openxiangda 1.0.172 → 1.0.173

package/README.md

@@ -41,11 +41,8 @@ openxiangda resource validate function --only customer_get,customer_save --profi
 openxiangda resource plan function --only customer_get,customer_save --profile dev
 # merge/push approved task commits to main, then create and push one release bundle
 openxiangda sdd bundle mainline-release --changes add-customer-page,fix-customer-api
-openxiangda sdd verify mainline-release --changed --stage prepublish --profile dev
-openxiangda release begin --change mainline-release --profile dev
-# execute the canonical staged commands emitted by the release plan
-openxiangda release integration-status --profile dev
-openxiangda release end --profile dev
+# verify, wait for the lease, stage exact children, atomically finalize, and release
+openxiangda release publish --change mainline-release --profile dev
 openxiangda resource explain public-access --json
 openxiangda inspect app --profile dev --json
 openxiangda app snapshot APP_XXXX --profile dev --json
@@ -57,7 +54,7 @@ User tokens are stored in `~/.openxiangda/profiles.json` with `0600` permissions
 
 React SPA workspaces publish their frontend with `openxiangda runtime deploy`. Every finalized Runtime release is built from a clean, committed Git `HEAD`; the CLI freezes `sourceRevision`, the current active release, and its source revision before any build/upload. Deploy fails with `RUNTIME_SOURCE_BASE_DIVERGED` when its `HEAD` does not descend from the online Runtime source, including with `--no-activate`, so an old isolated worktree cannot stage and later activate a silent rollback. `.openxiangda/`, `openspec/`, `dist/`, and other pure generated/governance/state paths do not make the source dirty, but `--no-build` cannot bypass the lineage gate. An intentional rollback requires `--allow-runtime-rollback --reason "<at least 8 characters>"`, which is persisted for audit and never bypasses dirty/non-Git checks.
 
-Parallel tasks develop and test in isolated worktrees, but feature worktrees do not publish. After approved commits are merged and pushed, `sdd bundle <release-change> --changes ...` unions their exact structured scope. Commit/push the bundle, then run one promotion from a clean local main/master whose commit exactly equals the authoritative remote tip. `release begin` rejects feature branches and unpushed/diverged mainline before any platform write. Runtime build readiness is also checked before lease acquisition; the CLI executes the declared build through `npm run build`, which works with pnpm worktree symlinked dependencies without reinstalling or changing the lock file. The protected upload plan still precedes the actual build because its provider-specific `assetBaseUrl` is compiled into the bundle.
+Parallel tasks develop and test in isolated worktrees, but feature worktrees do not publish. After approved commits are merged and pushed, `sdd bundle <release-change> --changes ...` unions their exact structured scope. Commit/push the bundle, then run `release publish --change <release-change> --profile <name>` from a clean local main/master whose commit exactly equals the authoritative remote tip. It verifies without rewriting reviewed SDD files, waits for the app lease, freezes one authoritative App capture, executes exact Form/Backend/Runtime staged steps, atomically finalizes the Root App release, and records a resumable local execution journal. Runtime checks use the narrow head endpoint; immutable Git-base artifact hashes are reused across plans.
 
 Because promotion starts from an already-pushed authoritative mainline commit, `openxiangda release integration-status --profile <name>` should pass immediately after activation. Run it and `release end`; there is no post-release merge step.
 
@@ -426,7 +423,7 @@ const PublicAccessError = ({ error }: { error: { message?: string } }) => (
 
 App Function 访问第三方凭据时使用 `app_function_secrets_v1`：manifest 顶层只声明 `secretRefs: [{ "name": "dingtalk_org_app_key", "required": true }]`，同时使用 `definitionJson.version="function_v2"`、`runtimeContractVersion="trusted_node_v2"`；源码通过 `await ctx.secrets.get(name)` 解析，并通过 `ctx.utils.http` 访问受控公网 HTTPS（该桥接不会携带平台 Runtime token）。值只能经 `openxiangda secret create|rotate --value-stdin --change <id> --profile <name>` 或隐藏 TTY 输入，禁止进入 Git、manifest、源码、构建产物、plan、日志或异常。带 `secretRefs` 的 Function 必须走 `backend_release_v2`；需要整应用原子发布时先执行 `resource publish function --only <code> --stage-only`，再把返回的真实 `stagedResource` 交给 `release app-finalize --staged-resources-json ...` 完成 `atomic_staged_children_v2`。默认直接激活的 Backend Release 只返回 `activeResource`，不会伪装成 staged；旧平台 capability 不完整时 CLI 会失败关闭，绝不忽略绑定。
 
