openxiangda 1.0.214 → 1.0.216

package/README.md

@@ -82,7 +82,7 @@ openxiangda app snapshot APP_XXXX --profile dev --json
 
 User tokens are stored in `~/.openxiangda/profiles.json` with `0600` permissions. Shared workspace environment values, including `APP_OSS_*`, can live in `~/.openxiangda/.env` and are inherited by new workspaces. Project `.env` files still work and override the global defaults. Project state is stored in `.openxiangda/state.json` and contains only durable profile-specific resource IDs and environment bindings; volatile candidate/deployment progress lives in the private `.openxiangda/releases/` journal so a release does not dirty the reviewed Git state. Durable CLI writes use a workspace lock plus atomic merge/rename so concurrent processes do not truncate another profile's state.
 
-An environment-managed workspace keeps one logical application with independent `preproduction` and `production` targets. Each target owns its own `appType`, resource IDs, release heads, data, and side-effect policy; IDs must never be copied across targets. `release ship` is deliberately two-phase: the first invocation seals the clean authoritative Git revision and deploys one immutable candidate only to preproduction; it always stops at `awaiting_production_confirmation`. A later invocation includes `--confirm-production` and promotes that exact candidate to production without rebuilding it. Real human acceptance is the recommended default; an optional `--acceptance-note` records it in the deployment evidence, but the platform does not force every low-risk or emergency release through a rigid approval gate. It is impossible to prepare and promote in one invocation. For an audited catch-up whose exact non-delete targets are already merged but whose active resources came from several historical release lineages, the first invocation may explicitly add `--adopt-online-baseline --adoption-reason "..."`; ship validates and freezes this pair before creating a candidate/deployment, then automatically reuses it during the later production confirmation and forwards it only to exact scoped resource stages. A reviewed complete Function/Automation manifest replacement may similarly add the inseparable `--replace-manifest --reason "..."` pair; ship forwards it only to an exact Backend stage and requires the production confirmation to repeat the exact preproduction intent. Frozen online heads, change/lease ownership, server CAS, staged children, and the single App finalize remain mandatory. Supported configuration resources use exact `resourceSelectors`; a legacy `resources=true` category marker is narrowed by those selectors, while unknown, wildcard, destructive, and genuinely unscoped generic resources remain blocked. The lower-level `candidate/deploy/test/promote` commands remain available for recovery and diagnostics. Direct `release publish` is retained only for legacy, unmanaged workspaces and fails closed for either target of an environment-managed application.
+An environment-managed workspace keeps one logical application with independent `preproduction` and `production` targets. Each target owns its own `appType`, resource IDs, release heads, data, and side-effect policy; IDs must never be copied across targets. `release ship` always executes the same ordered candidate → preproduction → production protocol. The normal first invocation seals the candidate, deploys only to preproduction, and stops at `awaiting_production_confirmation`; a later invocation with `--confirm-production` promotes it. For an explicitly authorized emergency, supplying `--confirm-production` on the first invocation runs both phases in one command without bypassing preproduction, CAS, evidence, or production confirmation. Candidate sealing covers source, `public/`, build controls/scripts, stable environment/resource bindings, and target-specific hashed Runtime artifacts. Both deployments upload those artifacts with `--no-build`; each deployment is completed with evidence and reaches terminal `succeeded`, so it cannot leave the target slot blocked. Unrelated commits may land on authoritative mainline between phases only while the sealed commit remains an ancestor and every sealed input/binding/artifact still validates. Real human acceptance remains the recommended default and `--acceptance-note` records it. For audited historical-lineage adoption or reviewed Backend manifest replacement, the existing paired flags and exact-scope gates remain mandatory. Supported configuration resources use exact `resourceSelectors`; unknown, wildcard, destructive, and genuinely unscoped generic resources remain blocked. Lower-level candidate/deploy/test/promote commands are recovery primitives. Direct `release publish` is retained only for legacy unmanaged workspaces.
 
 Exact, non-destructive configuration selectors such as Data Views and permission groups are now sequenced automatically inside the same ship journal instead of requiring separate SDD changes. New forms are idempotently ensured per environment before their immutable FormRelease is staged. Unscoped resources and destructive configuration deletes remain fail-closed.
 
@@ -108,6 +108,8 @@ Parallel tasks develop and test in isolated worktrees, but feature worktrees do
 
 Because promotion starts from an already-pushed authoritative mainline commit, `openxiangda release integration-status --change <change> --profile <name>` should pass immediately after activation. After a managed ship has ended, `--change` recovers lineage directly from the private `ship.json` or follows its production/preproduction deployment IDs to the matching `execution.json`; a recovery failure names the missing file or field. Run it and `release end`; there is no post-release merge step.
 
