openxiangda 1.0.170 → 1.0.172

package/README.md

@@ -39,11 +39,12 @@ openxiangda sdd approve add-customer-page --summary "用户确认"
 openxiangda sdd verify add-customer-page --changed --stage implementation --profile dev
 openxiangda resource validate function --only customer_get,customer_save --profile dev
 openxiangda resource plan function --only customer_get,customer_save --profile dev
-openxiangda runtime deploy --change add-customer-page --profile dev --no-activate --json
-openxiangda sdd verify add-customer-page --changed --stage prepublish --profile dev
-openxiangda release begin --change add-customer-page --profile dev
-openxiangda resource publish function --only customer_get,customer_save --stage-only --change add-customer-page --profile dev
-openxiangda release app-finalize --staged-resources-json .openxiangda/releases/add-customer-page/staged-resources.json --change add-customer-page --profile dev
+# merge/push approved task commits to main, then create and push one release bundle
+openxiangda sdd bundle mainline-release --changes add-customer-page,fix-customer-api
+openxiangda sdd verify mainline-release --changed --stage prepublish --profile dev
+openxiangda release begin --change mainline-release --profile dev
+# execute the canonical staged commands emitted by the release plan
+openxiangda release integration-status --profile dev
 openxiangda release end --profile dev
 openxiangda resource explain public-access --json
 openxiangda inspect app --profile dev --json
@@ -56,9 +57,9 @@ User tokens are stored in `~/.openxiangda/profiles.json` with `0600` permissions
 
 React SPA workspaces publish their frontend with `openxiangda runtime deploy`. Every finalized Runtime release is built from a clean, committed Git `HEAD`; the CLI freezes `sourceRevision`, the current active release, and its source revision before any build/upload. Deploy fails with `RUNTIME_SOURCE_BASE_DIVERGED` when its `HEAD` does not descend from the online Runtime source, including with `--no-activate`, so an old isolated worktree cannot stage and later activate a silent rollback. `.openxiangda/`, `openspec/`, `dist/`, and other pure generated/governance/state paths do not make the source dirty, but `--no-build` cannot bypass the lineage gate. An intentional rollback requires `--allow-runtime-rollback --reason "<at least 8 characters>"`, which is persisted for audit and never bypasses dirty/non-Git checks.
 
-Concurrent development may still upload immutable previews with `--no-activate`, but the preview must also freeze a real clean Git source revision before it can become a release. Final promotion uses `release begin/end` so one `(tenant, app)` has one writer while other worktrees keep developing and testing. `release begin --change <change>` binds the per-task `clientSessionId` (Codex uses `CODEX_THREAD_ID`), keeps the earlier change base separate, and freezes the actual clean publish `HEAD` plus the selected remote resource-field heads. That publish commit must already contain the current authoritative remote default branch, and it cannot change during the release. Before the first live write, the CLI preflights the complete selected set. A stale resource worktree fails with `SOURCE_BASE_DIVERGED`/`RELEASE_SOURCE_BEHIND_MAIN`; a selected remote field that moved after the baseline fails with `RESOURCE_FIELD_CONFLICT`. Resolve the divergence, rebuild/re-plan, and start a new release instead of retrying a stale payload. The only exception is a historical catch-up where approved code was already merged to main and the live app demonstrably consists of several older release lineages: exact, non-delete publishes may use `--adopt-online-baseline --adoption-reason "<at least 8 characters>"` together with the same `--change` (or its already-held release lease). This adopts the server-frozen online Function/Automation heads instead of inventing one Git base; Function/Automation still run the server remote-head preflight, and every resource remains inside the app lease, staged-release/CAS path supported by its publisher. It rejects `--all`, `--force`, `--prune`, and every delete plan. The default upload mode is `auto`: it tries staged multipart first, then falls back to built-in OSS direct upload if the staged file API returns HTTP 403. Use `--upload-mode oss-direct` to force built-in OSS direct upload, or `--upload-mode legacy-json` only as a compatibility fallback for older platforms. Upload progress, timeout, and `traceId` are written to stderr; `--json` stdout remains the final JSON result.
+Parallel tasks develop and test in isolated worktrees, but feature worktrees do not publish. After approved commits are merged and pushed, `sdd bundle <release-change> --changes ...` unions their exact structured scope. Commit/push the bundle, then run one promotion from a clean local main/master whose commit exactly equals the authoritative remote tip. `release begin` rejects feature branches and unpushed/diverged mainline before any platform write. Runtime build readiness is also checked before lease acquisition; the CLI executes the declared build through `npm run build`, which works with pnpm worktree symlinked dependencies without reinstalling or changing the lock file. The protected upload plan still precedes the actual build because its provider-specific `assetBaseUrl` is compiled into the bundle.
 