-平台部门和账号管理走 app-scoped organization 能力。调用者必须在目标应用拥有 `app:organization:manage`；平台管理员天然可用，普通应用角色需要显式授权。Runtime service principal 不会直接放行，`ctx.organization` 会按真实操作人 / audit actor 校验权限。新接口只提供创建、更新、查询和密码专用操作，不提供删除；`account-update` 不能携带 `password`，重置他人密码必须走 `account-reset-password`，当前用户改密用 SDK / `ctx.organization.accounts.changeMyPassword({ oldPassword, newPassword })`。
+平台部门和账号管理走 app-scoped organization 能力。只读查询要求目标应用的 `app:organization:read` 或 `app:organization:manage`，创建、更新和密码操作要求 `app:organization:manage`；平台管理员天然可用，普通应用角色需要显式授权。Runtime service principal 不会直接放行，`ctx.organization` 会按真实操作人 / audit actor 校验权限。新接口不提供删除；`account-update` 不能携带 `password`，重置他人密码必须走 `account-reset-password`，当前用户改密用 SDK / `ctx.organization.accounts.changeMyPassword({ oldPassword, newPassword })`。
 
 CLI 写操作必须加 `--force`：
 

package/lib/change-baseline.js

@@ -1,4 +1,8 @@
 const { spawnSync } = require('child_process');
+const {
+  legacyRemoteIdentity,
+  remoteRepositoryHashes,
+} = require('./git-remote-identity');
 const crypto = require('crypto');
 const fs = require('fs');
 const os = require('os');
@@ -6,6 +10,7 @@ const path = require('path');
 
 const { saveProjectState } = require('./config');
 const { runWorkspaceJsCodeBuildBatch } = require('./js-code-build');
+const { version: OPENXIANGDA_VERSION } = require('../package.json');
 
 const SOURCE_KIND_BY_RESOURCE_KIND = Object.freeze({
   Function: 'functions',
@@ -232,14 +237,18 @@ function readGitSourceBase(cwd = process.cwd(), baseRef = 'HEAD') {
           : path.resolve(repository.root, commonGitDirValue)
       )
     : repository.root;
+  const repositoryIds = remote
+    ? remoteRepositoryHashes(remote)
+    : [];
   const identitySeed = remote
-    ? `remote:${normalizeRemoteIdentity(remote)}`
+    ? `remote:${legacyRemoteIdentity(remote)}`
     : `local:${commonGitDir}`;
   const repositoryId = `sha256:${sha256Buffer(Buffer.from(identitySeed, 'utf8'))}`;
 
