oasis_test_v2 2.2.18 → 2.2.19

package/dist/index.js

@@ -22923,7 +22923,7 @@ function normalizeClaudeStreamLine(line) {
     for (const block of content3) {
       switch (block["type"]) {
         case "text":
-          out.push({ kind: "message", payload: { text: block["text"] } });
+          if (type === "assistant") out.push({ kind: "message", payload: { text: block["text"] } });
           break;
         case "thinking":
           out.push({ kind: "thought", payload: { text: block["thinking"] } });
@@ -23123,6 +23123,8 @@ var init_claude_code = __esm({
       // 同上
       ["--verbose", "boolean"],
       // 与 --output-format stream-json 配对；单独无意义、成对是重复
+      ["--replay-user-messages", "boolean"],
+      // Input consumption receipts are adapter-owned.
       ["--include-partial-messages", "boolean"]
       // 同上
     ]);
@@ -23211,7 +23213,7 @@ var init_claude_code = __esm({
           // 据此喂 onOutput 实现 chat 逐字流式（同时 telemetry 仍由整条 assistant 消息归一）。
           ...this.opts.streamJson ? ["--output-format", "stream-json", "--verbose", "--include-partial-messages"] : [],
           // ADR-0093：stream-json 输入模式——让 claude 逐条从 stdin 读 user 消息（支持多轮追加）。
-          ...appendMode ? ["--input-format", "stream-json"] : [],
+          ...appendMode ? ["--input-format", "stream-json", "--replay-user-messages"] : [],
           ...job.model ?? this.opts.model ? ["--model", job.model ?? this.opts.model] : [],
           // ADR「agent CLI 启动参数员工级可配置化」：员工配置 job.extraArgs（在前）+ opts.extraArgs（静态默认，在后），
           // 过 CLAUDE_BLOCKED_FLAGS 拦截打破协议契约的 flag（剔除 + warn），追加到 argv 末尾。
@@ -23279,10 +23281,11 @@ var init_claude_code = __esm({
             pendingClose = null;
           }
         };
-        const writeUserMessage = (text5) => {
+        const pendingInputReceipts = /* @__PURE__ */ new Map();
+        const writeUserMessage = (text5, uuid2) => {
           try {
             child.stdin.write(
-              JSON.stringify({ type: "user", message: { role: "user", content: [{ type: "text", text: text5 }] } }) + "\n"
+              JSON.stringify({ type: "user", ...uuid2 ? { uuid: uuid2 } : {}, message: { role: "user", content: [{ type: "text", text: text5 }] } }) + "\n"
             );
             writes++;
             cancelPendingClose();
@@ -23357,6 +23360,22 @@ var init_claude_code = __esm({
             out.write(line + "\n");
             try {
               const p2 = JSON.parse(line);
+              if (p2["type"] === "user" && p2["isReplay"] === true && !p2["parent_tool_use_id"] && typeof p2["uuid"] === "string") {
+                const key = pendingInputReceipts.get(p2["uuid"]);
+                if (key) {
+                  pendingInputReceipts.delete(p2["uuid"]);
+                  diag("input_consumed", { key, uuid: p2["uuid"] });
+                  for (const cb of liveEventCbs) cb({
+                    protocolVersion: 2,
+                    streamId: `claude-live:${id}`,
+                    turnId: id,
+                    itemId: `input:${p2["uuid"]}`,
+                    itemType: "control",
+                    operation: "completed",
+                    payload: { code: "input_consumed", clientMessageKey: key }
+                  });
+                }
+              }
               if (p2["type"] === "result") {
                 lastResult = p2;
                 results++;
@@ -23532,6 +23551,9 @@ var init_claude_code = __esm({
           }
         };
         function doAppend(input) {
+          if (input.requireConsumptionReceipt && (!input.clientMessageKey || !appendMode)) {
+            return Promise.resolve({ accepted: false, reason: "consumption-unsupported" });
+          }
           if (!appendMode) {
             diag("append_rejected", { reason: "unsupported", writes, results });
             return Promise.resolve({ accepted: false, reason: "unsupported", ...input.interrupt ? { interrupt: "unsupported" } : {} });
@@ -23545,9 +23567,12 @@ var init_claude_code = __esm({
           const outgoing = report.failed.length ? appendMaterializeWarning(input.text, report) : input.text;
