openxiangda 1.0.166 → 1.0.168

package/README.md

@@ -56,7 +56,7 @@ User tokens are stored in `~/.openxiangda/profiles.json` with `0600` permissions
 
 React SPA workspaces publish their frontend with `openxiangda runtime deploy`. Every finalized Runtime release is built from a clean, committed Git `HEAD`; the CLI freezes `sourceRevision`, the current active release, and its source revision before any build/upload. Deploy fails with `RUNTIME_SOURCE_BASE_DIVERGED` when its `HEAD` does not descend from the online Runtime source, including with `--no-activate`, so an old isolated worktree cannot stage and later activate a silent rollback. `.openxiangda/`, `openspec/`, `dist/`, and other pure generated/governance/state paths do not make the source dirty, but `--no-build` cannot bypass the lineage gate. An intentional rollback requires `--allow-runtime-rollback --reason "<at least 8 characters>"`, which is persisted for audit and never bypasses dirty/non-Git checks.
 
-Concurrent development may still upload immutable previews with `--no-activate`, but the preview must also freeze a real clean Git source revision before it can become a release. Final promotion uses `release begin/end` so one `(tenant, app)` has one writer while other worktrees keep developing and testing. `release begin --change <change>` binds the per-task `clientSessionId` (Codex uses `CODEX_THREAD_ID`), keeps the earlier change base separate, and freezes the actual clean publish `HEAD` plus the selected remote resource-field heads. That publish commit must already contain the current authoritative remote default branch, and it cannot change during the release. Before the first live write, the CLI preflights the complete selected set. A stale resource worktree fails with `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`; a selected remote field that moved after the baseline fails with `RESOURCE_FIELD_CONFLICT`. Resolve the divergence, rebuild/re-plan, and start a new release instead of retrying a stale payload. The default upload mode is `auto`: it tries staged multipart first, then falls back to built-in OSS direct upload if the staged file API returns HTTP 403. Use `--upload-mode oss-direct` to force built-in OSS direct upload, or `--upload-mode legacy-json` only as a compatibility fallback for older platforms. Upload progress, timeout, and `traceId` are written to stderr; `--json` stdout remains the final JSON result.
+Concurrent development may still upload immutable previews with `--no-activate`, but the preview must also freeze a real clean Git source revision before it can become a release. Final promotion uses `release begin/end` so one `(tenant, app)` has one writer while other worktrees keep developing and testing. `release begin --change <change>` binds the per-task `clientSessionId` (Codex uses `CODEX_THREAD_ID`), keeps the earlier change base separate, and freezes the actual clean publish `HEAD` plus the selected remote resource-field heads. That publish commit must already contain the current authoritative remote default branch, and it cannot change during the release. Before the first live write, the CLI preflights the complete selected set. A stale resource worktree fails with `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`; a selected remote field that moved after the baseline fails with `RESOURCE_FIELD_CONFLICT`. Resolve the divergence, rebuild/re-plan, and start a new release instead of retrying a stale payload. The only exception is a historical catch-up where approved code was already merged to main and the live app demonstrably consists of several older release lineages: exact, non-delete publishes may use `--adopt-online-baseline --adoption-reason "<at least 8 characters>"` together with the same `--change` (or its already-held release lease). This adopts the server-frozen online Function/Automation heads instead of inventing one Git base; Function/Automation still run the server remote-head preflight, and every resource remains inside the app lease, staged-release/CAS path supported by its publisher. It rejects `--all`, `--force`, `--prune`, and every delete plan. The default upload mode is `auto`: it tries staged multipart first, then falls back to built-in OSS direct upload if the staged file API returns HTTP 403. Use `--upload-mode oss-direct` to force built-in OSS direct upload, or `--upload-mode legacy-json` only as a compatibility fallback for older platforms. Upload progress, timeout, and `traceId` are written to stderr; `--json` stdout remains the final JSON result.
 
