@stalfh233/omc-cli 0.4.87 → 0.4.90

package/dist/lanes/workflow.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { ENDPOINTS } from "../endpoints.js";
+import { collectOrgDepartments } from "./org-tree.js";
 import { capabilityArg, environmentArg } from "../args.js";
 import { governedRead } from "../read.js";
 import { ToolRefusalError } from "../tool-types.js";
@@ -732,6 +733,86 @@ function participantReferenceWarnings(template) {
     }
     return warnings;
 }
+/**
+ * Role participants are filtered by `ouScope ∩ originator's department chain`.
+ * A role whose members all have an empty scope therefore resolves to NOBODY —
+ * but the workflow still publishes, the submit still answers 0, and the todo
+ * silently falls back to the originator (r9/r10 live; r15 lost 12 calls to it).
+ * Refuse BEFORE the update wire (read-only check, fail-open when the member
+ * list is unavailable) so the trap is named where the participant is authored.
+ */
+async function assertRoleParticipantScopes(session, body) {
+    const rows = Array.isArray(body.activities)
+        ? body.activities
+        : body.activities && typeof body.activities === "object"
+            ? Object.values(body.activities)
+            : [];
+    const roles = [];
+    for (const activity of rows) {
+        if (String(activity.activityType ?? "") !== "PARTICIPANT")
+            continue;
+        const raw = activity.participant;
+        if (typeof raw !== "string" || !raw.trim().startsWith("["))
+            continue;
+        for (const segment of raw.split("+")) {
+            let parsed;
+            try {
+                parsed = JSON.parse(segment.trim());
+            }
+            catch {
+                continue;
+            }
+            if (!Array.isArray(parsed))
+                continue;
+            for (const entry of parsed) {
+                if (entry === null || typeof entry !== "object")
+                    continue;
+                const record = entry;
+                if (String(record.type ?? record.participantType ?? "") !== "2")
+                    continue;
+                const roleId = String(record.id ?? "");
+                if (roleId)
+                    roles.push({ activityCode: String(activity.activityCode ?? ""), roleId, roleName: String(record.name ?? roleId) });
+            }
+        }
+    }
+    const problems = [];
+    for (const role of roles) {
+        let members;
+        try {
+            const data = (await wireCall(session, {
+                path: ENDPOINTS.organizationRoleUsers,
+                query: { corpId: session.enterpriseId(), roleId: role.roleId, page: "0", size: "500" },
+            })).data;
+            members = Array.isArray(data?.content) ? data.content : wireRows(data);
+        }
+        catch {
+            // A read failure must not block the write (fail open) — the platform
+            // will answer, and the participant warnings still ride the readback.
+            continue;
+        }
+        if (members.length === 0)
+            continue; // nothing to prove
+        const withScope = members.filter((member) => Array.isArray(member.ouScope) && member.ouScope.length > 0);
+        if (withScope.length === 0)
+            problems.push({ ...role, members: members.length });
+    }
+    if (problems.length === 0)
+        return;
+    const detail = problems.map((problem) => `${problem.activityCode} → 角色 ${problem.roleName}(${problem.roleId}) 的 ${problem.members} 名成员 ouScope 全为空`).join("；");
+    const first = problems[0];
+    throw new ToolRefusalError({
+        status: "refused",
+        blocker: "workflow-participant-role-scope-empty",
+        roles: problems,
+        nextCommand: `omc call org.role.users --args '${JSON.stringify({ roleId: first.roleId })}'`,
+        message: `节点参与者用了角色，但该角色成员的 ouScope 为空：${detail}。` +
+            `平台按「ouScope ∩ 发起人部门链」解析角色成员，空范围 = 永远解析不到人；流程仍会发布、submit 仍回 errcode 0，` +
+            `待办会**静默回退给发起人**（r9/r10/r15 真机）。` +
+            `先给成员补管理范围（部门节点）：omc call org.role.setUserScope --args '{"roleId":"${first.roleId}","userId":"<成员recId>","scopes":[{"id":"<部门id>","name":"<部门名>","type":"1"}],"mode":"replace"}'，` +
+            `或在 addUsers 时直接带 scopes。补完再重试本次 workflow.update。`,
+    });
+}
 function isPlatformParticipantReference(participant) {
     if (/^\{[^}]+\}$/.test(participant))
         return true; // {Originator} keyword
@@ -2102,6 +2183,7 @@ export function registerWorkflowLane(tools) {
         await backfillDesignerDefaults(session, args.schemaCode, body, template);
         assertFirstActivityIsOriginator(template, "workflow.update", body);
         validateWorkflowRender(body, "workflow.update");
+        await assertRoleParticipantScopes(session, body);
         // Live: workflow/update does NOT run the template validator — it stores a
         // refused participant silently and only /publish answers the
         // ValidateMessage[]. So the guard belongs on publish/bindRule, not here.