           if (input.interrupt) writeInterrupt();
           diag("append_accepted", { writes, results, interrupt: !!input.interrupt, chars: input.text.length });
-          const ok3 = writeUserMessage(outgoing);
+          const receiptId = input.requireConsumptionReceipt ? (0, import_node_crypto8.randomUUID)() : void 0;
+          if (receiptId) pendingInputReceipts.set(receiptId, input.clientMessageKey);
+          const ok3 = writeUserMessage(outgoing, receiptId);
+          if (!ok3 && receiptId) pendingInputReceipts.delete(receiptId);
           if (!ok3) return Promise.resolve({ accepted: false, reason: "rejected", ...hasFiles ? { files: report } : {}, ...input.interrupt ? { interrupt: "unknown" } : {} });
-          return Promise.resolve({ accepted: true, ...hasFiles ? { files: report } : {}, interrupt: input.interrupt ? "interrupted" : "queued_at_boundary" });
+          return Promise.resolve({ accepted: true, ...receiptId ? { consumption: "pending" } : {}, ...hasFiles ? { files: report } : {}, interrupt: input.interrupt ? "interrupted" : "queued_at_boundary" });
         }
       }
     };
@@ -25027,6 +25052,7 @@ async function runProtocolSession(job, cfg) {
       return !closing && started && !exited;
     },
     appendInput(input) {
+      if (input.requireConsumptionReceipt) return Promise.resolve({ accepted: false, reason: "consumption-unsupported" });
       appendChain = appendChain.then(async () => {
         if (exited || closing) return { accepted: false, reason: "session-closing" };
         const files = materializeFiles(dir, input.files, input.binaryFiles);
@@ -26852,6 +26878,7 @@ ${task}` : task;
     }
   };
   function doAppend(input) {
+    if (input.requireConsumptionReceipt) return Promise.resolve({ accepted: false, reason: "consumption-unsupported" });
     if (exited || closingForExit) return Promise.resolve({ accepted: false, reason: "session-closing" });
     const report = materializeFiles(dir, input.files, input.binaryFiles);
     const queued = report.failed.length ? { ...input, text: appendMaterializeWarning(input.text, report) } : input;
@@ -28507,6 +28534,18 @@ var init_normalizer = __esm({
       onLiveEvent(event) {
         this.turnId = event.turnId || this.turnId;
         const payload = event.payload && typeof event.payload === "object" && !Array.isArray(event.payload) ? event.payload : {};
+        if (event.itemType === "control" && payload.code === "input_consumed" && typeof payload.clientMessageKey === "string") {
+          this.closeOpen("completed");
+          this.emitItem({
+            key: providerItemKey(this.providerName, event.itemId),
+            kind: "control",
+            role: "system",
+            origin: "live",
+            opShape: { op: "set_status", status: "completed" },
+            attrs: { code: "input_consumed", clientMessageKey: payload.clientMessageKey }
+          });
+          return;
+        }
         if (event.operation === "turn_completed" || event.operation === "turn_failed") {
           this.turnFinished(event.operation === "turn_failed" ? "failed" : "completed");
           return;
@@ -28922,7 +28961,7 @@ var init_chat_item_ledger = __esm({
         const payload = { role: "user", text: text5 };
         if (attachments?.length) payload.attachments = attachments;
         if (clientKeys?.length) payload.clientSubmitIds = clientKeys;
-        this.insert({
+        return this.insert({
           kind: "text",
           role: "user",
           status: "completed",
@@ -29072,10 +29111,10 @@ var init_chat_item_ledger = __esm({
        * 返回落下的那一行（`null` = 本段有输出、或还没有 assistant 行可归属，不需要注解），
        * 调用方据它把这条推上 v3 流——不推的话它只在下一次快照才出现。
        */
-      closeSegmentBeforeUserInput() {
+      closeSegmentBeforeUserInput(allowUnboundSegment = false) {
         this.closeStreamingRows("completed");
         if (this.segmentEndEmitted) return null;
-        if (this.segmentItemCount !== 0 || !this.messageId) return null;
+        if (this.segmentItemCount !== 0 || !this.messageId && !allowUnboundSegment) return null;