+Task worktrees are disposable only after the release lifecycle is closed. From the synchronized canonical main checkout, run `openxiangda workspace cleanup` for a dry-run inventory. A worktree is `SAFE` only when it is OpenXiangda/Codex-managed, its commit is contained in live remote mainline, it is clean and unowned, and it has no private candidate/release journal or promotion lease/baseline. `--apply` is bound to the exact hashed dry-run plan, revalidates under the worktree owner lock, and removes only those reviewed entries plus their unchanged local branches. Newly-safe worktrees are left for the next review. Malformed owner state fails closed. Stale records are reported for explicit manual review because the CLI never runs repository-wide `git worktree prune`. Remote branches are retained.
+
 `openxiangda task status --change <id>` is the compact, read-only answer to
 “现在到哪一步”：it combines SDD、TaskResult、IntegrationBundle、execution
 journal、lease 和 post-commit outbox，输出进度、ETA、是否已经发生平台写入、
@@ -175,6 +177,8 @@ L1 quick records are generated in a compact form and should not be expanded into
 
 Every concurrent task uses its own Git worktree/branch and development change. The canonical main checkout is reserved for integration and release; tasks never stash/restore each other's files to make it publishable. The mainline release coordinator bundles selected approved changes after merge; dependency impact outside the approved scope is reported as a warning rather than silently widening a small release. Live commands still require canonical exact selectors, and app-wide/delete operations need explicit authority.
 
+After the mainline release and `release end`, the coordinator runs `workspace cleanup` from canonical main and applies only `SAFE` entries. Dirty/unmerged/owned worktrees and worktrees with private release or promotion state remain blocked for recovery.
+
 Agent investigation is bounded to one complete CodeGraph survey plus at most one focused follow-up, and ordinary work loads one domain skill. Unchanged lease/build waits use `task status --watch` and produce updates only on material transitions.
 
 Before confirmation, agents may read, inspect, snapshot, dry-run, ask questions, and output/write the architecture document. They must not edit source files, mutate platform resources, publish, deploy, send notifications, or call live write/delete endpoints.

package/lib/application-environments.js

@@ -570,20 +570,163 @@ function hashWorkspaceFile(cwd, relativePath) {
   if (
     !normalized ||
     relative.startsWith('..') ||
-    path.isAbsolute(relative) ||
-    !fs.existsSync(absolute) ||
-    !fs.statSync(absolute).isFile()
+    path.isAbsolute(relative)
   ) {
     return null;
   }
+  if (!fs.existsSync(absolute)) {
+    return {
+      path: normalized,
+      exists: false,
+      size: 0,
+      sha256: null,
+    };
+  }
+  if (!fs.statSync(absolute).isFile()) return null;
   const buffer = fs.readFileSync(absolute);
   return {
     path: normalized,
+    exists: true,
     size: buffer.length,
     sha256: crypto.createHash('sha256').update(buffer).digest('hex'),
   };
 }
 