@@ -2553,6 +2635,7 @@ export function registerWorkflowLane(tools) {
                     blocker: "workflow-has-instances",
                     workflowCode: args.code,
                     ...(pending > 0 ? { pendingWorkItems: pending } : {}),
+                    nextCommand: `omc call workitem.list --args '${JSON.stringify({ workflowCode: args.code })}'`,
                     message: `流程 ${args.code} 还有流程实例，平台拒绝删除（402508）。**不要改用 model.delete 绕过**——那会把流程模板级联删掉，` +
                         `留下指向空模板的待办，而平台全局待办搜索会给每条待办解析模板，**一条缺失就整页 NPE（50000），所有用户的待办列表一起坏掉**（r14 实测 8 连击，需维护者清库）。` +
                         `正确顺序：① 先完结/清理实例的待办（workitem.list --workflowCode ${args.code} 看还有哪些在办）；② 再 workflow.delete；③ 最后才 model.delete。`,
@@ -3028,50 +3111,15 @@ export function registerWorkflowLane(tools) {
         lane: WORKFLOW_LANE,
         scope: WORKFLOW_TOOLS["org.department.list"].scope,
         description: WORKFLOW_TOOLS["org.department.list"].description,
-        inputSchema: { environment: environmentArg, parentId: z.string().min(1).optional().describe("只列出该部门下的子树（默认从根递归展开整棵部门树）"), capability: capabilityArg },
+        inputSchema: { environment: environmentArg, parentId: z.string().min(1).optional().describe("只列出该部门及其下属（BFS 展开；默认从根展开整棵部门树）"), capability: capabilityArg },
         handler: async (ctx, args, self) => governedRead(ctx, self, args, async (session) => {
-            // `/department/tree` semantics (live 2026-10-22, 1.1.25): no `deptIds`
-            // → the ROOTS; with `deptIds=<id>` → that department's WHOLE SUBTREE
-            // (not one level). So: roots once, then one subtree call per root.
+            // `/department/tree` semantics (re-verified r15, 1.1.25): no `deptIds`
+            // → ROOTS; `deptIds=<id>` → DIRECT CHILDREN. The old "whole subtree"
+            // reading hid third-level departments (电气组) from this list. The shared
+            // walker does a bounded BFS.
             const requested = args.parentId;
-            const fetchLevel = async (deptId) => {
-                const query = deptId === undefined ? {} : { deptIds: deptId };
-                const data = (await wireCall(session, { path: ENDPOINTS.organizationDepartmentTree, query })).data;
-                return Array.isArray(data?.departmentList) ? data.departmentList : wireRows(data);
-            };
-            const levels = [];
-            const seen = new Set();
-            const push = (rows) => {
-                for (const row of rows) {
-                    const id = String(row.id ?? "");
-                    if (id === "" || seen.has(id))
-                        continue;
-                    seen.add(id);
-                    levels.push(row);
-                }
-            };
-            if (requested === undefined) {
-                push(await fetchLevel(undefined));
-            }
-            else {
-                // `deptIds=<id>` returns the subtree BELOW that department, excluding
-                // it (live 2026-10-22). A caller asking for `parentId` expects that
-                // department itself too, so add it from the authoritative record.
