@stalfh233/omc-cli 0.6.3 → 0.6.4

package/dist/lanes/b2-registration.js

@@ -19,6 +19,82 @@ const B2_TOOLS = B2_LANE_CONTRACT.tools;
 function decodeJsonColumn(value) {
     return decodeSharedJsonColumn(value, JSON_COLUMN_NULL_COALESCE);
 }
+/**
+ * 只读 SQL 判定用的结构视图：剥掉字符串字面量与注释，只留可执行的 SQL 骨架。
+ *
+ * 为什么需要：`SELECT note FROM ledger WHERE note = 'for update'` 是正常查询，
+ * 但直接对全文跑「FOR UPDATE」正则会误杀；反过来，若不剥字面量就放宽规则，
+ * `SELECT 1 INTO OUTFILE ...` 这类真副作用又会漏过。
+ *
+ * 保守约定：引号/注释**不配对**时返回 null（调用方据此拒绝）——不猜残缺 SQL 的
+ * 语义。支持 SQL 的两种转义（`''` 与 `\'`）。
+ */
+function stripSqlLiteralsAndComments(sql) {
+    let out = "";
+    let index = 0;
+    while (index < sql.length) {
+        const char = sql[index];
+        const next = sql[index + 1];
+        if (char === "'" || char === '"' || char === "`") {
+            const quote = char;
+            index += 1;
+            let closed = false;
+            while (index < sql.length) {
+                const current = sql[index];
+                if (current === "\\") {
+                    index += 2;
+                    continue;
+                }
+                if (current === quote) {
+                    if (quote !== "`" && sql[index + 1] === quote) {
+                        index += 2;
+                        continue;
+                    } // '' 转义
+                    index += 1;
+                    closed = true;
+                    break;
+                }
+                index += 1;
+            }
+            if (!closed)
+                return null;
+            out += " '' ";
+            continue;
+        }
+        if (char === "-" && next === "-" && (index + 2 >= sql.length || /\s/.test(sql[index + 2]))) {
+            // SQL/MySQL 的 `--` 注释要求后面跟空白；不跟空白时是算术（`1--2`），
+            // 若当注释剥掉会把其后的 `INTO OUTFILE` 一起吞成注释 → 绕过。
+            const end = sql.indexOf("\n", index);
+            if (end < 0)
+                return out;
+            index = end;
+            continue;
+        }
+        if (char === "#") {
+            // MySQL 的 `#` 注释（无需空白）。
+            const end = sql.indexOf("\n", index);
+            if (end < 0)
+                return out;
+            index = end;
+            continue;
+        }
+        if (char === "/" && next === "*") {
+            // MySQL 可执行注释 `/*!50000 ... */` 里的语句**会执行**——不能当注释剥掉，
+            // 直接判定为无法静态证明只读。
+            if (sql[index + 2] === "!")
+                return null;
+            const end = sql.indexOf("*/", index + 2);
+            if (end < 0)
+                return null; // 未闭合注释：拒绝
+            index = end + 2;
+            out += " ";
+            continue;
+        }
+        out += char;
+        index += 1;
+    }
+    return out;
+}
 function adapterCodeOf(serviceRow) {
     return typeof serviceRow?.adapterCode === "string" ? serviceRow.adapterCode : "";
 }
@@ -1294,10 +1370,109 @@ export function registerB2Lane(tools) {
     const TEST_EVIDENCED_ADAPTERS = new Set(["RESTFUL", "DATA_SQL", "DATA_TABLE", "SOAP", "INTERNAL"]);
     /** Adapters whose method configJson must be non-null to be executable (SOAP methods are WSDL-discovered and carry none). */
     const TEST_CONFIG_REQUIRED_ADAPTERS = new Set(["RESTFUL", "DATA_SQL", "DATA_TABLE", "SAP", "KAFKA", "INTERNAL"]);
+    /** 只读环境放行判定：只认「显式传参 + DATA_SQL + 严格 SELECT-only」。 */
+    const methodTestReadOnlyEscape = {
+        requested: (args) => args.readOnlyOnReadOnlyEnv === true,
+        verify: async (session, args) => {
+            const serviceCode = String(args.serviceCode ?? "");
+            const methodCode = String(args.methodCode ?? "");
+            const refusal = (blocker, message, extra = {}) => ({
+                ok: false,
+                refusal: { status: "refused", blocker, serviceCode, methodCode, message, ...extra },
+            });
+            let serviceRow;
+            try {
+                serviceRow = (await wireCall(session, { path: ENDPOINTS.bizServiceGetByCode, query: { serviceCode } })).data;
+            }
+            catch (error) {
+                return refusal("read-only-escape-unverified", `只读放行需要先证明方法确实是只读 SELECT，但服务配置读回失败（${error instanceof Error ? error.message : String(error)}）——零试跑调用。`);
+            }
+            if (serviceRow === null)
+                return refusal("wire-business", `业务服务不存在：${serviceCode}`);
+            const adapterCode = adapterCodeOf(serviceRow);
+            if (adapterCode !== "DATA_SQL")
+                return refusal("read-only-escape-adapter-refused", `readOnlyOnReadOnlyEnv 只对 DATA_SQL 适配器生效（本次 ${adapterCode || "(空)"}）：RESTFUL/SOAP/INTERNAL 等会真实打外部系统（可能 INSERT/UPDATE），无法静态证明只读，只读环境一律拒绝。`, { adapterCode });
+            let rows;
+            try {
+                rows = wireRows((await wireCall(session, { path: ENDPOINTS.bizServiceMethodList, query: { serviceCode, filterFlag: "false" } })).data);
+            }
+            catch (error) {
