openxiangda 1.0.162 → 1.0.164

package/README.md

@@ -56,7 +56,9 @@ User tokens are stored in `~/.openxiangda/profiles.json` with `0600` permissions
 
 React SPA workspaces publish their frontend with `openxiangda runtime deploy`. Every finalized Runtime release is built from a clean, committed Git `HEAD`; the CLI freezes `sourceRevision`, the current active release, and its source revision before any build/upload. Deploy fails with `RUNTIME_SOURCE_BASE_DIVERGED` when its `HEAD` does not descend from the online Runtime source, including with `--no-activate`, so an old isolated worktree cannot stage and later activate a silent rollback. `.openxiangda/`, `openspec/`, `dist/`, and other pure generated/governance/state paths do not make the source dirty, but `--no-build` cannot bypass the lineage gate. An intentional rollback requires `--allow-runtime-rollback --reason "<at least 8 characters>"`, which is persisted for audit and never bypasses dirty/non-Git checks.
 
-Concurrent development may still upload immutable previews with `--no-activate`, but the preview must also freeze a real clean Git source revision before it can become a release. Final promotion uses `release begin/end` so one `(tenant, app)` has one writer while other worktrees keep developing and testing. `release begin --change <change>` binds the per-task `clientSessionId` (Codex uses `CODEX_THREAD_ID`) and freezes both the reviewed Git source base and the selected remote resource-field heads. Before the first live write, the CLI preflights the complete selected set. A stale resource worktree fails with `SOURCE_BASE_DIVERGED`; a selected remote field that moved after the baseline fails with `RESOURCE_FIELD_CONFLICT`. Resolve the divergence, rebuild/re-plan, and start a new release instead of retrying a stale payload. The default upload mode is `auto`: it tries staged multipart first, then falls back to built-in OSS direct upload if the staged file API returns HTTP 403. Use `--upload-mode oss-direct` to force built-in OSS direct upload, or `--upload-mode legacy-json` only as a compatibility fallback for older platforms. Upload progress, timeout, and `traceId` are written to stderr; `--json` stdout remains the final JSON result.
+Concurrent development may still upload immutable previews with `--no-activate`, but the preview must also freeze a real clean Git source revision before it can become a release. Final promotion uses `release begin/end` so one `(tenant, app)` has one writer while other worktrees keep developing and testing. `release begin --change <change>` binds the per-task `clientSessionId` (Codex uses `CODEX_THREAD_ID`), keeps the earlier change base separate, and freezes the actual clean publish `HEAD` plus the selected remote resource-field heads. That publish commit must already contain the current authoritative remote default branch, and it cannot change during the release. Before the first live write, the CLI preflights the complete selected set. A stale resource worktree fails with `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`; a selected remote field that moved after the baseline fails with `RESOURCE_FIELD_CONFLICT`. Resolve the divergence, rebuild/re-plan, and start a new release instead of retrying a stale payload. The default upload mode is `auto`: it tries staged multipart first, then falls back to built-in OSS direct upload if the staged file API returns HTTP 403. Use `--upload-mode oss-direct` to force built-in OSS direct upload, or `--upload-mode legacy-json` only as a compatibility fallback for older platforms. Upload progress, timeout, and `traceId` are written to stderr; `--json` stdout remains the final JSON result.
+
+After a live promotion, merge or fast-forward the exact frozen publish commit into the authoritative default branch and push it before closing the task. `openxiangda release integration-status --profile <name>` checks the live remote tip; normal `release end` keeps the reconciliation evidence and returns `RELEASE_MAIN_MERGE_PENDING` until that exact SHA is present. Squash/rebase does not preserve the published commit and therefore does not pass. The authoritative target is always the live default `main`/`master` of `origin` (or the repository's sole remote); CLI flags, environment variables, local-only branches, and lease expiry cannot bypass it. OpenXiangda's own `npm publish` and the platform image release script apply the stronger pre-release form of the same rule: root and pinned submodule commits must already be in their remote default branches.
 