-                try {
-                    const self = (await wireCall(session, { path: ENDPOINTS.organizationDepartmentGet, query: { deptId: requested } })).data;
-                    if (self)
-                        push([self]);
-                }
-                catch {
-                    // an unknown id simply yields an empty list
-                }
-                push(await fetchLevel(requested));
-            }
-            for (const root of levels.filter((row) => String(row.parentId ?? "") === "" || requested !== undefined).map((row) => String(row.id ?? ""))) {
-                if (seen.size >= 500)
-                    break;
-                push(await fetchLevel(root));
-            }
+            const walked = await collectOrgDepartments(session, requested === undefined ? {} : { rootId: requested });
+            const levels = walked.rows;
             const departments = levels.map((dept) => ({
                 id: dept.id ?? null,
                 name: dept.name ?? null,
@@ -3112,33 +3160,10 @@ export function registerWorkflowLane(tools) {
             if (!keyword) {
                 return governedRead(ctx, self, args, async (session) => {
                     const orgQuery = { corpId: session.enterpriseId() };
-                    const seenDepartments = new Set();
-                    const order = [];
-                    const pushRows = (rows) => {
-                        for (const row of rows) {
-                            const id = String(row.id ?? "");
-                            if (id === "" || seenDepartments.has(id))
-                                continue;
-                            seenDepartments.add(id);
-                            order.push(id);
-                        }
-                    };
-                    // `/department/tree` answers `{departmentList:[...]}`, not a bare array;
-                    // `wireRows` only understands arrays/page envelopes.
-                    const treeRows = async (deptId) => {
-                        const data = (await wireCall(session, {
-                            path: ENDPOINTS.organizationDepartmentTree,
-                            query: deptId === undefined ? orgQuery : { ...orgQuery, deptIds: deptId },
-                        })).data;
-                        return Array.isArray(data?.departmentList) ? data.departmentList : [];
-                    };
-                    pushRows(await treeRows());
-                    // `deptIds` returns the subtree BELOW that department; walk the roots.
-                    for (const rootId of [...order]) {
-                        if (order.length >= 200)
-                            break;
-                        pushRows(await treeRows(rootId));
-                    }
+                    // r15: `deptIds` answers DIRECT CHILDREN only, so the earlier
+                    // roots + one-level walk missed users in third-level departments.
+                    const walked = await collectOrgDepartments(session, { limit: 200 });
+                    const order = walked.rows.map((row) => row.id);
                     const seenUsers = new Map();
                     let departmentsScanned = 0;
                     for (const deptId of order.slice(0, 200)) {
@@ -3163,7 +3188,7 @@ export function registerWorkflowLane(tools) {
                         count: users.length,
                         total: users.length,
                         departmentsScanned,
-                        ...(order.length > 200 ? { truncated: true, note: `部门树超过 200 个，只聚合了前 200 个；用 wd 关键字精确检索` } : {}),
+                        ...(walked.truncated || order.length >= 200 ? { truncated: true, note: `部门树超过 200 个，只聚合了前 200 个；用 wd 关键字精确检索` } : {}),
                         users,
                         hint: "无关键字=列全员（按部门树聚合）。平台 user/search 的 wd 不支持空串（10005），所以这条路径走 department/list_user；只要某部门的人用 org.department.users。",
                     };

package/dist/model-purge.js

@@ -0,0 +1,343 @@
+/**
+ * `omc model-purge` — one command erases a model and everything hanging off it.
+ *
+ * Why this exists (the most expensive lesson of rounds 12–14): every "dirty
+ * sandbox" that derailed a probe was MY non-atomic cleanup, not the platform's
+ * fault.
+ *
+ *   r12  deleted a department with SQL → the user cache kept the dead id →
+ *        every `data.submit` answered a phantom 40009
+ *   r12  cleared `h_biz_schema` without `h_app_function` → an orphan model that
+ *        no tool could delete (the platform has no path for it)
+ *   r14  deleted a model that still had instances → the cascade removed the
+ *        workflow template but left `biz_workitem` rows pointing at nothing →
+ *        the platform's GLOBAL todo search NPE'd for everyone (8× 50000)
+ *
+ * The platform's dependency order is real and each violation produces a
+ * different, confusing failure. Encoding the order ONCE — verified by readback
+ * at every step — removes the class of bug instead of the instance.
+ *
+ * Order (dependents first):
+ *   list views → business rules → data rules → workflow instances →
+ *   workflow → model (fields/forms/views cascade)
+ */
+import { argvValue } from "./args.js";
+import { runToolCall } from "./call.js";
+import { CLI_EXIT_CODES, classifyResult, envelope, refusalText, requestId } from "./cli-contract.js";
+import { writeEnvelope } from "./cli-output.js";
+import { ENDPOINTS } from "./endpoints.js";
+import { wireCall, wireRows } from "./wire.js";
+import { SessionManager } from "./session-manager.js";
+import { ConfigStore, defaultPaths } from "./config-store.js";
+async function sessionFor(environment) {
+    const store = new ConfigStore(defaultPaths());
+    const sessions = new SessionManager(store);
+    return sessions.session(environment);
+}
+/**
+ * Read-only discovery: everything the purge would remove, in dependency order.