-After a live promotion, merge or fast-forward the exact frozen publish commit into the authoritative default branch and push it before closing the task. `openxiangda release integration-status --profile <name>` checks the live remote tip; normal `release end` keeps the reconciliation evidence and returns `RELEASE_MAIN_MERGE_PENDING` until that exact SHA is present. Squash/rebase does not preserve the published commit and therefore does not pass. The authoritative target is always the live default `main`/`master` of `origin` (or the repository's sole remote); CLI flags, environment variables, local-only branches, and lease expiry cannot bypass it. OpenXiangda's own `npm publish` and the platform image release script apply the stronger pre-release form of the same rule: root and pinned submodule commits must already be in their remote default branches.
+Because promotion starts from an already-pushed authoritative mainline commit, `openxiangda release integration-status --profile <name>` should pass immediately after activation. Run it and `release end`; there is no post-release merge step.
 
 Source-triggered Function and Automation publishing is source-only by default. Backend Release v2 can mix create, source-only update, and manifest replacement update in one immutable child; a stale target therefore causes zero resource writes instead of failing halfway through 88 Functions and 11 Automations. `--stage-only` stops after verification, reports all handled selectors, and never falls back to direct Function/Automation writes when the platform is missing or incompatible. The release preserves online `resourceBindings`, input/output contracts, descriptive metadata, trigger/view configuration, and enabled/published state, and planned noops do not advance resource versions or timestamps. To intentionally make a complete local manifest replace the online definition, select exact codes and opt in explicitly with `--replace-manifest --reason "<why this replacement is safe>"`; `--sdd-bypass` does not widen that scope. Standard workspaces use the CLI-bundled scoped builder without spawning workspace `pnpm`, and `source_lineage_v1` compares authored source/dependencies independently from generated bundle bytes.
 
@@ -94,9 +95,9 @@ Domestic npm mirrors may lag and return an older OpenXiangda version. `openxiang
 
 Architecture-class requests are plan-gated by default. For new apps, complex pages, login/register, public/no-login access, role/data-scope design, workflow/automation, App Function, connector, notification, and external integration work, AI agents must plan first and implement only after the user confirms the design.
 
-Risk is tiered. Read-only/docs/tests are L0. Narrow reversible copy/style or single existing binding fixes are L1 and use `openxiangda sdd quick` to record exact files/resources plus the user's already-explicit intent; do not add a second proposal/approval ceremony to such a small change. Function quick fixes additionally require the complete negative risk assessment. Schema, business Functions, Automation/Workflow, permissions, auth/public access, data writes, and runtime/config are L2; irreversible production or app-wide changes are L3. L2/L3 use an explicit SDD change from context through plan/check/verify/publish/archive. `verify --stage implementation` deliberately does not block coding on unfinished prose/checklists; plain `verify` stops at the prepublish boundary and never demands future postpublish/archive evidence. Exact argv and staged-child scope become strict only at the write/finalize boundary. Emergency releases can still use `--sdd-bypass --reason "..."` and remain auditable.
+Risk is tiered. Read-only/docs/tests are L0. Narrow reversible fixes are L1 and use `sdd quick`; L2/L3 retain explicit approval and exact structured coverage. SDD is streamlined by default: incomplete task/evidence/spec prose warns but does not block. Workspaces that intentionally require prose completion may set `strictDocumentation: true`. Actual argv, exact scope, mainline identity, lease, CAS, destructive operations, Secrets, and Root App atomic activation remain hard gates.
 
