openxiangda 1.0.174 → 1.0.176

package/lib/cli.js

@@ -70,6 +70,25 @@ const {
   normalizeReleaseTargets,
   releasePlanHash,
 } = require('./release-plan');
+const {
+  assertIntegrationBundleCommits,
+  collectIntegrationTaskResults,
+  inspectIntegrationBundleCommits,
+  readIntegrationTaskResult,
+  recordIntegrationTaskResult,
+} = require('./integration-bundle');
+const {
+  readContentCache,
+  writeContentCache,
+} = require('./content-cache');
+const { explainReleaseExecution } = require('./release-explain');
+const { buildTaskStatus, findAppReleaseId } = require('./task-status');
+const {
+  checkEngineeringPolicyMarkers,
+  loadEngineeringPolicy,
+  renderEngineeringPolicyMarkdown,
+} = require('./policy');
+const { prepareDependencyCapsule } = require('./dependency-capsule');
 const {
   analyzeManifestSourceDependencies,
   getImpactedResourceTargets,
@@ -118,6 +137,7 @@ const {
   initSddWorkspace,
   proposeSddChange,
   recordSddReleaseSourceRevision,
+  renderSddDocumentation,
   syncSddChange,
   verifySddChange,
 } = require('./sdd');
@@ -178,10 +198,12 @@ async function mainImpl(argv) {
   if (command === 'platform') return platform(rest);
   if (command === 'doctor') return doctor(rest);
   if (command === 'contract') return contract(rest);
+  if (command === 'policy') return policy(rest);
   if (command === 'open-api') return openApi(rest);
   if (command === 'design') return design(rest);
   if (command === 'sdd') return sdd(rest);
   if (command === 'release') return release(rest);
+  if (command === 'task') return task(rest);
   if (command === 'workspace') return workspace(rest);
   if (command === 'app') return app(rest);
   if (command === 'form') return form(rest);
@@ -224,15 +246,18 @@ Usage:
   openxiangda auth status|refresh|logout [--profile name]
   openxiangda doctor [--profile name] [--app-type APP_XXX] [--release] [--json]
   openxiangda contract list|explain <contract-name> [--json]
+  openxiangda policy show|check|render [--json]
   openxiangda open-api spec tags|list|describe [operationId|path] [--method post] [--tag name] [--search text] [--json]
   openxiangda open-api credential list|get|create|update|rotate-secret [id] [--profile name] [--show-secret] [--yes] [--json]
   openxiangda design gates|template|review [--topic code] [--json]
   openxiangda sdd init|migrate|propose|quick|bundle|approve|status|context|verify|sync|archive [change] [--change id] [--json]
-  openxiangda release publish|begin|status|integration-status|renew|end [--change id] [--profile name] [--json]
+  openxiangda release publish|begin|status|integration-status|renew|end [--change id] [--profile name] [--watch] [--json]
+  openxiangda task status --change <id> [--profile name] [--watch] [--json]
   openxiangda release backend-head|backend-list|backend-detail|backend-diff|backend-rollback|backend-abort|backend-retry [releaseId] [--profile name] [--json]
   openxiangda release app-capture|app-head|app-list|app-detail|app-diff|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort [releaseId] [--staged-resources-json <JSON|file>] [--activate-staged-children] [--profile name] [--json]
   openxiangda env [--profile name]
   openxiangda workspace init [dir] [--name package-name] [--runtime legacy|react-spa] [--install] [--profile name --app-type APP_XXX]
+  openxiangda workspace prepare [--check] [--force] [--json]
   openxiangda workspace init [dir] --profile <name> --app-name <app-name> [--runtime legacy|react-spa] [--install]
   openxiangda workspace bind --profile <name> --app-type <APP_XXX>
   openxiangda workspace plan|check [--change id|--changed] [--json]
@@ -329,6 +354,8 @@ const SUBCOMMAND_BOOLEAN_FLAGS = new Set([
   '--summary',
   '--unpublish',
   '--value-stdin',
+  '--wait',
+  '--watch',
   '--write-manifest',
   '--yes',
   '-h',
@@ -652,19 +679,21 @@ async function sdd(args) {
   const { flags, positional } = parseArgs(rest);
   if (wantsSubcommandHelp(subcommand, flags)) {
     print([
-      '用法: openxiangda sdd init|migrate|propose|quick|bundle|approve|status|context|verify|sync|archive [change] [--change id] [--json]',
+      '用法: openxiangda sdd init|migrate|propose|quick|ready|bundle|approve|status|context|verify|render|sync|archive [change] [--change id] [--json]',
       '常用流程:',
       '  openxiangda sdd init --upgrade',
       '  openxiangda sdd propose add-customer-list --title "客户列表" --forms customer --pages customer_list --resources',
       '  openxiangda sdd quick tune-customer-copy --kind copy --pages customer_list --files src/pages/customer_list/index.tsx --summary "用户确认小范围文案调整"',
       '  openxiangda sdd approve add-customer-list --summary "用户确认设计"',
+      '  openxiangda sdd ready add-customer-list',
       '  openxiangda sdd bundle mainline-release --changes add-customer-list,fix-order-log',
       '  openxiangda sdd context --change add-customer-list --json',
       '  openxiangda sdd verify --change add-customer-list --stage prepublish --json',
+      '  openxiangda sdd render add-customer-list  # 仅在确实需要完整文档时',
       '  openxiangda sdd archive --change add-customer-list',
       '说明:',
       '  - SDD 记录保存在 openspec/，不依赖官方 OpenSpec CLI。',
-      '  - 新工作区使用 openxiangda-sdd-v2：proposal/specs/design/tasks/evidence 给人读，coverage.json/release.json 给 CLI 校验。',
+      '  - 新工作区默认只维护 change.json/coverage.json/release.json；proposal/specs/design/tasks/evidence 由 sdd render 按需生成。',
       '  - 高风险发布需要 approved change 的 coverage 覆盖本次 forms/pages/functions/automations/workflows/JS_CODE/resources/runtime 目标和高风险文件。',
       '  - --change 使用该 change 的 coverage/release 与范围内 dirty files；不会吸收其他并行会话的全局变更。',
       '  - 在 Codex 中 propose/quick/context 会按 CODEX_THREAD_ID 占用当前 worktree；其他任务必须切换到独立 worktree。',
@@ -694,6 +723,7 @@ async function sdd(args) {
     assertOrClaimWorktreeOwner({ cwd: process.cwd(), changeId });
     const result = proposeSddChange({
       cwd: process.cwd(),
+      configText: readWorkspaceConfigText(),
       changeId,
       title: flags.title || flags.name,
       riskLevel: flags.risk || flags['risk-level'],
@@ -717,6 +747,7 @@ async function sdd(args) {
         : {};
     const result = createQuickSddChange({
       cwd: process.cwd(),
+      configText: readWorkspaceConfigText(),
       changeId,
       title: flags.title || flags.name,
       changeKind: flags.kind || flags['change-kind'],
@@ -734,12 +765,21 @@ async function sdd(args) {
   if (subcommand === 'bundle') {
     const changeId = positional[0] || flags.change;
     assertOrClaimWorktreeOwner({ cwd: process.cwd(), changeId });
+    const sourceChangeIds = String(flags.changes || '')
+      .split(',')
+      .map(item => item.trim())
+      .filter(Boolean);
+    const integration = collectIntegrationTaskResults({
+      cwd: process.cwd(),
+      changeIds: sourceChangeIds,
+    });
     const result = createMainlineSddBundle({
       cwd: process.cwd(),
       configText: readWorkspaceConfigText(),
       changeId,
       title: flags.title || flags.name,
       changes: flags.changes,
+      integration,
       profile: flags.profile,
       force: Boolean(flags.force),
     });
@@ -750,11 +790,47 @@ async function sdd(args) {
     return;
   }
 
