openxiangda 1.0.159 → 1.0.161

package/lib/publish-lease.js

@@ -0,0 +1,190 @@
+const { execFileSync } = require('child_process');
+const crypto = require('crypto');
+const path = require('path');
+
+const { saveProjectState } = require('./config');
+
+const DEFAULT_CLI_PUBLISH_LEASE_TTL_SECONDS = 1800;
+const PUBLISH_LEASE_RENEW_WINDOW_SECONDS = 180;
+
+function getStoredPublishLease(target) {
+  const lease = target?.bound?.promotion?.publishLease;
+  return lease && typeof lease === 'object' ? lease : null;
+}
+
+function getUsableStoredPublishLease(target, now = Date.now()) {
+  const lease = getStoredPublishLease(target);
+  if (!lease?.leaseId || !lease?.expiresAt) return null;
+  const expiresAt = new Date(lease.expiresAt).getTime();
+  if (!Number.isFinite(expiresAt) || expiresAt <= Number(now)) return null;
+  if (lease.appType && lease.appType !== target.appType) return null;
+  if (lease.profile && lease.profile !== target.profileName) return null;
+  if (!isPublishLeaseOwnedByCurrentSession(lease)) return null;
+  return lease;
+}
+
+function isPublishLeaseExpired(lease, now = Date.now()) {
+  if (!lease?.expiresAt) return true;
+  const expiresAt = new Date(lease.expiresAt).getTime();
+  return !Number.isFinite(expiresAt) || expiresAt <= Number(now);
+}
+
+function currentCodexThreadId(env = process.env) {
+  return String(env?.CODEX_THREAD_ID || '').trim();
+}
+
+function createPublishClientSessionId(env = process.env) {
+  const threadId = currentCodexThreadId(env);
+  return threadId ? `codex:${threadId}` : `cli:${crypto.randomUUID()}`;
+}
+
+function isPublishLeaseOwnedByCurrentSession(lease, env = process.env) {
+  const ownerThreadId = String(lease?.workspace?.threadId || '').trim();
+  const threadId = currentCodexThreadId(env);
+  if (ownerThreadId && threadId) return ownerThreadId === threadId;
+  return true;
+}
+
+function shouldRenewPublishLease(
+  lease,
+  now = Date.now(),
+  renewWindowSeconds = PUBLISH_LEASE_RENEW_WINDOW_SECONDS
+) {
+  if (!lease?.expiresAt) return true;
+  const expiresAt = new Date(lease.expiresAt).getTime();
+  if (!Number.isFinite(expiresAt)) return true;
+  return expiresAt - Number(now) <= Number(renewWindowSeconds) * 1000;
+}
+
+function savePublishLease(target, input, options = {}) {
+  const lease = normalizePublishLease(input, target);
+  target.bound.promotion = {
+    ...(target.bound.promotion || {}),
+    publishLease: lease,
+  };
+  target.bound.updatedAt = new Date().toISOString();
+  if (target.state.profiles?.[target.profileName]) {
+    target.state.profiles[target.profileName] = target.bound;
+  }
+  (options.saveState || saveProjectState)(target.state, options.cwd || process.cwd());
+  return lease;
+}
+
+function clearPublishLease(target, leaseId, options = {}) {
+  const current = getStoredPublishLease(target);
+  if (!current) return false;
+  if (leaseId && current.leaseId !== leaseId) return false;
+  target.bound.promotion = { ...(target.bound.promotion || {}) };
+  delete target.bound.promotion.publishLease;
+  if (Object.keys(target.bound.promotion).length === 0) {
+    delete target.bound.promotion;
+  }
+  target.bound.updatedAt = new Date().toISOString();
+  if (target.state.profiles?.[target.profileName]) {
+    target.state.profiles[target.profileName] = target.bound;
+  }
+  (options.saveState || saveProjectState)(target.state, options.cwd || process.cwd());
+  return true;
+}
+
+function normalizePublishLease(input, target) {
+  const leaseId = String(input?.leaseId || '').trim();
+  const expiresAt = normalizeDate(input?.expiresAt, 'expiresAt');
+  if (!leaseId) throw new Error('publish lease response 缺少 leaseId');
+  return {
+    leaseId,
+    appType: String(input?.appType || target?.appType || '').trim(),