-Every concurrent task should use its own Git worktree/branch. `sdd propose|quick|context` automatically claims the current worktree for the active `CODEX_THREAD_ID`; a second task receives `WORKTREE_OWNED_BY_ANOTHER_TASK` before it can publish through the shared directory. Inspect or explicitly release ownership with `openxiangda workspace ownership status|release`; forced takeover requires a reason. Live `resource publish` requires exact `--only <codes>` or `--code <code>`; an app-wide publish needs explicit `--all --reason`, even when SDD is bypassed. The approved change scope, not the checkout's global dirty set, is the release boundary.
+Every concurrent task uses its own Git worktree/branch and development change. The mainline release coordinator bundles selected approved changes after merge; dependency impact outside the approved scope is reported as a warning rather than silently widening a small release. Live commands still require canonical exact selectors, and app-wide/delete operations need explicit authority.
 
 Before confirmation, agents may read, inspect, snapshot, dry-run, ask questions, and output/write the architecture document. They must not edit source files, mutate platform resources, publish, deploy, send notifications, or call live write/delete endpoints.
 

package/lib/cli.js

@@ -105,6 +105,7 @@ const {
   approveSddChange,
   buildSddGovernanceReport,
   buildSddStatus,
+  createMainlineSddBundle,
   createQuickSddChange,
   getSddChangeScope,
   initSddWorkspace,
@@ -219,7 +220,7 @@ Usage:
   openxiangda open-api spec tags|list|describe [operationId|path] [--method post] [--tag name] [--search text] [--json]
   openxiangda open-api credential list|get|create|update|rotate-secret [id] [--profile name] [--show-secret] [--yes] [--json]
   openxiangda design gates|template|review [--topic code] [--json]
-  openxiangda sdd init|migrate|propose|quick|approve|status|context|verify|sync|archive [change] [--change id] [--json]
+  openxiangda sdd init|migrate|propose|quick|bundle|approve|status|context|verify|sync|archive [change] [--change id] [--json]
   openxiangda release begin|status|integration-status|renew|end [--change id] [--profile name] [--json]
   openxiangda release backend-head|backend-list|backend-detail|backend-diff|backend-rollback|backend-abort|backend-retry [releaseId] [--profile name] [--json]
   openxiangda release app-capture|app-head|app-list|app-detail|app-diff|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort [releaseId] [--staged-resources-json <JSON|file>] [--activate-staged-children] [--profile name] [--json]
@@ -287,7 +288,7 @@ Usage:
 