+                return refusal("read-only-escape-unverified", `方法面读回失败（${error instanceof Error ? error.message : String(error)}）——零试跑调用。`);
+            }
+            const method = rows.find((row) => row.code === methodCode);
+            if (!method)
+                return refusal("wire-business", `业务方法不存在：${serviceCode}/${methodCode}`);
+            // 平台把方法 configJson 以**明文 JSON**落库（controller 解密后存明文；
+            // 回读面同样是明文）。个别部署/中间层可能回密文，所以两种都认：先当明文
+            // JSON 解析，失败再按 AES 解密——两条都失败就拒绝（不能证明只读）。
+            const rawConfig = typeof method.configJson === "string" ? method.configJson : "";
+            if (!rawConfig)
+                return refusal("bizservice-test-shell", `方法 ${methodCode} 是注册壳（无 configJson）——不可执行，只读放行不适用。`);
+            let parsedConfig;
+            try {
+                parsedConfig = JSON.parse(rawConfig);
+            }
+            catch {
+                try {
+                    parsedConfig = JSON.parse((await omcCore()).decryptBizServiceMethodConfigJson(rawConfig));
+                }
+                catch (error) {
+                    return refusal("read-only-escape-unverified", `configJson 既不是明文 JSON 也无法解密（${error instanceof Error ? error.message : String(error)}）——不能证明只读，零试跑调用。`);
+                }
+            }
+            const sql = typeof parsedConfig.sql === "string" ? parsedConfig.sql : "";
+            const trimmed = sql.trim().replace(/^\(+/, "").trim();
+            // 严格 SELECT-only：`;` 多语句、WITH 后接 DML 一律不放行（宁可误杀）。
+            // 审查补强（2026-11-04）：`/^select/` 远不等于只读——下面这些都是真实
+            // 副作用写，却被首词 select 掩护：
+            //   SELECT … INTO OUTFILE/DUMPFILE '/tmp/x'   → 落盘写文件
+            //   SELECT … INTO @v                          → 会话变量（配合后续可用）
+            //   SELECT … FOR UPDATE / FOR SHARE / LOCK IN SHARE MODE → 行锁
+            //   SELECT 1\nDELETE FROM t                   → 换行分隔的第二条语句（无分号）
+            // 只读环境上放行这些等于给写副作用开口子，所以一律拒绝。
+            // 先剥掉字符串字面量与注释再判（否则 `WHERE note = 'for update'` 被误杀）；
+            // 引号/注释不配对就直接拒绝——那段 SQL 本身就有问题，不猜。
+            const structural = stripSqlLiteralsAndComments(sql);
+            if (structural === null)
+                return refusal("read-only-escape-not-select", `readOnlyOnReadOnlyEnv 需要能静态判定的 SQL：方法 ${methodCode} 的 SQL 字符串/注释引号不配对，无法证明只读（零试跑调用）。`, { sqlPreview: sql.slice(0, 120) });
+            const dangerousClauses = [
+                { pattern: /\binto\s+(outfile|dumpfile)\b/i, label: "INTO OUTFILE/DUMPFILE（写文件）" },
+                { pattern: /\binto\s+@\w+/i, label: "INTO @变量（会话变量）" },
+                { pattern: /\bfor\s+(update|share)\b/i, label: "FOR UPDATE/SHARE（行锁）" },
+                { pattern: /\block\s+in\s+share\s+mode\b/i, label: "LOCK IN SHARE MODE（行锁）" },
+                // 不再只盯「换行后的第二条语句」：剥离注释后 `SELECT 1 /*x*/ DELETE …`
+                // 会变成同一行，只查换行前缀就漏。改成全文任何位置出现写关键字即拒绝
+                // （fail-closed；正常 SELECT 不会出现这些词，列名如 update_log 有下划线
+                // 不算词边界，不会被误杀）。
+                { pattern: /\b(insert|update|delete|drop|alter|truncate|create|replace|call|exec|execute|merge|grant|revoke)\b/i, label: "写/DDL 关键字（非纯 SELECT）" },
+            ];
+            const dangerous = dangerousClauses.find((entry) => entry.pattern.test(structural));
+            const looksSelectOnly = /^select\b/i.test(trimmed) && !/[;]/.test(structural) && !/^with\b/i.test(trimmed) && dangerous === undefined;
+            if (!looksSelectOnly)
+                return refusal("read-only-escape-not-select", dangerous !== undefined
+                    ? `readOnlyOnReadOnlyEnv 只放行**纯读取**的 SELECT（方法 ${methodCode} 的 SQL 含 ${dangerous.label}）——这在只读环境上仍然有副作用，请在可写环境执行。`
+                    : `readOnlyOnReadOnlyEnv 只放行单条 SELECT（方法 ${methodCode} 的 SQL 不是严格 SELECT-only：禁止 ';' 多语句、WITH…DML、非 SELECT 语句）。要跑写库/DDL 方法请在可写环境执行。`, { sqlPreview: sql.slice(0, 120), ...(dangerous !== undefined ? { rejectedClause: dangerous.label } : {}) });
+            return {
+                ok: true,
+                note: {
+                    reason: "read-only-select-on-read-only-environment",
+                    adapterCode,
+                    methodCode,
+                    sqlPreview: sql.slice(0, 120),
+                    note: "只读环境 + 显式 readOnlyOnReadOnlyEnv + DATA_SQL 严格 SELECT-only：本次试跑已放行；它仍会真调数据库（SELECT）并记集成日志，不写配置行。",
+                },
+            };
+        },
+    };
     writeTool(tools, "method.test", B2_LANE, B2_TOOLS["method.test"].scope, B2_TOOLS["method.test"].description, {
         serviceCode: z.string().min(1),
         methodCode: z.string().min(1),
         testInputParametersMap: z.record(z.string(), z.unknown()).describe("试跑入参：参数 code → JSON 值（BizServiceMethodVO Map<String,Object>；按方法声明参数面校验）"),
+        // P2-5（GitLab #18）：method.test 是治理写（会真调外部系统），只读环境下默认
+        // 拒绝——但一条纯 SELECT 的 DATA_SQL 方法没有任何副作用，此前却必须先把
+        // 生产环境改成 writable 才能读数据（安全语义倒置）。显式传本参数 + 工具