+    profile: String(target?.profileName || '').trim(),
+    changeId: String(input?.changeId || '').trim() || null,
+    clientSessionId: String(input?.clientSessionId || '').trim() || null,
+    baseRevision: String(input?.baseRevision || '').trim() || null,
+    expiresAt,
+    holder: input?.holder === 'other' ? 'other' : 'self',
+    workspace: readWorkspaceIdentity(optionsCwd(target)),
+    updatedAt: new Date().toISOString(),
+  };
+}
+
+function buildPublishBaseRevision(snapshot) {
+  const app = unwrapRecord(snapshot?.app) || {};
+  const runtime = unwrapRecord(snapshot?.runtime) || {};
+  const updatedAt = textValue(
+    app.updatedAt || runtime.updatedAt || snapshot?.updatedAt
+  );
+  const activeReleaseId = textValue(
+    app.activeRuntimeReleaseId ||
+      runtime.activeReleaseId ||
+      snapshot?.activeRuntimeReleaseId
+  );
+  const activeBuildId = textValue(
+    app.activeRuntimeBuildId || runtime.activeBuildId || snapshot?.activeRuntimeBuildId
+  );
+  return [
+    `appUpdatedAt=${updatedAt || '-'}`,
+    `runtimeRelease=${activeReleaseId || '-'}`,
+    `runtimeBuild=${activeBuildId || '-'}`,
+  ].join(';');
+}
+
+function readWorkspaceIdentity(cwd = process.cwd()) {
+  const resolvedCwd = path.resolve(cwd);
+  return {
+    cwd: resolvedCwd,
+    branch: readGitValue(resolvedCwd, ['branch', '--show-current']),
+    commit: readGitValue(resolvedCwd, ['rev-parse', 'HEAD']),
+    worktreeRoot: readGitValue(resolvedCwd, ['rev-parse', '--show-toplevel']),
+    threadId: currentCodexThreadId(),
+  };
+}
+
+function readGitValue(cwd, args) {
+  try {
+    return String(
+      execFileSync('git', ['-C', cwd, ...args], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+      })
+    ).trim();
+  } catch {
+    return '';
+  }
+}
+
+function optionsCwd(target) {
+  return target?.cwd || process.cwd();
+}
+
+function normalizeDate(value, field) {
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    throw new Error(`publish lease response ${field} 无效`);
+  }
+  return date.toISOString();
+}
+
+function unwrapRecord(value) {
+  if (!value || typeof value !== 'object') return null;
+  if (value.data && typeof value.data === 'object') return value.data;
+  return value;
+}
+
+function textValue(value) {
+  if (value === undefined || value === null) return '';
+  return String(value).trim();
+}
+
+module.exports = {
+  DEFAULT_CLI_PUBLISH_LEASE_TTL_SECONDS,
+  PUBLISH_LEASE_RENEW_WINDOW_SECONDS,
+  buildPublishBaseRevision,
+  clearPublishLease,
+  createPublishClientSessionId,
+  currentCodexThreadId,
+  getStoredPublishLease,
+  getUsableStoredPublishLease,
+  isPublishLeaseExpired,
+  isPublishLeaseOwnedByCurrentSession,
+  readWorkspaceIdentity,
+  savePublishLease,
+  shouldRenewPublishLease,
+};

package/lib/release-telemetry.js

@@ -0,0 +1,182 @@
+const DEFAULT_PROGRESS_HEARTBEAT_MS = 15_000;
+
+class ReleaseTelemetry {
+  constructor(options = {}) {
+    this.operation = String(options.operation || 'release').trim() || 'release';
+    this.now = options.now || Date.now;
+    this.onProgress =
+      typeof options.onProgress === 'function' ? options.onProgress : () => {};
+    this.heartbeatMs = normalizePositiveInteger(
+      options.heartbeatMs,
+      DEFAULT_PROGRESS_HEARTBEAT_MS
+    );
+    this.setInterval = options.setInterval || global.setInterval;
+    this.clearInterval = options.clearInterval || global.clearInterval;
+    this.startedAtMs = Number(this.now());
+    this.finishedAtMs = null;
+    this.phases = [];
+    this.active = [];
+    this.timer = null;
+    this.stopped = false;
+  }
+
+  start() {
+    if (this.stopped || this.timer) return this;
+    this.timer = this.setInterval(() => this.emitHeartbeat(), this.heartbeatMs);
