && typeof result.citation === "object" ? result.citation : undefined;
+    const cited = typeof citation?.message === "string" ? citation.message : "";
+    if (cited)
+        return cited;
+    const reason = typeof citation?.reason === "string" ? citation.reason : "";
+    if (reason)
+        return reason;
+    return String(result.blocker ?? result.status ?? "failed");
+}
 //# sourceMappingURL=cli-contract.js.map

package/dist/goal-routes.js

@@ -321,7 +321,68 @@ function orderedCapabilities(ids, index) {
  * runtime/exact patches), not a second main path.
  */
 const WHOLE_PACKAGE_CAPABILITIES = ["model", "field", "form", "listview", "datarule", "businessrule", "workflow", "onlinejs"];
-/** A whole-package ask (build OR modify) is a declarative-intent candidate. */
+const COMPOSER_ROUTES = Object.freeze([
+    {
+        id: "model-scaffold",
+        command: "omc model-scaffold --code <模型code> --name <模型名> --fields '<JSON数组>' --apply",
+        usage: "omc model-scaffold --help",
+        summary: "一条命令建模型：模型 → N 字段（subFields 子表+子列）→ 发布字段 → 发布表单；apply 前逐字段 dry-run 预检、零写入",
+        // (build verb) × (model noun) × (field/child-table noun)
+        groups: [["建", "创建", "新建", "搭建", "从零"], ["模型"], ["字段", "子表", "列", "属性", "明细"]],
+        avoid: ["嵌套子表", "子表套子表"],
+        topics: ["omc-business-configuration"],
+    },
+    {
+        id: "approval-flow",
+        command: "omc approval-flow --schema <模型code> --steps '<节点名>@role:<角色code>' --apply",
+        usage: "omc approval-flow --help",
+        summary: "线性审批流一条命令：建流程 → 模板+字段只读权限 → 发布（多级用重复 --steps）",
+        groups: [["审批", "流程"], ["建", "创建", "新建", "配置", "加", "搭"]],
+        // Branching / countersign shapes are NOT this composer's business.
+        avoid: ["条件分支", "分支", "会签", "并行", "或签", "网关", "子流程", "动态审批人"],
+        topics: ["omc-five-piece-flow"],
+    },
+    {
+        id: "compute",
+        command: "omc compute --schema <模型code> --target <目标字段> --formula '<公式>' [--where '<子列> = <值>'] --apply",
+        usage: "omc compute --help",
+        summary: "字段计算规则一条命令（datarule type2）：普通表达式、子表求和、条件计数 COUNTIF/SUMIF；服务端 submit/update 时回填",
+        groups: [["计算", "统计", "汇总", "求和", "聚合", "计数", "合计"], ["字段", "子表", "列", "回主表", "写入"]],
+        avoid: [],
+        topics: ["omc-write-hazards"],
+    },
+    {
+        id: "rule-when",
+        command: "omc rule-when --schema <模型code> --rule <规则code> --when '<条件>' --then '<动作>'",
+        usage: "omc rule-when --help",
+        summary: "条件→动作规则一条命令（BRANCH + 赋值节点拼装），替代手拼 nodeGraph",
+        groups: [["规则", "条件"], ["如果", "当", "满足", "时"], ["更新", "赋值", "改为", "设为", "动作"]],
+        avoid: [],
+        topics: ["omc-business-configuration"],
+    },
+    {
+        id: "form-default",
+        command: "omc form-default --schema <模型code> --field <字段code> --value <值>",
+        usage: "omc form-default --help",
+        summary: "表单字段默认值一条命令（建表单/复用已有表单 + 写默认值），无需手改 options",
+        groups: [["默认值", "默认"], ["表单", "字段"]],
+        avoid: [],
+        topics: ["omc-business-configuration"],
+    },
+]);
+function matchComposer(goal, mode) {
+    // A composer is a WRITE path: reads and scouting asks must keep their ladder.
+    if (mode !== "build" && mode !== "modify")
+        return undefined;
+    for (const composer of COMPOSER_ROUTES) {
+        if (composer.avoid?.some((phrase) => goal.includes(phrase)))
+            continue;
+        if (!composer.groups.every((group) => group.some((cue) => goal.includes(cue))))
+            continue;
+        return composer;
+    }
+    return undefined;
+}
 function isWholePackageWrite(mode, goal, capabilityCount) {
     return (mode === "build" || mode === "modify") && looksWholePackage(goal, capabilityCount);
 }
@@ -400,6 +461,33 @@ export function goalRoute(registry, goal) {
             route: { write: false, readback: false, firstCommands: ["omc capabilities", "omc capability <id>", "omc help omc-capability-scouting"] },
         };
     }
+    // Composer before the capability solver: a recurring write SHAPE has a single
+    // command that does the job with preflight + idempotency, which beats a ladder
+    // of atomic tools even when the ladder also matches (r13: 26 field.create).
+    const composer = matchComposer(goal, mode);
+    if (composer) {
+        const topics = (composer.topics ?? []).filter((topic) => availableTopics.has(topic));
+        return {
+            status: "ok",
+            goal,
+            confident: true,
+            mode,
+            write: true,
+            match: { kind: "composer", ref: composer.id, title: composer.summary, command: composer.command },
+            route: {
+                composer: composer.id,
+                command: composer.command,
+                summary: composer.summary,
+                // The composer IS the first step; readiness still comes first because
+                // the command needs a bound environment to run.
+                firstCommands: [DISCOVERY_AUTHORITY.readiness, composer.command, composer.usage],
+                write: true,
+                readback: true,
+                ...(topics.length > 0 ? { readCommands: topics.map((topic) => `omc help ${topic} --section "<节>"`), readHint: "只在 composer 的 --help 不够用时再读这些 topic 的对应节" } : {}),
+            },
+            ...(topics.length > 0 ? { topics } : {}),
+        };
+    }
     const scores = [...capabilityScores(registry, goal).entries()].sort((left, right) => right[1] - left[1]);
     const fallback = {
         status: "ok",