+        // 用真实配置证明「DATA_SQL 且严格 SELECT-only」才放行，其余一律原写门。
+        readOnlyOnReadOnlyEnv: z.boolean().optional().describe("只读环境（writable=false）里显式放行本次试跑：仅当服务是 DATA_SQL 且方法 SQL 是单条 SELECT 时生效；不传=按写门拒绝（默认）。仍会真执行 SELECT 并记集成日志，不写配置行"),
     }, async (session, args) => {
         // Ticket 107 — a REAL one-shot execution of the configured method
         // (BizServiceMethodController.java:398-412 → BizServiceFacadeImpl:426-464
@@ -1398,6 +1573,6 @@ export function registerB2Lane(tools) {
                 ...(externalSuccess ? {} : { externalFailure }),
             },
         };
-    });
+    }, undefined, undefined, undefined, methodTestReadOnlyEscape);
 }
 //# sourceMappingURL=b2-registration.js.map

package/dist/lanes/form.js

@@ -144,21 +144,41 @@ export function registerFormLane(tools) {
                 ...(wanted ? { draftControls: pick(sheet.draftAttributesJson), publishedControls: pick(sheet.publishedAttributesJson) } : {}),
             };
         }, {
+            // T1（GitLab #17，2026-11-04）：`full` 此前没传，于是 form.get --full 永远
+            // 整包内联（实测 94.9KB 只为 grep 一个串）——与 data/workflow 的 8KB 读门
+            // 不一致，且外置态的根键随来源漂移。传入后大包走 fullOmitted + artifact，
+            // 小包行为不变（≤8KB 仍原样内联）。
+            full: args.full === true,
             // 2026-11-01 读门 2048：controls=true 是**显式**取控件定义的请求——compact
             // 保留定义映射与按钮/options（--full 的语义面），其余大数组归码表/计数。
+            // T1：六份布局 JSON 是大**字符串**（不是数组/对象），旧 compact 的 else 分支
+            // 原样保留 → 外置了也没省体积。超过 4KB 的单串改为 `*Omitted` + 字节数，
+            // 正文用 `artifact get <detailArtifactId> --jq draftViewJson` 定向取回。
             compact: (result) => {
                 const KEEP = new Set(["draftControls", "publishedControls", "customButtonJson", "options", "formButtons", "formButtonCodes"]);
                 const out = {};
+                const omitted = [];
                 for (const [key, value] of Object.entries(result)) {
                     if (KEEP.has(key))
                         out[key] = value;
+                    else if (typeof value === "string" && Buffer.byteLength(value, "utf8") > 4096) {
+                        out[`${key}Omitted`] = true;
+                        out[`${key}Bytes`] = Buffer.byteLength(value, "utf8");
+                        omitted.push(key);
+                    }
                     else if (Array.isArray(value))
                         out[`${key}Codes`] = value.map((entry) => (entry && typeof entry === "object" ? String(entry.code ?? entry.propertyCode ?? "") : String(entry))).filter((entry) => entry.length > 0), out[`${key}Count`] = value.length;
+                    // 大**对象**也要降载：审查 2026-11-04 指出旧 else 分支把
+                    // htmlRenderCompat 这类非 KEEP 对象整包内联，抵消了 T1 的省体积目标。
                     else if (value !== null && typeof value === "object")
                         out[`${key}Count`] = Object.keys(value).length;
                     else
                         out[key] = value;
                 }
+                // 有任一布局被外置时给一行可执行取回路径，避免把 Omitted 面误读成
+                // 「这个表单没有布局」。
+                if (omitted.length > 0)
+                    out.layoutHint = `这些布局正文已外置（${omitted.join("、")}）：用 \`omc artifact get <detailArtifactId> --jq <key>\` 取原文，例如 --jq draftViewJson。**不要**把 Omitted 面当空布局回写 form.draft（fromReadback 需要 artifact 里的原文）。`;
                 return out;
             },
         }),

package/dist/lanes/model.js

@@ -9,7 +9,7 @@ import { writeSummary } from "../human-summary.js";
 import { capabilityArg, environmentArg } from "../args.js";
 import { governedRead, withoutReadbackCache } from "../read.js";
 import { parseToolInput } from "../tool-types.js";
-import { applicationResolutionOf, applicationScopeHint, flattenTreeRows, resolveApplicationCode, resolveApplicationScope } from "../support.js";
+import { applicationResolutionOf, applicationScopeHint, applicationScopeNotice, flattenTreeRows, resolveApplicationCode, resolveApplicationScope } from "../support.js";
 import { writeTool } from "../write.js";
 import { registerPackageTool } from "../package-tool.js";
 import { defineTool, ToolInputError, ToolRefusalError } from "../tool-types.js";
@@ -221,6 +221,7 @@ export function registerModelLane(tools) {
                 totalBeforeFilter: all.length,
                 filterApplied: needle !== undefined && needle !== "",
                 ...(needle ? { filter: needle } : {}),
+                scopeHint: applicationScopeNotice(scope),
                 models,
                 ...(models.length === 0 ? { hint: applicationScopeHint(scope, "模型") } : {}),
             };
@@ -275,14 +276,28 @@ export function registerModelLane(tools) {
                 // parallel (bounded) instead of paying six sequential round-trips. Only
                 // workflow.get_published stays chained (it needs workflowCode from the
                 // draft face). Output ordering is unchanged (results land by index).