+ * `session` is injectable so tests can plan against a fake platform; the CLI
+ * passes nothing and gets the environment's real session.
+ */
+export async function planPurge(options, injected) {
+    const session = injected ?? (await sessionFor(options.environment));
+    let modelExists = true;
+    try {
+        const record = (await wireCall(session, { path: ENDPOINTS.modelGet, query: { schemaCode: options.schemaCode } })).data;
+        modelExists = record !== null && record !== undefined;
+    }
+    catch {
+        modelExists = false;
+    }
+    const listViews = [];
+    try {
+        const rows = wireRows((await wireCall(session, { path: ENDPOINTS.listQueryList, query: { schemaCode: options.schemaCode, clientType: "PC" } })).data);
+        for (const row of rows) {
+            const code = String(row.code ?? row.queryCode ?? "");
+            if (code)
+                listViews.push(code);
+        }
+    }
+    catch {
+        // A missing list-view face must not block the plan.
+    }
+    const businessRules = [];
+    try {
+        const rows = wireRows((await wireCall(session, { path: ENDPOINTS.runtimeBusinessRuleListBySchemaCode, query: { schemaCode: options.schemaCode } })).data);
+        for (const row of rows) {
+            // The platform ships seven SYSTEM rules per model (Create/Update/Delete/
+            // Load/GetList/Available/Cancel) flagged `defaultRule:true` on the wire
+            // (`rule.list` projects that as `preset`). They are part of the model and
+            // cascade with it — deleting them first is noise at best, a broken model if
+            // the delete is partial. Only caller-authored rules go first.
+            if (row.defaultRule === true || row.preset === true)
+                continue;
+            const code = String(row.code ?? row.ruleCode ?? "");
+            if (code)
+                businessRules.push(code);
+        }
+    }
+    catch {
+        // ditto
+    }
+    let workflowCode;
+    let instanceCount = 0;
+    let pendingWorkItems = 0;
+    const instanceIds = new Set();
+    try {
+        const template = (await wireCall(session, { path: ENDPOINTS.workflowGetBySchema, query: { schemaCode: options.schemaCode } })).data;
+        const code = template && typeof template.workflowCode === "string" ? template.workflowCode : "";
+        if (code) {
+            workflowCode = code;
+            // `/runtime/workflow/list_instances` ALWAYS sets `currentUserId`, and the
+            // server adds `state != DRAFT` for any non-empty current user
+            // (BizWorkflowinstanceServiceImpl#toSearchListWorkflowInstanceCriterion).
+            // A `data.save {workflowCode}` starter is exactly a DRAFT instance, so the
+            // plain instance list answers 0 while its start work item sits in
+            // `biz_workitem` — the r14 orphan disease. Discover DRAFT instances
+            // through their work items; the instance list still covers the rest.
+            try {
+                const page = (await wireCall(session, {
+                    path: ENDPOINTS.workflowListInstances,
+                    query: { workflowCode: code, page: "0", size: "200" },
+                })).data;
+                const rows = Array.isArray(page?.content) ? page.content : wireRows(page);
+                for (const row of rows) {
+                    const id = String(row.id ?? row.workflowInstanceId ?? "");
+                    if (id)
+                        instanceIds.add(id);
+                }
+                const total = Number(page?.totalElements ?? rows.length);
+                if (Number.isFinite(total) && total > rows.length)
+                    instanceCount = total;
+            }
+            catch {
+                // A missing instance face must not block the plan; work items still do.
+            }
+            // Work items are the authoritative source for open (and DRAFT) instances:
+            // `list_workitems` REQUIRES a status (402504 without one), so ask for each
+            // open state and collect the instance ids it names.
+            for (const status of ["DRAFT", "PENDING", "INPROGRESS", "NOTSTARTED"]) {
+                try {
+                    const wip = (await wireCall(session, {
+                        path: ENDPOINTS.workflowListWorkItems,
+                        query: { workflowCode: code, status, page: "0", size: "200" },
+                    })).data;
+                    const rows = Array.isArray(wip?.content) ? wip.content : wireRows(wip);
+                    for (const row of rows) {
+                        const id = String(row.instanceId ?? row.workflowInstanceId ?? "");
+                        if (id)
+                            instanceIds.add(id);
+                    }
+                    const total = Number(wip?.totalElements ?? 0);
+                    if (Number.isFinite(total))
+                        pendingWorkItems += total;
+                }
+                catch {
+                    // One unreadable status must not hide the others.