+    this.timer?.unref?.();
+    return this;
+  }
+
+  async runPhase(name, metadata, operation) {
+    if (typeof metadata === 'function') {
+      operation = metadata;
+      metadata = {};
+    }
+    if (typeof operation !== 'function') {
+      throw new TypeError('release telemetry phase operation 必须是函数');
+    }
+    const phase = this.beginPhase(name, metadata);
+    try {
+      const value = await operation();
+      this.endPhase(phase, 'success');
+      return value;
+    } catch (error) {
+      this.endPhase(phase, 'failed', {
+        errorCode: error?.code || error?.errorCode || null,
+        errorMessage: String(error?.message || error || '').slice(0, 500),
+      });
+      throw error;
+    }
+  }
+
+  beginPhase(name, metadata = {}) {
+    const phase = {
+      name: normalizeName(name),
+      status: 'running',
+      startedAtMs: Number(this.now()),
+      finishedAtMs: null,
+      durationMs: null,
+      metadata: normalizeMetadata(metadata),
+    };
+    this.phases.push(phase);
+    this.active.push(phase);
+    this.emit({ type: 'phase-start', phase: this.serializePhase(phase) });
+    return phase;
+  }
+
+  endPhase(phase, status = 'success', metadata = {}) {
+    if (!phase || phase.status !== 'running') return phase;
+    phase.finishedAtMs = Number(this.now());
+    phase.durationMs = Math.max(0, phase.finishedAtMs - phase.startedAtMs);
+    phase.status = status;
+    phase.metadata = {
+      ...phase.metadata,
+      ...normalizeMetadata(metadata),
+    };
+    const index = this.active.lastIndexOf(phase);
+    if (index >= 0) this.active.splice(index, 1);
+    this.emit({ type: 'phase-end', phase: this.serializePhase(phase) });
+    return phase;
+  }
+
+  addMetadata(phase, metadata = {}) {
+    if (!phase) return;
+    phase.metadata = {
+      ...phase.metadata,
+      ...normalizeMetadata(metadata),
+    };
+  }
+
+  emitHeartbeat() {
+    if (this.stopped || this.active.length === 0) return;
+    const now = Number(this.now());
+    const phase = this.active[this.active.length - 1];
+    this.emit({
+      type: 'heartbeat',
+      phase: this.serializePhase(phase, now),
+      operationElapsedMs: Math.max(0, now - this.startedAtMs),
+    });
+  }
+
+  snapshot() {
+    const now =
+      this.finishedAtMs === null ? Number(this.now()) : this.finishedAtMs;
+    return {
+      operation: this.operation,
+      startedAt: new Date(this.startedAtMs).toISOString(),
+      finishedAt:
+        this.finishedAtMs === null
+          ? null
+          : new Date(this.finishedAtMs).toISOString(),
+      durationMs: Math.max(0, now - this.startedAtMs),
+      phases: this.phases.map(phase => this.serializePhase(phase, now)),
+    };
+  }
+
+  stop() {
+    if (this.timer) {
+      this.clearInterval(this.timer);
+      this.timer = null;
+    }
+    if (!this.stopped) {
+      this.finishedAtMs = Number(this.now());
+      for (const phase of [...this.active]) {
+        this.endPhase(phase, 'interrupted');
+      }
+    }
+    this.stopped = true;
+    return this.snapshot();
+  }
+
+  serializePhase(phase, now = Number(this.now())) {
+    const finishedAtMs = phase.finishedAtMs;
+    return {
+      name: phase.name,
+      status: phase.status,
+      startedAt: new Date(phase.startedAtMs).toISOString(),
+      finishedAt:
+        finishedAtMs === null ? null : new Date(finishedAtMs).toISOString(),
+      durationMs:
+        phase.durationMs === null
+          ? Math.max(0, now - phase.startedAtMs)
+          : phase.durationMs,
+      metadata: { ...phase.metadata },
+    };
+  }
+
+  emit(event) {
+    try {
+      this.onProgress({ operation: this.operation, ...event });
+    } catch {
+      // Telemetry must never change release correctness.