-                const [fieldFace, formFace, listviewFace, ruleFace, dataruleFace, draftFace] = await mapBounded([
+                // T4（GitLab #17，2026-11-04）：业务方永远按中文菜单名提问，而本面此前不
+                // 回显示名——只能靠 listview.list 反推（未配视图的模型无路可查）。应用树
+                // 节点本来就带 name，与六面同一批并发读，零额外顺序往返。
+                const treeFace = async () => {
+                    try {
+                        return { node: (await resolveModelTreeNode(session, schemaCode)).node };
+                    }
+                    catch {
+                        return undefined;
+                    }
+                };
+                const [fieldFace, formFace, listviewFace, ruleFace, dataruleFace, draftFace, treeRead] = await mapBounded([
                     () => face("field.list", { schemaCode, published: true, ...(all ? { all: true } : {}) }, faceErrcodes),
                     () => face("form.get", { schemaCode }),
                     () => face("listview.get", { schemaCode }),
                     () => face("rule.list", { schemaCode }),
                     () => face("datarule.list", { schemaCode }),
                     () => face("workflow.get_draft", { schemaCode }),
-                ], 6, (task) => task());
+                    () => treeFace(),
+                ], 7, (task) => task());
+                const treeNode = treeRead?.node;
+                const modelName = typeof treeNode?.name === "string" && treeNode.name ? treeNode.name : typeof treeNode?.text === "string" && treeNode.text ? treeNode.text : undefined;
                 const fieldRows = Array.isArray(fieldFace?.fields) ? fieldFace.fields : [];
                 const fields = fieldRows
                     .filter((field) => all || !SYSTEM_FIELD_CODES.has(String(field.code)))
@@ -353,6 +368,7 @@ export function registerModelLane(tools) {
                 const modelPresent = absent ? false : fieldFace !== undefined && !fieldRefused ? true : undefined;
                 return {
                     schemaCode,
+                    ...(modelName !== undefined ? { name: modelName } : {}),
                     ...(modelPresent !== undefined ? { modelPresent } : {}),
                     ...(modelPresent === false
                         ? {
@@ -367,7 +383,7 @@ export function registerModelLane(tools) {
                     rulesCustom: rules.filter((rule) => rule.defaultRule !== true).map((rule) => rule.code),
                     datarules,
                     workflow,
-                    hint: "model.inspect 聚合设计时六面（fields/form/listview/rules/datarules/workflow，摘要）。modelPresent 是存在性判据（field 面 300004=false）；字段 options 细节用 field.list --code；规则图用 rule.get schemaCode+ruleCode；运行数据用 data.list（不在此面）。",
+                    hint: "model.inspect 聚合设计时六面（fields/form/listview/rules/datarules/workflow，摘要）；name 是模型显示名（业务方的中文菜单名），与 schemaCode 一一对应，不必再用 listview.list 反推。modelPresent 是存在性判据（field 面 300004=false）；字段 options 细节用 field.list --code；规则图用 rule.get schemaCode+ruleCode；运行数据用 data.list（不在此面）。",
                 };
             };
             const one = await inspectOne(codes[0]);

package/dist/lanes/runtime-data.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
-import { FilterDslError, injectPropertyTypes, toQueryCondition } from "../data-list-filter.js";
+import { FilterDslError, injectPropertyTypes, SIMPLE_OP_MAP, toQueryCondition } from "../data-list-filter.js";
 import { ENDPOINTS } from "../endpoints.js";
 import { capabilityArg, environmentArg } from "../args.js";
 import { governedRead } from "../read.js";
@@ -759,6 +759,9 @@ export function registerRuntimeDataLane(tools) {
         lane: RUNTIME_LANE,
         scope: RUNTIME_TOOLS["data.list"].scope,
         description: RUNTIME_TOOLS["data.list"].description,
+        // T3（GitLab #17）：op 的封闭取值来自 DSL 的 SIMPLE_OP_MAP（不是 zod enum——
+        // 那样会抢先拒绝、丢掉带 acceptedOps 的说明性拒绝）。默认 describe 内联一次。
+        paramEnums: { filter: Object.keys(SIMPLE_OP_MAP).join("|") },
         inputSchema: {
             environment: environmentArg,
             schemaCode: z.string().min(1),
@@ -768,7 +771,7 @@ export function registerRuntimeDataLane(tools) {
             // `Expected object, received array`). An array is the caller's AND-list,
             // so accept it and treat it as `filters` rather than costing a retry
             // (dogfood R1 round17).