+                }
+            }
+            instanceCount = Math.max(instanceCount, instanceIds.size);
+        }
+    }
+    catch {
+        // No workflow is a normal state.
+    }
+    const steps = [];
+    if (instanceCount > 0)
+        steps.push(options.purgeInstances ? `workflow.delete_instance ×${instanceCount}` : `⛔ ${instanceCount} 个流程实例（需 --purge-instances）`);
+    steps.push(`model.delete ${options.schemaCode}（级联带走：${[
+        workflowCode ? `流程 ${workflowCode}` : undefined,
+        listViews.length > 0 ? `${listViews.length} 个列表视图` : undefined,
+        businessRules.length > 0 ? `${businessRules.length} 条自建规则` : undefined,
+        "字段/表单/计算规则",
+    ].filter(Boolean).join("、")}）`);
+    const blockers = [];
+    if (instanceCount > 0 && !options.purgeInstances)
+        blockers.push(`${instanceCount} 个流程实例存在：workflow.delete 会回 402508。` +
+            `**不要直接用 model.delete 绕过**——那会级联删掉流程模板、留下指向空模板的待办，` +
+            `平台全局待办搜索会给每条待办解析模板，一条缺失就整页 NPE（50000，影响所有用户）。` +
+            `加 --purge-instances 让本命令先逐个删实例。`);
+    return {
+        schemaCode: options.schemaCode,
+        modelExists,
+        listViews,
+        businessRules,
+        ...(workflowCode !== undefined ? { workflowCode } : {}),
+        instanceCount,
+        pendingWorkItems,
+        instanceIds: [...instanceIds].slice(0, 50),
+        steps,
+        blockers,
+    };
+}
+/**
+ * Delete the instances a purge must remove. Split out so the r15 case — a stale
+ * instance whose bizObject is gone makes `delete_instance` answer 50000 — is
+ * testable without a live platform. Returns the steps it produced; `failed`
+ * means an instance with OPEN work items could not be removed (the only case
+ * that must stop the cascade).
+ */
+export async function deleteInstancesForPurge(session, workflowCode, instanceIds) {
+    const steps = [];
+    const unremovableInstances = [];
+    let failed = false;
+    if (workflowCode === undefined)
+        return { failed, steps, unremovableInstances };
+    const openWorkItemsFor = async (instanceId) => {
+        let total = 0;
+        for (const status of ["DRAFT", "PENDING", "INPROGRESS", "NOTSTARTED"]) {
+            try {
+                const page = (await wireCall(session, {
+                    path: ENDPOINTS.workflowListWorkItems,
+                    query: { workflowCode, status, page: "0", size: "200" },
+                })).data;
+                const rows = Array.isArray(page?.content) ? page.content : wireRows(page);
+                total += rows.filter((row) => String(row.instanceId ?? row.workflowInstanceId ?? "") === instanceId).length;
+            }
+            catch {
+                return null;
+            }
+        }
+        return total;
+    };
+    for (const id of instanceIds) {
+        if (failed)
+            break;
+        try {
+            const deleted = (await wireCall(session, { path: ENDPOINTS.workflowDeleteInstance, method: "POST", query: { workflowInstanceId: id } })).data;
+            steps.push({ step: `workflow.delete_instance:${id}`, status: deleted === true ? "ok" : "failed", ...(deleted === true ? {} : { detail: { note: "平台返回 false（可能已完结或无权），继续" } }) });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const openItems = await openWorkItemsFor(id);
+            if (openItems === 0) {
+                unremovableInstances.push({ id, reason: "delete_instance 50000 且该实例没有在办待办（平台在业务对象缺失时 NPE）" });
+                steps.push({ step: `workflow.delete_instance:${id}`, status: "skipped", detail: { code: "platform-orphan-instance", message } });
+                continue;
+            }
+            steps.push({ step: `workflow.delete_instance:${id}`, status: "failed", detail: { message, ...(openItems === null ? { openWorkItems: "unknown" } : { openWorkItems: openItems }) } });
+            failed = true;
+        }
+    }
+    return { failed, steps, unremovableInstances };
+}