         const id = this.insertSegmentEnd();
         this.segmentEndEmitted = true;
         const row = this.rows.get(id);
@@ -160057,7 +160096,8 @@ var init_live_chat = __esm({
           v3Seq: 0,
           v3Buffer: [],
           v3Subscribers: prev?.recovering ? prev.v3Subscribers : /* @__PURE__ */ new Set(),
-          v3Items: /* @__PURE__ */ new Map()
+          v3Items: /* @__PURE__ */ new Map(),
+          inputReceipts: /* @__PURE__ */ new Map()
         };
         this.turns.set(chatSessionId, turn);
         this.flushPendingUserItems(chatSessionId);
@@ -160111,6 +160151,8 @@ var init_live_chat = __esm({
             };
           },
           finish: (status) => {
+            for (const receipt of turn.inputReceipts.values()) receipt.abandon();
+            turn.inputReceipts.clear();
             try {
               turn.items?.finish(status === "error" ? "failed" : "completed");
             } catch {
@@ -160172,6 +160214,11 @@ var init_live_chat = __esm({
        * 账本坏掉不影响对话；v3 emit 抛异常也不影响 v2 通路与账本落盘——两条独立通路。
        */
       applyNormalizedEvent(turn, event) {
+        if (event.type === "item" && event.kind === "control" && event.attrs?.code === "input_consumed") {
+          const key = event.attrs.clientMessageKey;
+          if (key) turn.inputReceipts.get(key)?.consume();
+          return;
+        }
         let outcome = null;
         try {
           outcome = turn.items?.apply(event) ?? null;
@@ -160695,7 +160742,7 @@ var init_live_chat = __esm({
         if (turn.recovering) return say({ accepted: false, reason: "recovering" }, { recovering: true });
         const fn = turn.handle.appendInput;
         if (typeof fn !== "function") return say({ accepted: false, reason: "unsupported" });
-        const pendingItemId = !opts?.system && opts?.clientMessageKey ? `oasis-user:${opts.clientMessageKey}` : void 0;
+        const pendingItemId = !opts?.requireConsumptionReceipt && !opts?.system && opts?.clientMessageKey ? `oasis-user:${opts.clientMessageKey}` : void 0;
         const pendingAttachments = opts?.attachments?.map((a) => ({
           name: a.name,
           ...a.blobRef ? { blobRef: a.blobRef } : {},
@@ -160726,17 +160773,75 @@ var init_live_chat = __esm({
             payload: { role: "user" }
           });
         };
+        let confirmed2 = false;
+        let consumedItemId;
+        let receiptPromise;
+        const receiptKey = opts?.requireConsumptionReceipt && !opts.system ? opts.clientMessageKey : void 0;
+        if (opts?.requireConsumptionReceipt && !opts.system && !receiptKey) {
+          return say({ accepted: false, reason: "consumption-unsupported" });
+        }
+        if (receiptKey) {
+          const existing = turn.inputReceipts.get(receiptKey);
+          if (existing) {
+            const consumed = await existing.result;
+            await turn.items?.drain();
+            return consumed && existing.itemId && turn.items?.ordFor(existing.itemId) !== void 0 ? { accepted: true } : { accepted: false, reason: "unconfirmed" };
+          }
+          let resolveReceipt;
+          receiptPromise = new Promise((resolve10) => {
+            resolveReceipt = resolve10;
+          });
+          turn.inputReceipts.set(receiptKey, {
+            get itemId() {
+              return consumedItemId;
+            },
+            result: receiptPromise,
+            consume: () => {
+              if (confirmed2 || turn.status !== "running") return;
+              confirmed2 = true;
+              consumedItemId = this.commitUserInput(turn, text5, opts);
+              resolveReceipt(true);
+            },
+            abandon: () => {
+              resolveReceipt(false);
+            }
+          });
+        }
+        const clearReceipt = () => {
+          if (!receiptKey) return;
+          turn.inputReceipts.get(receiptKey)?.abandon();
+          turn.inputReceipts.delete(receiptKey);
+        };
         let res;
         try {
           res = await fn.call(turn.handle, {
             text: text5,
