aitable-workflow-cli 0.1.28 → 0.1.29-beta.1790736949347

package/dist/web/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="/icon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>aitable-workflow · AI 工作流编排</title>
-    <script type="module" crossorigin src="/assets/index-HTw8K38o.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-DPc2WOdp.css">
+    <script type="module" crossorigin src="/assets/index-Dbs1xWB9.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-Bnmnydwk.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/web/install.ps1

@@ -0,0 +1,173 @@
+# Public same-origin bootstrap for Windows PowerShell 5.1+ (native x64 only).
+
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+
+$MinimumNodeVersion = [Version]'20.18.1'
+$NodeMajor = if ($env:AITABLE_NODE_MAJOR) { $env:AITABLE_NODE_MAJOR } else { '22' }
+$InstallRoot = if ($env:AITABLE_INSTALL_ROOT) { $env:AITABLE_INSTALL_ROOT } elseif ($env:LOCALAPPDATA) { Join-Path $env:LOCALAPPDATA 'aitable-workflow' } else { Join-Path $HOME '.aitable-workflow' }
+$NpmPrefix = if ($env:AITABLE_NPM_PREFIX) { $env:AITABLE_NPM_PREFIX } else { Join-Path $InstallRoot 'npm' }
+$NodeDistUrls = if ($env:AITABLE_NODE_DIST_URLS) { $env:AITABLE_NODE_DIST_URLS -split ';' } else { @('https://nodejs.org/dist', 'https://npmmirror.com/mirrors/node') }
+
+function Write-InstallerInfo([string]$Message) { Write-Host "  $Message" }
+function Stop-Installer([string]$Message) { throw $Message }
+
+function Get-CommandPath([string]$Name) {
+    $command = Get-Command $Name -ErrorAction SilentlyContinue | Select-Object -First 1
+    if ($null -eq $command) { return $null }
+    return $command.Source
+}
+
+function Test-NodeReady {
+    $node = Get-CommandPath 'node.exe'
+    $npm = Get-CommandPath 'npm.cmd'
+    if ($null -eq $node -or $null -eq $npm) { return $false }
+    try {
+        $version = [Version]((& $node -p 'process.versions.node' 2>$null | Select-Object -Last 1).ToString().Trim())
+        if ($version -lt $MinimumNodeVersion) { return $false }
+        $script:NodeCommand = $node
+        $script:NpmCommand = $npm
+        return $true
+    }
+    catch { return $false }
+}
+
+function Invoke-Download([string]$Uri, [string]$Destination) {
+    Invoke-WebRequest -UseBasicParsing -Uri $Uri -OutFile $Destination
+}
+
+function Resolve-LatestNode([string]$Architecture) {
+    $escapedMajor = [Regex]::Escape($NodeMajor)
+    foreach ($base in $NodeDistUrls) {
+        $base = $base.Trim().TrimEnd('/')
+        if (-not $base) { continue }
+        try {
+            $checksums = (Invoke-WebRequest -UseBasicParsing -Uri "$base/latest-v$NodeMajor.x/SHASUMS256.txt").Content
+            $match = [Regex]::Match($checksums, "(?m)^([0-9a-fA-F]{64})\s+(node-v($escapedMajor\.[0-9]+\.[0-9]+)-win-$Architecture\.zip)\s*$")
+            if ($match.Success) {
+                return @{ Base = "$base/latest-v$NodeMajor.x"; Hash = $match.Groups[1].Value.ToLowerInvariant(); Archive = $match.Groups[2].Value; Version = $match.Groups[3].Value }
+            }
+        }
+        catch { Write-InstallerInfo "Node.js 下载源暂不可用：$base" }
+    }
+    Stop-Installer "无法从 Node.js 官方源或镜像解析 Node.js $NodeMajor.x。"
+}
+
+function Add-UserPath([string[]]$Entries) {
+    $registryPath = 'Registry::HKEY_CURRENT_USER\Environment'
+    if (-not (Test-Path -LiteralPath $registryPath)) { New-Item -Path $registryPath -Force | Out-Null }