-            filter: z.union([z.record(z.string(), z.unknown()), z.array(z.record(z.string(), z.unknown()))]).optional().describe('one clause { op, field, value? } (or an array of clauses = AND); op is one of eq, neq, gt, lt, gte, lte, like, notlike, in, notin, between, notbetween, isnull, isnotnull（camelCase 别名 equally valid: equals/notEquals/contains/isNull/isNotNull）'),
+            filter: z.union([z.record(z.string(), z.unknown()), z.array(z.record(z.string(), z.unknown()))]).optional().describe('one clause { op, field, value? } (or an array of clauses = AND); op 取值见过滤语义：eq/neq/gt/lt/gte/lte/like/notlike/in/notin/between/notbetween/isnull/isnotnull（camelCase 别名 equally valid: equals/notEquals/contains/isNull/isNotNull）。**like/contains 是子串包含（String.includes），不是前缀匹配，`%` / `_` 是字面量而非通配符**；按前缀分片请用 gte/lt 区间或更长的前缀+本地去重，别假设 like:"0%" 只命中 0 开头（GitLab #18 P1-3 实测 4 个"前缀分片"互相重叠 2258 条）'),
             filters: z.array(z.record(z.string(), z.unknown())).optional().describe("clauses combined with AND; a malformed clause is refused with blocker invalid-filter-DSL"),
             filterGroup: z.record(z.string(), z.unknown()).optional().describe('nested group { op:"and"|"or", clauses:[clause|group] }'),
             rawCondition: z.unknown().optional(),
@@ -779,7 +782,7 @@ export function registerRuntimeDataLane(tools) {
             showTotal: z.boolean().default(true),
             page: z.number().int().min(0).default(0),
             size: z.number().int().min(1).max(200).default(10),
-            all: z.boolean().optional().describe("true 时自动翻页聚合全部结果（内部按 size=200 逐页拉取，安全上限 1000 行，超出截断并标记 capped）——存量盘点/数据核对用，替代手动循环翻页"),
+            all: z.boolean().optional().describe("true 时自动翻页聚合全部结果（内部按 size=200 逐页拉取，安全上限 1000 行；超过时回 truncated:true + missingCount，别当全集）——存量盘点/数据核对用，替代手动循环翻页。与 page 互斥（all 固定从第 0 页起）"),
             full: z.boolean().optional().describe("内联完整列表结果；默认大结果只返回计数与 detailFile"),
             // r31 (2026-10-31 real machine): agents pass `query: {field: value}` as a
             // filter — zod would STRIP the unknown key silently and the server
@@ -816,7 +819,7 @@ export function registerRuntimeDataLane(tools) {
                         status: "refused",
                         blocker: "invalid-filter-DSL",
                         reason: error.code,
-                        message: `${error.message}；filter 的最小合法形状：{"filter":{"op":"eq","field":"<字段code>","value":"<值>"}}（op 取 eq/neq/gt/lt/gte/lte/like/notlike/in/notin/between/notbetween/isnull/isnotnull）；多条件用 filters:[clause,…]（AND）或 filterGroup:{op:"and"|"or",clauses:[…]}。可运行示例：describe data.list --example list-filter-equality`,
+                        message: `${error.message}；filter 的最小合法形状：{"filter":{"op":"eq","field":"<字段code>","value":"<值>"}}（op 取 eq/neq/gt/lt/gte/lte/like/notlike/in/notin/between/notbetween/isnull/isnotnull；like/contains 是**子串包含**、% 非通配）。多条件用 filters:[clause,…]（AND）或 filterGroup:{op:"and"|"or",clauses:[…]}。可运行示例：describe data.list --example list-filter-equality`,
                         minimalValidFilter: { filter: { op: "eq", field: "<fieldCode>", value: "<value>" } },
                         acceptedOps: ["eq", "neq", "gt", "lt", "gte", "lte", "like", "notlike", "in", "notin", "between", "notbetween", "isnull", "isnotnull"],
                     };
@@ -856,6 +859,20 @@ export function registerRuntimeDataLane(tools) {
                     // 字典 key 匹配）。带出这些字段，total:0 时给写法提示，防"查不到数据"
                     // 误报（实测 313 条被 total:0 误读成"今天没有已审核单"）。
                     choiceFilterFields = collectConditionLeafFields(condition).filter((code) => CHOICE_FILTER_PROPERTY_TYPES.has(typeByCode.get(code) ?? -1));
+                    // P1-4（GitLab #18，2026-11-04）：子表字段（CHILD_TABLE=8）的值是行数组，
+                    // 运行面 query/list 只做标量过滤——拿它当 filter 字段会回一个没有明细的
+                    // errcode 50000「服务异常」，被读成"平台挂了"。元数据已证它是子表，就在
+                    // 发查询前拒绝并给替代路径（data.load 读主表后看子表数组）。
+                    const childTableFields = collectConditionLeafFields(condition).filter((code) => typeByCode.get(code) === CHILD_TABLE_PROPERTY_TYPE);
+                    if (childTableFields.length > 0)
+                        return {
+                            status: "refused",
+                            blocker: "unsupported-filter-on-child-table",
+                            schemaCode: args.schemaCode,
+                            fields: childTableFields,
+                            message: `这些字段是子表（propertyType=${CHILD_TABLE_PROPERTY_TYPE}，值是行数组）：运行面 query/list 只支持标量过滤，按子表字段过滤会回 errcode 50000 且无明细。改法：用 data.load 读主表记录（子表行随主记录返回），或在本地按子表字段筛选。`,
+                            nextCommand: `omc call data.load --env <env> --args '{"schemaCode":"${args.schemaCode}","bizObjectId":"<主表 bizObjectId>"}'`,
+                        };
                 }
                 const requestedFields = args.displayFields ?? args.columns;
                 const fields = requestedFields && requestedFields.length > 0 ? requestedFields : undefined;
@@ -875,6 +892,17 @@ export function registerRuntimeDataLane(tools) {
                 if (args.all === true) {
                     const CAP = 1000;
                     const pageSize = 200;
+                    // GitLab #18 P1-2: `all:true` is "aggregate from page 0 up to the cap".
+                    // A caller who ALSO passed page expected server-side paging, got page 0
+                    // silently (page:6 → 0 rows, read as "no data"). Refuse the combo
+                    // instead of guessing which one they meant.