+            ...receiptKey ? { requireConsumptionReceipt: true } : {},
             ...opts?.clientMessageKey ? { clientMessageKey: opts.clientMessageKey } : {},
             ...opts?.files && Object.keys(opts.files).length ? { files: opts.files } : {},
             ...opts?.binaryFiles && Object.keys(opts.binaryFiles).length ? { binaryFiles: opts.binaryFiles } : {}
           });
         } catch (e) {
+          if (!receiptKey) clearReceipt();
           failPending();
-          return say({ accepted: false, reason: "rejected" }, { err: String(e) });
+          if (confirmed2) await turn.items?.drain();
+          confirmed2 = confirmed2 && !!consumedItemId && turn.items?.ordFor(consumedItemId) !== void 0;
+          return say({ accepted: confirmed2, ...!confirmed2 ? { reason: receiptKey ? "unconfirmed" : "rejected" } : {} }, { err: String(e) });
+        }
+        if (receiptPromise) {
+          const notSent = ["unsupported", "consumption-unsupported", "session-closing", "no-live-turn", "recovering"];
+          if (!confirmed2 && !res.accepted && notSent.includes(res.reason ?? "")) {
+            clearReceipt();
+            failPending();
+            return say(res);
+          }
+          if (!await receiptPromise) {
+            clearReceipt();
+            failPending();
+            return say({ accepted: false, reason: "unconfirmed" });
+          }
+          await turn.items?.drain();
+          return say(!consumedItemId || turn.items?.ordFor(consumedItemId) === void 0 ? { accepted: false, reason: "unconfirmed" } : { accepted: true });
         }
         if (!res.accepted) {
           failPending();
@@ -160747,6 +160852,10 @@ var init_live_chat = __esm({
           failPending();
           return say({ accepted: false, reason: "turn-finished" }, { turnStatus: turn.status, replaced: this.turns.get(chatSessionId) !== turn });
         }
+        this.commitUserInput(turn, text5, opts);
+        return { accepted: true };
+      }
+      commitUserInput(turn, text5, opts) {
         const shown = opts?.displayText ?? text5;
         const userPart = {
           type: "user",
@@ -160755,7 +160864,7 @@ var init_live_chat = __esm({
         };
         const segmentEnd = (() => {
           try {
-            return turn.items?.closeSegmentBeforeUserInput() ?? null;
+            return turn.items?.closeSegmentBeforeUserInput(!!opts?.requireConsumptionReceipt && !!turn.onUserInput) ?? null;
           } catch {
             return null;
           }
@@ -160771,8 +160880,9 @@ var init_live_chat = __esm({
             payload: { code: "segment_end", note: SEGMENT_END_NOTE }
           });
         }
+        let userItemId;
         try {
-          turn.items?.recordUserInput(shown, opts?.attachments, opts?.clientKeys);
+          userItemId = turn.items?.recordUserInput(shown, opts?.attachments, opts?.clientKeys);
         } catch {
         }
         const withSeq = { ...userPart, seq: ++turn.seq };
@@ -160806,7 +160916,7 @@ var init_live_chat = __esm({
           turn.onUserInput?.(shown, opts?.attachments);
         } catch {
         }
-        return { accepted: true };
+        return userItemId;
       }
       /** 反查该会话当前驻留那一轮的 runId（无进行中/grace 轮，或该轮无 runId 时 undefined）。
        *  建单草案 submit 发生在这一轮内：用它给草案盖上「产出轮次」标记，供 friday 重进对话页把每版
@@ -160952,10 +161062,10 @@ var init_chat_attachment_files = __esm({
 });
 
 // ../server/src/domains/chat-sessions/append-now.ts
-async function appendNowThroughQueue(chatSessionId, text5, deps, clientKey, attachments) {
+async function appendNowThroughQueue(chatSessionId, text5, deps, clientKey, attachments, retainLocallyOnFailure = false) {
   const newId = deps.newId ?? import_node_crypto20.randomUUID;
   const now = deps.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  await deps.store.enqueuePendingMessage({
+  const submitted = await deps.store.enqueuePendingMessage({
     id: newId(),
     chatSessionId,
     text: text5,
@@ -160988,10 +161098,19 @@ async function appendNowThroughQueue(chatSessionId, text5, deps, clientKey, atta