+    $userPath = Get-ItemPropertyValue -LiteralPath $registryPath -Name Path -ErrorAction SilentlyContinue
+    $allEntries = @($Entries + ($userPath -split ';')) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }
+    $unique = @()
+    foreach ($entry in $allEntries) {
+        $entry = $entry.Trim().TrimEnd('\')
+        if ($unique -notcontains $entry) { $unique += $entry }
+    }
+    Set-ItemProperty -LiteralPath $registryPath -Name Path -Value ($unique -join ';') -Force
+    foreach ($entry in $Entries) {
+        if (($env:Path -split ';') -notcontains $entry) { $env:Path = "$entry;$env:Path" }
+    }
+    Write-InstallerInfo '已更新当前用户 PATH；若其他终端未识别新命令，请重开终端。'
+}
+
+function Install-NodeManaged {
+    $architecture = $env:PROCESSOR_ARCHITECTURE
+    if ($env:PROCESSOR_ARCHITEW6432) { $architecture = $env:PROCESSOR_ARCHITEW6432 }
+    if ($architecture -ne 'AMD64') { Stop-Installer "不支持的 Windows 架构：$architecture。当前只支持原生 Windows x64。" }
+
+    $tempDirectory = Join-Path ([IO.Path]::GetTempPath()) ("aitable-install-" + [Guid]::NewGuid().ToString('N'))
+    New-Item -ItemType Directory -Path $tempDirectory -Force | Out-Null
+    try {
+        $resolved = Resolve-LatestNode 'x64'
+        $archivePath = Join-Path $tempDirectory $resolved.Archive
+        Write-InstallerInfo "正在下载并校验 Node.js v$($resolved.Version)。"
+        Invoke-Download "$($resolved.Base)/$($resolved.Archive)" $archivePath
+        $actualHash = (Get-FileHash -Algorithm SHA256 -LiteralPath $archivePath).Hash.ToLowerInvariant()
+        if ($actualHash -ne $resolved.Hash) { Stop-Installer 'Node.js SHA256 校验失败，已中止安装。' }
+        Expand-Archive -LiteralPath $archivePath -DestinationPath $tempDirectory -Force
+
+        $target = Join-Path $InstallRoot "node-v$($resolved.Version)"
+        New-Item -ItemType Directory -Path $InstallRoot -Force | Out-Null
+        if (Test-Path -LiteralPath $target) {
+            if (-not (Test-Path -LiteralPath (Join-Path $target 'node.exe')) -or -not (Test-Path -LiteralPath (Join-Path $target 'npm.cmd'))) {
+                Stop-Installer "用户级 Node.js 路径已存在但不完整，未覆盖：$target。请检查后自行修复。"
+            }
+        }
+        else {
+            $staging = "$target.new.$(New-Guid)"
+            Move-Item -LiteralPath (Join-Path $tempDirectory "node-v$($resolved.Version)-win-x64") -Destination $staging
+            Move-Item -LiteralPath $staging -Destination $target
+        }
+        $script:NodeCommand = Join-Path $target 'node.exe'
+        $script:NpmCommand = Join-Path $target 'npm.cmd'
+        $script:ManagedNodeDirectory = $target
+        $env:Path = "$target;$env:Path"
+    }
+    finally {
+        if (Test-Path -LiteralPath $tempDirectory) { Remove-Item -LiteralPath $tempDirectory -Recurse -Force }
+    }
+}
+
+function Install-WithNvm([string]$NvmCommand) {
+    $architecture = $env:PROCESSOR_ARCHITECTURE
+    if ($env:PROCESSOR_ARCHITEW6432) { $architecture = $env:PROCESSOR_ARCHITEW6432 }
+    if ($architecture -ne 'AMD64') { Stop-Installer "不支持的 Windows 架构：$architecture。当前只支持原生 Windows x64。" }
+    $resolved = Resolve-LatestNode 'x64'
+    Write-InstallerInfo "检测到 nvm-windows，安装并选择 Node.js v$($resolved.Version)。"
+    & $NvmCommand install $resolved.Version 64
+    if ($LASTEXITCODE -eq 0) {
+        & $NvmCommand use $resolved.Version 64
+        if ($LASTEXITCODE -eq 0 -and (Test-NodeReady)) { return }
+    }
+    Write-InstallerInfo 'nvm-windows 无法在当前权限下切换版本；改用用户目录安装，不会请求管理员权限。'