+export async function cmdModelPurge(args) {
+    const request = requestId();
+    const flag = (name) => argvValue(args, name);
+    const schemaCode = flag("--code") ?? flag("--schema") ?? flag("--schema-code");
+    const environment = flag("--env") ?? flag("--environment");
+    const apply = args.includes("--apply");
+    const purgeInstances = args.includes("--purge-instances");
+    const usage = [
+        "用法：omc model-purge --code <模型code> [--purge-instances] [--env <环境>] [--apply]",
+        "  一条命令按依赖倒序清掉：列表视图 → 自建业务规则 → 流程实例 → 流程 → 模型（字段/表单/计算规则/预置规则随模型级联）。",
+        "  默认 dry-run（只列计划，不写）。--purge-instances 才删流程实例（workflow.delete 遇到实例会 402508）。",
+        "  每步回读确认；某步失败即停并说明已完成到哪一步（幂等，可修好后重跑）。",
+    ].join("\n");
+    const invalid = (message) => {
+        writeEnvelope(envelope("error", {}, request, { code: "invalid-input", message: `${message}\n${usage}`, retryable: false }));
+        return CLI_EXIT_CODES.invalidInput;
+    };
+    if (!schemaCode)
+        return invalid("--code 必填");
+    const options = { schemaCode, apply, purgeInstances, ...(environment !== undefined ? { environment } : {}) };
+    let plan;
+    try {
+        plan = await planPurge(options);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        writeEnvelope(envelope("error", {}, request, { code: "internal", message: `清理计划读取失败：${message}`, retryable: false }));
+        return CLI_EXIT_CODES.internal;
+    }
+    if (!apply) {
+        writeEnvelope(envelope("ok", {
+            status: plan.blockers.length > 0 ? "blocked" : "dry-run",
+            ...plan,
+            ...(plan.blockers.length > 0
+                ? {}
+                : { note: "dry-run 只列计划、不写。--apply 按上面的顺序执行；每步回读确认。" }),
+        }, request));
+        return CLI_EXIT_CODES.ok;
+    }
+    // Refuse rather than do the dangerous half: deleting the model with live
+    // instances is exactly the mistake that poisoned r14's todo search.
+    if (plan.blockers.length > 0) {
+        writeEnvelope(envelope("refused", { status: "refused", blocker: "purge-blocked", ...plan, message: plan.blockers.join(" ") }, request, {
+            code: "policy-refused",
+            message: plan.blockers.join(" "),
+            retryable: false,
+        }));
+        return CLI_EXIT_CODES.policyRefused;
+    }
+    const steps = [];
+    const session = await sessionFor(environment);
+    const call = async (tool, toolArgs) => {
+        const outcome = await runToolCall(tool, { args: toolArgs, requestId: request, ...(environment !== undefined ? { environment } : {}), print: () => undefined });
+        return { ok: outcome.exitCode === 0, result: outcome.result };
+    };
+    const record = (step, ok, detail) => {
+        steps.push({ step, status: ok ? "ok" : "failed", ...(detail ? { detail } : {}) });
+    };
+    // The whole order is TWO steps, and that is the point.
+    //
+    // Round 13/14 tried: views → rules → instances → workflow → model. It
+    // deadlocks. A list view bound to the workflow cannot be deleted (the platform
+    // refuses to remove the LAST visible view, 306103) and the workflow cannot be
+    // deleted while that view binds it (303024) — a cycle no ordering escapes.
+    //
+    // `model.delete` already cascades the template, the views, the fields, the
+    // forms and the rules. The ONLY thing it does not clean is `biz_workitem`,
+    // which is exactly what poisons the global todo search. So: delete the
+    // instances first (that is the dangerous half), then let the model cascade
+    // take everything else.
+    // 1) instances — required before the model goes, or their work items outlive
+    //    their template (the r14 50000). DRAFT instances only surface through
+    //    their work items (r15: list_instances hides DRAFT), so the plan's union
+    //    is authoritative; a stale instance with no open todo is skipped and
+    //    reported instead of deadlocking the purge.