+                    if ((args.page ?? 0) !== 0)
+                        throw new ToolInputError({
+                            status: "error",
+                            blocker: "invalid-input",
+                            tool: "data.list",
+                            message: `all:true 与 page 互斥：all 固定从第 0 页聚合到上限 ${CAP} 行；要指定页请去掉 all（page/size 手动翻页），要全集请用 filters 分片。`,
+                        });
                     const firstBody = { ...body, page: 0, size: pageSize };
                     const first = await wireCall(session, { path: ENDPOINTS.runtimeQueryList, method: "POST", body: firstBody });
                     const firstPage = extractBizObjectPage(first.data);
@@ -892,8 +920,15 @@ export function registerRuntimeDataLane(tools) {
                         rows.push(...nextPage.content);
                         pageIndex += 1;
                     }
-                    const capped = rows.length > CAP;
-                    const items = (capped ? rows.slice(0, CAP) : rows).map((row0) => {
+                    // 翻页按 size=200 走，最后一页可能越过 total（total=999 会拉到 1000 行）；
+                    // 先按 total 夹一次，itemsCount/items.length 才与 total 可比。
+                    const collected = rows.length > total ? rows.slice(0, total) : rows;
+                    // GitLab #18 P1-2：`capped = rows.length > CAP` 是死代码——target 已被
+                    // Math.min(total, CAP) 夹住，rows 永远到不了 CAP+1，于是 total>1000 时
+                    // 返回「total:1043 / items:1000 / 无任何标记」，43 条静默消失（实测被
+                    // 读成"数据就这么多"）。真正的截断判据是「拿到的比总量少」。
+                    const truncatedByCap = collected.length < total;
+                    const items = collected.map((row0) => {
                         const row = row0;
                         const rawData = row.data && typeof row.data === "object" ? row.data : {};
                         const data = args.full === true ? rawData : compactRuntimeRecord(rawData);
@@ -915,7 +950,27 @@ export function registerRuntimeDataLane(tools) {
                             // 元数据读失败不阻断数据返回
                         }
                     }
-                    return { schemaCode: args.schemaCode, total, page: "all", size: rows.length, pagesFetched: pageIndex, ...(capped ? { capped: true, capNotice: `结果超过安全上限 ${CAP}，已截断；请加 filters 分批` } : {}), ...(allHint ? { projectionHint: allHint } : {}), items };
+                    return {
+                        schemaCode: args.schemaCode,
+                        total,
+                        page: "all",
+                        size: collected.length,
+                        pagesFetched: pageIndex,
+                        // 形状常量：脚本按 result.items 取数（与内联态一致），itemsCount 与
+                        // total 的差就是被截断的条数——不再只靠 size 反推。
+                        itemsCount: collected.length,
+                        ...(truncatedByCap
+                            ? {
+                                truncated: true,
+                                capped: true,
+                                cap: CAP,
+                                missingCount: total - collected.length,
+                                capNotice: `已取前 ${collected.length} 条 / 共 ${total} 条（安全上限 ${CAP}）——还差 ${total - collected.length} 条没返回。不要把它当全集：加 filters 分片（如按日期/业务键）分别拉取，或去掉 all 用 page/size 手动翻页。`,
+                            }
+                            : {}),
+                        ...(allHint ? { projectionHint: allHint } : {}),
+                        items,
+                    };
                 }
                 let result;
                 try {
@@ -945,6 +1000,13 @@ export function registerRuntimeDataLane(tools) {
                             }
                         }
                     }
+                    // P1-4：其余 50000 保持原样抛出（真服务异常必须照实暴露），但给一条
+                    // 不改判定的排查提示——子表/子表 schema 的过滤与系统字段过滤是这个面
+                    // 最常见的"服务异常"来源（live: 子表 schema 加 parentId 过滤 → 50000，
+                    // 去掉 filter 就正常）。只加 hint，不猜 blocker。
+                    if (error instanceof WireError && error.kind === "business" && error.errcode === 50000) {
+                        throw new WireError(error.kind, error.message, error.errcode, error.diagnostic, `若 filter/filters 里含子表字段或子表自身 schema 的 parentId 等系统字段：运行面 query/list 的标量过滤不适用于子表，去掉 filter 后按主表 id 用 data.load 读子表行。其余情况按真服务异常处理（同一 schemaCode 去掉 filter 可读即说明是过滤形状问题）。`);
+                    }
                     throw error;
                 }
                 const page = extractBizObjectPage(result.data);
@@ -1050,8 +1112,8 @@ export function registerRuntimeDataLane(tools) {
             environment: environmentArg,
             schemaCode: z.string(),
             bizObjectId: z.string({ required_error: "bizObjectId 必填（参数名就是 bizObjectId——不是 id 也不是 objectId，r44 两个 agent 都猜了 objectId；取值来自 data.submit 读回的 objectId/sequenceNo 或 data.list 的 row.bizObjectId）" }),
-            full: z.boolean().optional().describe("返回未裁剪的完整业务对象（含 owner/creater 等系统字段；默认返回业务字段+身份的精简记录）"),