+    Install-NodeManaged
+}
+
+function Install-Cli([string]$Package) {
+    Write-InstallerInfo "正在安装 $Package。"
+    $arguments = @('install', '--global', '--prefix', $NpmPrefix)
+    if ($env:AITABLE_REGISTRY) { $arguments += @('--registry', $env:AITABLE_REGISTRY) }
+    $arguments += $Package
+    & $script:NpmCommand @arguments
+    if ($LASTEXITCODE -ne 0) { Stop-Installer "npm 安装 $Package 失败，退出码 $LASTEXITCODE。" }
+}
+
+function Main {
+    if ($env:OS -ne 'Windows_NT') { Stop-Installer '该脚本只支持原生 Windows；macOS/Linux 请运行 install.sh。' }
+    if ($PSVersionTable.PSVersion -lt [Version]'5.1') { Stop-Installer '需要 Windows PowerShell 5.1 或更高版本。' }
+    $architecture = $env:PROCESSOR_ARCHITECTURE
+    if ($env:PROCESSOR_ARCHITEW6432) { $architecture = $env:PROCESSOR_ARCHITEW6432 }
+    if ($architecture -ne 'AMD64') { Stop-Installer "不支持的 Windows 架构：$architecture。当前只支持原生 Windows x64。" }
+    if ($NodeMajor -notmatch '^[1-9][0-9]*$') { Stop-Installer 'AITABLE_NODE_MAJOR 必须是正整数。' }
+    if (-not $env:LOCALAPPDATA) { Stop-Installer 'Windows 环境缺少 LOCALAPPDATA。' }
+    New-Item -ItemType Directory -Path $NpmPrefix -Force | Out-Null
+    $env:Path = "$NpmPrefix;$env:Path"
+
+    if (Test-NodeReady) {
+        $version = (& $script:NodeCommand -p 'process.versions.node' | Select-Object -Last 1).ToString().Trim()
+        Write-InstallerInfo "复用 Node.js v$version。"
+    }
+    else {
+        $nvm = Get-CommandPath 'nvm.exe'
+        if ($nvm) { Install-WithNvm $nvm }
+        else { Write-InstallerInfo "未检测到可用 Node.js；将安装用户级 Node.js $NodeMajor.x。"; Install-NodeManaged }
+    }
+
+    Install-Cli 'dingtalk-workspace-cli@latest'
+    Install-Cli 'aitable-workflow-cli@latest'
+    Install-Cli '@qoder-ai/qodercli@latest'
+
+    $pathEntries = @($NpmPrefix)
+    if ($script:ManagedNodeDirectory) { $pathEntries += $script:ManagedNodeDirectory }
+    Add-UserPath $pathEntries
+    Write-InstallerInfo "安装完成：Node.js v$(& $script:NodeCommand -p 'process.versions.node')，npm v$(& $script:NpmCommand --version)。"
+    foreach ($name in @('dws.cmd', 'aitable-workflow.cmd', 'qodercli.cmd')) {
+        if (-not (Get-CommandPath $name)) { Stop-Installer "$name 安装后仍不可用；请检查 npm registry 和用户 PATH。" }
+        Write-InstallerInfo "✓ $name 已就绪。"
+    }
+    Write-InstallerInfo '下一步：在接入卡片复制对应执行引擎的 Daemon 接入命令。'
+    Write-InstallerInfo 'DWS 首次使用时需自行登录：dws auth login。'
+}
+
+try { Main }
+catch { Write-Error "安装失败：$($_.Exception.Message)"; throw }

package/dist/web/install.sh

@@ -0,0 +1,188 @@
+#!/bin/sh
+# Public same-origin bootstrap for the relay machine setup card.
+
+set -eu
+
+MIN_NODE_VERSION="20.18.1"
+NODE_MAJOR="${AITABLE_NODE_MAJOR:-22}"
+NPM_PREFIX="${AITABLE_NPM_PREFIX:-$HOME/.local/share/aitable-workflow/npm}"
+NODE_ROOT="${AITABLE_INSTALL_ROOT:-$HOME/.local/share/aitable-workflow}"
+NODE_DIST_URLS="${AITABLE_NODE_DIST_URLS:-https://nodejs.org/dist https://npmmirror.com/mirrors/node}"
+TMP_DIR=""
+PERSIST_NODE_BIN="0"
+
+say() { printf '  %s\n' "$*"; }
+fail() { printf '  ERROR: %s\n' "$*" >&2; exit 1; }
+has() { command -v "$1" >/dev/null 2>&1; }
+
+cleanup() {
+  if [ -n "$TMP_DIR" ] && [ -d "$TMP_DIR" ]; then rm -rf "$TMP_DIR"; fi
+}
+trap cleanup EXIT HUP INT TERM
+
+version_at_least() {
+  awk -v current="${1#v}" -v required="$MIN_NODE_VERSION" '
+    BEGIN {
+      split(current, c, /[.]/); split(required, r, /[.]/);
+      for (i = 1; i <= 3; i++) {
+        if ((c[i] + 0) > (r[i] + 0)) exit 0;