   return {
     repo: repositoryId,
     repositoryId,
+    repoAliases: Array.from(new Set([repositoryId, ...repositoryIds])),
     baseCommit,
     treeHash,
   };
@@ -253,7 +262,20 @@ function buildGitBaseSourceArtifacts({
   packageManager = 'pnpm',
 } = {}) {
   const normalizedTargets = normalizeArtifactTargets(targets);
-  return withGitBaseWorkspace({ cwd, baseCommit, env }, context => {
+  const cacheFile =
+    env?.FAKE_BATCH_FAIL || env?.OPENXIANGDA_DISABLE_ARTIFACT_CACHE === '1'
+      ? null
+      : resolveGitArtifactCacheFile({
+          cwd,
+          baseCommit,
+          targets: normalizedTargets,
+          packageManager,
+        });
+  const cached = cacheFile
+    ? readGitArtifactCache(cacheFile, baseCommit, normalizedTargets)
+    : null;
+  if (cached) return { ...cached, cacheHit: true };
+  const built = withGitBaseWorkspace({ cwd, baseCommit, env }, context => {
     const {
       buildRoot,
       buildEnv,
@@ -349,6 +371,99 @@ function buildGitBaseSourceArtifacts({
       localBaseArtifactHashes,
     };
   });
+  if (cacheFile) writeGitArtifactCache(cacheFile, built);
+  return { ...built, cacheHit: false };
+}
+
+function resolveGitArtifactCacheFile({
+  cwd,
+  baseCommit,
+  targets,
+  packageManager,
+}) {
+  const commit = String(baseCommit || '').trim().toLowerCase();
+  if (!/^[0-9a-f]{40,64}$/.test(commit)) return null;
+  const repository = resolveGitRepository(cwd);
+  const commonDirValue =
+    tryRunGit(repository.root, [
+      'rev-parse',
+      '--path-format=absolute',
+      '--git-common-dir',
+    ]).trim() ||
+    tryRunGit(repository.root, ['rev-parse', '--git-common-dir']).trim();
+  if (!commonDirValue) return null;
+  const commonDir = path.resolve(repository.root, commonDirValue);
+  const key = canonicalJsonSha256({
+    schemaVersion: 'git_base_artifacts_v2',
+    openxiangdaVersion: OPENXIANGDA_VERSION,
+    baseCommit: commit,
+    packageManager,
+    targets,
+  });
+  return path.join(
+    commonDir,
+    'openxiangda-cache',
+    'git-base-artifacts-v2',
+    `${key}.json`
+  );
+}
+
+function readGitArtifactCache(file, baseCommit, targets) {
+  if (!fs.existsSync(file)) return null;
+  let value;
+  try {
+    value = JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return null;
+  }
+  if (
+    value?.schemaVersion !== 'git_base_artifacts_v2' ||
+    value?.openxiangdaVersion !== OPENXIANGDA_VERSION ||
+    value?.result?.baseCommit !== String(baseCommit).toLowerCase()
+  ) {
+    return null;
+  }
+  const expectedKeys = targets
+    .map(target => `${target.kind}:${target.code}`)
+    .sort();
+  const artifactKeys = Object.keys(value.result.artifacts || {}).sort();
+  if (
+    expectedKeys.length !== artifactKeys.length ||
+    expectedKeys.some((key, index) => key !== artifactKeys[index])
+  ) {
+    return null;
+  }
+  if (
+    artifactKeys.some(
+      key =>
+        !/^[a-f0-9]{64}$/.test(
+          String(value.result.artifacts[key]?.artifactHash || '')
+        )
+    )
+  ) {
+    return null;
+  }
+  return cloneJson(value.result);
+}
+
+function writeGitArtifactCache(file, result) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const tempFile = `${file}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(
+    tempFile,
+    `${JSON.stringify(
+      {
+        schemaVersion: 'git_base_artifacts_v2',
+        openxiangdaVersion: OPENXIANGDA_VERSION,
+        createdAt: new Date().toISOString(),
+        result,
+      },
+      null,
+      2
+    )}\n`,
+    { mode: 0o600 }
+  );
+  fs.renameSync(tempFile, file);
 }
 
 function readBuiltSourceHash(buildRoot, sourceKind, code) {
@@ -1109,22 +1224,6 @@ function splitNullBuffer(buffer) {
   return records;
 }
 
-function normalizeRemoteIdentity(value) {
-  const remote = String(value || '').trim();
-  try {
-    const url = new URL(remote);
-    url.username = '';
-    url.password = '';
-    url.search = '';
-    url.hash = '';
-    return url.toString();
-  } catch {
-    return remote
-      .replace(/^[^@/]+@([^:]+):/, '$1:')
-      .replace(/[?#].*$/, '');
-  }
-}
-
 function getChangeBaselineOwnerThreadId(baseline) {
   return String(
     baseline?.workspace?.threadId || baseline?.ownerThreadId || ''