+  if (subcommand === 'ready') {
+    const changeId = positional[0] || flags.change;
+    const scope = getSddChangeScope({
+      cwd: process.cwd(),
+      configText: readWorkspaceConfigText(),
+      changeId,
+    });
+    if (scope.change?.status !== 'approved' || !scope.change?.approvedAt) {
+      fail(`INTEGRATION_TASK_CHANGE_NOT_APPROVED: ${changeId} 尚未 approved`);
+    }
+    const result = recordIntegrationTaskResult({
+      cwd: process.cwd(),
+      changeId,
+      targets: scope.targets,
+      changedFiles: scope.changedFiles,
+    });
+    const ownerStatus = getWorktreeOwnerStatus({ cwd: process.cwd() });
+    if (
+      ownerStatus.ownedByCurrentThread &&
+      ownerStatus.owner?.changeId === changeId
+    ) {
+      const released = releaseWorktreeOwner({
+        cwd: process.cwd(),
+        expectedThreadId: ownerStatus.owner.threadId,
+        expectedChangeId: changeId,
+      });
+      result.worktreeOwnershipReleased = Boolean(released.released);
+    }
+    if (flags.json) return writeJson(result);
+    print(
+      `任务已准备合并: ${result.changeId}@${result.commit.slice(0, 12)}\nbranch=${result.branch}${result.worktreeOwnershipReleased ? '\nworktree owner 已自动释放' : ''}`
+    );
+    return;
+  }
+
   if (subcommand === 'approve') {
     const changeId = positional[0] || flags.change;
     assertOrClaimWorktreeOwner({ cwd: process.cwd(), changeId });
     const result = approveSddChange({
       cwd: process.cwd(),
+      configText: readWorkspaceConfigText(),
       changeId,
       summary: flags.summary || flags.note,
     });
@@ -806,7 +882,6 @@ async function sdd(args) {
 
   if (subcommand === 'verify') {
     const changeId = positional[0] || flags.change;
-    assertOrClaimWorktreeOwner({ cwd: process.cwd(), changeId });
     const hasExplicitReleaseScope = Boolean(
       changeId || flags.changed || flags['changed-only'] || flags.since || flags.all || flags['no-changed']
     );
@@ -821,9 +896,10 @@ async function sdd(args) {
       : null;
     const result = verifySddChange({
       cwd: process.cwd(),
+      configText: readWorkspaceConfigText(),
       changeId,
       releasePlan,
-      writeMetadata: Boolean(releasePlan),
+      writeMetadata: false,
       stage: flags.stage,
     });
     if (flags.json) {
@@ -836,10 +912,32 @@ async function sdd(args) {
     return;
   }
 
+  if (subcommand === 'render') {
+    const changeId = positional[0] || flags.change;
+    assertOrClaimWorktreeOwner({ cwd: process.cwd(), changeId });
+    const result = renderSddDocumentation({
+      cwd: process.cwd(),
+      configText: readWorkspaceConfigText(),
+      changeId,
+      force: Boolean(flags.force),
+    });
+    if (flags.json) return writeJson(result);
+    print(
+      result.rendered.length > 0
+        ? `已按需生成 SDD 文档:\n${result.rendered.map(item => `- ${item}`).join('\n')}`
+        : 'SDD 文档已存在；使用 --force 重新生成'
+    );
+    return;
+  }
+
   if (subcommand === 'sync') {
     const changeId = positional[0] || flags.change;
     assertOrClaimWorktreeOwner({ cwd: process.cwd(), changeId });
-    const result = syncSddChange({ cwd: process.cwd(), changeId });
+    const result = syncSddChange({
+      cwd: process.cwd(),
+      configText: readWorkspaceConfigText(),
+      changeId,
+    });
     if (flags.json) return writeJson(result);
     print(`SDD specs 已同步: ${result.change.id}\n${result.synced.map(item => `- ${item}`).join('\n')}`);
     return;
@@ -857,6 +955,7 @@ async function sdd(args) {
     });
     const result = archiveSddChange({
       cwd: process.cwd(),
+      configText: readWorkspaceConfigText(),
       changeId,
       releasePlan,
       force: Boolean(flags.force),
@@ -867,7 +966,7 @@ async function sdd(args) {
     return;
   }
 
-  fail('用法: openxiangda sdd init|migrate|propose|quick|bundle|approve|status|context|verify|sync|archive [change] [--json]');
+  fail('用法: openxiangda sdd init|migrate|propose|quick|bundle|approve|status|context|verify|render|sync|archive [change] [--json]');
 }
 
 function parseSddAffectedFlags(flags) {
@@ -946,6 +1045,10 @@ function summarizeReleaseStepResult(result) {
       findId(value.verified) ||
       findId(value.prepared) ||
       findId(value),
+    healthStatus:
+      value.healthWait?.status ||
+      value.activated?.activation?.postCommit?.status ||
+      null,
   };
 }
 
@@ -1023,41 +1126,40 @@ function parseChildJsonOutput(stdout) {
   }
 }
 
-function runOpenXiangdaChild(args, options = {}) {
-  return new Promise((resolve, reject) => {
-    const bin = path.join(__dirname, '..', 'bin', 'openxiangda.js');
-    const child = spawn(process.execPath, [bin, ...args, '--json'], {
-      cwd: process.cwd(),
-      env: process.env,
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let stdout = '';
-    let stderr = '';
-    child.stdout.on('data', chunk => {
-      stdout += String(chunk);
-    });
-    child.stderr.on('data', chunk => {
-      const text = String(chunk);
-      stderr += text;
-      if (!options.quiet) warn(maskText(text).trimEnd());
-    });
-    child.on('error', reject);
-    child.on('close', code => {
-      if (code === 0) {
-        resolve(parseChildJsonOutput(stdout));
-        return;
-      }
-      const message = maskText(
-        String(stderr || stdout || `openxiangda ${args.join(' ')} failed`)
-      ).trim();
-      const error = new Error(message);
+async function runOpenXiangdaInProcess(args, options = {}) {
+  let stdout = '';
+  const originalWrite = process.stdout.write;
+  const previousExitCode = process.exitCode;
+  process.exitCode = undefined;
+  process.stdout.write = function capture(chunk, encoding, callback) {
+    stdout += Buffer.isBuffer(chunk) ? chunk.toString(encoding) : String(chunk);
+    if (typeof encoding === 'function') encoding();
+    if (typeof callback === 'function') callback();
+    return true;
+  };
+  try {
+    await mainImpl([...args, '--json']);
+    if (process.exitCode && process.exitCode !== 0) {
+      const error = new Error(
+        maskText(stdout).trim() ||
+          `openxiangda ${args.join(' ')} exited with ${process.exitCode}`
+      );
       error.code =
-        message.match(/\b([A-Z][A-Z0-9_]{3,})\b/)?.[1] ||
+        error.message.match(/\b([A-Z][A-Z0-9_]{3,})\b/)?.[1] ||
         'RELEASE_STEP_FAILED';
-      error.exitCode = code;
-      reject(error);
-    });
-  });
+      error.exitCode = process.exitCode;
+      throw error;
+    }
+    return parseChildJsonOutput(stdout);
+  } catch (error) {
+    if (!options.quiet && stdout.trim()) {
+      warn(maskText(stdout).trimEnd());
+    }
+    throw error;
+  } finally {
+    process.stdout.write = originalWrite;
+    process.exitCode = previousExitCode;
+  }
 }
 
 function normalizeReleaseWaitSeconds(flags) {
@@ -1273,6 +1375,19 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
     target.profileName,
     changeId
   );
+  const releaseScope = getSddChangeScope({
+    cwd: process.cwd(),
+    configText: readWorkspaceConfigText(),
+    changeId,
+  });
+  const isMainlineBundle =
+    releaseScope.change?.changeMode === 'mainline-bundle';
+  const integration = isMainlineBundle
+    ? inspectIntegrationBundleCommits(
+        releaseScope.release?.integration,
+        { cwd: process.cwd() }
+      )
+    : null;
   const planHash = releasePlanHash({
     schemaVersion: 'openxiangda_release_execution_v1',
     appType: target.appType,
@@ -1292,8 +1407,14 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
       targets: plan.targets,
       activationTargets: plan.activationTargets,
       steps,
+      integration,
     };
   }
+  if (isMainlineBundle) {
+    assertIntegrationBundleCommits(releaseScope.release?.integration, {
+      cwd: process.cwd(),
+    });
+  }
   const verification = verifySddChange({
     cwd: process.cwd(),
     changeId,
@@ -1301,7 +1422,7 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
       ...plan,
       commands: steps.map(step => step.command),
     },
-    writeMetadata: true,
+    writeMetadata: false,
     stage: 'prepublish',
   });
   if (!verification.passed) {
@@ -1428,7 +1549,7 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
       execution.updatedAt = journalStep.startedAt;
       writePrivateJsonAtomic(releaseExecutionFile(changeId), execution);
       warn(`发布步骤开始: ${step.id}`);
-      const result = await runOpenXiangdaChild(step.args);
+      const result = await runOpenXiangdaInProcess(step.args);
       journalStep.status = 'completed';
       journalStep.completedAt = new Date().toISOString();
       journalStep.result = summarizeReleaseStepResult(result);
@@ -1497,7 +1618,7 @@ async function publishWorkspaceRelease(config, target, flags = {}) {
     writePrivateJsonAtomic(releaseExecutionFile(changeId), execution);
     if (!execution.writeAttempted) {
       try {
-        await runOpenXiangdaChild(
+        await runOpenXiangdaInProcess(
           [
             'release',
             'end',
@@ -1521,9 +1642,9 @@ async function release(args) {
   const { flags, positional } = parseArgs(rest);
   if (wantsSubcommandHelp(subcommand, flags)) {
     print([
-      '用法: openxiangda release publish|begin|status|integration-status|renew|end [--change id] [--profile name] [--json]',
+      '用法: openxiangda release publish|begin|status|explain|integration-status|renew|end [--change id] [--profile name] [--json]',
       '      openxiangda release backend-head|backend-list|backend-detail|backend-diff|backend-rollback|backend-abort|backend-retry [releaseId] [--profile name] [--json]',
-      '      openxiangda release app-capture|app-head|app-list|app-detail|app-diff|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort [releaseId] [--staged-resources-json <JSON|file>] [--activate-staged-children] [--profile name] [--json]',
+      '      openxiangda release app-capture|app-head|app-list|app-detail|app-diff|app-post-commit|app-retry|app-prepare|app-verify|app-activate|app-finalize|app-rollback|app-abort [releaseId] [--staged-resources-json <JSON|file>] [--activate-staged-children] [--profile name] [--json]',
       '常用流程:',
       '  openxiangda release publish --change <id> --profile <name>',
       '  openxiangda release begin --change <id> --profile <name>',
@@ -1588,6 +1709,28 @@ async function release(args) {
   }
   const leaseIdFromArgs = positional[0] || readStringFlag(flags, 'lease-id');
 