+        if ((c[i] + 0) < (r[i] + 0)) exit 1;
+      }
+      exit 0;
+    }
+  ' </dev/null
+}
+
+node_is_ready() {
+  has node && has npm || return 1
+  _version=$(node -p 'process.versions.node' 2>/dev/null || true)
+  [ -n "$_version" ] && version_at_least "$_version"
+}
+
+download() {
+  if has curl; then curl -fsSL --retry 2 --connect-timeout 10 "$1" -o "$2"
+  elif has wget; then wget -q -O "$2" "$1"
+  else fail "需要 curl 或 wget 下载 Node.js。"; fi
+}
+
+platform_triplet() {
+  case "$(uname -s)" in
+    Darwin) NODE_OS=darwin ;;
+    Linux) NODE_OS=linux ;;
+    *) fail "不支持的操作系统：$(uname -s)。请在 macOS、Linux 或 WSL 中运行。" ;;
+  esac
+  case "$(uname -m)" in
+    arm64|aarch64) NODE_ARCH=arm64 ;;
+    x86_64|amd64) NODE_ARCH=x64 ;;
+    *) fail "不支持的 CPU 架构：$(uname -m)。支持 arm64 与 x64。" ;;
+  esac
+}
+
+load_nvm() {
+  has nvm && return 0
+  for _candidate in "${NVM_DIR:-$HOME/.nvm}/nvm.sh" "${XDG_CONFIG_HOME:-$HOME/.config}/nvm/nvm.sh" /opt/homebrew/opt/nvm/nvm.sh /usr/local/opt/nvm/nvm.sh; do
+    [ -s "$_candidate" ] || continue
+    set +u
+    . "$_candidate" --no-use || true
+    set -u
+    has nvm && return 0
+  done
+  return 1
+}
+
+install_node_managed() {
+  platform_triplet
+  has tar || fail "安装 Node.js 需要 tar。"
+  TMP_DIR=$(mktemp -d)
+  _checksums="$TMP_DIR/SHASUMS256.txt"
+  _source=""
+  _archive=""
+  for _base in $NODE_DIST_URLS; do
+    _url="${_base%/}/latest-v${NODE_MAJOR}.x/SHASUMS256.txt"
+    say "正在查询 Node.js ${NODE_MAJOR}.x：${_base%/}"
+    if download "$_url" "$_checksums"; then
+      _archive=$(awk -v suffix="-${NODE_OS}-${NODE_ARCH}.tar.gz" '$2 ~ /^node-v[0-9]/ && index($2, suffix) == length($2) - length(suffix) + 1 { print $2; exit }' "$_checksums")
+      if [ -n "$_archive" ]; then _source="${_base%/}/latest-v${NODE_MAJOR}.x"; break; fi
+    fi
+  done
+  [ -n "$_archive" ] || fail "无法从 Node.js 官方源或镜像解析 Node.js ${NODE_MAJOR}.x。"
+  _expected=$(awk -v file="$_archive" '$2 == file { print $1; exit }' "$_checksums")
+  [ -n "$_expected" ] || fail "Node.js 校验清单缺少 $_archive。"
+  download "$_source/$_archive" "$TMP_DIR/$_archive" || fail "Node.js 下载失败。"
+  if has sha256sum; then _actual=$(sha256sum "$TMP_DIR/$_archive" | awk '{print $1}')
+  elif has shasum; then _actual=$(shasum -a 256 "$TMP_DIR/$_archive" | awk '{print $1}')
+  else fail "缺少 sha256sum 或 shasum，无法校验 Node.js 下载内容。"; fi
+  [ "$_actual" = "$_expected" ] || fail "Node.js SHA256 校验失败。"
+  tar -xzf "$TMP_DIR/$_archive" -C "$TMP_DIR"
+  _extract="${_archive%.tar.gz}"
+  _version="${_extract#node-v}"
+  _version="${_version%-${NODE_OS}-${NODE_ARCH}}"
+  _target="$NODE_ROOT/node-v$_version"
+  mkdir -p "$NODE_ROOT" "$NPM_PREFIX/bin"
+  if [ -e "$_target" ]; then
+    [ -x "$_target/bin/node" ] && [ -x "$_target/bin/npm" ] \
+      || fail "用户级 Node.js 路径已存在但不完整，未覆盖：$_target。请检查后自行修复。"
+  else
+    _staging="$_target.new.$$"
+    mv "$TMP_DIR/$_extract" "$_staging"
+    mv "$_staging" "$_target"
+  fi
+  NODE_BIN="$_target/bin"
+  PATH="$NODE_BIN:$PATH"
+  export PATH
+  PERSIST_NODE_BIN="1"
+  hash -r 2>/dev/null || true
+  node_is_ready || fail "Node.js 安装后版本仍低于 v${MIN_NODE_VERSION}，或 npm 不可用。"
+}
+
+persist_path() {
+  case "$(basename "${SHELL:-sh}")" in
+    zsh) _config="$HOME/.zshrc" ;;
+    bash) if [ "$(uname -s)" = Darwin ]; then _config="$HOME/.bash_profile"; else _config="$HOME/.bashrc"; fi ;;
+    *) _config="$HOME/.profile" ;;
+  esac