package/dist/lanes/runtime-data.js

@@ -8,7 +8,7 @@ import { ToolInputError, ToolRefusalError } from "../tool-types.js";
 import { writeTool } from "../write.js";
 import { defineTool } from "../tool-types.js";
 import { wireCall, wireRows, WireError } from "../wire.js";
-import { CHILD_TABLE_PROPERTY_TYPE, runtimeWriteWithAppMapping } from "../runtime-support.js";
+import { CHILD_TABLE_PROPERTY_TYPE, diagnoseApprovalSubmitIdentity, runtimeWriteWithAppMapping } from "../runtime-support.js";
 import { getReplayToken, searchWorkItems, wireString } from "../workflow-support.js";
 import { ENGINE_OWNED_KEYS, RUNTIME_DATA_LANE_CONTRACT, RUNTIME_DATA_WIRE, runtimeFormDataArg, } from "./runtime-data-contract.js";
 import { SYSTEM_FIELD_CODES } from "../field-families.js";
@@ -1083,6 +1083,11 @@ export function registerRuntimeDataLane(tools) {
             payload.runMode = args.runMode;
         if (typeof args.isSimulative === "boolean")
             payload.isSimulative = args.isSimulative;
+        // Approval submits are resolved against the LOGGED-IN user (r13: six
+        // blind 40005s). Name the boundary before the write instead of letting the
+        // platform answer "权限不足", which reads like a misconfiguration.
+        if (hasWorkItem)
+            await diagnoseApprovalSubmitIdentity(session, { workflowInstanceId: args.workflowInstanceId, workItemId: args.workItemId });
         const performed = await runtimeWriteWithAppMapping(session, args.schemaCode, 50000, "data.submit 运行时提交稳定失败（50000）", () => wireCall(session, {
             path: ENDPOINTS.runtimeFormSubmit,
             method: "POST",