-            fields: z.array(z.string().min(1)).optional().describe("只保留列出的字段——核验状态时传 [\"sequenceStatus\",\"<业务状态字段>\"]，别整条 data.load（r4-training 2026-10-20：同一对象被读 74 次）；缺失字段回在 missingFields"),
+            full: z.boolean().optional().describe("返回未裁剪的完整业务对象（含 owner/creater 等系统字段；默认返回业务字段+身份的精简记录）。整条大对象（百 KB 级）会被外置成 artifact——只需要几列时改用 fields"),
+            fields: z.array(z.string().min(1)).optional().describe("列投影：只保留列出的字段——核验状态时传 [\"sequenceStatus\",\"<业务状态字段>\"]，别整条 data.load（r4-training 2026-10-20：同一对象被读 74 次）；缺失字段回在 missingFields。这是本地裁剪、在 artifact 外置**之前**生效，所以只取 9 列不会先拉整包（GitLab #17 T5）。平台 form/load 无列参数，投影只能在这一层做"),
             capability: capabilityArg,
         },
         handler: async (ctx, args, self) => {

package/dist/path-projection.js

@@ -105,21 +105,23 @@ export function projectJsonPathFanout(value, path) {
     if (marker < 0) {
         const projected = projectJsonPath(value, path);
         return projected.missed
-            ? { values: [], missed: true, ...(projected.at !== undefined ? { at: projected.at } : {}), ...(projected.available !== undefined ? { available: projected.available } : {}), missedEntries: 0 }
-            : { values: [projected.value], missed: false, missedEntries: 0 };
+            ? { values: [], missed: true, ...(projected.at !== undefined ? { at: projected.at } : {}), ...(projected.available !== undefined ? { available: projected.available } : {}), missedEntries: 0, nullEntries: 0 }
+            : { values: [projected.value], missed: false, missedEntries: 0, nullEntries: projected.value === null ? 1 : 0 };
     }
     const before = path.slice(0, marker);
     const after = path.slice(marker + 2).replace(/^[./]+/, "");
     const base = projectJsonPath(value, before);
     if (base.missed)
-        return { values: [], missed: true, ...(base.at !== undefined ? { at: base.at } : {}), ...(base.available !== undefined ? { available: base.available } : {}), missedEntries: 0 };
+        return { values: [], missed: true, ...(base.at !== undefined ? { at: base.at } : {}), ...(base.available !== undefined ? { available: base.available } : {}), missedEntries: 0, nullEntries: 0 };
     if (!Array.isArray(base.value))
-        return { values: [], missed: true, at: before || "$", available: `该层不是数组（是 ${base.value === null ? "null" : typeof base.value}）；[] 只能映射数组，如 items[].fields.planNo`, missedEntries: 0 };
+        return { values: [], missed: true, at: before || "$", available: `该层不是数组（是 ${base.value === null ? "null" : typeof base.value}）；[] 只能映射数组，如 items[].fields.planNo`, missedEntries: 0, nullEntries: 0 };
     const values = [];
     let missedEntries = 0;
+    let nullEntries = 0;
     for (const entry of base.value) {
         const projected = projectJsonPathFanout(entry, after);
         values.push(...projected.values);
+        nullEntries += projected.nullEntries;
         if (projected.missed)
             missedEntries += 1;
     }
@@ -127,9 +129,9 @@ export function projectJsonPathFanout(value, path) {
     // array) — report the miss so the caller does not read an empty list as data.
     if (values.length === 0 && missedEntries > 0) {
         const first = projectJsonPathFanout(base.value[0], after);
-        return { values: [], missed: true, ...(first.at !== undefined ? { at: `${before}[].${first.at}` } : {}), ...(first.available !== undefined ? { available: first.available } : {}), missedEntries };
+        return { values: [], missed: true, ...(first.at !== undefined ? { at: `${before}[].${first.at}` } : {}), ...(first.available !== undefined ? { available: first.available } : {}), missedEntries, nullEntries: 0 };
     }
-    return { values, missed: false, ...(missedEntries > 0 ? { missedEntries } : { missedEntries: 0 }) };
+    return { values, missed: false, ...(missedEntries > 0 ? { missedEntries } : { missedEntries: 0 }), nullEntries };
 }
 /** Collect every value of a repeatable flag (`--extract a --extract b`). */
 function argvValues(args, name) {
@@ -145,6 +147,13 @@ function argvValues(args, name) {
 }
 /** Shared wording for every projection miss, so all three faces teach the same syntax. */
 const PATH_MISS_HINT = "路径未命中（这一层没有该段）。可用写法：点式 a.b、下标 a[0]、切片 a[0:6]、数组映射 items[].fields.x、按键选择 rules[code=Create] 或 data.activities[code=A1]（数组与 index→条目对象都支持；键名可省 activityCode/nodeCode 等别名；返回第一个匹配项）。available 是该层真实存在的键。注意：本参数是路径选择器、不是 jq 语言（不支持 | 管道与对象构造）；一次取多列用逗号分隔（--jq \"a.b,c.d\"）或重复传 --jq。";
+/**
+ * T6（GitLab #17）：`mapped` 只是"路径命中的条目数"，值为 null 也算命中。
+ * 全 null + ok:true 曾被读成"取到了 N 个值/台账只有 1 行"（真实 42 行）。
+ * 提示里把两种成因分开说：未投影（看 data.list 的 projectionHint / data.load）
+ * 与字段本身为空。
+ */
+const ALL_NULL_HINT = `路径全部命中但值都是 null——注意 mapped 只是命中条目数，不代表有值。常见成因是列表投影没配置该列（data.list 只投影视图列，null 或整键省略；看同一次 data.list 的 projectionHint，或用 data.load 读单条权威值）。若 projectionHint 也指向该列，就不是"字段为空"。`;
 /**
  * `call --extract/--extract-keys`: resolve paths inside the result's own
  * artifact (or inside the result object when the tool returned no artifact).