+  _prefix_quoted=$(printf '%s' "$NPM_PREFIX/bin" | sed "s/'/'\\\\''/g")
+  _line="export PATH='$_prefix_quoted':\"\$PATH\""
+  if [ "$PERSIST_NODE_BIN" = "1" ]; then
+    _node_quoted=$(printf '%s' "$NODE_BIN" | sed "s/'/'\\\\''/g")
+    _line="export PATH='$_prefix_quoted':'$_node_quoted':\"\$PATH\""
+  fi
+  _has_prefix="0"
+  _has_node="1"
+  if [ -f "$_config" ] && grep -F "$NPM_PREFIX/bin" "$_config" >/dev/null 2>&1; then _has_prefix="1"; fi
+  if [ "$PERSIST_NODE_BIN" = "1" ] && { [ ! -f "$_config" ] || ! grep -F "$NODE_BIN" "$_config" >/dev/null 2>&1; }; then _has_node="0"; fi
+  if [ "$_has_prefix" != "1" ] || [ "$_has_node" != "1" ]; then
+    { printf '\n# Added by the AITable Workflow installer.\n'; printf '%s\n' "$_line"; } >>"$_config"
+    say "已将 CLI 与 Node.js 目录加入 $_config；新终端将自动加载。"
+  fi
+}
+
+install_cli() {
+  _package="$1"
+  say "正在安装 ${_package}。"
+  if [ -n "${AITABLE_REGISTRY:-}" ]; then
+    npm install --global --prefix "$NPM_PREFIX" --registry "$AITABLE_REGISTRY" "$_package"
+  else
+    npm install --global --prefix "$NPM_PREFIX" "$_package"
+  fi
+}
+
+main() {
+  case "$NODE_MAJOR" in *[!0-9]*|'') fail "AITABLE_NODE_MAJOR 必须是整数。" ;; esac
+  platform_triplet
+  mkdir -p "$NPM_PREFIX/bin"
+  PATH="$NPM_PREFIX/bin:$PATH"
+  export PATH
+  if node_is_ready; then
+    say "复用 Node.js v$(node -p 'process.versions.node')。"
+    NODE_BIN="$(dirname "$(command -v node)")"
+  elif load_nvm; then
+    say "检测到 nvm，切换到 Node.js ${NODE_MAJOR}.x。"
+    nvm install "$NODE_MAJOR"
+    nvm alias default "$NODE_MAJOR"
+    nvm use "$NODE_MAJOR"
+    NODE_BIN="$(dirname "$(command -v node)")"
+    node_is_ready || fail "nvm 提供的 Node.js 未达到 v${MIN_NODE_VERSION}。"
+  else
+    say "未检测到可用 Node.js；将安装用户级 Node.js ${NODE_MAJOR}.x。"
+    install_node_managed
+  fi
+
+  PATH="$NPM_PREFIX/bin:$NODE_BIN:$PATH"
+  export PATH
+  mkdir -p "$NPM_PREFIX"
+  install_cli 'dingtalk-workspace-cli@latest'
+  install_cli 'aitable-workflow-cli@latest'
+  install_cli '@qoder-ai/qodercli@latest'
+  persist_path
+
+  say "安装完成：Node.js v$(node -p 'process.versions.node')，npm v$(npm --version)。"
+  for _command in dws aitable-workflow qodercli; do
+    if command -v "$_command" >/dev/null 2>&1; then say "✓ $_command：$(command -v "$_command")"
+    else fail "$_command 安装后仍不可用；请检查 npm registry 和 PATH。"; fi
+  done
+  say "下一步：在接入卡片复制对应执行引擎的 Daemon 接入命令。"
+  say "DWS 首次使用时需自行登录：dws auth login。"
+}
+
+main "$@"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aitable-workflow-cli",
-  "version": "0.1.28",
+  "version": "0.1.29-beta.1790736949347",
   "description": "aitable-workflow 命令行工具(cli):init/design/setup/run/serve 等命令;含 relay 本地反连客户端与 daemon 进程管理。bin: aitable-workflow。",
   "type": "module",
   "bin": {
@@ -19,8 +19,8 @@
     "access": "public"
   },
   "dependencies": {
-    "aitable-workflow-core": "0.1.28",
-    "aitable-workflow-server": "0.1.28",
+    "aitable-workflow-core": "0.1.29-beta.1790736949347",
+    "aitable-workflow-server": "0.1.29-beta.1790736949347",
     "@inquirer/prompts": "^8.5.2",
     "commander": "^14.0.2",
     "dotenv": "^17.4.2",

package/templates/ai-native-sdlc/.env.example

@@ -0,0 +1,11 @@
+# 外部凭据在这里**只声明变量名与用途**，真实值写进 .env（不入库）。
+#
+# 空脚手架不预设任何凭据：设计阶段确定了用哪些外部能力之后，
+# 把对应变量补进这里，并在 profile.yml 里用 ${env.XXX} 引用。
+#
+# 常见的几类（用到才加，不要照抄）：
+#   AI 表格 / 消息收发 → 依赖 dws CLI 已登录，不需要变量
+#   自定义机器人 webhook → DINGTALK_WEBHOOK / DINGTALK_WEBHOOK_SECRET
+#   LLM 直连 → 对应 provider 的 API Key