package/dist/model-scaffold.js

@@ -18,7 +18,7 @@
  */
 import { argvValue } from "./args.js";
 import { runToolCall } from "./call.js";
-import { CLI_EXIT_CODES, classifyResult, envelope, requestId } from "./cli-contract.js";
+import { CLI_EXIT_CODES, classifyResult, envelope, refusalText, requestId } from "./cli-contract.js";
 import { writeEnvelope } from "./cli-output.js";
 /** Validate the caller's `--fields` payload (fail before any write). */
 export function validateScaffoldFields(fields) {
@@ -294,21 +294,6 @@ export async function cmdModelScaffold(args) {
     writeEnvelope(envelope(classified.status, result, request, classified.error));
     return status === "partial" ? 1 : 0;
 }
-/**
- * A refusal's human text: `message` for ordinary ones, `citation.message` for
- * capability-gate refusals (`capability-out-of-coverage` keeps its reason inside
- * the citation, so the old `message` read produced an empty failure string).
- */
-function refusalText(result) {
-    const direct = typeof result.message === "string" && result.message.length > 0 ? result.message : "";
-    if (direct)
-        return direct;
-    const citation = result.citation && typeof result.citation === "object" ? result.citation : undefined;
-    const cited = typeof citation?.message === "string" ? citation.message : "";
-    if (cited)
-        return cited;
-    return String(result.blocker ?? "failed");
-}
 function describeScaffoldPlan(options) {
     const childTables = options.fields.filter((field) => scaffoldChildrenOf(field).length > 0);
     return {