 After a live promotion, merge or fast-forward the exact frozen publish commit into the authoritative default branch and push it before closing the task. `openxiangda release integration-status --profile <name>` checks the live remote tip; normal `release end` keeps the reconciliation evidence and returns `RELEASE_MAIN_MERGE_PENDING` until that exact SHA is present. Squash/rebase does not preserve the published commit and therefore does not pass. The authoritative target is always the live default `main`/`master` of `origin` (or the repository's sole remote); CLI flags, environment variables, local-only branches, and lease expiry cannot bypass it. OpenXiangda's own `npm publish` and the platform image release script apply the stronger pre-release form of the same rule: root and pinned submodule commits must already be in their remote default branches.
 

package/lib/cli.js

@@ -8665,6 +8665,7 @@ async function resource(args) {
       '  - Function/Automation 可用 --stage-only 只 prepare + verify Backend Release；随后把返回的 stagedResource 交给 release app-finalize 原子激活。',
       '  - publish --dry-run 等价于发布前计划，不会写平台资源。',
       '  - 在线 publish 必须用 --only/--code 精确选择；真正全量发布必须显式 --all --reason，SDD bypass 不能绕过此范围门。',
+      '  - 历史代码已先合入主线、线上又来自多次分批发布时，可显式使用 --adopt-online-baseline --adoption-reason "..."；仅允许绑定同一 change/lease 的精确非删除范围，仍保留 lease、冻结 head 检查与写入 CAS。',
       '  - 源码依赖触发的 Function/Automation 更新默认只替换 source snapshot，保留线上 bindings/schema/metadata；显式替换 manifest 必须加 --replace-manifest --reason。',
       '  - --only/--code 会在读取/分析 manifest 与构建源码前按逻辑资源 code 早期收窄；也支持 function:foo 这类带类型 selector。',
       '  - type 可选: workflow, notification, route, menu, role, permission, data-view, function, connector 等。',
@@ -8931,6 +8932,45 @@ function assertExplicitManifestReplacement(flags) {
   }
 }
 