+## 钉钉企业机器人凭据 JSON map（AI表格开发小助手）
+DINGTALK_ROBOTS=

package/templates/ai-native-sdlc/aitable-workflow.config.yml

@@ -0,0 +1,47 @@
+# aitable-workflow 配置 —— 空脚手架
+#
+# 这份文件是**故意不完整**的：`workflows/` 目录为空，`scene` 还没填。
+# 交付流程的「设计」一步会按用户的真实需求补齐这两处，并生成
+# workflows/<id>/{workflow.yml,recipes/} 与 profile 的 roles/workflows 段。
+#
+# 在设计完成之前 `aitable-workflow setup` 会报 workflow-not-found，这是预期的。
+
+# ─── 场景描述 ─────────────────────────────────────
+# 设计阶段把澄清后的业务流程写在这里：谁触发、经过哪几个环节、每环节谁做什么、
+# 什么算做完、业务差异放哪。写完之后它就是这个项目的需求事实源。
+scene: |
+  AI Native SDLC 双数字员工协作台：intake 受理需求并由 PM 分诊，execution 在同一条变更记录中依次执行 PM 意图/PRD 与 Dev 技术方案/编码/评审。AI 表格保存状态、问答、审批与链接；Git changes/ 保存可版本化工件。完成工件后自动推送并创建 CR，人工评审和合并仍是硬门禁。
+
+# ─── Base 文件名 ─────────────────────────────────
+# setup 建 Base 时优先用该名（缺省回落实例目录名）。设计阶段按场景改成产品视角的名字。
+base_name: "AI Native SDLC 双数字员工协作台"
+
+# ─── 工作流目录（多工作流）────────────────────────
+workflows:
+  dir: "./workflows"
+
+# ─── Agent 引擎 ──────────────────────────────────
+agent:
+  # engine 留空：首次运行 `aitable-workflow setup` 时检测本机 coding agent 并回填
+  engine: qoder
+  max_concurrent: 3
+  # 1 小时：PRD/评审等阶段 agent 要产出多份工件并自检，10min 会在收尾前被硬切导致假失败。
+  timeout_ms: 3600000
+  max_step_failures: 5
+  # 一轮 poll 只执行一个阶段；下一轮由 durable「当前步骤」继续，避免同轮串行跨过可见阶段。
+  auto_advance: false
+  trace_dir: "./traces"
+
+# ─── Recipe 配置 ─────────────────────────────────
+recipe:
+  default_timeout_ms: 300000
+
+# ─── 轮询配置 ────────────────────────────────────
+polling:
+  interval_ms: 5000
+
+# ─── SLA 配置 ─────────────────────────────────────
+sla:
+  enabled: false
+  default_timeout_ms: 86400000
+  escalation_notify: []

package/templates/ai-native-sdlc/coding-agents.config.json

@@ -0,0 +1,17 @@
+{
+  "version": 1,
+  "agents": {
+    "claudecode": {
+      "enabled": true,
+      "cmd": "claude"
+    },
+    "codex": {
+      "enabled": true,
+      "permissionMode": "bypassPermissions"
+    },
+    "qoder": {
+      "enabled": true,
+      "permissionMode": "bypassPermissions"
+    }
+  }
+}

package/templates/ai-native-sdlc/docs/plans/2026-09-15-ai-native-sdlc-dual-staff-implementation-plan.md

@@ -0,0 +1,150 @@
+# AI Native SDLC 双数字员工协作台 Implementation Plan
+
+## 2026-09-16 增量审计与纠偏
+
+本项目已完成过一次 setup，因此只允许追加配置或调整 recipe；不得删除、改名或改类型已有 AI 表格字段，也不得改写已回填的 tracker Base/Table ID。修复以已发布的 `aitable-workflow-core` 能力为边界，不修改框架源码。
+
+- [ ] 将「领域字典表」改为 `classify-domain` recipe 的 `tableRefConfigSchema` 受管表引用，并通过 `config set` 绑定已创建表。
+- [ ] 为每个配置化 recipe 声明 Zod config；移除未声明、靠 YAML 锚点隐式传入的部署配置。
+- [ ] 将跨 workflow 创建变更改为 `{ ref: "workflow:execution.tracker" }`，禁止手工拆分 Base/Table ID 字符串。
+- [ ] 让 Dev 先在 PM 工件仓库产出并持久化选定仓库，随后只为选中的 Dev 仓库创建 worktree、提交与 CR；所有 `changes/` 工件只写 PM 仓库。
+- [ ] 修复人工问答、PRD/CR 评审和阶段跃迁的恢复条件；使用已发布 `isMerged` 确认已合并事实，绝不把 ready-to-merge 当作已合并。
+- [ ] 逐个重新部署并验证自动化；确认受理通知由领域判定的「待评估」写入真正触发。
+- [ ] 使用 setup 检查、`validate` 和受控试运行复核。只有完整链路有证据后才启动常驻服务。
+
+### 审计发现的框架缺口（不得用 recipe 伪造）
+
+1. 公开的 `field_definitions` 只支持文本、选择、人员等类型，不支持关联字段或查找字段；现有「需求池」「变更流水」的「领域」已经是文本列，原地改为关联列属于远端数据迁移。
+2. 原先 `toolkit.codeReview` 缺少已合并事实；项目现在升级为 `aitable-workflow-core@0.1.28-beta.1789525693558`，使用其只读 `isMerged` 作为阶段跃迁事实，绝不由 Agent 执行合并。
+3. `tableRefConfigSchema` 可以由 setup 创建「领域字典表」字段，但当前 setup schema 没有种子记录声明；已部署 Base 的七条领域记录需要保留，新的 Base 若要求“一次 setup 自动预填”需要框架级种子能力。
+
+**Goal:** Generate, configure and verify a single-instance two-workflow AI Native SDLC project with PM/Dev handoff, Git artifacts, CR gates, blocked Q&A and session resume.