+    }
+  }
+}
+
+function normalizeName(value) {
+  const name = String(value || '').trim();
+  if (!name) throw new TypeError('release telemetry phase name 不能为空');
+  return name.slice(0, 128);
+}
+
+function normalizeMetadata(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
+  return Object.fromEntries(
+    Object.entries(value).filter(([, item]) => item !== undefined)
+  );
+}
+
+function normalizePositiveInteger(value, fallback) {
+  const numeric = Number(value);
+  return Number.isSafeInteger(numeric) && numeric > 0 ? numeric : fallback;
+}
+
+function createReleaseTelemetry(options) {
+  return new ReleaseTelemetry(options);
+}
+
+module.exports = {
+  DEFAULT_PROGRESS_HEARTBEAT_MS,
+  ReleaseTelemetry,
+  createReleaseTelemetry,
+};

package/lib/runtime-lineage.js

@@ -0,0 +1,297 @@
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const { readGitSourceBase } = require('./change-baseline');
+
+const MIN_ROLLBACK_REASON_LENGTH = 8;
+const PURE_RUNTIME_OUTPUT_PREFIXES = Object.freeze([
+  '.codegraph',
+  '.openxiangda',
+  '.turbo',
+  '.vite',
+  'coverage',
+  'dist',
+  'node_modules',
+  'openspec',
+]);
+const IGNORED_BUILD_INPUT_PATHS = Object.freeze([
+  ':(glob).env',
+  ':(glob).env.*',
+  ':(glob)app-workspace.config.*',
+  ':(glob)components.json',
+  ':(glob)index.html',
+  ':(glob)package.json',
+  ':(glob)package-lock.json',
+  ':(glob)pnpm-lock.yaml',
+  ':(glob)yarn.lock',
+  ':(glob)postcss.config.*',
+  ':(glob)public/**',
+  ':(glob)scripts/**',
+  ':(glob)src/**',
+  ':(glob)tailwind.config.*',
+  ':(glob)tsconfig*.json',
+  ':(glob)vite.config.*',
+]);
+
+function prepareRuntimeDeployLineage(options = {}) {
+  const cwd = path.resolve(options.cwd || process.cwd());
+  const app = normalizeAppSnapshot(options.app);
+  const activate = options.activate !== false;
+  const rollback = resolveRuntimeRollbackBypass(options);
+  const parentReleaseId = normalizeNullableString(app.activeRuntimeReleaseId);
+  const parentSourceRevision = normalizeRuntimeSourceRevision(
+    app.activeRuntimeSourceRevision,
+    { optional: true }
+  );
+
+  let sourceRevision;
+  try {
+    sourceRevision = normalizeRuntimeSourceRevision(readGitSourceBase(cwd, 'HEAD'));
+  } catch (error) {
+    throw runtimeLineageError(
+      'RUNTIME_SOURCE_LINEAGE_REQUIRED',
+      `创建 Runtime release 前必须在可审计 Git 工作区的已提交 HEAD 上构建；当前目录无法读取 Git HEAD。${formatCause(error)}`
+    );
+  }
+
+  const dirtyPaths = listRuntimeBuildInputChanges(cwd);
+  if (dirtyPaths.length > 0) {
+    throw runtimeLineageError(
+      'RUNTIME_SOURCE_DIRTY',
+      [
+        '创建 Runtime release 前，所有可能进入构建的源码和配置必须提交到当前 HEAD。',
+        `未提交路径: ${summarizePaths(dirtyPaths)}`,
+        '请先提交/合并这些修改并重新构建；.openxiangda/、dist/ 等纯状态或生成目录不会触发此阻断。',
+      ].join(' '),
+      { dirtyPaths }
+    );
+  }
+
+  const legacyBootstrap = Boolean(parentReleaseId && !parentSourceRevision);
+  if (parentSourceRevision) {
+    const sameRepository = parentSourceRevision.repo === sourceRevision.repo;
+    const descendsFromActive =
+      sameRepository &&
+      isGitAncestor(cwd, parentSourceRevision.baseCommit, sourceRevision.baseCommit);
+    if ((!sameRepository || !descendsFromActive) && !rollback.enabled) {
+      const detail = sameRepository