+function resolveOnlineBaselineAdoption(
+  flags = {},
+  planActions = [],
+  publishLease = null
+) {
+  if (!flags['adopt-online-baseline']) return null;
+  const reason = String(
+    flags['adoption-reason'] || flags.reason || ''
+  ).trim();
+  if (reason.length < 8) {
+    fail(
+      '--adopt-online-baseline 必须提供至少 8 个字符的 --adoption-reason，说明为何线上资源无法对应单一 Git 基线'
+    );
+  }
+  const changeId = String(flags.change || publishLease?.changeId || '').trim();
+  if (!changeId) {
+    fail(
+      '--adopt-online-baseline 必须与 --change <id> 或已持有的同 change 发布租约一起使用'
+    );
+  }
+  if (flags.all || flags.force || flags.prune) {
+    fail('--adopt-online-baseline 禁止与 --all、--force 或 --prune 一起使用');
+  }
+  if (!flags.only && !flags.code) {
+    fail('--adopt-online-baseline 只允许 --only/--code 精确资源范围');
+  }
+  const deletes = (planActions || []).filter(
+    action => action?.action === 'delete'
+  );
+  if (deletes.length > 0) {
+    fail('--adopt-online-baseline 禁止任何 delete 计划');
+  }
+  return {
+    mode: 'frozen_online_heads_v1',
+    changeId,
+    reason,
+  };
+}
+
 function buildResourceManifestSddTargets(manifest, planActions = []) {
   const codes = key => unique((manifest[key] || []).map(getResourceItemCode).filter(Boolean)).sort();
   const deletedCodes = kind =>
@@ -14483,6 +14523,7 @@ function runGenericResourceGitBasePreflight({
   baseline,
   publishLease,
   targets,
+  onlineBaselineAdoption = null,
 }) {
   if (!targets.length) return null;
   const publishLeaseId = String(
@@ -14508,6 +14549,26 @@ function runGenericResourceGitBasePreflight({
   const selectors = unique(
     targets.map(item => `${item.resourceKey}:${item.code}`)
   ).sort();
+  if (onlineBaselineAdoption) {
+    return {
+      ok: true,
+      baselineId: baseline.baselineId,
+      publishLeaseId,
+      headDigest,
+      baseCommit,
+      checkedTargets: targets.map(({ kind, code, action }) => ({
+        kind,
+        code,
+        action,
+      })),
+      selectors,
+      planRuns: 0,
+      cached: false,
+      readOnly: true,
+      gitBasePlanSkipped: true,
+      onlineBaselineAdoption,
+    };
+  }
   const typeFilters = unique(manifest.resourceTypeFilters || []).sort();
   const cacheKey = canonicalJsonSha256({
     publishLeaseId,
@@ -14697,6 +14758,11 @@ async function runResourceChangeBaselinePreflight(
   flags = {},
   publishLease = null
 ) {
+  const onlineBaselineAdoption = resolveOnlineBaselineAdoption(
+    flags,
+    planActions,
+    publishLease
+  );
   const genericTargets = buildGenericResourceGitBaseTargets(planActions, {
     force: Boolean(flags.force),
   });
@@ -14720,19 +14786,22 @@ async function runResourceChangeBaselinePreflight(
     };
   } else {
     const artifactCache = { ...(baseline.localBaseArtifactHashes || {}) };
-    const missingArtifactTargets = targets.filter(targetItem => {
-      const frozen = baseline.resourceHeads?.[targetItem.kind]?.[targetItem.code];
-      const cached = artifactCache[
-        resourceBaselineTargetKey(targetItem.kind, targetItem.code)
-      ];
-      const hasStableLineage =
-        frozen?.fields?.sourceLineageHash &&
-        frozen.fields.sourceLineageHash !== canonicalJsonSha256(null);
-      return (
-        frozen?.fields?.sourceArtifactHash &&
-        (!cached || (hasStableLineage && !cached.sourceHash))
-      );
-    });
+    const missingArtifactTargets = onlineBaselineAdoption
+      ? []
+      : targets.filter(targetItem => {
+          const frozen =
+            baseline.resourceHeads?.[targetItem.kind]?.[targetItem.code];
+          const cached = artifactCache[
+            resourceBaselineTargetKey(targetItem.kind, targetItem.code)
+          ];
+          const hasStableLineage =
+            frozen?.fields?.sourceLineageHash &&
+            frozen.fields.sourceLineageHash !== canonicalJsonSha256(null);
+          return (
+            frozen?.fields?.sourceArtifactHash &&
+            (!cached || (hasStableLineage && !cached.sourceHash))
+          );
+        });
     if (missingArtifactTargets.length > 0) {
       const built = buildGitBaseSourceArtifacts({
         cwd: process.cwd(),
@@ -14758,6 +14827,13 @@ async function runResourceChangeBaselinePreflight(
         };
       }
       const fields = { ...(frozen.fields || {}) };
+      if (onlineBaselineAdoption) {
+        return {
+          kind: targetItem.kind,
+          code: targetItem.code,
+          fields,
+        };
+      }
       const artifact = artifactCache[
         resourceBaselineTargetKey(targetItem.kind, targetItem.code)
       ];
@@ -14813,6 +14889,12 @@ async function runResourceChangeBaselinePreflight(
         },
       },
     );
+    if (onlineBaselineAdoption) {
+      serverPreflight = {
+        ...serverPreflight,
+        onlineBaselineAdoption,
+      };
+    }
   }
 
   const genericResourcePreflight = runGenericResourceGitBasePreflight({
@@ -14821,6 +14903,7 @@ async function runResourceChangeBaselinePreflight(
     baseline,
     publishLease,
     targets: genericTargets,
+    onlineBaselineAdoption,
   });
   return genericResourcePreflight
     ? { ...serverPreflight, genericResourcePreflight }

package/lib/workspace-init.js

@@ -19,6 +19,8 @@ const TEMPLATE_IGNORE_NAMES = new Set([
 const TEMPLATE_IGNORE_PATHS = new Set([
   '.openxiangda/build-cache.json',
   '.openxiangda/build-cache.json.lock',
+  '.openxiangda/build-cache.cli-v4.json',
+  '.openxiangda/build-cache.cli-v4.json.lock',
   '.openxiangda/worktree-owner.json',
   '.openxiangda/worktree-owner.json.lock',
 ]);

package/openxiangda-skills/SKILL.md

@@ -93,7 +93,7 @@ openxiangda release end --profile <name>
 
 `resource plan` and publish dry-runs are strictly GET/HEAD-only. `READ_ONLY_AUTH_REQUIRED` means the access token expired; run `openxiangda auth refresh --profile <name>` or log in again before retrying. Never add an automatic refresh POST inside a plan.
 