 OpenXiangda 应用开发使用普通用户登录 token，不需要 AK/SK；外部后端集成使用 open-api skill 与 AK/SK。
 所有直接配置写入必须携带 --change <id>，或先执行 release begin --change <id>；dry-run、schema-plan、validate、query/invoke 等只读/数据面命令不会获取发布租约。
-正式发布会冻结 clean committed HEAD；上线后必须将该 SHA merge/fast-forward 并 push 到权威远端主分支，integration-status 通过后 normal release end 才会清理会话。
+正式发布只接受已经合并并 push、且与权威远端默认主分支完全一致的 clean HEAD；激活后直接运行 integration-status 与 release end，不再补做发布后合并。
 表单页、流程表单页和代码页的主链路是 sy-lowcode-app-workspace + openxiangda workspace publish。
 新 React SPA 公开访问使用 public-access 命令和 src/resources/public-access；settings public-access 仅用于旧表单公开设置兼容/修复。
 JS_CODE V2 使用 trusted_node；AI 源码必须写在 src/js-code-nodes/<scriptCode>/index.ts，代码自动化源码写在 src/automations/<resourceCode>/index.ts。definition-json 中的 sourceFile.localPath 会在 validate/create/publish 时先 TS 校验、再构建并上传为快照。`);
@@ -644,12 +645,13 @@ async function sdd(args) {
   const { flags, positional } = parseArgs(rest);
   if (wantsSubcommandHelp(subcommand, flags)) {
     print([
-      '用法: openxiangda sdd init|migrate|propose|quick|approve|status|context|verify|sync|archive [change] [--change id] [--json]',
+      '用法: openxiangda sdd init|migrate|propose|quick|bundle|approve|status|context|verify|sync|archive [change] [--change id] [--json]',
       '常用流程:',
       '  openxiangda sdd init --upgrade',
       '  openxiangda sdd propose add-customer-list --title "客户列表" --forms customer --pages customer_list --resources',
       '  openxiangda sdd quick tune-customer-copy --kind copy --pages customer_list --files src/pages/customer_list/index.tsx --summary "用户确认小范围文案调整"',
       '  openxiangda sdd approve add-customer-list --summary "用户确认设计"',
+      '  openxiangda sdd bundle mainline-release --changes add-customer-list,fix-order-log',
       '  openxiangda sdd context --change add-customer-list --json',
       '  openxiangda sdd verify --change add-customer-list --stage prepublish --json',
       '  openxiangda sdd archive --change add-customer-list',
@@ -661,7 +663,9 @@ async function sdd(args) {
       '  - 在 Codex 中 propose/quick/context 会按 CODEX_THREAD_ID 占用当前 worktree；其他任务必须切换到独立 worktree。',
       '  - quick 仅用于 L1 精确小改动；Function quick 还必须提供完整 --risk-json，不能用 riskTier 标签绕过。',
       '  - verify stage 可选 implementation、prepublish、postpublish、archive；不传保持旧版全量校验。',
-      '  - 新 release 会把实际 publish HEAD 写入 release.json；archive（包括 --force）要求该 SHA 已进入权威远端主分支。',
+      '  - 默认 streamlined 校验只把 approval、精确资源/文件范围、实际发布命令作为硬门禁；任务、证据和规格文案仅告警。配置 strictDocumentation: true 可恢复严格文档门禁。',
+      '  - bundle 聚合多个 approved change；提交并推送该 bundle 后，在权威主分支执行一次 staged + atomic 发布。',
+      '  - 新 release 只能从已推送且与权威远端默认主分支一致的 clean HEAD 开始。',
     ].join('\n'));
     return;
   }
@@ -720,6 +724,23 @@ async function sdd(args) {
     return;
   }
 
+  if (subcommand === 'bundle') {
+    const changeId = positional[0] || flags.change;
+    assertOrClaimWorktreeOwner({ cwd: process.cwd(), changeId });
+    const result = createMainlineSddBundle({
+      cwd: process.cwd(),
+      changeId,
+      title: flags.title || flags.name,
+      changes: flags.changes,
+      force: Boolean(flags.force),
+    });
+    if (flags.json) return writeJson(result);
+    print(
+      `已创建主线发布 bundle: ${result.change.id}\nchanges=${result.bundledChanges.join(', ')}\n目录: ${result.dir}`
+    );
+    return;
+  }
+
   if (subcommand === 'approve') {
     const changeId = positional[0] || flags.change;
     assertOrClaimWorktreeOwner({ cwd: process.cwd(), changeId });
@@ -837,7 +858,7 @@ async function sdd(args) {
     return;
   }
 
-  fail('用法: openxiangda sdd init|migrate|propose|quick|approve|status|context|verify|sync|archive [change] [--json]');
+  fail('用法: openxiangda sdd init|migrate|propose|quick|bundle|approve|status|context|verify|sync|archive [change] [--json]');
 }
 