+  if (subcommand === 'explain') {
+    const changeId = positional[0] || readStringFlag(flags, 'change');
+    if (!changeId) {
+      fail('用法: openxiangda release explain --change <id> [--json]');
+    }
+    const execution = readReleaseExecution(changeId);
+    const result = {
+      changeId,
+      execution,
+      diagnosis: explainReleaseExecution(execution),
+    };
+    if (flags.json) return writeJson(result);
+    print(
+      [
+        `release ${changeId}: ${result.diagnosis.state}`,
+        result.diagnosis.summary,
+        `下一步: ${result.diagnosis.nextAction}`,
+      ].join('\n')
+    );
+    return;
+  }
+
   if (subcommand === 'status') {
     const local = getStoredPublishLease(target);
     const baseline = getStoredChangeBaseline(target, {
@@ -1604,16 +1747,28 @@ async function release(args) {
       target,
       clientSessionId
     );
+    const changeId =
+      positional[0] ||
+      readStringFlag(flags, 'change') ||
+      local?.changeId ||
+      baseline?.changeId;
+    const execution = changeId ? readReleaseExecution(changeId) : null;
     const result = {
       remote,
       local,
       releaseSourceRevision: baseline?.releaseSourceRevision || null,
       integration: null,
       integrationCheckRequired: Boolean(baseline?.releaseSourceRevision),
+      changeId: changeId || null,
+      execution,
+      diagnosis: explainReleaseExecution(execution),
       localOwnedByCurrentSession: local
         ? isPublishLeaseOwnedByCurrentSession(local)
         : null,
     };
+    if (flags.watch) {
+      return await watchTaskStatus(config, target, changeId, flags);
+    }
     if (flags.json) return writeJson(result);
     printPublishLeaseStatus(result);
     return;
@@ -1623,10 +1778,14 @@ async function release(args) {
     const baseline = getStoredChangeBaseline(target, {
       access: 'reconciliation-read',
     });
-    const sourceRevision = baseline?.releaseSourceRevision;
+    const changeId = positional[0] || readStringFlag(flags, 'change');
+    const recovered = readReleaseRecoveryContext(target, changeId);
+    const sourceRevision =
+      baseline?.releaseSourceRevision ||
+      recovered?.context?.releaseSourceRevision;
     if (!sourceRevision) {
       fail(
-        'RELEASE_SOURCE_LINEAGE_REQUIRED: 当前 release 没有冻结的 releaseSourceRevision，不能证明发布提交已回到权威主分支'
+        'RELEASE_SOURCE_LINEAGE_REQUIRED: 当前 release 没有冻结的 releaseSourceRevision；发布已结束时请同时传入 --change <id>，以便从私有执行日志恢复主线证据'
       );
     }
     const result = inspectReleaseSourceIntegration(
@@ -1868,6 +2027,233 @@ async function release(args) {
   fail('用法: openxiangda release publish|begin|status|integration-status|renew|end|backend-*|app-* [--change id] [--profile name]');
 }
 
+async function task(args) {
+  const { subcommand, rest } = parseSubcommandArgs(args);
+  const { flags, positional } = parseArgs(rest);
+  if (wantsSubcommandHelp(subcommand, flags)) {
+    print([
+      '用法: openxiangda task status --change <id> [--profile name] [--watch] [--interval-seconds 5] [--timeout-seconds 300] [--json]',
+      '说明:',
+      '  - 聚合 SDD、task result、主线包含关系、本地 execution、远端 lease 和 App Release post-commit。',
+      '  - --watch 只轮询只读状态，不会续租、重试或写平台。',
+    ].join('\n'));
+    return;
+  }
+  if (subcommand !== 'status') {
+    fail('用法: openxiangda task status --change <id> [--profile name] [--watch]');
+  }
+  const changeId = positional[0] || readStringFlag(flags, 'change');
+  if (!changeId) {
+    fail('用法: openxiangda task status --change <id> [--profile name]');
+  }
+  const config = loadConfig();
+  const target = getWorkspaceTarget(
+    config,
+    flags.profile || config.currentProfile,
+    flags
+  );
+  if (flags.watch) {
+    return await watchTaskStatus(config, target, changeId, flags);
+  }
+  const result = await loadTaskStatusSnapshot(
+    config,
+    target,
+    changeId
+  );
+  if (flags.json) return writeJson(result);
+  printTaskStatus(result);
+}
+
+async function loadTaskStatusSnapshot(config, target, changeId) {
+  let change = null;
+  try {
+    const scope = getSddChangeScope({
+      cwd: process.cwd(),
+      configText: readWorkspaceConfigText(),
+      changeId,
+    });
+    change = scope.change || null;
+  } catch {
+    // Missing local SDD is a status fact, not a status-command failure.
+  }
+  const taskResult = readIntegrationTaskResult(
+    process.cwd(),
+    changeId
+  );
+  const integration = taskResult
+    ? inspectIntegrationBundleCommits(
+        {
+          requiredCommits: [
+            {
+              changeId,
+              commit: taskResult.commit,
+              treeHash: taskResult.treeHash,
+              sourceBranch: taskResult.branch,
+            },
+          ],
+        },
+        { cwd: process.cwd() }
+      )
+    : null;
+  const execution = readReleaseExecution(changeId);
+  const localLease = getStoredPublishLease(target);
+  const baseline = getStoredChangeBaseline(target, {
+    access: 'reconciliation-read',
+  });
+  const clientSessionId =
+    localLease?.clientSessionId ||
+    baseline?.clientSessionId ||
+    createPublishClientSessionId();
+  let remoteLease = null;
+  let remoteLeaseError = null;
+  try {
+    remoteLease = await fetchPublishLeaseStatus(
+      config,
+      target,
+      clientSessionId
+    );
+  } catch (error) {
+    remoteLeaseError = {
+      code: error?.code || 'LEASE_STATUS_UNAVAILABLE',
+      message: maskText(error?.message || String(error)),
+    };
+  }
+  const appReleaseId = findAppReleaseId(execution?.steps || []);
+  let postCommit = null;
+  let postCommitError = null;
+  if (appReleaseId) {
+    try {
+      postCommit = await requestWithAuth(
+        config,
+        target.profileName,
+        appReleaseApiPath(
+          target,
+          `/${encodeURIComponent(appReleaseId)}/post-commit`
+        )
+      );
+    } catch (error) {
+      postCommitError = {
+        code: error?.code || 'POST_COMMIT_STATUS_UNAVAILABLE',
+        message: maskText(error?.message || String(error)),
+      };
+    }
+  }
+  return {
+    ...buildTaskStatus({
+      changeId,
+      change,
+      taskResult,
+      integration,
+      execution,
+      remoteLease,
+      postCommit,
+    }),
+    checkedAt: new Date().toISOString(),
+    diagnostics: {
+      remoteLeaseError,
+      postCommitError,
+    },
+  };
+}
+
+async function watchTaskStatus(config, target, changeId, flags = {}) {
+  if (!changeId) {
+    fail('task/release status --watch 需要 --change <id>');
+  }
+  const intervalSeconds = normalizeWatchNumber(
+    flags['interval-seconds'],
+    5,
+    1,
+    60,
+    '--interval-seconds'
+  );
+  const timeoutSeconds = normalizeWatchNumber(
+    flags['timeout-seconds'],
+    300,
+    1,
+    3600,
+    '--timeout-seconds'
+  );
+  const deadline = Date.now() + timeoutSeconds * 1000;
+  let previousFingerprint = '';
+  let result;
+  for (;;) {
+    result = await loadTaskStatusSnapshot(
+      config,
+      target,
+      changeId
+    );
+    const fingerprint = [
+      result.phase,
+      result.progress.currentStep,
+      result.progress.completed,
+      result.release.postCommitStatus,
+      result.blocker?.layer,
+    ].join(':');
+    if (!flags.json && fingerprint !== previousFingerprint) {
+      printTaskStatus(result);
+    }
+    previousFingerprint = fingerprint;
+    if (
+      ['healthy', 'failed', 'write-review', 'integration-ready'].includes(
+        result.phase
+      )
+    ) {
+      break;
+    }
+    if (Date.now() >= deadline) {
+      result.timedOut = true;
+      break;
+    }
+    await sleep(
+      Math.min(intervalSeconds * 1000, Math.max(1, deadline - Date.now()))
+    );
+  }
+  if (flags.json) return writeJson(result);
+  if (result.timedOut) {
+    warn(
+      `状态观察已达到 ${timeoutSeconds}s；没有执行任何写入，稍后可继续使用同一命令。`
+    );
+  }
+  return result;
+}
+
+function normalizeWatchNumber(value, fallback, minimum, maximum, label) {
+  const number =
+    value === undefined || value === null || value === ''
+      ? fallback
+      : Number(value);
+  if (
+    !Number.isSafeInteger(number) ||
+    number < minimum ||
+    number > maximum
+  ) {
+    fail(`${label} 必须是 ${minimum}-${maximum} 之间的整数`);
+  }
+  return number;
+}
+
+function printTaskStatus(result) {
+  const eta =
+    result.estimatedRemainingMs === null
+      ? 'unknown'
+      : formatDurationMs(result.estimatedRemainingMs);
+  print(
+    [
+      `task ${result.changeId || '-'}: ${result.phase}`,
+      `progress: ${result.progress.completed}/${result.progress.total} current=${result.progress.currentStep || '-'}`,
+      `elapsed: ${result.elapsedMs === null ? 'unknown' : formatDurationMs(result.elapsedMs)} eta=${eta}`,
+      `platform write: ${result.wrotePlatform ? 'yes' : 'no'} health=${result.healthy ? 'healthy' : 'pending'}`,
+      ...(result.blocker
+        ? [
+            `blocked by: ${result.blocker.layer}${result.blocker.code ? ` (${result.blocker.code})` : ''}`,
+          ]
+        : []),
+      `下一步: ${result.nextAction}`,
+    ].join('\n')
+  );
+}
+
 async function fetchPublishLeaseStatus(config, target, clientSessionId) {
   return await requestWithAuth(
     config,
@@ -1946,6 +2332,10 @@ function backendReleaseApiPath(target, suffix = '') {
   return `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/backend-releases${suffix}`;
 }
 