@@ -186,6 +195,14 @@ export function projectResultExtract(result, paths, keysOnly) {
         ...(artifactId !== undefined ? { artifactId, sha256: artifact?.sha256 } : {}),
         from: readFromArtifact ? "artifact" : "result",
     };
+    // T6：列表投影里「未配置的列」也是 null 键——工具自己已经写了 projectionHint
+    // （#15 A6），但投影层此前把它丢了，于是 `--jq items[].fields.x` 全 null 时
+    // 调用方看不到任何线索。把源结果的提示原样透传（有才带，零额外体积）。
+    const sourceProjectionHint = source && typeof source === "object" && !Array.isArray(source) && typeof source.projectionHint === "string"
+        ? source.projectionHint
+        : undefined;
+    if (sourceProjectionHint !== undefined)
+        out.projectionHint = sourceProjectionHint;
     if (keysOnly) {
         const record = source && typeof source === "object" && !Array.isArray(source) ? source : undefined;
         out.keys = record
@@ -203,7 +220,14 @@ export function projectResultExtract(result, paths, keysOnly) {
                 const fanout = projectJsonPathFanout(source, path);
                 return fanout.missed
                     ? { path, content: null, pathMiss: true, missedAt: fanout.at, available: fanout.available, missedEntries: fanout.missedEntries, hint: PATH_MISS_HINT }
-                    : { path, content: fanout.values, mapped: fanout.values.length, ...(fanout.missedEntries > 0 ? { missedEntries: fanout.missedEntries, hint: `有 ${fanout.missedEntries} 条记录在该路径下缺失，values 只含命中项` } : {}) };
+                    : {
+                        path,
+                        content: fanout.values,
+                        mapped: fanout.values.length,
+                        ...(fanout.nullEntries > 0 ? { nullEntries: fanout.nullEntries } : {}),
+                        ...(fanout.nullEntries > 0 && fanout.nullEntries === fanout.values.length ? { hint: ALL_NULL_HINT } : {}),
+                        ...(fanout.missedEntries > 0 ? { missedEntries: fanout.missedEntries, hint: `有 ${fanout.missedEntries} 条记录在该路径下缺失，values 只含命中项` } : {}),
+                    };
             }
             const projected = projectJsonPath(source, path);
             return projected.missed

package/dist/read.js

@@ -79,7 +79,7 @@ export async function governedRead(ctx, tool, args, execute, options = {}) {
             ctx.readbackCache.set(target, { ...cacheEntry, shapePlaceholders: placeholders });
             return {
                 status: "ok",
-                ...passthroughScalars(result),
+                ...passthroughScalars(result, omittedScalarKeys(compact)),
                 ...compact,
                 ...placeholders,
                 full: true,
@@ -98,13 +98,13 @@ export async function governedRead(ctx, tool, args, execute, options = {}) {
         const compact = options.compact ? options.compact(result, session) : compactReadback(result);
         const placeholders = externalizedShapePlaceholders(result, droppedShapeKeys(result, compact));
         ctx.readbackCache.set(target, { ...cacheEntry, shapePlaceholders: placeholders });
-        return { status: "ok", ...passthroughScalars(result), ...compact, ...placeholders, environmentFingerprint, detailFile: artifactRef.detailFile, detailSha256: artifactRef.detailSha256 };
+        return { status: "ok", ...passthroughScalars(result, omittedScalarKeys(compact)), ...compact, ...placeholders, environmentFingerprint, detailFile: artifactRef.detailFile, detailSha256: artifactRef.detailSha256 };
     }
     catch (error) {
         if (isUncertainWireError(error))
             return { status: "uncertain", frozen: true, reason: `wire-transport:${wireErrorKind(error)}`, detail: error.message };
         if (error instanceof WireError)
-            return { status: "refused", blocker: `wire-${error.kind}`, errcode: error.errcode, message: error.message, ...(error.diagnostic ? { diagnostic: error.diagnostic } : {}) };
+            return { status: "refused", blocker: `wire-${error.kind}`, errcode: error.errcode, message: error.message, ...(error.diagnostic ? { diagnostic: error.diagnostic } : {}), ...(error.hint ? { hint: error.hint } : {}) };
         throw error;
     }
 }
@@ -208,10 +208,10 @@ const BULKY_READ_KEYS = new Set(["data", "nodes", "routes", "items", "rules", "a
  * `result.workflowCode` got `undefined` (round 10: live demo). Pass the scalar
  * (non-bulky) top-level keys through; the compact's own keys still win.
  */
-function passthroughScalars(result) {
+function passthroughScalars(result, omit = []) {
     const carried = {};
     for (const [key, value] of Object.entries(result)) {
-        if (key === "status" || BULKY_READ_KEYS.has(key))
+        if (key === "status" || BULKY_READ_KEYS.has(key) || omit.includes(key))
             continue;
         const type = typeof value;
         if (value === null || type === "string" || type === "number" || type === "boolean")
@@ -219,6 +219,32 @@ function passthroughScalars(result) {
     }
     return carried;
 }
+/**
+ * T1（GitLab #17）：某个工具的自定义 compact 用 `<key>Omitted` 显式声明"这段正文
+ * 已外置"（form.get 的六份布局 JSON 是大**字符串**，不是 BULKY_READ_KEYS 里的
+ * 数组/对象）。passthroughScalars 会把所有字符串原样带回来，正好把外置又抵消掉
+ * （42KB 读回里 41KB 是刚声明省略的布局）。这里把省略声明翻译成跳过名单。
+ *
+ * 白名单化（审查 2026-11-04）：只认 form 的六个布局面。否则任何 compact 恰好
+ * 产出的 `<key>Omitted:true`（如 `fullOmitted` → 派生 omit=`full`）都会误删同名
+ * 标量，靠后续展开掩盖太脆。
+ */
+const EXTERNALIZED_SCALAR_KEYS = new Set([
+    "draftViewJson",
+    "draftAttributesJson",
+    "draftHtmlJson",
+    "draftActionsJson",
+    "publishedViewJson",
+    "publishedAttributesJson",
+    "publishedHtmlJson",
+    "publishedActionsJson",
+]);
+function omittedScalarKeys(compact) {
+    return Object.keys(compact)
+        .filter((key) => key.endsWith("Omitted") && compact[key] === true)
+        .map((key) => key.slice(0, -"Omitted".length))
+        .filter((key) => EXTERNALIZED_SCALAR_KEYS.has(key));
+}
 function safeFingerprint(session) {
     try {
         return session.environmentFingerprint();