 function parseSddAffectedFlags(flags) {
@@ -886,8 +907,8 @@ async function release(args) {
       '  - 带 --change 的 resource/runtime 写命令在没有本地 lease 时会自动 begin，并在后续命令复用。',
       '  - 子 Runtime/Page/Backend/Form Release 默认先 stage；app-finalize 用 --staged-resources-json 覆盖 capture 中的 changed children，并在同一事务中原子激活。',
       '  - 默认 TTL 为 1800 秒；长异步发布每 30 秒检查并在到期前自动续租，续租失败会以 PUBLISH_LEASE_LOST 阻断后续写入。',
-      '  - begin 冻结 clean committed HEAD，并要求它包含权威远端主分支；发布期间 HEAD/源码不可变化。',
-      '  - 发布后先把冻结提交以保留 SHA 的 merge/fast-forward 合并并 push 到主分支；end 会在线验证后才清理会话。',
+      '  - begin 仅接受 clean 且与权威远端默认 main/master 完全一致的 HEAD；feature branch 先合并并 push，再由主分支一次发布。',
+      '  - 因发布源已在远端主线，成功激活后 integration-status 会立即通过，end 不再等待补合并。',
       '  - integration-status --check 可作为 CI 门禁；尚未回合时返回非零。',
       '  - 主线目标只能来自权威 Git remote 的实时默认 main/master；参数和环境变量不能改写。',
       '  - 租约过期也会保留待回合证据；完成 merge/push 后仍可执行 end 清理。',
@@ -9120,7 +9141,7 @@ async function runtime(args) {
       '  - runtime 只发布前端产物；表单、流程、通知等资源仍走 resource publish。',
       '  - deploy/activate 会读取当前 Runtime head 并携带 CAS preconditions；head 已变化时平台返回 409，避免静默覆盖。',
       '  - 所有 deploy（含 --no-activate）先获取应用 publish lease；在任何构建/上传前要求 Git clean committed HEAD，并校验当前 HEAD 继承线上 Runtime 源码血缘。',
-      '  - release begin 还会冻结实际 publish HEAD 并要求它包含当前权威远端主分支；上线后 merge/push 该 SHA，通过 release integration-status 后再 release end。',
+      '  - release begin 只接受与权威远端默认主分支完全一致的 clean HEAD；先合并/push 所有 approved changes，再一次发布。',
       '  - Runtime 同步构建前把 lease 续到平台最大 TTL；构建/上传后每次写入仍会重新校验，失租不会继续激活。',
       '  - build 不能安全前移到 lease 之前：直传模式的 assetBase 由受保护的 upload-plan 返回，不能用 gateway 路径静默替换。',
       '  - deploy 会输出 lease/head/preflight/build/upload/activate 阶段进度，JSON 结果包含 timings。',
@@ -9190,6 +9211,9 @@ async function runtime(args) {
   }
 
   if (subcommand === 'deploy') {
+    const runtimeBuildCommand = flags['no-build']
+      ? null
+      : assertRuntimeBuildReady(flags['build-command']);
     const scopedRuntimeFiles = flags.change
       ? buildWorkspaceReleasePlan({
           changeId: flags.change,
@@ -9324,7 +9348,7 @@ async function runtime(args) {
           buildId,
           appType: target.appType,
           assetBaseUrl,
-          command: flags['build-command'],
+          command: runtimeBuildCommand,
           jsonOutput: Boolean(flags.json),
         })
       );
@@ -9630,9 +9654,34 @@ function runRuntimeBuild(options) {
   if (result.status !== 0) fail(`runtime build 失败: exit ${result.status}`);
 }
 
+function assertRuntimeBuildReady(explicitCommand) {
+  if (explicitCommand) return String(explicitCommand);
+  const packageFile = path.join(process.cwd(), 'package.json');
+  if (!fs.existsSync(packageFile)) {
+    fail('RUNTIME_BUILD_NOT_READY: 缺少 package.json；尚未获取发布租约');
+  }
+  let packageJson;
+  try {
+    packageJson = JSON.parse(fs.readFileSync(packageFile, 'utf8'));
+  } catch (error) {
+    fail(`RUNTIME_BUILD_NOT_READY: package.json 无法解析: ${error.message}`);
+  }
+  if (!packageJson?.scripts?.build) {
+    fail('RUNTIME_BUILD_NOT_READY: package.json 缺少 scripts.build；尚未获取发布租约');
+  }
+  const modulesDir = path.join(process.cwd(), 'node_modules');
+  if (!fs.existsSync(modulesDir)) {
+    fail(
+      'RUNTIME_BUILD_DEPENDENCIES_MISSING: 缺少 node_modules；请在开发阶段完成依赖安装，发布命令不会临时安装或修改锁文件'
+    );
+  }
+  return defaultRuntimeBuildCommand();
+}
+
 function defaultRuntimeBuildCommand() {
-  if (fs.existsSync(path.join(process.cwd(), 'pnpm-lock.yaml'))) return 'pnpm build';
-  if (fs.existsSync(path.join(process.cwd(), 'yarn.lock'))) return 'yarn build';
+  // npm run only executes the already-declared script and resolves
+  // node_modules/.bin. Unlike pnpm build, it does not reject a valid worktree
+  // whose node_modules is a symlink into the primary checkout.
   return 'npm run build';
 }
 