+function workflowReleaseApiPath(target, suffix = '') {
+  return `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/workflow-releases${suffix}`;
+}
+
 async function runBackendReleaseCommand(
   config,
   target,
@@ -2102,6 +2492,62 @@ function appReleaseApiPath(target, suffix = '') {
   return `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/app-releases${suffix}`;
 }
 
+async function waitForAppReleasePostCommit(
+  config,
+  target,
+  releaseId,
+  flags = {}
+) {
+  const timeoutSeconds = normalizeWatchNumber(
+    flags['health-timeout-seconds'] || flags['timeout-seconds'],
+    60,
+    1,
+    900,
+    '--health-timeout-seconds'
+  );
+  const intervalSeconds = normalizeWatchNumber(
+    flags['interval-seconds'],
+    2,
+    1,
+    30,
+    '--interval-seconds'
+  );
+  const startedAt = Date.now();
+  const deadline = startedAt + timeoutSeconds * 1000;
+  let status = null;
+  for (;;) {
+    status = await requestWithAuth(
+      config,
+      target.profileName,
+      appReleaseApiPath(
+        target,
+        `/${encodeURIComponent(releaseId)}/post-commit`
+      )
+    );
+    if (status?.status === 'completed') {
+      return {
+        ...status,
+        healthy: true,
+        waitedMs: Date.now() - startedAt,
+      };
+    }
+    if (Date.now() >= deadline) {
+      return {
+        ...(status || {}),
+        status: status?.status || 'pending_retry',
+        healthy: false,
+        timedOut: true,
+        waitedMs: Date.now() - startedAt,
+        message:
+          'App Release 已原子激活，提交后动作仍由平台 outbox 自动重试。',
+      };
+    }
+    await sleep(
+      Math.min(intervalSeconds * 1000, Math.max(1, deadline - Date.now()))
+    );
+  }
+}
+
 async function fetchAppReleaseCapture(config, target, flags = {}) {
   const capture = await requestWithAuth(
     config,
@@ -2223,6 +2669,7 @@ const APP_RELEASE_IMMUTABLE_RESOURCE_KINDS = new Set([
   'RuntimeRelease',
   'PageRelease',
   'BackendRelease',
+  'WorkflowRelease',
   'FormRelease',
 ]);
 
@@ -2233,7 +2680,7 @@ function describeAppReleaseResource(resource, index, label) {
   const kind = String(resource.kind || '').trim();
   if (!APP_RELEASE_IMMUTABLE_RESOURCE_KINDS.has(kind)) {
     fail(
-      `APP_RELEASE_STAGED_RESOURCE_KIND_UNSUPPORTED: ${label}[${index}].kind 仅支持 RuntimeRelease/PageRelease/BackendRelease/FormRelease`
+      `APP_RELEASE_STAGED_RESOURCE_KIND_UNSUPPORTED: ${label}[${index}].kind 仅支持 RuntimeRelease/PageRelease/BackendRelease/WorkflowRelease/FormRelease`
     );
   }
   const identity =
@@ -2578,6 +3025,26 @@ function assertStagedAppReleaseScope(target, flags, resources) {
     );
   }
 
+  const expectedWorkflowSelectors = (targets.workflows || [])
+    .map(code => `workflow:${code}`)
+    .sort();
+  const workflows = byKind('WorkflowRelease');
+  if (expectedWorkflowSelectors.length > 0) {
+    if (
+      workflows.length !== 1 ||
+      !exactStringSet(
+        workflows[0]?.metadata?.handledSelectors,
+        expectedWorkflowSelectors
+      )
+    ) {
+      fail(
+        `APP_RELEASE_STAGED_SCOPE_MISMATCH: Workflow handledSelectors 必须精确为 ${expectedWorkflowSelectors.join(',')}`
+      );
+    }
+  } else if (workflows.length > 0) {
+    fail('APP_RELEASE_STAGED_SCOPE_MISMATCH: SDD 未授权 WorkflowRelease child');
+  }
+
   const runtimeCount = byKind('RuntimeRelease').length;
   if (runtimeCount !== (targets.runtime ? 1 : 0)) {
     fail(
@@ -2650,7 +3117,10 @@ function stagedAppReleaseProtocolVersion(stagedResources) {
           ''
       ) === APP_FUNCTION_SECRET_CAPABILITIES.backendRelease
   );
-  return hasBackendReleaseV2
+  const hasWorkflowRelease = (stagedResources || []).some(
+    resource => resource.kind === 'WorkflowRelease'
+  );
+  return hasBackendReleaseV2 || hasWorkflowRelease
     ? APP_FUNCTION_SECRET_CAPABILITIES.atomicActivation
     : null;
 }
@@ -2883,16 +3353,43 @@ async function runAppReleaseCommand(
     data = await requestWithAuth(
       config,
       target.profileName,
-      apiPathWithQuery(appReleaseApiPath(target), { limit: flags.limit })
+      apiPathWithQuery(appReleaseApiPath(target), { limit: flags.limit })
+    );
+  } else if (subcommand === 'app-detail') {
+    if (!releaseId) {
+      fail('用法: openxiangda release app-detail <releaseId> [--profile name]');
+    }
+    data = await requestWithAuth(
+      config,
+      target.profileName,
+      appReleaseApiPath(target, `/${encodeURIComponent(releaseId)}`)
+    );
+  } else if (subcommand === 'app-post-commit') {
+    if (!releaseId) {
+      fail(
+        '用法: openxiangda release app-post-commit <releaseId> [--profile name]'
+      );
+    }
+    data = await requestWithAuth(
+      config,
+      target.profileName,
+      appReleaseApiPath(
+        target,
+        `/${encodeURIComponent(releaseId)}/post-commit`
+      )
     );
-  } else if (subcommand === 'app-detail') {
+  } else if (subcommand === 'app-retry') {
     if (!releaseId) {
-      fail('用法: openxiangda release app-detail <releaseId> [--profile name]');
+      fail('用法: openxiangda release app-retry <releaseId> [--profile name]');
     }
     data = await requestWithAuth(
       config,
       target.profileName,
-      appReleaseApiPath(target, `/${encodeURIComponent(releaseId)}`)
+      appReleaseApiPath(
+        target,
+        `/${encodeURIComponent(releaseId)}/post-commit/retry`
+      ),
+      { method: 'POST', body: {} }
     );
   } else if (subcommand === 'app-diff') {
     const fromReleaseId = releaseId || readStringFlag(flags, 'from-release-id');
@@ -3098,10 +3595,28 @@ async function runAppReleaseCommand(
         protocolVersion,
       }
     );
+    const healthWait = flags.wait
+      ? await waitForAppReleasePostCommit(
+          config,
+          target,
+          activated?.id || verified?.id || prepared.id,
+          flags
+        )
+      : null;
     let stateReconcileWarning = null;
     try {
       const appHead = await loadRuntimeHeadApp(config, target);
-      saveRuntimeHeadState(target, appHead);
+      const stagedRuntime = stagedResources?.find(
+        resource => resource.kind === 'RuntimeRelease'
+      );
+      saveRuntimeHeadState(target, appHead, {
+        id:
+          stagedRuntime?.identity?.releaseId ||
+          stagedRuntime?.releaseId ||
+          null,
+        buildId: stagedRuntime?.metadata?.buildId || null,
+        assetBaseUrl: stagedRuntime?.metadata?.assetBaseUrl || null,
+      });
     } catch (error) {
       stateReconcileWarning = {
         component: 'RuntimeStateReadback',
@@ -3117,6 +3632,7 @@ async function runAppReleaseCommand(
       prepared,
       verified,
       activated,
+      ...(healthWait ? { healthWait } : {}),
       ...(stateReconcileWarning ? { stateReconcileWarning } : {}),
     };
   } else if (subcommand === 'app-rollback') {
@@ -4092,6 +4608,47 @@ async function contract(args) {
   fail('用法: openxiangda contract list|explain <contract-name> [--json]');
 }
 