     ...displayText !== merged ? { displayText } : {},
     ...attachmentRefs.length ? { attachments: attachmentRefs } : {}
   });
-  const DEFINITELY_NOT_DELIVERED = /* @__PURE__ */ new Set(["unsupported", "no-live-turn", "session-closing", "turn-finished", "recovering"]);
+  const DEFINITELY_NOT_DELIVERED = /* @__PURE__ */ new Set(["unsupported", "no-live-turn", "session-closing", "turn-finished", "recovering", "consumption-unsupported"]);
   const nextState = res.accepted ? "delivered" : DEFINITELY_NOT_DELIVERED.has(res.reason ?? "") ? "queued" : "unconfirmed";
-  await deps.store.markPendingMessages?.(chatSessionId, ids2, nextState, res.reason).catch(() => void 0);
-  return { ...res, queued: true, delivered: merged, batch, ...prepared.paths.length ? { attachmentPaths: prepared.paths } : {} };
+  const returnToClient = retainLocallyOnFailure && !!clientKey && nextState === "queued";
+  if (returnToClient && deps.store.markPendingMessages) {
+    await deps.store.markPendingMessages(chatSessionId, [submitted.id], "cancelled", "client-retained");
+    await deps.store.markPendingMessages(chatSessionId, ids2.filter((id) => id !== submitted.id), nextState, res.reason);
+  } else {
+    const transition = deps.store.markPendingMessages?.(chatSessionId, ids2, nextState, res.reason);
+    if (retainLocallyOnFailure) await transition;
+    else await transition?.catch(() => void 0);
+    if (returnToClient) await deps.store.removePendingMessage(chatSessionId, submitted.id);
+  }
+  return { ...res, queued: !returnToClient, delivered: merged, batch, ...prepared.paths.length ? { attachmentPaths: prepared.paths } : {} };
 }
 var import_node_crypto20;
 var init_append_now = __esm({
@@ -204053,7 +204172,7 @@ async function startOasisServer(opts) {
     }
     return void 0;
   }
-  const appendNowThroughQueue2 = async (sid, text5, clientKey, attachments, perCompanyStore) => {
+  const appendNowThroughQueue2 = async (sid, text5, clientKey, attachments, perCompanyStore, retainLocallyOnFailure = false) => {
     if (perCompanyStore === null) {
       throw new Error(
         `appendNowThroughQueue: per-company chat store unresolved (sid=${sid})`
@@ -204067,7 +204186,7 @@ async function startOasisServer(opts) {
       store,
       // ADR-0166 D9.1：附件与正文**同一次**送出——拆开就等于让 agent 拿着「见附件」而
       // 附件不存在的描述去干活。`files` 空时这次调用与从前逐字相同。
-      deliver: (merged, clientMessageKey, extra) => liveChat.append(sid, merged, { clientMessageKey, ...extra }),
+      deliver: (merged, clientMessageKey, extra) => liveChat.append(sid, merged, { clientMessageKey, ...extra, requireConsumptionReceipt: true }),
       // **先查资产柜再查事实柜**——chat 附件是 `uploadChatAttachment` 存进**资产柜**的
       // （serve 那侧 `assets.put`），两个柜是**物理隔离**的（「资产柜与事实柜分开」）。
       // 只查 `opts.blobs` 必然取不到，于是每张图都被报成「附件没能取回来」。
@@ -204082,8 +204201,8 @@ async function startOasisServer(opts) {
         }
         throw new Error(`blob ${blobRef} \u4E24\u4E2A\u67DC\u91CC\u90FD\u6CA1\u6709`);
       }
-    }, clientKey, attachments);
-    return { accepted: r.accepted, ...r.reason ? { reason: r.reason } : {}, queued: true };
+    }, clientKey, attachments, retainLocallyOnFailure);
+    return { accepted: r.accepted, ...r.reason ? { reason: r.reason } : {}, queued: r.queued };
   };
   const GRAPH_EDIT_SUMMARY_MAX = 60;
   const truncateSummary = (s2) => {
@@ -206240,9 +206359,11 @@ async function startOasisServer(opts) {
           let text5 = "";
           let clientKey;
           let insertAttachments = [];
+          let retainLocallyOnFailure = false;
           try {
             const b2 = JSON.parse(rawBody);
             text5 = String(b2.text ?? "").trim();
+            retainLocallyOnFailure = b2.retainLocallyOnFailure === true;
             if (typeof b2.clientKey === "string" && b2.clientKey) clientKey = b2.clientKey;
             insertAttachments = (Array.isArray(b2.attachments) ? b2.attachments : []).filter((a) => !!a && typeof a === "object" && typeof a["name"] === "string" && (typeof a["text"] === "string" || typeof a["blobRef"] === "string")).map((a) => ({
               name: a["name"],