@@ -10130,7 +10179,7 @@ async function commands(args) {
       'open-api spec tags|list|describe [operationId|path]',
       'open-api credential list|get|create|update|rotate-secret [id]',
       'design gates|template|review [--topic code]',
-      'sdd init|migrate|propose|approve|status|context|verify|sync|archive',
+      'sdd init|migrate|propose|quick|bundle|approve|status|context|verify|sync|archive',
       'release begin|status|integration-status|renew|end|backend-head|backend-list|backend-detail|backend-diff|backend-rollback|backend-abort|backend-retry|app-capture|app-head|app-list|app-detail|app-diff|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort',
       'env',
       'workspace init|bind|plan|check|publish [--app-name] [--changed|--since|--form|--page|--only|--dry-run|--force|--resources|--skip-resources|--prune]',
@@ -10168,7 +10217,7 @@ async function commands(args) {
       'Direct live mutation commands should use --dry-run first and --write-manifest when the repository should remain source of truth.',
       'App Function Secret values never belong in a manifest or workspace file. Use top-level function secretRefs, ctx.secrets.get(name), and secret create/rotate via hidden TTY or --value-stdin.',
       'OpenXiangda native SDD uses openspec/ records; high-risk publishes require an approved change with coverage.json/release.json verification unless --sdd-bypass --reason is used.',
-      'A formal release freezes the clean publish HEAD separately from the change base; after activation merge/fast-forward and push that exact SHA to the authoritative default branch, verify release integration-status, then run release end.',
+      'A formal release only starts from a clean local main/master that exactly equals the authoritative remote tip. Merge and push approved changes first; after activation verify release integration-status, then run release end without a post-release merge.',
     ],
   };
   if (flags.json) return writeJson(manifest);
@@ -20849,9 +20898,9 @@ function getChangeScopedWorkspaceFiles(changeScope, runtimeMode, options = {}) {
     );
   };
   return unique([
-    ...(changeScope.ownedFiles || []),
     ...unique([
       ...(changeScope.recordedChangedFiles || []),
+      ...(changeScope.ownedFiles || []),
       ...dirtyFiles,
     ]).filter(file =>
       fileBelongsToChangeScope(file, changeScope, runtimeMode) || dependencyBelongsToScope(file)
@@ -21042,17 +21091,47 @@ function buildWorkspaceReleasePlan(options = {}) {
         runtime: Boolean(changeScope.targets.runtime),
         other: [...(changeScope.targets.other || [])],
       }
-    : classifyWorkspaceFiles(files, runtimeMode, {
+      : classifyWorkspaceFiles(files, runtimeMode, {
         baseRef: options.since || 'HEAD',
       });
+  let dependencyImpact = {};
   if (changeScope) {
     const dependencyTargets = getWorkspaceImpactedResourceTargets(files);
+    dependencyImpact = Object.fromEntries(
+      ['functions', 'automations', 'workflows', 'jsCodeNodes'].map(key => [
+        key,
+        (dependencyTargets[key] || []).filter(
+          code => !(targets[key] || []).includes(code)
+        ),
+      ])
+    );
+    // The approved structured scope is authoritative. Shared-source impact is
+    // reported for review, but no longer silently broadens a release into
+    // dozens of unrelated resources. Callers may opt in when the intended
+    // change genuinely requires the whole dependency closure.
+    if (options.expandDependencies) {
     for (const key of ['functions', 'automations', 'workflows', 'jsCodeNodes']) {
       targets[key] = unique([...(targets[key] || []), ...(dependencyTargets[key] || [])]).sort();
     }
+    }
   }
   if (options.includeResources) targets.resources = true;
-  const issues = scanWorkspaceReliabilityIssues(files);
+  const issues = [
+    ...scanWorkspaceReliabilityIssues(files),
+    ...Object.entries(dependencyImpact).flatMap(([key, codes]) =>
+      codes.length > 0
+        ? [
+            {
+              rule: 'shared-source-outside-approved-scope',
+              severity: 'warn',
+              file: '(release scope)',
+              line: 0,
+              message: `${key} shared-source impact not included unless explicitly approved: ${codes.join(', ')}`,
+            },
+          ]
+        : []
+    ),
+  ];
   const errors = issues
     .filter(issue => issue.severity === 'error')
     .map(issue => ({
@@ -21065,11 +21144,19 @@ function buildWorkspaceReleasePlan(options = {}) {
     options.profile,
     changeScope?.changeId
   );
+  const knownTargetCount =
+    targets.forms.length +
+    targets.pages.length +
+    (targets.functions || []).length +
+    (targets.automations || []).length +
+    (targets.workflows || []).length +
+    (targets.jsCodeNodes || []).length +
+    (targets.runtime ? 1 : 0);
   const commands =
-    changeScope?.commands?.length > 0
+    targets.resources && knownTargetCount === 0 && changeScope?.commands?.length > 0
       ? [...changeScope.commands]
       : generatedCommands;
-  if (!changeScope?.commands?.length && targets.resources) {
+  if (commands.length === generatedCommands.length && targets.resources && knownTargetCount === 0) {
     errors.push({
       name: 'sdd-release-generic-resource-selector-required',
       message:
@@ -21077,7 +21164,7 @@ function buildWorkspaceReleasePlan(options = {}) {
     });
   }
   if (
-    !changeScope?.commands?.length &&
+    commands.length === generatedCommands.length &&
     (targets.jsCodeNodes || []).length > 0 &&
     (targets.functions || []).length === 0 &&
     (targets.automations || []).length === 0 &&
@@ -21147,6 +21234,7 @@ function buildWorkspaceReleasePlan(options = {}) {
     checks,
     sdd,
     issues,
+    dependencyImpact,
     errors: [...errors, ...sddErrors],
   };
 }