+async function policy(args) {
+  const { subcommand, rest } = parseSubcommandArgs(args);
+  const { flags } = parseArgs(rest);
+  if (wantsSubcommandHelp(subcommand, flags)) {
+    print('用法: openxiangda policy show|check|render [--json]');
+    return;
+  }
+  if (subcommand === 'show') {
+    const result = loadEngineeringPolicy();
+    if (flags.json) return writeJson(result);
+    print(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (subcommand === 'check') {
+    const result = checkEngineeringPolicyMarkers();
+    if (!result.valid) {
+      const error = new Error(
+        `OPENXIANGDA_POLICY_DOC_DRIFT: ${result.files
+          .filter(item => !item.synchronized)
+          .map(item => item.file)
+          .join(', ')}`
+      );
+      error.code = 'OPENXIANGDA_POLICY_DOC_DRIFT';
+      throw error;
+    }
+    if (flags.json) return writeJson(result);
+    print(`OpenXiangda engineering policy v${result.policyVersion} synchronized`);
+    return;
+  }
+  if (subcommand === 'render') {
+    const result = {
+      policyVersion: loadEngineeringPolicy().policyVersion,
+      markdown: renderEngineeringPolicyMarkdown(),
+    };
+    if (flags.json) return writeJson(result);
+    print(result.markdown);
+    return;
+  }
+  fail('用法: openxiangda policy show|check|render [--json]');
+}
+
 async function openApi(args) {
   const [section, action, ...rest] = args;
   const { flags, positional } = parseArgs(rest);
@@ -4263,6 +4820,29 @@ async function platform(args) {
   }
   const config = loadConfig();
 
+  if (subcommand === 'prepare') {
+    const result = prepareDependencyCapsule({
+      cwd: process.cwd(),
+      check: Boolean(flags.check || flags['dry-run']),
+      force: Boolean(flags.force),
+      quiet: Boolean(flags.json),
+    });
+    if (flags.json) {
+      writeJson(result);
+      if (!result.ready) process.exitCode = 1;
+      return;
+    }
+    if (!result.ready) {
+      fail(
+        `依赖 capsule 尚未准备。运行: ${result.recommendedCommand}`
+      );
+    }
+    print(
+      `依赖环境已就绪: ${result.packageManager} ${result.fingerprint.slice(0, 12)} (${result.action || 'ready'})`
+    );
+    return;
+  }
+
   if (subcommand === 'add') {
     const [name, rawUrl] = positional;
     if (!name || !rawUrl) {
@@ -5251,7 +5831,7 @@ async function workspace(args) {
     return;
   }
 
-  fail('用法: openxiangda workspace init|bind|plan|check|publish|ownership [--changed [--since ref]|--form code|--page code|--only list] [--dry-run] [--force] [--resources|--skip-resources]');
+  fail('用法: openxiangda workspace init|prepare|bind|plan|check|publish|ownership [--changed [--since ref]|--form code|--page code|--only list] [--dry-run] [--force] [--resources|--skip-resources]');
 }
 
 function printWorkspaceHelp() {
@@ -5261,6 +5841,7 @@ Usage:
   openxiangda workspace init [dir] [--name package-name] [--runtime legacy|react-spa] [--install] [--force]
   openxiangda workspace init [dir] --profile <name> --app-name <app-name> [--runtime legacy|react-spa] [--description text] [--install] [--force]
   openxiangda workspace init [dir] --profile <name> --app-type <APP_XXX> [--runtime legacy|react-spa] [--install] [--force]
+  openxiangda workspace prepare [--check] [--force] [--json]
   openxiangda workspace bind --profile <name> --app-type <APP_XXX>
   openxiangda workspace ownership status|claim|release [--change <id>] [--force --reason text]
   openxiangda workspace plan [--change <id>|--changed] [--json]
@@ -5285,6 +5866,7 @@ Options:
   --dry-run                        Show planned work without writing.
   --resources / --skip-resources   Include or skip src/resources publish.
   --legacy-form-bundle             Force legacy workspace publish in React SPA workspaces.
+  prepare                           Reuse one lockfile-addressed dependency capsule across worktrees.
   plan/check                       Show release order and fail on risky AI fallback patterns.`);
 }
 
@@ -9531,14 +10113,14 @@ async function resource(args) {
       '  openxiangda resource validate --profile <name>',
       '  openxiangda resource plan [type] --only <code1,code2> --profile <name> --json',
       '  openxiangda resource publish [type] --only <code1,code2> --profile <name>',
-      '  openxiangda resource publish function --only <code> --stage-only --profile <name>',
+      '  openxiangda resource publish function,workflow --only function:<code>,workflow:<code> --stage-only --profile <name>',
       '  openxiangda resource publish form-settings --only <code> --activate --profile <name>',
       '  openxiangda resource publish [type] --all --reason "approved app-wide closure" --profile <name>',
       '说明:',
       '  - 读取 src/resources/**；workflowFile 会先走非写入编译校验。',
       '  - publish 默认跳过 plan 判定为 noop 的资源，避免无意义 upsert；需要强制写入时加 --force。',
       '  - Form settings bundle 默认只 stage，不推进线上 Form head；只有显式 --activate 才 CAS 激活。',
-      '  - Function/Automation 可用 --stage-only 只 prepare + verify Backend Release；随后把返回的 stagedResource 交给 release app-finalize 原子激活。',
+      '  - Function/Automation/Workflow 可用 --stage-only 只 prepare + verify immutable child；随后由 release app-finalize 一次原子激活。',
       '  - publish --dry-run 等价于发布前计划，不会写平台资源。',
       '  - 在线 publish 必须用 --only/--code 精确选择；真正全量发布必须显式 --all --reason，SDD bypass 不能绕过此范围门。',
       '  - 历史代码已先合入主线、线上又来自多次分批发布时，可显式使用 --adopt-online-baseline --adoption-reason "..."；仅允许绑定同一 change/lease 的精确非删除范围，仍保留 lease、冻结 head 检查与写入 CAS。',
@@ -9743,7 +10325,15 @@ async function resource(args) {
           baseRef: flags.since || 'HEAD',
           replaceManifest: Boolean(flags['replace-manifest']),
           activateFormBundles: Boolean(flags.activate),
-          stageBackendReleaseOnly: Boolean(flags['stage-only']),
+          stageBackendReleaseOnly:
+            Boolean(flags['stage-only']) &&
+            Boolean(
+              typeFilters?.has('functions') ||
+                typeFilters?.has('automations')
+            ),
+          stageWorkflowReleaseOnly:
+            Boolean(flags['stage-only']) &&
+            Boolean(typeFilters?.has('workflows')),
         })
     );
     if (changeBaselinePreflight) {
@@ -9795,9 +10385,11 @@ function assertBackendStageOnlyScope(subcommand, flags, typeFilters) {
   const normalized = Array.from(typeFilters || []);
   if (
     normalized.length === 0 ||
-    normalized.some(type => !['functions', 'automations'].includes(type))
+    normalized.some(
+      type => !['functions', 'automations', 'workflows'].includes(type)
+    )
   ) {
-    fail('--stage-only 必须显式选择 function 或 automation 资源类型');
+    fail('--stage-only 必须显式选择 function、automation 或 workflow 资源类型');
   }
 }
 
@@ -9953,11 +10545,11 @@ async function runtime(args) {
   const { flags, positional } = parseArgs(rest);
   if (wantsSubcommandHelp(subcommand, flags)) {
     print([
-      '用法: openxiangda runtime deploy|releases|activate [--profile name] [--json]',
+      '用法: openxiangda runtime deploy|releases [--full]|activate [--profile name] [--json]',
       '常用流程:',
       '  npm run build',
       '  openxiangda runtime deploy --no-activate --change <change> --profile <name> --json',
-      '  openxiangda runtime releases --profile <name>',
+      '  openxiangda runtime releases --profile <name> [--full]',
       '说明:',
       '  - deploy 上传当前工作区 dist/ 并激活 React SPA runtime release。',
       '  - 默认 --upload-mode auto；multipart 上传遇到 403 时自动切换到平台内置对象存储直传。',
@@ -9984,8 +10576,9 @@ async function runtime(args) {
       target.profileName,
       `/openxiangda-api/v1/apps/${encodeURIComponent(target.appType)}/runtime/releases`
     );
-    if (flags.json) return writeJson(data);
-    print(JSON.stringify(data, null, 2));
+    const output = flags.full ? data : summarizeRuntimeReleaseList(data);
+    if (flags.json) return writeJson(output);
+    print(JSON.stringify(output, null, 2));
     return;
   }
 