@@ -206256,7 +206377,7 @@ async function startOasisServer(opts) {
             res.writeHead(400, { "content-type": "application/json" }).end(JSON.stringify({ error: "EMPTY_TEXT" }));
             return;
           }
-          const result = await appendNowThroughQueue2(sid, text5, clientKey, insertAttachments, perCompanyStore);
+          const result = await appendNowThroughQueue2(sid, text5, clientKey, insertAttachments, perCompanyStore, retainLocallyOnFailure);
           res.writeHead(result.accepted ? 200 : 409, { "content-type": "application/json" }).end(JSON.stringify(result));
           return;
         }
@@ -218446,6 +218567,10 @@ var init_daemon_hub = __esm({
         this.onHandshakeRejected?.(rejection);
         cb(false, code2, message);
       }
+      /** Ask the running session: an upgrade leaves existing sessions alive. */
+      supportsInputConsumptionReceipts(dispatchId) {
+        return this.hasSession(dispatchId) && this.sessionMeta.get(dispatchId)?.supportsInputConsumptionReceipts === true;
+      }
       dispatch(daemonId, msg) {
         const daemon = this.daemons.get(daemonId);
         if (!daemon) return false;
@@ -218515,6 +218640,7 @@ var init_daemon_hub = __esm({
                 nodeId,
                 sessionId: msg.sessionId,
                 connectedAt: Date.now(),
+                supportsInputConsumptionReceipts: msg.supportsInputConsumptionReceipts === true,
                 ...msg.jobArtifactId ? { jobArtifactId: msg.jobArtifactId } : {}
               });
               for (const l of this.sessionConnectListeners) l({ dispatchId, sessionId: msg.sessionId, nodeId });
@@ -223300,6 +223426,16 @@ var init_assistant_tier_dispatch = __esm({
 // ../server/src/domains/projects/routes.ts
 function projectsDomain(opts) {
   const svc = async (req) => opts.resolveService ? opts.resolveService(req.auth.companyId) : opts.service;
+  const requireProjectManagePermission = async (req, projectId2, action) => {
+    if (!opts.resolveMemberRole) return;
+    if (isUncategorizedProjectId(projectId2)) return;
+    const project = await (await svc(req)).getProject(projectId2);
+    if (!project) throw new ApiError(404, "NOT_FOUND", `\u6CA1\u6709\u8FD9\u4E2A\u9879\u76EE\uFF1A${projectId2}`);
+    if (project.createdBy && project.createdBy.id === req.auth.actor) return;
+    const role = await opts.resolveMemberRole(req.auth.companyId, req.auth.actor);
+    if (role === "owner" || role === "admin") return;
+    throw new ApiError(403, action.code, `\u4F60\u6CA1\u6709${action.verb}\u8BE5\u9879\u76EE\u7684\u6743\u9650\uFF0C\u8BF7\u8054\u7CFB\u7EC4\u7EC7\u7BA1\u7406\u5458`);
+  };
   return (router) => {
     router.post("/api/projects", async (req) => {
       const body2 = req.body;
@@ -223341,6 +223477,7 @@ function projectsDomain(opts) {
       return { status: 200, body: toApiProject(project) };
     });
     router.patch("/api/projects/:id", async (req) => {
+      await requireProjectManagePermission(req, req.params.id, { verb: "\u7F16\u8F91", code: "PROJECT_EDIT_FORBIDDEN" });
       const body2 = req.body ?? {};
       for (const immutable of ["id", "project_id", "projectId", "createdBy", "created_by", "ownerId", "owner_id"]) {
         if (Object.prototype.hasOwnProperty.call(body2, immutable)) {
@@ -223360,6 +223497,7 @@ function projectsDomain(opts) {
       }
     });
     router.delete("/api/projects/:id", async (req) => {
+      await requireProjectManagePermission(req, req.params.id, { verb: "\u5220\u9664", code: "PROJECT_DELETE_FORBIDDEN" });
       try {
         const result = await (await svc(req)).deleteProject(req.params.id);
         return {
@@ -228641,7 +228779,8 @@ function createProjectsDomain(opts) {
     register: projectsDomain({
       service,
       ...opts.resolveCompany ? { resolveService } : {},
-      ...opts.defaultBranchResolver ? { defaultBranchResolver: opts.defaultBranchResolver } : {}
+      ...opts.defaultBranchResolver ? { defaultBranchResolver: opts.defaultBranchResolver } : {},
+      ...opts.resolveMemberRole ? { resolveMemberRole: opts.resolveMemberRole } : {}