+        ? `线上基线 ${shortCommit(parentSourceRevision.baseCommit)} 不是当前 HEAD ${shortCommit(sourceRevision.baseCommit)} 的祖先`
+        : '当前 Git 仓库与线上 Runtime 的源码仓库不一致';
+      throw runtimeLineageError(
+        'RUNTIME_SOURCE_BASE_DIVERGED',
+        `${detail}；已在构建和上传前阻断。请合并线上 release head 后重试；确需审计式回退时使用 --allow-runtime-rollback --reason "至少 8 个字符的原因"。`,
+        { sourceRevision, parentSourceRevision, parentReleaseId }
+      );
+    }
+    return stripUndefinedValues({
+      sourceRevision,
+      parentReleaseId,
+      parentSourceRevision,
+      lineageBypassReason: rollback.enabled ? rollback.reason : undefined,
+      lineageStatus:
+        rollback.enabled && (!sameRepository || !descendsFromActive)
+          ? 'rollback-bypass'
+          : activate
+            ? 'descendant'
+            : 'preview',
+      auditable: true,
+      activationAllowed: true,
+    });
+  }
+
+  return stripUndefinedValues({
+    sourceRevision,
+    parentReleaseId,
+    parentSourceRevision,
+    lineageBypassReason: rollback.enabled ? rollback.reason : undefined,
+    lineageStatus: legacyBootstrap ? 'legacy-bootstrap' : 'bootstrap',
+    legacyBootstrap,
+    auditable: true,
+    activationAllowed: true,
+  });
+}
+
+function resolveRuntimeRollbackBypass(options = {}) {
+  const enabled = Boolean(options.allowRollback);
+  const reason = String(options.reason || '').trim();
+  if (!enabled) return { enabled: false, reason: '' };
+  if (reason.length < MIN_ROLLBACK_REASON_LENGTH) {
+    throw runtimeLineageError(
+      'RUNTIME_ROLLBACK_REASON_REQUIRED',
+      `--allow-runtime-rollback 必须同时提供至少 ${MIN_ROLLBACK_REASON_LENGTH} 个字符的 --reason，原因会写入发布审计`
+    );
+  }
+  return { enabled: true, reason };
+}
+
+function listRuntimeBuildInputChanges(cwd = process.cwd()) {
+  const changed = runGitNameList(cwd, [
+    'diff',
+    '--name-only',
+    '-z',
+    '--relative',
+    'HEAD',
+    '--',
+    '.',
+  ]);
+  const untracked = runGitNameList(cwd, [
+    'ls-files',
+    '--others',
+    '--exclude-standard',
+    '-z',
+    '--',
+    '.',
+  ]);
+  const ignoredInputs = runGitNameList(
+    cwd,
+    [
+      'ls-files',
+      '--others',
+      '--ignored',
+      '--exclude-standard',
+      '-z',
+      '--',
+      ...IGNORED_BUILD_INPUT_PATHS,
+    ],
+    { allowFailure: true }
+  );
+  return [...new Set([...changed, ...untracked, ...ignoredInputs])]
+    .map(normalizeGitPath)
+    .filter(Boolean)
+    .filter(filePath => !isPureRuntimeOutputPath(filePath))
+    .sort((left, right) => left.localeCompare(right));
+}
+
+function isPureRuntimeOutputPath(filePath) {
+  const normalized = normalizeGitPath(filePath);
+  const firstSegment = normalized.split('/')[0];
+  return (
+    PURE_RUNTIME_OUTPUT_PREFIXES.includes(firstSegment) ||
+    /(^|\/)\.DS_Store$/.test(normalized) ||
+    /\.tsbuildinfo$/.test(normalized)
+  );
+}
+
+function isGitAncestor(cwd, ancestorCommit, descendantCommit) {
+  const result = spawnSync(
+    'git',
+    ['-C', cwd, 'merge-base', '--is-ancestor', ancestorCommit, descendantCommit],
+    { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }
+  );
+  return !result.error && result.status === 0;
+}
+
+function runGitNameList(cwd, args, options = {}) {
+  const result = spawnSync('git', ['-C', cwd, ...args], {