@@ -10298,6 +10891,7 @@ async function runtime(args) {
     const runtimeContentHash = String(data?.contentHash || '')
       .trim()
       .toLowerCase();
+    const releaseAssetBaseUrl = data?.assetBaseUrl || assetBaseUrl;
     const stagedResource = flags['no-activate']
       ? stripUndefinedValues({
           kind: 'RuntimeRelease',
@@ -10311,6 +10905,7 @@ async function runtime(args) {
           metadata: {
             buildId: data?.buildId || buildId,
             releaseStatus: data?.status || 'staged',
+            assetBaseUrl: releaseAssetBaseUrl,
           },
         })
       : null;
@@ -10335,7 +10930,6 @@ async function runtime(args) {
             target
           )
         : null;
-    const releaseAssetBaseUrl = data?.assetBaseUrl || assetBaseUrl;
     const result = {
       appType: target.appType,
       buildId,
@@ -10381,7 +10975,7 @@ async function runtime(args) {
     }
   }
 
-  fail('用法: openxiangda runtime deploy|releases|activate [--profile name]');
+  fail('用法: openxiangda runtime deploy|releases [--full]|activate [--profile name]');
 }
 
 async function loadRuntimeHeadApp(config, target) {
@@ -10568,9 +11162,11 @@ async function uploadRuntimeDistFilesStaged(options) {
     async file => {
       const uploaded = await uploadRuntimeDistFile(options, file);
       completed += 1;
-      printRuntimeProgress(
-        `runtime file uploaded [${completed}/${files.length}] ${file.path} ${formatBytes(file.size)} traceId=${options.traceId}`
-      );
+      if (shouldReportRuntimeUploadProgress(completed, files.length)) {
+        printRuntimeProgress(
+          `runtime file uploaded [${completed}/${files.length}] ${file.path} ${formatBytes(file.size)} traceId=${options.traceId}`
+        );
+      }
       return uploaded;
     }
   );
@@ -10625,9 +11221,11 @@ async function uploadRuntimeDistFilesOssDirect(options) {
       );
       const uploaded = await uploadRuntimeDistFileToSignedUrl(options, file, uploadInfo);
       completed += 1;
-      printRuntimeProgress(
-        `runtime ${formatRuntimeStorageProvider(storageProvider)} file uploaded [${completed}/${files.length}] ${file.path} ${formatBytes(file.size)} traceId=${options.traceId}`
-      );
+      if (shouldReportRuntimeUploadProgress(completed, files.length)) {
+        printRuntimeProgress(
+          `runtime ${formatRuntimeStorageProvider(storageProvider)} file uploaded [${completed}/${files.length}] ${file.path} ${formatBytes(file.size)} traceId=${options.traceId}`
+        );
+      }
       return { ...uploaded, storageProvider };
     }
   );
@@ -10889,21 +11487,71 @@ function saveRuntimeReleaseState(target, release) {
   saveProjectState(target.state);
 }
 
-function saveRuntimeHeadState(target, app) {
+function saveRuntimeHeadState(target, app, fallbackRelease = {}) {
   const activeReleaseId =
-    app?.activeRuntimeReleaseId || app?.activeRuntime?.releaseId || null;
+    app?.activeRuntimeReleaseId ||
+    app?.activeRuntime?.releaseId ||
+    fallbackRelease?.id ||
+    fallbackRelease?.releaseId ||
+    null;
   const activeBuildId =
-    app?.activeRuntimeBuildId || app?.activeRuntime?.buildId || null;
+    app?.activeRuntimeBuildId ||
+    app?.activeRuntime?.buildId ||
+    fallbackRelease?.buildId ||
+    null;
   if (!activeReleaseId && !activeBuildId) return false;
   saveRuntimeReleaseState(target, {
     id: activeReleaseId,
     buildId: activeBuildId,
     assetBaseUrl:
-      app?.runtimeAssetBaseUrl || app?.activeRuntime?.assetBaseUrl || null,
+      app?.runtimeAssetBaseUrl ||
+      app?.activeRuntime?.assetBaseUrl ||
+      fallbackRelease?.assetBaseUrl ||
+      null,
   });
   return true;
 }
 
+function summarizeRuntimeReleaseList(data) {
+  const items = Array.isArray(data)
+    ? data
+    : Array.isArray(data?.items)
+      ? data.items
+      : [];
+  const summarized = items.map(item =>
+    stripUndefinedValues({
+      id: item?.id,
+      version: item?.version,
+      buildId: item?.buildId,
+      status: item?.status,
+      storageProvider: item?.storageProvider,
+      fileCount: item?.fileCount,
+      sizeBytes: item?.sizeBytes,
+      contentHash: item?.contentHash,
+      sourceRevision: item?.sourceRevision,
+      parentReleaseId: item?.parentReleaseId,
+      parentSourceRevision: item?.parentSourceRevision,
+      lineageBypassReason: item?.lineageBypassReason,
+      lineageBootstrap: item?.lineageBootstrap,
+      releaseNotes: item?.releaseNotes,
+      createdAt: item?.createdAt,
+      activatedAt: item?.activatedAt,
+    })
+  );
+  return Array.isArray(data)
+    ? summarized
+    : {
+        ...(data && typeof data === 'object' ? data : {}),
+        items: summarized,
+      };
+}
+
+function shouldReportRuntimeUploadProgress(completed, total) {
+  if (total <= 10) return true;
+  const interval = Math.max(1, Math.ceil(total / 10));
+  return completed === 1 || completed === total || completed % interval === 0;
+}
+
 function formatBytes(value) {
   const bytes = Number(value || 0);
   if (bytes < 1024) return `${bytes}B`;
@@ -14350,7 +14998,7 @@ async function tryBuildFunctionSourcesWithLegacyWorkspaceBuilder(
 
   let usedLegacyBuilder = false;
   for (const sourceInfo of sourceInfos) {
-    const result = runWorkspaceJsCodeBuild(
+    const result = runLegacyWorkspaceJsCodeBuild(
       workspaceRoot,
       sourceInfo.scriptCode,
       sourceInfo.sourceKind
@@ -15235,8 +15883,17 @@ async function publishBackendReleaseResources(
     if (!result.backendRelease.stagedResource) {
       fail('Backend Release stage-only 响应缺少 verified stagedResource');
     }
-    result.stagedResource = result.backendRelease.stagedResource;
-    result.handledSelectors = handledSelectors;
+    result.stagedResources = result.stagedResources || [];
+    result.stagedResources.push(result.backendRelease.stagedResource);
+    if (result.stagedResources.length === 1) {
+      result.stagedResource = result.backendRelease.stagedResource;
+    } else {
+      delete result.stagedResource;
+    }
+    result.handledSelectors = unique([
+      ...(result.handledSelectors || []),
+      ...handledSelectors,
+    ]).sort();
     return;
   }
   const activated = await requestWithAuth(
@@ -15323,6 +15980,176 @@ async function publishBackendReleaseResources(
   result.handledSelectors = handledSelectors;
 }
 