package/dist/runtime-support.js

@@ -2,6 +2,7 @@ import { wireCall, wireRows, WireError } from "./wire.js";
 import { ENDPOINTS } from "./endpoints.js";
 import { ToolRefusalError } from "./tool-types.js";
 import { resolveModelTreeNode } from "./lanes/model.js";
+import { listInstanceActivities, wireString } from "./workflow-support.js";
 /**
  * Ticket 78 — map the two same-root-cause platform failures of an
  * UNPUBLISHED application to the explicit `app-not-published` blocker:
@@ -222,4 +223,94 @@ async function resolvePublishedWorkflowCodeQuiet(session, schemaCode) {
         return undefined;
     }
 }
+/**
+ * 40005 权限不足 on an APPROVAL submit — the caller is not a participant of the
+ * pending work item.
+ *
+ * r13 (2026-10-24, 1.1.25) could not verify "审批通过" at all: the todo existed,
+ * `workflow.instanceActivity` showed the node active with the right participant,
+ * and `data.submit` with `workItemId` + `agree:true` answered a bare
+ * `40005 权限不足`. Six attempts, plus two round trips spent trying to add an
+ * approval node as a workaround, before a control experiment (clearing the role
+ * membership so the participant fell back to the originator) proved the cause:
+ * **the platform submits as the logged-in user**, and OMC holds exactly one
+ * session, so an approval addressed to anyone else can never be driven from the
+ * CLI.
+ *
+ * This is a capability boundary, not a config defect — but a boundary the CLI
+ * must NAME, because "权限不足" reads like a permission misconfiguration. Fail
+ * open whenever the participant set is unknown (no active activity, empty
+ * participantors, or a read failure): a diagnosis must never invent a refusal.
+ */
+export async function diagnoseApprovalSubmitIdentity(session, args) {
+    const instanceId = typeof args.workflowInstanceId === "string" ? args.workflowInstanceId : "";
+    if (!instanceId)
+        return;
+    let activities;
+    let me;
+    try {
+        activities = await listInstanceActivities(session, instanceId);
+        // `organization/user/info` needs an `id`; resolve "me" from the login
+        // identity (the username the token was issued for) through user/search.
+        const identity = (await session.login()).accountIdentity;
+        me = null;
+        if (identity !== undefined && identity.length > 0) {
+            const searchData = (await wireCall(session, {
+                path: ENDPOINTS.organizationUserSearch,
+                method: "POST",
+                body: { wd: identity, page: 0, size: 20 },
+            })).data;
+            // user/search answers a page envelope ({content:[…]}), not a bare array —
+            // `wireRows` refuses that shape (same decode as `org.user.search`).
+            const found = Array.isArray(searchData?.content) ? searchData.content : wireRows(searchData);
+            const exact = found.find((row) => [row.username, row.userId, row.name].some((value) => String(value ?? "") === identity)) ?? found[0];
+            if (exact) {
+                const id = wireString(exact.id) ?? wireString(exact.userId);
+                if (id)
+                    me = (await wireCall(session, { path: ENDPOINTS.organizationUserInfo, query: { id } })).data;
+                if (!me && exact)
+                    me = exact;
+            }
+        }
+    }
+    catch {
+        return; // Unreadable faces: let the platform answer.
+    }
+    const myId = me ? wireString(me.id) ?? wireString(me.userId) : undefined;
+    if (!myId)
+        return;
+    const myName = me ? wireString(me.name) ?? myId : myId;
+    // Only an activity that currently HOLDS tasks can be submitted against.
+    const active = activities.filter((row) => String(row.status ?? "") === "1");
+    if (active.length === 0)
+        return;
+    const participantIds = (row) => {
+        const list = Array.isArray(row.participantors) ? row.participantors : [];
+        return list.map((person) => wireString(person.id) ?? wireString(person.userId) ?? "").filter((id) => id.length > 0);
+    };
+    const known = active.filter((row) => participantIds(row).length > 0);
+    // Nobody publishes a participant list (auto/service tasks): stay silent.
+    if (known.length === 0)
+        return;
+    if (known.some((row) => participantIds(row).includes(myId)))
+        return;
+    const awaiting = known
+        .map((row) => ({ activityName: wireString(row.activityName) ?? null, activityCode: wireString(row.activityCode) ?? null, participants: participantIds(row) }))
+        .filter((row) => row.participants.length > 0);
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "submit-workitem-not-mine",
+        workflowInstanceId: instanceId,
+        ...(typeof args.workItemId === "string" ? { workItemId: args.workItemId } : {}),
+        currentUser: { id: myId, name: myName },
+        awaiting,
+        message: `当前登录人 ${myName}（${myId}）不是该实例待办节点的参与者，平台会以 **40005 权限不足** 拒绝这次提交。` +
+            `待办持有者：${awaiting.map((row) => `${row.activityName ?? row.activityCode ?? "?"} → ${row.participants.join("/")}`).join("；")}。` +
+            `**这是 OMC 的能力边界**：平台按登录态鉴权，而 OMC 一次只持有一个会话（一份 token 缓存），` +
+            `因此「非发起人身份的审批」无法在 CLI 内推进。可选做法：① 由该参与人自己在门户审批；` +
+            `② 用该参与人的账号另建一个环境（omc env add）再执行同一条 data.submit；` +
+            `③ 若只是为了验证流程能走通，把该节点参与人临时改为发起人（org.role.addUsers / workflow.update），验证后改回。` +
+            `不要重复盲试——同一个 workItemId 会一直回 40005。`,
+    });
+}
 //# sourceMappingURL=runtime-support.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stalfh233/omc-cli",
-  "version": "0.4.84",
+  "version": "0.4.86",
   "description": "CloudPivot 8.6 configuration capability CLI — governed, fail-closed, coverage-manifest bounded.",
   "type": "module",
   "bin": {
@@ -50,9 +50,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@stalfh233/omc-fake-platform": "0.4.84",
+    "@stalfh233/omc-fake-platform": "0.4.86",
     "commander": "14.0.3",
-    "omc-core": "0.4.84",
+    "omc-core": "0.4.86",
     "proper-lockfile": "4.1.2",
     "write-file-atomic": "6.0.0",
     "zod": "^3.23.8",