+    encoding: 'buffer',
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  if (result.error || result.status !== 0) {
+    if (options.allowFailure) return [];
+    const detail = Buffer.isBuffer(result.stderr)
+      ? result.stderr.toString('utf8').trim()
+      : String(result.stderr || '').trim();
+    throw runtimeLineageError(
+      'RUNTIME_SOURCE_LINEAGE_REQUIRED',
+      `无法检查 Runtime Git 工作区状态${detail ? `: ${detail}` : ''}`
+    );
+  }
+  const stdout = Buffer.isBuffer(result.stdout)
+    ? result.stdout
+    : Buffer.from(result.stdout || '');
+  return stdout
+    .toString('utf8')
+    .split('\0')
+    .filter(Boolean);
+}
+
+function normalizeRuntimeSourceRevision(value, options = {}) {
+  if (value === undefined || value === null || value === '') {
+    if (options.optional) return null;
+    throw runtimeLineageError(
+      'RUNTIME_SOURCE_LINEAGE_REQUIRED',
+      'Runtime source revision 缺失'
+    );
+  }
+  let input = value;
+  if (typeof input === 'string') {
+    try {
+      input = JSON.parse(input);
+    } catch {
+      input = null;
+    }
+  }
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw runtimeLineageError(
+      'RUNTIME_SOURCE_LINEAGE_REQUIRED',
+      '线上 Runtime source revision 无效'
+    );
+  }
+  const repo = String(input.repo || input.repositoryId || '').trim();
+  const baseCommit = String(input.baseCommit || '').trim().toLowerCase();
+  const treeHash = String(input.treeHash || '').trim().toLowerCase();
+  if (
+    !/^sha256:[0-9a-f]{64}$/i.test(repo) ||
+    !/^[0-9a-f]{40,64}$/.test(baseCommit) ||
+    !/^[0-9a-f]{40,64}$/.test(treeHash)
+  ) {
+    throw runtimeLineageError(
+      'RUNTIME_SOURCE_LINEAGE_REQUIRED',
+      '线上 Runtime source revision 缺少有效的 repo/baseCommit/treeHash'
+    );
+  }
+  return { repo, baseCommit, treeHash };
+}
+
+function normalizeAppSnapshot(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
+  return value.app || value.application || value;
+}
+
+function normalizeNullableString(value) {
+  const text = String(value === undefined || value === null ? '' : value).trim();
+  return text || null;
+}
+
+function normalizeGitPath(value) {
+  return String(value || '')
+    .replace(/\\/g, '/')
+    .replace(/^\.\//, '')
+    .replace(/^\/+|\/+$/g, '');
+}
+
+function summarizePaths(paths, limit = 8) {
+  const selected = paths.slice(0, limit).join(', ');
+  return paths.length > limit ? `${selected}（另有 ${paths.length - limit} 项）` : selected;
+}
+
+function shortCommit(value) {
+  return String(value || '').slice(0, 12) || '-';
+}
+
+function formatCause(error) {
+  const message = String(error?.message || '').trim();
+  return message ? ` 原因: ${message}` : '';
+}
+
+function stripUndefinedValues(value) {
+  return Object.fromEntries(
+    Object.entries(value).filter(([, item]) => item !== undefined)
+  );
+}
+
+function runtimeLineageError(code, message, details = {}) {
+  const error = new Error(`[${code}] ${message}`);
+  error.code = code;
+  Object.assign(error, details);
+  return error;
+}
+
+module.exports = {
+  MIN_ROLLBACK_REASON_LENGTH,
+  isPureRuntimeOutputPath,
+  listRuntimeBuildInputChanges,
+  normalizeRuntimeSourceRevision,
+  prepareRuntimeDeployLineage,
+  resolveRuntimeRollbackBypass,
+};