 Source-triggered Function and Automation publishing is source-only by default. On a current platform, every eligible existing Function and Automation in one command is uploaded, prepared, verified, and activated through one immutable Backend Release transaction; a stale target therefore causes zero resource writes instead of failing halfway through 88 Functions and 11 Automations. The release preserves online `resourceBindings`, input/output contracts, descriptive metadata, trigger/view configuration, and enabled/published state, and planned noops do not advance resource versions or timestamps. Only an older platform whose Backend Release `head` route explicitly returns HTTP 404 uses the compatibility per-resource source PATCH, with a warning on stderr. To intentionally make a complete local manifest replace the online definition, select exact codes and opt in explicitly with `--replace-manifest --reason "<why this replacement is safe>"`; `--sdd-bypass` does not widen that scope.
 
@@ -119,7 +121,9 @@ openxiangda resource publish function --code customer_get --change <change> --pr
   --replace-manifest --reason "reviewed manifest is the complete desired definition"
 ```
 
-For source-only Function/Automation changes, the final command does not reconstruct whole definitions with client-side GET+PUT. `release begin` captures the Git/change baseline, one preflight covers every selected code, and Backend Release performs one `prepare -> verify -> activate` sequence for all eligible updates. Inspect history with `openxiangda release backend-head|backend-list|backend-detail`, compare it with `backend-diff`, or create an audited immutable rollback with `backend-rollback <releaseId> --change <change> --reason "..."`. Always run `release end` when promotion finishes or is abandoned.
+Exact `--only` / `--code` selectors are applied before unrelated manifests, source dependencies, and JS_CODE targets are read or built. Shared/transitive dependencies of the selected targets remain in scope; omitting a selector intentionally preserves full-workspace validation and planning. Resource commands use the packaged canonical scoped builder for standard workspaces, so an older checked-in `scripts/build-js-code.mjs` does not need to be upgraded before the installed CLI gains this optimization; refresh the workspace template only when developers also need the same behavior from a manual `pnpm build-js-code` command.
+
+For source-only Function/Automation changes, the final command does not reconstruct whole definitions with client-side GET+PUT. `release begin` captures the Git/change baseline, one preflight covers every selected code, and Backend Release performs one `prepare -> verify -> activate` sequence for all eligible updates. Inspect history with `openxiangda release backend-head|backend-list|backend-detail`, compare it with `backend-diff`, or create an audited immutable rollback with `backend-rollback <releaseId> --change <change> --reason "..."`. Always merge/push the frozen SHA and run `release end` when promotion finishes. A lost or expired lease retains the pending-mainline evidence instead of silently clearing it.
 
 Page repair publishing is staged by default. It first freezes `pages/snapshot`, sends the active Page Release parent plus every page revision, and uses revision `0` only for a genuinely new page. Review with `openxiangda page head|releases|detail|diff`; activate an immutable complete release explicitly with `page activate <releaseId> --change <change>`. Historical activation requires `page rollback <releaseId> --rollback --change <change> --reason "..."`. Parent or revision conflicts are never refreshed or retried automatically.
 

package/lib/change-baseline.js

@@ -111,6 +111,75 @@ function clearChangeBaseline(target, baselineIdOrOptions, maybeOptions = {}) {
   return true;
 }
 
+function clearChangeBaselineForReconciliation(target, expected = {}, options = {}) {
+  const baseline = target?.bound?.promotion?.changeBaseline;
+  if (!baseline || typeof baseline !== 'object' || Array.isArray(baseline)) return false;
+  assertStoredChangeBaseline(target, baseline, {