+    const instanceOutcome = await deleteInstancesForPurge(session, plan.workflowCode, plan.instanceIds);
+    steps.push(...instanceOutcome.steps);
+    let failed = instanceOutcome.failed;
+    const unremovableInstances = instanceOutcome.unremovableInstances;
+    // 2) the model — everything else cascades with it.
+    if (!failed) {
+        const outcome = await call("model.delete", { schemaCode });
+        const readback = outcome.result.readback;
+        const absent = readback?.absent === true || outcome.result.performed?.skipped === "already-absent";
+        record(`model.delete:${schemaCode}`, outcome.ok || absent, outcome.ok || absent ? (readback ? { cascades: true, absent: readback.absent ?? null } : undefined) : { message: refusalText(outcome.result) });
+        if (!outcome.ok && !absent)
+            failed = true;
+    }
+    const status = failed ? "partial" : "ok";
+    const result = {
+        status,
+        schemaCode,
+        ...(plan.workflowCode !== undefined ? { workflowCode: plan.workflowCode } : {}),
+        deletedInstances: steps.filter((step) => step.step.startsWith("workflow.delete_instance:") && step.status === "ok").length,
+        ...(unremovableInstances.length > 0 ? { unremovableInstances } : {}),
+        steps,
+        ...(failed
+            ? {
+                nextAction: "fix-and-rerun",
+                message: "在失败的这一步停下（幂等，可修好后重跑同一条命令）。已成功的步骤不会重复破坏。",
+            }
+            : unremovableInstances.length > 0
+                ? {
+                    cleanupWarning: `${unremovableInstances.length} 条停滞实例无法通过平台 REST 删除（delete_instance 50000：业务对象已不存在，平台 NPE）。` +
+                        "它们没有在办待办，所以不会污染全局待办搜索；模型已按其能力级联清理。" +
+                        "残留的 `biz_workflow_instance` 行需要维护者清库（平台不提供强制删除面）；再次用同 code 建流程前先清，否则新实例会继承这些行。",
+                    maintainerAction: `DELETE FROM biz_workflow_instance WHERE id IN (${unremovableInstances.map((item) => `'${item.id}'`).join(", ")});`,
+                }
+                : {
+                    note: "已清理：流程实例逐个删除 → model.delete 级联带走流程模板/列表视图/字段/表单/业务规则。" +
+                        "model.delete 的异步级联约 40-60s，稍后仍能读到模型记录属正常残留，重跑本命令即可（幂等）。" +
+                        "**这就是 r12–r14 三次脏沙盒的根治**：实例先走，就不会留下指向空模板的待办。",
+                }),
+    };
+    const classified = classifyResult(status === "partial" ? { ...result, requested: steps.length, succeeded: steps.filter((step) => step.status !== "failed").length } : result);
+    writeEnvelope(envelope(classified.status, result, request, classified.error));
+    return failed ? 1 : 0;
+}
+//# sourceMappingURL=model-purge.js.map

package/dist/path-projection.js

@@ -53,6 +53,37 @@ export function projectJsonPath(value, path) {
     }
     return { missed: false, value: current };
 }
+export function projectJsonPathFanout(value, path) {
+    const marker = path.indexOf("[]");
+    if (marker < 0) {
+        const projected = projectJsonPath(value, path);
+        return projected.missed
+            ? { values: [], missed: true, ...(projected.at !== undefined ? { at: projected.at } : {}), ...(projected.available !== undefined ? { available: projected.available } : {}), missedEntries: 0 }
+            : { values: [projected.value], missed: false, missedEntries: 0 };
+    }
+    const before = path.slice(0, marker);
+    const after = path.slice(marker + 2).replace(/^[./]+/, "");
+    const base = projectJsonPath(value, before);
+    if (base.missed)
+        return { values: [], missed: true, ...(base.at !== undefined ? { at: base.at } : {}), ...(base.available !== undefined ? { available: base.available } : {}), missedEntries: 0 };
+    if (!Array.isArray(base.value))
+        return { values: [], missed: true, at: before || "$", available: `该层不是数组（是 ${base.value === null ? "null" : typeof base.value}）；[] 只能映射数组，如 items[].fields.planNo`, missedEntries: 0 };
+    const values = [];
+    let missedEntries = 0;
+    for (const entry of base.value) {
+        const projected = projectJsonPathFanout(entry, after);
+        values.push(...projected.values);
+        if (projected.missed)
+            missedEntries += 1;
+    }
+    // Every element missing means the path is wrong for this shape (not a sparse
+    // array) — report the miss so the caller does not read an empty list as data.