+async function publishWorkflowReleaseResources(
+  config,
+  target,
+  manifest,
+  result,
+  options = {}
+) {
+  if (!options.stageWorkflowReleaseOnly) return;
+  const candidates = (manifest.workflows || [])
+    .map(item => {
+      const code = item.code || item.resourceCode;
+      const action = getPlannedResourceAction(options, 'workflow', code);
+      return { item, code, action };
+    })
+    .filter(
+      candidate =>
+        candidate.action &&
+        ['create', 'update', 'noop'].includes(candidate.action.action) &&
+        !(candidate.action.action === 'noop' && options.skipNoop !== false)
+    );
+  if (candidates.length === 0) {
+    fail('--stage-only 没有匹配到可冻结的 Workflow 资源');
+  }
+  const head = await requestWithAuth(
+    config,
+    target.profileName,
+    workflowReleaseApiPath(target, '/head')
+  );
+  const releaseContext = await ensureOwnedImmutableReleasePublishContext(
+    config,
+    target,
+    options.publishLeaseFlags || {},
+    'Workflow 原子发布',
+    'Workflow Release'
+  );
+  options.publishLease = releaseContext.publishLease;
+  options.publishLeaseId = releaseContext.publishLease.leaseId;
+  const resources = await runWithConcurrency(
+    candidates,
+    Math.min(6, candidates.length),
+    async candidate => {
+      const compiled = await compileWorkflowSourceFile(candidate.item);
+      const definitionJson =
+        compiled?.definitionJson ||
+        (await resolveManifestJson(
+          config,
+          target.profileName,
+          candidate.item,
+          'definitionJson',
+          'definitionFile'
+        ));
+      const viewJson =
+        compiled?.previewJson ??
+        (await resolveManifestJson(
+          config,
+          target.profileName,
+          candidate.item,
+          'viewJson',
+          'viewFile',
+          true
+        )) ??
+        (await resolveManifestJson(
+          config,
+          target.profileName,
+          candidate.item,
+          'previewJson',
+          'previewFile',
+          true
+        ));
+      return {
+        code: candidate.code,
+        operation:
+          candidate.action.action === 'create' ? 'create' : 'update',
+        formUuid: resolveManifestFormUuid(target.bound, candidate.item),
+        definitionJson,
+        ...(viewJson !== undefined ? { viewJson } : {}),
+        publish: candidate.item.publish !== false,
+      };
+    }
+  );
+  const prepared = await requestWithAuth(
+    config,
+    target.profileName,
+    workflowReleaseApiPath(target),
+    {
+      method: 'POST',
+      body: {
+        ...releaseContext.control,
+        sourceRepositoryId: releaseContext.sourceRepositoryId,
+        sourceRevision: releaseContext.sourceRevision,
+        parentReleaseId: head?.activeWorkflowReleaseId || null,
+        resources,
+      },
+    }
+  );
+  if (!prepared?.id || !/^[a-f0-9]{64}$/i.test(prepared?.manifestHash || '')) {
+    fail('Workflow Release prepare 响应缺少 id 或 manifestHash');
+  }
+  const preparedCodes = (prepared.resources || [])
+    .map(resource => String(resource.code || ''))
+    .sort();
+  const expectedCodes = candidates.map(candidate => candidate.code).sort();
+  if (!exactStringSet(preparedCodes, expectedCodes)) {
+    fail('Workflow Release prepare 返回的资源集合与精确 selector 不一致');
+  }
+  const verified = await requestWithAuth(
+    config,
+    target.profileName,
+    workflowReleaseApiPath(
+      target,
+      `/${encodeURIComponent(prepared.id)}/verify`
+    ),
+    {
+      method: 'POST',
+      body: {
+        ...releaseContext.control,
+        manifestHash: prepared.manifestHash,
+      },
+    }
+  );
+  if (String(verified?.status || '').toLowerCase() !== 'verified') {
+    fail('Workflow Release stage-only 未获得 verified 状态');
+  }
+  const handledSelectors = candidates
+    .map(candidate => `workflow:${candidate.code}`)
+    .sort();
+  const stagedResource = {
+    kind: 'WorkflowRelease',
+    identity: { releaseId: verified.id || prepared.id },
+    action: 'update',
+    hash: verified.manifestHash || prepared.manifestHash,
+    revision: {
+      releaseId: verified.id || prepared.id,
+      manifestHash: verified.manifestHash || prepared.manifestHash,
+      sourceRevision: verified.sourceRevision || prepared.sourceRevision,
+    },
+    metadata: {
+      contractVersion: 'workflow_release_v1',
+      handledSelectors,
+      resourceCount: candidates.length,
+    },
+  };
+  result.stagedResources = result.stagedResources || [];
+  result.stagedResources.push(stagedResource);
+  result.workflowRelease = {
+    id: verified.id || prepared.id,
+    manifestHash: verified.manifestHash || prepared.manifestHash,
+    status: verified.status,
+    handledSelectors,
+    stagedResource,
+  };
+  result.handledSelectors = unique([
+    ...(result.handledSelectors || []),
+    ...handledSelectors,
+  ]).sort();
+  options.workflowReleaseHandledKeys = new Set(
+    candidates.map(candidate => `Workflow:${candidate.code}`)
+  );
+  for (const candidate of candidates) {
+    result.published.push({
+      kind: 'workflow',
+      code: candidate.code,
+      action: 'stage',
+      writeMode: 'workflow-release-stage',
+      workflowReleaseId: stagedResource.identity.releaseId,
+      activation: 'staged',
+    });
+  }
+}
+
 async function publishResourceManifest(config, target, manifest, options = {}) {
   const result = {
     appType: target.appType,
@@ -15347,6 +16174,13 @@ async function publishResourceManifest(config, target, manifest, options = {}) {
   await publishMenuResources(config, target, manifest.menus || [], result, publishOptions);
   await publishConnectorResources(config, target, manifest.connectors || [], result, publishOptions);
   await publishNotificationResources(config, target, manifest.notifications || [], result, publishOptions);
+  await publishWorkflowReleaseResources(
+    config,
+    target,
+    manifest,
+    result,
+    publishOptions
+  );
   await publishWorkflowResources(config, target, manifest.workflows || [], result, publishOptions);
   await publishBackendReleaseResources(
     config,
@@ -15430,7 +16264,9 @@ function inferManifestSourceKind(item, kind) {
   if (candidates.some(value => value.includes('/js-code-nodes/'))) return 'js-code-nodes';
   if (candidates.some(value => value.includes('/automations/'))) return 'automations';
   if (candidates.some(value => value.includes('/functions/'))) return 'functions';
-  return kind === 'Function' ? 'functions' : 'automations';
+  if (kind === 'Function') return 'functions';
+  if (kind === 'Workflow') return 'workflows';
+  return 'automations';
 }
 
 function buildResourceChangeBaselineTargets(manifest, actions = [], options = {}) {
@@ -15441,7 +16277,12 @@ function buildResourceChangeBaselineTargets(manifest, actions = [], options = {}
     for (const item of items || []) {
       const code = item.code || item.functionCode || item.resourceCode;
       if (!code) continue;
-      const planKind = kind === 'Function' ? 'function' : 'automation';
+      const planKind =
+        kind === 'Function'
+          ? 'function'
+          : kind === 'Workflow'
+            ? 'workflow'
+            : 'automation';
       const action = actionIndex.get(`${planKind}:${code}`);
       if (action?.action === 'create') continue;
       if (action?.action === 'noop' && !options.force) continue;
@@ -15457,6 +16298,7 @@ function buildResourceChangeBaselineTargets(manifest, actions = [], options = {}
   };
   append('Function', manifest.functions);
   append('Automation', manifest.automations);
+  append('Workflow', manifest.workflows);
   for (const action of actions || []) {
     if (action?.action !== 'delete' || !action.code) continue;
     const kind =
@@ -15464,6 +16306,8 @@ function buildResourceChangeBaselineTargets(manifest, actions = [], options = {}
         ? 'Function'
         : action.kind === 'automation'
           ? 'Automation'
+          : action.kind === 'workflow'
+            ? 'Workflow'
           : null;
     if (!kind) continue;
     const key = resourceBaselineTargetKey(kind, action.code);
@@ -15472,7 +16316,12 @@ function buildResourceChangeBaselineTargets(manifest, actions = [], options = {}
     targets.push({
       kind,
       code: action.code,
-      sourceKind: kind === 'Function' ? 'functions' : 'automations',
+      sourceKind:
+        kind === 'Function'
+          ? 'functions'
+          : kind === 'Workflow'
+            ? 'workflows'
+            : 'automations',
     });
   }
   return targets;
@@ -15484,7 +16333,6 @@ const GENERIC_RESOURCE_KEY_BY_PLAN_KIND = Object.freeze({
   connector: 'connectors',
   notificationTemplate: 'notifications',
   notificationTypeConfig: 'notifications',
-  workflow: 'workflows',
   authConfig: 'authConfigs',
   route: 'routes',
   publicAccessPolicy: 'publicAccessPolicies',
@@ -15582,13 +16430,22 @@ function runGenericResourceGitBasePreflight({
     publishLeaseId,
     headDigest,
     baseCommit,
+    appType: target.appType,
+    profile: target.profileName,
+    repository: baseline?.sourceBase?.repo,
+    resourceHeads: baseline?.resourceHeads,
     selectors,
     typeFilters,
   });
-  let basePlan = genericGitBasePlanCache.get(cacheKey);
-  let cached = true;
+  let basePlan =
+    genericGitBasePlanCache.get(cacheKey) ||
+    readContentCache({
+      cwd: process.cwd(),
+      namespace: 'generic-git-base-plan',
+      key: cacheKey,
+    });
+  let cached = Boolean(basePlan);
   if (!basePlan) {
-    cached = false;
     basePlan = withGitBaseWorkspace(
       {
         cwd: process.cwd(),
@@ -15659,6 +16516,20 @@ function runGenericResourceGitBasePreflight({
       }
     );
     genericGitBasePlanCache.set(cacheKey, basePlan);
+    writeContentCache({
+      cwd: process.cwd(),
+      namespace: 'generic-git-base-plan',
+      key: cacheKey,
+      value: {
+        actions: (basePlan.actions || [])
+          .filter(action => action?.kind && action?.code && action?.action)
+          .map(action => ({
+            kind: action.kind,
+            code: action.code,
+            action: action.action,
+          })),
+      },
+    });
     while (genericGitBasePlanCache.size > 32) {
       genericGitBasePlanCache.delete(genericGitBasePlanCache.keys().next().value);
     }
@@ -15790,7 +16661,7 @@ async function runResourceChangeBaselinePreflight(
       ok: true,
       baselineId: baseline.baselineId,
       checkedTargets: [],
-      skipped: 'no-existing-function-or-automation-writes',
+      skipped: 'no-existing-function-automation-or-workflow-writes',
     };
   } else {
     const artifactCache = { ...(baseline.localBaseArtifactHashes || {}) };
@@ -16995,6 +17866,13 @@ async function publishNotificationResources(config, target, notifications, resul
 
 async function publishWorkflowResources(config, target, workflows, result, options = {}) {
   for (const workflowItem of workflows) {
+    if (
+      options.workflowReleaseHandledKeys?.has(
+        `Workflow:${workflowItem.code}`
+      )
+    ) {
+      continue;
+    }
     if (shouldSkipNoopResource(options, 'workflow', workflowItem.code)) {
       recordNoopResource(result, 'workflow', workflowItem.code, options);
       continue;
@@ -21237,6 +22115,27 @@ function runWorkspaceJsCodeBuild(workspaceRoot, resolvedScriptCode, sourceKind)
   );
 }
 