+    ...options,
+    access: 'reconciliation-read',
+  });
+
+  const expectedBaselineId = normalizeOptionalString(expected.baselineId || expected.id);
+  const expectedChangeId = normalizeOptionalString(expected.changeId);
+  const expectedClientSessionId = normalizeOptionalString(expected.clientSessionId);
+  const expectedSourceCommit = normalizeOptionalString(
+    expected.releaseSourceRevision?.baseCommit || expected.sourceCommit
+  );
+  const hasExpectedLeaseId = Object.prototype.hasOwnProperty.call(
+    expected,
+    'leaseId'
+  );
+  const expectedLeaseId = normalizeOptionalString(expected.leaseId);
+  if (
+    !expectedBaselineId ||
+    !expectedChangeId ||
+    !expectedClientSessionId ||
+    !expectedSourceCommit ||
+    !hasExpectedLeaseId
+  ) {
+    throw changeBaselineError(
+      'CHANGE_BASELINE_RECONCILIATION_INVALID',
+      'reconciliation 清理必须提供精确 baselineId/changeId/clientSessionId/sourceCommit/leaseId（无 lease 时显式传 null）'
+    );
+  }
+
+  if (
+    normalizeOptionalString(baseline.baselineId || baseline.id) !== expectedBaselineId ||
+    normalizeOptionalString(baseline.changeId) !== expectedChangeId ||
+    normalizeOptionalString(baseline.clientSessionId) !== expectedClientSessionId ||
+    normalizeOptionalString(baseline.releaseSourceRevision?.baseCommit) !== expectedSourceCommit
+  ) {
+    return false;
+  }
+
+  const lease = target?.bound?.promotion?.publishLease;
+  if (expectedLeaseId) {
+    if (
+      !lease ||
+      normalizeOptionalString(lease.leaseId) !== expectedLeaseId ||
+      normalizeOptionalString(lease.changeId) !== expectedChangeId ||
+      normalizeOptionalString(lease.clientSessionId) !== expectedClientSessionId ||
+      normalizeOptionalString(lease.workspace?.commit) !== expectedSourceCommit
+    ) {
+      return false;
+    }
+  } else if (lease) {
+    return false;
+  }
+
+  // Validate both pieces of release evidence before mutating either one, then
+  // persist once so a failed baseline CAS can never leave a lease-only partial
+  // cleanup behind.
+  target.bound.promotion = { ...(target.bound.promotion || {}) };
+  delete target.bound.promotion.publishLease;
+  delete target.bound.promotion.changeBaseline;
+  if (Object.keys(target.bound.promotion).length === 0) {
+    delete target.bound.promotion;
+  }
+  persistTargetState(target, options);
+  return true;
+}
+
 function isChangeBaselineOwnedByCurrentSession(baseline, env = process.env) {
   const ownerThreadId = getChangeBaselineOwnerThreadId(baseline);
   if (!ownerThreadId) return true;
@@ -129,11 +198,24 @@ function readGitSourceBase(cwd = process.cwd(), baseRef = 'HEAD') {
   ]).trim();
   assertGitObjectId(treeHash, 'treeHash');
 
-  const remote = tryRunGit(repository.root, [
+  let remote = tryRunGit(repository.root, [
     'config',
     '--get',
     'remote.origin.url',
   ]).trim();
+  if (!remote) {
+    const remotes = tryRunGit(repository.root, ['remote'])
+      .split(/\r?\n/)
+      .map(item => item.trim())
+      .filter(Boolean);
+    if (remotes.length === 1) {
+      remote = tryRunGit(repository.root, [
+        'config',
+        '--get',
+        `remote.${remotes[0]}.url`,
+      ]).trim();
+    }
+  }
   const commonGitDirValue = tryRunGit(repository.root, [
     'rev-parse',
     '--path-format=absolute',
@@ -530,7 +612,10 @@ function assertStoredChangeBaseline(target, baseline, options = {}) {
       `change baseline 属于 profile ${baselineProfile || '<missing>'}，不能用于 ${identity.profile}`
     );
   }
-  if (!isChangeBaselineOwnedByCurrentSession(baseline, options.env || process.env)) {
+  if (
+    options.access !== 'reconciliation-read' &&
+    !isChangeBaselineOwnedByCurrentSession(baseline, options.env || process.env)
+  ) {
     throw ownershipError(
       getChangeBaselineOwnerThreadId(baseline),
       currentCodexThreadId(options.env || process.env)
@@ -1068,6 +1153,7 @@ module.exports = {
   buildGitBaseSourceArtifacts,
   canonicalJsonSha256,
   clearChangeBaseline,
+  clearChangeBaselineForReconciliation,
   getStoredChangeBaseline,
   isChangeBaselineOwnedByCurrentSession,
   readGitSourceBase,