     }),
     ...opts.resolveCompany ? { resolveService } : {}
   };
@@ -239294,6 +239433,9 @@ function routeToSession(hub, nodeId, dispatchId, msg) {
 function remoteAppendInput(hub, nodeId, dispatchId, entry, input, timeoutMs) {
   const unknownIfInterrupting = input.interrupt ? { interrupt: "unknown" } : {};
   if (entry.exited) return Promise.resolve({ accepted: false, reason: "session-closing", ...unknownIfInterrupting });
+  if (input.requireConsumptionReceipt && !hub.supportsInputConsumptionReceipts?.(dispatchId)) {
+    return Promise.resolve({ accepted: false, reason: "consumption-unsupported" });
+  }
   const requestId = (0, import_node_crypto65.randomUUID)();
   const sent = routeToSession(hub, nodeId, dispatchId, { type: "append_input", dispatchId, input, requestId });
   if (!sent) return Promise.resolve({ accepted: false, reason: "session-closing", ...unknownIfInterrupting });
@@ -239301,10 +239443,10 @@ function remoteAppendInput(hub, nodeId, dispatchId, entry, input, timeoutMs) {
     const timer = setTimeout(() => {
       const i = entry.appendWaiters.findIndex((w2) => w2.timer === timer);
       if (i >= 0) entry.appendWaiters.splice(i, 1);
-      resolve10({ accepted: false, reason: "unsupported", ...unknownIfInterrupting });
+      resolve10({ accepted: false, reason: input.requireConsumptionReceipt ? "unconfirmed" : "unsupported", ...unknownIfInterrupting });
     }, timeoutMs);
     timer.unref?.();
-    entry.appendWaiters.push({ requestId, resolve: resolve10, timer });
+    entry.appendWaiters.push({ requestId, requireConsumptionReceipt: input.requireConsumptionReceipt, resolve: resolve10, timer });
   });
 }
 var import_node_crypto65, STASH_TTL_MS, STASH_MAX_FRAMES_PER_ID, STASH_MAX_IDS, DaemonHubAdapter, BindingRouterAdapter, WorkdirBridge;
@@ -239451,7 +239593,7 @@ var init_daemon_adapter = __esm({
         entry.exited = info;
         for (const w2 of entry.appendWaiters.splice(0)) {
           clearTimeout(w2.timer);
-          w2.resolve({ accepted: false, reason: "session-closing" });
+          w2.resolve({ accepted: false, reason: w2.requireConsumptionReceipt ? "unconfirmed" : "session-closing" });
         }
         if (info.reason === "server-unreachable") this.health?.recordUnreachable(entry.nodeId, info.reason);
         else this.health?.recordReachable(entry.nodeId);
@@ -253339,6 +253481,17 @@ var init_cutover_aware_dispatches = __esm({
         if (row.state === "frozen") throw new BundleFrozenError("dispatch");
         return this.o.cutover.readsCompanySchema(row) ? this.o.owned : this.o.legacy;
       }
+      /**
+       * 这家公司的派发台账当前**物理落在哪**：切走了就是它自己的引擎 schema，没切走就是那个
+       * 所有未切公司共用的 legacy 台账。
+       *
+       * 给 {@link FanOutDispatchLedger} 去重用。判据**不在调用方重算**——就是 {@link pick}
+       * 那一条（`cutover.get` + `readsCompanySchema`）。与 `CutoverAwareTraceStore.storageKey` 同构。
+       */
+      async storageKey() {
+        const row = await this.o.cutover.get(this.o.companyId, "dispatch");
+        return this.o.cutover.readsCompanySchema(row) ? `owned:${this.o.companyId}` : "legacy";
+      }
       async insertOpen(rec) {
         return (await this.pickWritable()).insertOpen(rec);
       }
@@ -253374,11 +253527,48 @@ var init_cutover_aware_dispatches = __esm({
       constructor(o) {
         this.o = o;
       }
-      async each(op, fn) {
+      /**
+       * 本次要作用的物理落点清单——**同一个台账只出现一次**。
+       *
+       * 为什么必须去重：`dispatch` 是按 (公司, bundle) 逐个切的，没切走的公司**全部共用同一个
+       * legacy 台账**（读写同一张 `public.dispatches`）。此前 `each` 直接按公司逐家来，于是同一张
+       * 表被访问 N 次（N = 未切走的公司数）：
+       *
+       *   - **纯读直接出重复行**（`listOpen` / `listByWorkorder` / `findOpenByTarget`）。
+       *     2026-09-11 v2 生产实证（`ws:wo-9f4652cd`）：35 家公司、其中 33 家 dispatch 未切走，
+       *     `listByWorkorder` 返回 33 份同一条派发，动态卡「执行轨迹」抽屉里同一轮 attempt
+       *     就出现 33 次（`attempts` 由它喂，见 server 的 `activity-trace.ts`）。
+       *   - 写侧**没有被放大**，但原因是运气好而不是设计：`markStarted` / `close` 是同值 UPDATE；
+       *     `closeStaleNeverStarted` / `closeOpenByTarget` 的 WHERE 带 `ended_at IS NULL`，