+
+**Architecture:** `intake` owns 「需求池」 and creates records in `execution`'s distinct 「变更流水」 tracker. PM and Dev steps execute serially against one execution record; all mutable per-stage state is namespaced in fields and all durable artifacts live in the PM repository `changes/` directory.
+
+**Tech Stack:** aitable-workflow profile v2, TypeScript ESM recipes, toolkit.coding/git/codeReview/table/messaging, DWS workflow-dsl/v1 automations, GitLab CR.
+
+**Spec:** `docs/plans/2026-09-15-ai-native-sdlc-dual-staff.md`
+
+## Global constraints
+
+- Depend on the framework session-resume CR before enabling a real resumed Agent call.
+- Do not use toolkit.ai, extra tracker tables, or a design step. Steps stay `auto: true`; recipes use `needs_human` only for active CR polling, never as an approval-state substitute.
+- Keep all user-visible names, enum values, notification copy and buttons exactly as specified.
+- Use table fields only for durable workflow data; never depend on `$var` across retries or blocked recovery.
+- 所有需要评审的阶段在完成本地 commit 后自动 push 并创建 CR；人工评审与合并仍为硬门禁。
+- `blocked` 只用于 AI 问答，必须从 execution 候选轮询移除；CR 等待保持 `active` 并由当前 recipe 持续轮询。
+
+### Task 0: Repair execution recovery and CR lifecycle
+
+**Files:**
+- Modify: `package.json`, `package-lock.json`
+- Modify: `workflows/execution/workflow.yml`
+- Modify: `lib/recipe-helpers.ts`
+- Modify: `workflows/execution/recipes/prd.recipe.ts`
+- Modify: `workflows/execution/recipes/review.recipe.ts`
+- Modify: `workflows/execution/automations/*.json`
+- Test: `test/recipe-helpers.test.ts`
+
+- [x] Upgrade to `aitable-workflow-core@0.1.28-beta.1789525693558` and prove the published `codeReview.isMerged` type is available.
+- [x] Restrict execution tracker candidates to `active`; blocked AI questions are resumed only by an answer-update automation that writes `状态=active`.
+- [x] Add an idempotent external-progress helper: it preserves `active`, writes changed human-readable wait fields once, and returns `needs_human` so CR checks retain the durable step pointer without creating a blocked-loop notification storm.
+- [x] Replace PRD and review's readiness-only terminal branches with `isMerged`; PRD advances to plan only after its CR merges, and review advances to shipped only after every code CR merges plus 「待人处理=无」.
+- [x] Keep 「属主」as PM/Dev through CR comment repair and wait cycles so existing domain-role question notifications route to a real responsible role; only `shipped` writes 「属主=人」.
+- [x] Add and deploy 「人工答复续跑」 automation; it must not write 「当前阶段」「属主」or「阶段跃迁审计」.
+- [x] Add regression tests for idempotent external-progress waiting and the execution tracker candidate-state contract.
+
+### Task 1: Create the project from the prescribed skeleton
+
+**Files:**
+- Create: `aitable-workflow.config.yml`, `package.json`, `.env.example`, `.gitignore`, `coding-agents.config.json`
+- Create: `profile/profile.yml`, `profile/prompts/pm.md`, `profile/prompts/dev.md`
+- Create: `workspaces/pm/AGENTS.md`, `workspaces/dev/AGENTS.md`
+
+- [ ] Copy the design skill `assets/project` contents into `/Users/xule/work/code/agent-tests/ai-native-sdlc-dual-staff` without a nested `project/` directory.
+- [ ] Set scene, business base name, conservative polling and profile v2 configuration.
+- [ ] Declare PM repository, Dev repository allowlist, robot credentials and agent engine as deployment configuration, never Role fields.
+- [ ] Declare every required environment value in `.env.example` without a real secret.
+- [ ] Install project dependencies with `npm install`.
+
+### Task 2: Declare trackers, roles and views
+
+**Files:**
+- Create: `workflows/intake/workflow.yml`
+- Create: `workflows/execution/workflow.yml`
+- Modify: `profile/profile.yml`
+
+- [ ] Define the exact 「需求池」, 「变更流水」 and 「领域字典表」 field contracts, including 「AI问题」, 「人工答复」, 「Agent会话ID」 and 「当前CR链接」.
+- [ ] Define separate tracker IDs with the same deferred Base ID; reference the execution tracker using `{ ref: "workflow:execution.tracker" }`.