-`release begin --change` separately freezes the change base and the actual publish source: a clean committed `HEAD` on a named branch that already contains the current authoritative remote default branch. Before any live write, the CLI preflights the complete target set and rejects source changes during the release. A worktree based on obsolete source fails with `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`; a selected remote field changed after the baseline fails with `RESOURCE_FIELD_CONFLICT`. Resolve/merge, rebuild, and re-plan instead of forcing the old release.
+`release begin --change` separately freezes the change base and the actual publish source: a clean committed `HEAD` on a named branch that already contains the current authoritative remote default branch. Before any live write, the CLI preflights the complete target set and rejects source changes during the release. A worktree based on obsolete source fails with `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`; a selected remote field changed after the baseline fails with `RESOURCE_FIELD_CONFLICT`. Resolve/merge, rebuild, and re-plan instead of forcing the old release. For a one-time historical catch-up only—approved code already merged to main while live resources come from several older release lineages—an exact non-delete publish may add `--adopt-online-baseline --adoption-reason "..."` under the same change/lease. It adopts the server-frozen heads and keeps lease, remote preflight, staged release, and CAS protection; it rejects `--all`, `--force`, `--prune`, and deletes.
 
 After promotion, immediately merge or fast-forward the exact frozen publish commit into the authoritative remote default branch and push it. `release integration-status` reports the result; normal `release end` refuses with `RELEASE_MAIN_MERGE_PENDING` until the remote mainline contains that exact SHA, so squash/rebase merges do not count. The authoritative target comes only from the live remote default `main`/`master`; local-only refs, overrides, and lease expiry cannot clear this obligation. Archive the SDD change from the updated mainline.
 

package/openxiangda-skills/skills/openxiangda-core/SKILL.md

@@ -130,7 +130,7 @@ openxiangda workspace bind --profile dev --app-type APP_XXXX
 
 - Wrong/missing profile: stop before writes and resolve `env`/`auth status`.
 - Dirty shared checkout: isolate the task; do not broaden its change coverage.
-- `SOURCE_BASE_DIVERGED`: the worktree no longer descends from the frozen Git base; merge/rebase onto the reviewed head, rebuild, and start a new release.
+- `SOURCE_BASE_DIVERGED`: the worktree no longer descends from the frozen Git base; merge onto the reviewed head, rebuild, and start a new release. Only when approved code was historically merged before release and the online app has multiple verified release lineages may an exact non-delete catch-up use `--adopt-online-baseline --adoption-reason "..."` under the same change/lease; never use it for a stale branch, delete, prune, force, or full-app wildcard.
 - `RESOURCE_FIELD_CONFLICT`: a selected remote field changed after the frozen baseline; fetch the conflicting fields, reconcile the intended change, and re-plan the whole set before writing anything.
 - `RUNTIME_HEAD_MOVED` or resource revision conflict: fetch the new baseline, merge, rebuild, and re-plan.
 - `RUNTIME_SOURCE_BASE_DIVERGED`: the Runtime build comes from an old/different Git lineage; merge the online release source into a clean committed `HEAD`, rebuild, and retry. Use audited rollback only when the rollback itself is the approved intent.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openxiangda",
-  "version": "1.0.166",
+  "version": "1.0.168",
   "description": "OpenXiangda CLI, workspace build tools, runtime SDK, and form components.",
   "private": false,
   "bin": {

package/templates/openxiangda-react-spa/AGENTS.md

@@ -72,7 +72,7 @@ App Function 第三方凭据只能在 Function manifest 顶层声明 `secretRefs
 
 `openxiangda runtime deploy --no-activate` 会构建并上传不可变预览版本；发布前先提交所有可能进入构建的源码/配置。所有 Runtime deploy（包括 `--no-activate`）都会先获取应用发布 lease，并在任何构建和上传前冻结 clean `HEAD` 与当前 active Runtime 父血缘；旧分支返回 `RUNTIME_SOURCE_BASE_DIVERGED`，不能先上传旧 preview 再激活。`openspec/` SDD 证据和生成/状态目录不算源码 dirty。仅审批的回退可使用 `--allow-runtime-rollback --reason "至少 8 个字符"`；`--no-build` 不会跳过守卫。不要手工修改 `dist/index.html`。
 