+function runLegacyWorkspaceJsCodeBuild(
+  workspaceRoot,
+  resolvedScriptCode,
+  sourceKind
+) {
+  return spawnSync(
+    'pnpm',
+    [
+      'build-js-code',
+      '--script',
+      resolvedScriptCode,
+      '--source',
+      sourceKind,
+    ],
+    {
+      cwd: workspaceRoot,
+      encoding: 'utf8',
+    }
+  );
+}
+
 function isUnsupportedFunctionsBuildScript(result) {
   const output = `${result.stdout || ''}\n${result.stderr || ''}`;
   return (
@@ -21668,6 +22567,79 @@ function isRuntimeSourceFile(file) {
   return /\.(ts|tsx|js|jsx|mjs|cjs|css|scss|sass|less|html|json|svg|png|jpe?g|gif|webp|avif|ico)$/i.test(file);
 }
 
+function resourceSpecForWorkspaceFile(file) {
+  const prefix = 'src/resources/';
+  if (!file.startsWith(prefix)) return null;
+  const relative = file.slice(prefix.length);
+  return (
+    RESOURCE_SPECS.find(spec => {
+      const dir = String(spec.dir || '').replace(/\\/g, '/').replace(/\/+$/, '');
+      const topFiles = (spec.topFiles || []).map(item =>
+        String(item).replace(/\\/g, '/')
+      );
+      return (
+        topFiles.includes(relative) ||
+        (dir && (relative === dir || relative.startsWith(`${dir}/`)))
+      );
+    }) || null
+  );
+}
+
+function changedResourceCodesForFile(file, spec, baseRef = 'HEAD') {
+  const absolute = path.join(process.cwd(), file);
+  const currentItems = fs.existsSync(absolute)
+    ? readResourceItemsFromFile(absolute, spec)
+    : [];
+  const baseItems = readResourceItemsFromGit(baseRef, file, spec) || [];
+  const current = indexResourceItemsForDiff(currentItems);
+  const base = indexResourceItemsForDiff(baseItems);
+  const codes = unique([...current.keys(), ...base.keys()]).filter(
+    code => current.get(code) !== base.get(code)
+  );
+  if (codes.length > 0) return codes.sort();
+  if (currentItems.some(item => item?.__invalid) || baseItems.some(item => item?.__invalid)) {
+    return ['*'];
+  }
+  return [];
+}
+
+function classifyGenericResourceFiles(files, baseRef = 'HEAD') {
+  const resourceSelectors = {};
+  const formSettings = new Set();
+  const unknown = new Set();
+  const codeResourceKeys = new Set([
+    'functions',
+    'automations',
+    'workflows',
+  ]);
+  for (const file of files || []) {
+    if (!file.startsWith('src/resources/')) continue;
+    const spec = resourceSpecForWorkspaceFile(file);
+    if (!spec) {
+      unknown.add(file);
+      continue;
+    }
+    if (codeResourceKeys.has(spec.key)) continue;
+    const codes = changedResourceCodesForFile(file, spec, baseRef);
+    if (spec.key === 'formSettings') {
+      for (const code of codes) formSettings.add(code);
+      continue;
+    }
+    if (codes.length === 0) continue;
+    resourceSelectors[spec.key] = unique([
+      ...(resourceSelectors[spec.key] || []),
+      ...codes,
+    ]).sort();
+  }
+  if (unknown.size > 0) {
+    resourceSelectors.unknown = Array.from(unknown).sort();
+  }
+  return {
+    formSettings: Array.from(formSettings).sort(),
+    resourceSelectors,
+  };
+}
+
 function classifyWorkspaceFiles(files, runtimeMode, options = {}) {
   const forms = new Set();
   const pages = new Set();
@@ -21685,6 +22657,11 @@ function classifyWorkspaceFiles(files, runtimeMode, options = {}) {
     jsCodeNodes,
   };
   const dependencyTargets = getWorkspaceImpactedResourceTargets(files);
+  const genericTargets = classifyGenericResourceFiles(
+    files,
+    options.baseRef || 'HEAD'
+  );
+  for (const code of genericTargets.formSettings) forms.add(code);
   for (const [key, codes] of Object.entries(dependencyTargets)) {
     for (const code of codes) codeResourceTargets[key]?.add(code);
   }
@@ -21729,7 +22706,7 @@ function classifyWorkspaceFiles(files, runtimeMode, options = {}) {
       continue;
     }
     if (file.startsWith('src/resources/')) {
-      resources = true;
+      if (!resourceSpecForWorkspaceFile(file)) resources = true;
       continue;
     }
     if (
@@ -21753,6 +22730,7 @@ function classifyWorkspaceFiles(files, runtimeMode, options = {}) {
     workflows: Array.from(workflows).sort(),
     jsCodeNodes: Array.from(jsCodeNodes).sort(),
     resources,
+    resourceSelectors: genericTargets.resourceSelectors,
     runtime,
     other,
   };
@@ -21926,17 +22904,45 @@ function buildWorkspaceReleasePlan(options = {}) {
       ? getWorkspaceChangedFiles({ since: options.since })
       : getAllWorkspaceSourceFiles();
   const targets = changeScope
-    ? {
-        forms: [...(changeScope.targets.forms || [])],
+    ? (() => {
+        const inferred = classifyWorkspaceFiles(files, runtimeMode, {
+          baseRef:
+            options.since ||
+            changeScope.change?.sourceBase?.baseCommit ||
+            'HEAD',
+        });
+        return {
+        forms: unique([
+          ...(changeScope.targets.forms || []),
+          ...(inferred.forms || []),
+        ]).sort(),
         pages: [...(changeScope.targets.pages || [])],
         functions: [...(changeScope.targets.functions || [])],
         automations: [...(changeScope.targets.automations || [])],
         workflows: [...(changeScope.targets.workflows || [])],
         jsCodeNodes: [...(changeScope.targets.jsCodeNodes || [])],
-        resources: Boolean(changeScope.targets.resources),
+        resources:
+          Boolean(changeScope.targets.resources) &&
+          (
+            Object.keys(inferred.resourceSelectors || {}).length === 0 ||
+            Boolean(inferred.resourceSelectors?.unknown?.length)
+          ),
+        resourceSelectors: Object.fromEntries(
+          unique([
+            ...Object.keys(changeScope.targets.resourceSelectors || {}),
+            ...Object.keys(inferred.resourceSelectors || {}),
+          ]).map(key => [
+            key,
+            unique([
+              ...(changeScope.targets.resourceSelectors?.[key] || []),
+              ...(inferred.resourceSelectors?.[key] || []),
+            ]).sort(),
+          ])
+        ),
         runtime: Boolean(changeScope.targets.runtime),
         other: [...(changeScope.targets.other || [])],
-      }
+        };
+      })()
       : classifyWorkspaceFiles(files, runtimeMode, {
         baseRef: options.since || 'HEAD',
       });
@@ -21996,12 +23002,22 @@ function buildWorkspaceReleasePlan(options = {}) {
     targets,
     runtimeMode
   );
-  const generatedCommands = buildWorkspaceReleaseCommands(
-    targets,
-    runtimeMode,
-    options.profile,
-    changeScope?.changeId
-  );
+  let generatedCommands = [];
+  try {
+    generatedCommands = buildWorkspaceReleaseCommands(
+      targets,
+      runtimeMode,
+      options.profile,
+      changeScope?.changeId
+    );
+  } catch (error) {
+    if (error?.code !== 'RELEASE_ATOMIC_TARGET_UNSUPPORTED') throw error;
+    errors.push({
+      name: 'release-atomic-target-unsupported',
+      message: error.message,
+      unsupportedTargets: error.unsupportedTargets || [],
+    });
+  }
   const knownTargetCount =
     targets.forms.length +
     targets.pages.length +
@@ -22111,6 +23127,10 @@ function printWorkspaceReleasePlan(plan) {
     `workflows: ${(plan.targets.workflows || []).length ? plan.targets.workflows.join(', ') : '(none)'}`,
     `jsCodeNodes: ${(plan.targets.jsCodeNodes || []).length ? plan.targets.jsCodeNodes.join(', ') : '(none)'}`,
     `resources: ${plan.targets.resources ? 'yes' : 'no'}`,
+    ...Object.entries(plan.targets.resourceSelectors || {}).map(
+      ([type, codes]) =>
+        `resource ${type}: ${codes.length ? codes.join(', ') : '(none)'}`
+    ),
     `runtime deploy: ${plan.targets.runtime ? 'yes' : 'no'}`,
   ];
   if (plan.commands.length > 0) {