+- [ ] Define the execution edges `intent → prd → prd-review → plan → build → review → shipped`; leave 「设计稿」 as an unused table option.
+- [ ] Define PM and Dev roles with only allowed identity fields, and role workspaces with durable artifact/output instructions.
+- [ ] Add stable views for pending intake, blocked changes and change history.
+
+### Task 3: Implement intake handler and PM recipes
+
+**Files:**
+- Create: `workflows/intake/recipes/intake_handler.recipe.ts`
+- Create: `workflows/intake/recipes/mechanical-deduplicate.recipe.ts`
+- Create: `workflows/intake/recipes/classify_domain.recipe.ts`
+- Create: `workflows/intake/recipes/create_change.recipe.ts`
+- Create: `workflows/execution/recipes/intent.recipe.ts`
+- Create: `workflows/execution/recipes/prd.recipe.ts`
+- Create: `workflows/**/__tests__/*.test.ts`
+
+- [ ] Persist source composite-key deduplication outside ephemeral variables and return no duplicate change action.
+- [ ] Use PM Coding Agent prompts to compare intake rows and select a domain from the read-only dictionary.
+- [ ] Create execution records only after 「需求状态=已接受」, with initial execution state and a deterministic CHG ID.
+- [ ] In intent/PRD recipes, ensure PM worktree, create Git artifacts, commit locally, write durable artifact/CR/session data, and block on unanswered questions or CR facts.
+- [ ] Before every blocked return, use `table.updateCurrentRow()` to persist the blocking fields, then return `blocked`.
+
+### Task 4: Implement Dev recipes and cross-repository CR gates
+
+**Files:**
+- Create: `workflows/execution/recipes/plan.recipe.ts`
+- Create: `workflows/execution/recipes/build.recipe.ts`
+- Create: `workflows/execution/recipes/review.recipe.ts`
+- Create: `workflows/execution/recipes/shipped.recipe.ts`
+- Create: `workflows/execution/recipes/shared/*.ts`
+- Create: `workflows/execution/__tests__/*.test.ts`
+
+- [ ] Resolve only configured Dev repositories; unknown repositories persist a blocked condition and do no Git operation.
+- [ ] Use deterministic worktrees, stage-keyed session map entries and real coding-agent execution for plan/build.
+- [ ] Record actual test command output, CI state, commit and CR information in `05-build.md`, `06-review.md` and append-only 「产出物」.
+- [ ] Poll unresolved comments, readiness and branch-merged facts; re-run the resumed Agent session after relevant human answers/comments.
+- [ ] Require every Dev CR merged to master and the human release confirmation before recipe sets `状态=shipped` and `当前阶段=已发布`.
+
+### Task 5: Generate and validate the three required automations
+
+**Files:**
+- Create: `workflows/intake/automations/accept-intake.json`
+- Create: `workflows/execution/automations/merge-gate.json`
+- Create: `workflows/execution/automations/blocked-questions.json`
+- Create: `workflows/execution/automations/cr-review.json`
+
+- [ ] Retrieve and save the current DWS workflow `edit-example` in `.sandbox/` before authoring DSL.
+- [ ] Implement the exact required intake and merge-gate copy/buttons.
+- [ ] Implement notification-only blocked-question and CR-review automations using 「AI问题」 and 「当前CR链接」.
+- [ ] Confirm no automation writes 「当前阶段」「属主」 or 「阶段跃迁审计」.
+- [ ] Validate/deploy every automation to the target Base and retain only responses with `valid: true`.
+
+### Task 6: Setup and verification
+
+**Files:**
+- Create: `__tests__/workflow-contract.test.ts`
+- Create: `.sandbox/smoke/intake.event.json`
+- Create: `.sandbox/smoke/execution.event.json`
+
+- [ ] Add tests for stage transition idempotency, blocked field persistence, session map isolation, composite intake deduplication and Dev allowlist enforcement.
+- [ ] Run `aitable-workflow validate -c /Users/xule/work/code/agent-tests/ai-native-sdlc-dual-staff`.
+- [ ] Run setup to create the Base, all tables, field options, domain seed rows, robot and automations; record generated IDs only in deployment configuration.
+- [ ] Run controlled `trigger-once` for intake and execution and inspect actions plus table writes.
+- [ ] Enable the remote CR acceptance switch only for an identified test record; verify a PM PRD CR and one Dev CR with real test/CI evidence.
+
+### Task 7: Start and hand off
+
+**Files:**
+- Verify: `.aitable-workflow/console-access.json`
+
+- [ ] Start the service through `aitable-workflow start` only after setup and smoke evidence are available.
+- [ ] Verify blocked question notification, answer consumption, resumed sessionId forwarding, CR review notification and phase transition on a controlled record.
+- [ ] Report the Base, table IDs, automation validation evidence, console URL and every remaining external authorization requirement.