+    if (values.length === 0 && missedEntries > 0) {
+        const first = projectJsonPathFanout(base.value[0], after);
+        return { values: [], missed: true, ...(first.at !== undefined ? { at: `${before}[].${first.at}` } : {}), ...(first.available !== undefined ? { available: first.available } : {}), missedEntries };
+    }
+    return { values, missed: false, ...(missedEntries > 0 ? { missedEntries } : { missedEntries: 0 }) };
+}
 /** Collect every value of a repeatable flag (`--extract a --extract b`). */
 function argvValues(args, name) {
     const values = [];
@@ -116,6 +147,15 @@ export function projectResultExtract(result, paths, keysOnly) {
     }
     if (paths.length > 0) {
         out.extract = paths.map((path) => {
+            // `items[].fields.planNo` maps over every row; a plain path stays a single
+            // value (issue 2026-10-25 §8). Both faces share one shape so a caller can
+            // switch between `--extract`/`--jq` without relearning the envelope.
+            if (path.includes("[]")) {
+                const fanout = projectJsonPathFanout(source, path);
+                return fanout.missed
+                    ? { path, content: null, pathMiss: true, missedAt: fanout.at, available: fanout.available, missedEntries: fanout.missedEntries }
+                    : { path, content: fanout.values, mapped: fanout.values.length, ...(fanout.missedEntries > 0 ? { missedEntries: fanout.missedEntries } : {}) };
+            }
             const projected = projectJsonPath(source, path);
             return projected.missed
                 ? { path, content: null, pathMiss: true, missedAt: projected.at, available: projected.available }

package/dist/recipes/businessrule.js

@@ -46,6 +46,9 @@ const ruleGraph = Object.freeze({
 const ruleBranchGraph = Object.freeze({
     id: "business-rule-branch-conditional",
     title: "金额分级：BRANCH 判断 + 两条 UPDATE 分支（真机验证）",
+    // Intent words, so `omc next "创建时如果 X 则赋值 Y 否则 Z"` finds this shape
+    // instead of falling back to a bare ladder (r14 hand-built it by hand).
+    aliases: ["条件赋值", "条件分支", "如果则否则", "大于则", "规则分支", "赋值规则", "if else"],
     status: "requires-prior-readback",
     tool: "rule.save",
     args: {

package/dist/recipes/list-view.js

@@ -21,6 +21,21 @@ const listViewConfigure = Object.freeze({
     refusalRecovery: [
         { code: "listview-columns-unknown-field", action: "字段未发布或名字写错；先 field.create + field.publish 或改引用" },
         { code: "listview-not-found", action: "默认视图应已存在；用 listview.list 确认 code，必要时 listview.create" },
+        // r14 (2026-10-24): the probe spent calls guessing `targetCode` for a custom
+        // button because the recovery list only covered columns and not-found.
+        {
+            code: "form-buttons-invalid",
+            action: "按钮形状不合格。targetCode 的语义按 bindAction 决定：**BUSINESS_RULE → 业务规则 code**（rule.list 的 code，如 Create/Update 或自建规则）；**FLOW → 流程 code**（workflow.get_published 的 workflowCode）；SCRIPT → scriptData（也可用 buttons[].script 简写）；ADD_DATA/FORM → targetModel + targetForm（工具会展开 schemaCodeVal/formListData）。name/code/useLocation/bindAction/operateType 必填。",
+        },
+        {
+            code: "listview-button-target-unresolved",
+            action: "ADD_DATA/FORM 按钮的 targetModel 在应用树里没有节点，或其默认表单未发布。先确认目标模型存在（discover_environment / model.list）且 form.publish 过；只想触发规则/流程时不要用 ADD_DATA，改用 BUSINESS_RULE/FLOW + targetCode。",
+        },
+        {
+            code: "listview-buttons-ambiguous",
+            action: "buttons 与 buttonScripts 不能同时传：整表重配用 buttons；只改脚本用 buttonScripts[{code,script}]。",
+        },
+        { code: "listview-button-absent", action: "该视图没有这个自定义按钮；先用 listview.configure 的 buttons 建（bindAction:SCRIPT），再改脚本。" },
         ...commonRecovery,
     ],
     requiresEnvironmentDerivedIds: false,