package/lib/release-mainline.js

@@ -35,6 +35,20 @@ function prepareReleaseSourceRevision(options = {}) {
     mainline.remoteName,
     mainline.branchName
   );
+  if (branch !== mainline.branchName) {
+    throw releaseMainlineError(
+      'RELEASE_SOURCE_MAINLINE_REQUIRED',
+      `正式发布只能从权威主分支 ${formatMainline(mainline)} 执行；当前分支为 ${branch}。请先把已批准变更合并到主分支并切换过去`,
+      { branch, mainline }
+    );
+  }
+  if (sourceRevision.baseCommit !== mainline.tipCommit) {
+    throw releaseMainlineError(
+      'RELEASE_SOURCE_MAINLINE_NOT_PUSHED',
+      `本地主分支 ${shortCommit(sourceRevision.baseCommit)} 尚未与远端 ${formatMainline(mainline)}@${shortCommit(mainline.tipCommit)} 完全一致；请先 fast-forward/push，再从该提交一次发布`,
+      { sourceRevision, mainline }
+    );
+  }
   if (
     !isGitAncestor(cwd, mainline.tipCommit, sourceRevision.baseCommit, {
       remoteName: mainline.remoteName,
@@ -57,6 +71,7 @@ function prepareReleaseSourceRevision(options = {}) {
     mainBranch: mainline.branchName,
     mainTipCommit: mainline.tipCommit,
     mainlineSource: mainline.source,
+    mainlinePolicy: 'publish-from-main-v1',
     capturedAt: new Date().toISOString(),
   };
 }