+       *     第一遍改完第二遍就匹配不上，返回 0，`reduce` 出来仍是真实值。
+       *   - 无论读写，同一条 SQL 都实打实打了 N 遍。
+       *
+       * 去重键由台账自己报，不在这里按 cutover 状态重算（见 `storageKey` 的注释）。也不能按
+       * `ledgerFor` 返回的对象做身份去重：每家各有一个 `CutoverAwareDispatchStore` 包装实例，
+       * N 个不同对象包着同一个 legacy 台账。
+       */
+      async targets(op) {
         const out = [];
+        const seen = /* @__PURE__ */ new Set();
         for (const cid of await this.o.listCompanies()) {
           try {
-            out.push(await fn(await this.o.ledgerFor(cid)));
+            if (this.o.storageKeyFor) {
+              const key = await this.o.storageKeyFor(cid);
+              if (seen.has(key)) continue;
+              seen.add(key);
+            }
+            out.push({ cid, ledger: await this.o.ledgerFor(cid) });
+          } catch (err) {
+            this.o.onError?.(cid, op, err);
+          }
+        }
+        return out;
+      }
+      async each(op, fn) {
+        const out = [];
+        for (const { cid, ledger } of await this.targets(op)) {
+          try {
+            out.push(await fn(ledger));
           } catch (err) {
             this.o.onError?.(cid, op, err);
           }
@@ -259595,6 +259785,14 @@ async function startServe(opts) {
     actorDirectory: registryStore,
     // 与 collab 同源；闭包避开下方 listCompanyMembers 声明的 TDZ，实际请求时才读取。
     listMembers: (companyId) => listCompanyMembers(companyId),
+    // 改/删项目的门禁判据之一（另一半是项目创建人）——见 domains/projects/routes.ts 的
+    // `requireProjectManagePermission`。同样用闭包避开 listCompanyMembers 的 TDZ。
+    // 成员表按 company_id 有索引、量级几十行，与 `listMembers` 同一次读的成本量级；
+    // 只在 PATCH/DELETE 这两个低频写端点上调，不在任何读热路径上。
+    resolveMemberRole: async (companyId, actorId) => {
+      const members = await listCompanyMembers(companyId);
+      return members.find((m2) => m2.actorId === actorId)?.role;
+    },
     resolveActorContext: (actorId) => buildActorContext(actors.service, actorId),
     defaultBranchResolver,
     // 展示：GET content-locations 给 git 仓补 resolvedDefaultBranch
@@ -260611,6 +260809,15 @@ async function startServe(opts) {
     // 只扫 active 的公司：停用公司的台账不该再被兜底扫改写（与本文件其它按公司扇出的地方同口径）。
     listCompanies: async () => (await controlPlaneStore.listCompanies()).filter((c) => c.status === "active").map((c) => c.id),
     ledgerFor: (cid) => dispatchLedgerFor(cid),
+    /**
+     * 去重键：`dispatch` 未切走的公司全部共用同一张 legacy 台账，扇出只该作用一次。
+     * 由台账自己报落点，这里不按 cutover 状态重算（见 FanOutDispatchLedger.targets 的注释）。
+     * 非 PG / 非 cutover-aware 的路径没有这个方法 ⇒ 退回按公司逐家来，行为不变。
+     */
+    storageKeyFor: async (cid) => {
+      const l = await dispatchLedgerFor(cid);
+      return typeof l.storageKey === "function" ? l.storageKey() : cid;
+    },
     onError: (cid, op, err) => console.warn(`[dispatch-ledger] ${cid} \u7684 ${op} \u5931\u8D25\uFF08\u5176\u4F59\u516C\u53F8\u7EE7\u7EED\uFF09\uFF1A${String(err)}`)
   }) : dispatchLedger;
   const companyRegistryFor = async (companyId) => pgPool ? (await openCompanyPlane(companyId)).overlay : scopedRegistryFor(companyId);
@@ -265262,7 +265469,8 @@ var SessionProcessState = class {
         // 只报 dispatchId 的话 serve 重启后它认不出这是条活会话，会当成野进程 evict 掉。
         ...this.spec.job.artifactId ? { jobArtifactId: this.spec.job.artifactId } : {},
         // ADR 0300 D2：自报支持帧号；新服务端据此回带 ackSeq 的 hello-ack，届时才把 serverSupportsDedup 置真。
-        supportsFrameSeq: true
+        supportsFrameSeq: true,
+        supportsInputConsumptionReceipts: true
       });
       const toResend = this.serverSupportsDedup ? this.outbox : this.outbox.filter(isKeyFrame);
       for (const m2 of toResend) this.rawSend(m2);
@@ -272184,7 +272392,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.18" : "dev";
+var PKG_VERSION = true ? "2.2.19" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test_v2",
-  "version": "2.2.18",
+  "version": "2.2.19",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"
@@ -26,6 +26,6 @@
     "node": ">=20"
   },
   "oasisRelease": {
-    "sourceHead": "dacd0d5f49191a0ba05c308ee96fef59efac071d"
+    "sourceHead": "2b179b35f141bdd0e3785e0cf069d22b76fc8a37"
   }
 }