-Function/Automation 走 Backend Release v2；同一个 child 可以混合 create、source-only update 与显式 manifest replacement，并对整个集合做 CAS。正式多资源发布必须使用精确 selector 和 `--stage-only`，不得回退为逐资源直写；整包 manifest 替换还必须显式加 `--replace-manifest --reason "..."`。`release begin --change` 会分别冻结 change base 与实际 clean publish HEAD，并要求后者包含当前远端主分支；旧 worktree 返回 `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`，期间远端字段变化返回 `RESOURCE_FIELD_CONFLICT`。上线后先 merge/push 冻结 SHA；正常 `release end` 会以 `RELEASE_MAIN_MERGE_PENDING` 阻断未回合提交。权威目标只取远端实时默认 `main`/`master`，本地分支、覆盖参数和租约过期都不能清除证据。
+Function/Automation 走 Backend Release v2；同一个 child 可以混合 create、source-only update 与显式 manifest replacement，并对整个集合做 CAS。正式多资源发布必须使用精确 selector 和 `--stage-only`，不得回退为逐资源直写；整包 manifest 替换还必须显式加 `--replace-manifest --reason "..."`。`release begin --change` 会分别冻结 change base 与实际 clean publish HEAD，并要求后者包含当前远端主分支；旧 worktree 返回 `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`，期间远端字段变化返回 `RESOURCE_FIELD_CONFLICT`。仅历史代码已先合入主线且线上经确认来自多个旧发布血缘时，精确非删除补发可在同一 change/lease 下加 `--adopt-online-baseline --adoption-reason "..."`；该模式禁止 `--all/--force/--prune/delete`，并保留冻结 head、lease 与 CAS。上线后先 merge/push 冻结 SHA；正常 `release end` 会以 `RELEASE_MAIN_MERGE_PENDING` 阻断未回合提交。权威目标只取远端实时默认 `main`/`master`，本地分支、覆盖参数和租约过期都不能清除证据。
 
 ## 应用结构
 

package/templates/sy-lowcode-app-workspace/AGENTS.md

@@ -53,7 +53,7 @@
 - ✅ 正式多资源开发优先写 `src/resources/**` 后执行 `openxiangda resource validate|plan|publish <type> --only <codes>`；单资源可用 `--code <code>`。直接 CLI 写平台资源时先 `--dry-run`，需要避免漂移就加 `--write-manifest`。
 - ✅ `resource plan` 与 publish dry-run 严格只允许 GET/HEAD；遇到 `READ_ONLY_AUTH_REQUIRED` 时先执行 `openxiangda auth refresh --profile <name>` 或重新登录，不得在 plan 内自动 POST 刷新 token。
 - ✅ Function/Automation 使用 Backend Release v2；正式多资源发布用精确 `--only/--code` 加 `--stage-only` 暂存，同一 child 可混合 create、source-only update 和显式 manifest replacement，再由 Root App finalize 原子激活。整包 manifest 替换必须另加 `--replace-manifest --reason "..."`。
-- ✅ 正式 promotion 先 `openxiangda release begin --change <change> --profile <name>`，冻结实际 clean publish HEAD + change/远端字段 baseline，并在任何 live write 前整体 preflight。旧 worktree 会收到 `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`，期间远端字段变化会收到 `RESOURCE_FIELD_CONFLICT`。所有 publish/activate 继续传同一 `--change`；上线后 merge/push 冻结 SHA，运行 `release integration-status`，再正常 `release end`。未回合会收到 `RELEASE_MAIN_MERGE_PENDING`；权威目标只取远端实时默认 `main`/`master`，本地分支、覆盖参数和租约过期都不能清除证据。
+- ✅ 正式 promotion 先 `openxiangda release begin --change <change> --profile <name>`，冻结实际 clean publish HEAD + change/远端字段 baseline，并在任何 live write 前整体 preflight。旧 worktree 会收到 `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`，期间远端字段变化会收到 `RESOURCE_FIELD_CONFLICT`。只有历史代码已先合入主线、且线上确认来自多个旧发布血缘时，精确非删除补发才可在同一 change/lease 下使用 `--adopt-online-baseline --adoption-reason "..."`；禁止 `--all/--force/--prune/delete`。所有 publish/activate 继续传同一 `--change`；上线后 merge/push 冻结 SHA，运行 `release integration-status`，再正常 `release end`。未回合会收到 `RELEASE_MAIN_MERGE_PENDING`；权威目标只取远端实时默认 `main`/`master`，本地分支、覆盖参数和租约过期都不能清除证据。
 
 ## 严禁