+function buildCandidateEnvironmentBindings(state) {
+  const targets =
+    state?.targets && typeof state.targets === 'object'
+      ? state.targets
+      : {};
+  return Object.fromEntries(
+    Object.entries(targets)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([targetName, binding]) => [
+        targetName,
+        {
+          targetName,
+          profile: binding?.profile || null,
+          environmentId: binding?.environmentId || null,
+          kind: binding?.kind || null,
+          appType: binding?.appType || null,
+          publicOrigin: binding?.publicOrigin || null,
+          sideEffectPolicy:
+            cloneJsonValue(binding?.sideEffectPolicy || {}) || {},
+          revision:
+            binding?.revision === undefined
+              ? null
+              : binding.revision,
+          resources: cloneJsonValue(binding?.resources || {}) || {},
+        },
+      ])
+  );
+}
+
+function candidateBindingValueContains(expected, current) {
+  if (Array.isArray(expected)) {
+    return (
+      Array.isArray(current) &&
+      expected.length === current.length &&
+      expected.every((item, index) =>
+        candidateBindingValueContains(item, current[index])
+      )
+    );
+  }
+  if (expected && typeof expected === 'object') {
+    if (!current || typeof current !== 'object' || Array.isArray(current)) {
+      return false;
+    }
+    return Object.entries(expected).every(([key, value]) =>
+      candidateBindingValueContains(value, current[key])
+    );
+  }
+  return expected === current;
+}
+
+function inspectCandidateEnvironmentBindings(candidate, state) {
+  const expected =
+    candidate?.sourceBundleManifest?.environmentBindings ||
+    candidate?.environmentBindings ||
+    {};
+  const current = buildCandidateEnvironmentBindings(state);
+  const mismatches = [];
+  const expectedNames = Object.keys(expected).sort();
+  const currentNames = Object.keys(current).sort();
+  if (canonicalJson(expectedNames) !== canonicalJson(currentNames)) {
+    mismatches.push({
+      targetName: '(targets)',
+      reason: 'target-set-changed',
+      expected: expectedNames,
+      current: currentNames,
+    });
+  }
+  for (const targetName of expectedNames) {
+    const expectedBinding = expected[targetName];
+    const currentBinding = current[targetName];
+    if (!currentBinding) continue;
+    for (const field of [
+      'targetName',
+      'profile',
+      'environmentId',
+      'kind',
+      'appType',
+      'publicOrigin',
+      'sideEffectPolicy',
+      'revision',
+    ]) {
+      if (
+        canonicalJson(expectedBinding?.[field]) !==
+        canonicalJson(currentBinding?.[field])
+      ) {
+        mismatches.push({
+          targetName,
+          field,
+          reason: 'changed',
+          expected: expectedBinding?.[field],
+          current: currentBinding?.[field],
+        });
+      }
+    }
+    if (
+      !candidateBindingValueContains(
+        expectedBinding?.resources || {},
+        currentBinding.resources || {}
+      )
+    ) {
+      mismatches.push({
+        targetName,
+        field: 'resources',
+        reason: 'sealed-resource-binding-changed',
+        expected: expectedBinding?.resources || {},
+        current: currentBinding.resources || {},
+      });
+    }
+  }
+  return {
+    valid: mismatches.length === 0,
+    checked: expectedNames.length,
+    mismatches,
+  };
+}
+
+function assertCandidateEnvironmentBindingsCurrent(candidate, state) {
+  const inspection = inspectCandidateEnvironmentBindings(candidate, state);
+  if (inspection.valid) return inspection;
+  const error = new Error(
+    `CANDIDATE_ENVIRONMENT_BINDINGS_CHANGED: sealed candidate 的环境或资源绑定已变化: ${inspection.mismatches
+      .slice(0, 8)
+      .map(
+        item =>
+          `${item.targetName}${
+            item.field ? `.${item.field}` : ''
+          }(${item.reason})`
+      )
+      .join(', ')}`
+  );
+  error.code = 'CANDIDATE_ENVIRONMENT_BINDINGS_CHANGED';
+  error.details = inspection;
+  throw error;
+}
+
 function buildCandidateBundle(input) {
   const cwd = path.resolve(input.cwd || process.cwd());
   const files = Array.from(new Set(input.files || []))
@@ -610,10 +753,17 @@ function buildCandidateBundle(input) {
     sourceRevision: input.sourceRevision,
     runtimeMode: input.runtimeMode,
     targets: input.targets,
+    inputPolicy: 'candidate-inputs-v2',
     files,
+    environmentBindings:
+      cloneJsonValue(input.environmentBindings || {}) || {},
+    runtimeArtifacts:
+      cloneJsonValue(input.runtimeArtifacts || []) || [],
     testPlanHash: sha256Canonical(testPlan),
     prepublishVerificationHash:
       input.prepublishVerificationHash || null,
+    candidatePreflightHash:
+      input.candidatePreflightHash || null,
     openxiangdaVersion: input.openxiangdaVersion,
   };
   return {
@@ -624,6 +774,75 @@ function buildCandidateBundle(input) {
   };
 }
 
+function inspectCandidateBundleFiles(candidate, cwd = process.cwd()) {
+  const manifest =
+    candidate?.sourceBundleManifest &&
+    typeof candidate.sourceBundleManifest === 'object'
+      ? candidate.sourceBundleManifest
+      : candidate;
+  const expectedFiles = Array.isArray(manifest?.files)
+    ? manifest.files
+    : [];
+  const mismatches = [];
+  const seen = new Set();
+  for (const expected of expectedFiles) {
+    const file = String(expected?.path || '').replace(/\\/g, '/');
+    if (!file || seen.has(file)) {
+      mismatches.push({
+        path: file || '(missing path)',
+        reason: seen.has(file) ? 'duplicate' : 'invalid',
+      });
+      continue;
+    }
+    seen.add(file);
+    const current = hashWorkspaceFile(path.resolve(cwd), file);
+    const expectedExists = expected.exists !== false;
+    if (!current || (expectedExists && current.exists === false)) {
+      mismatches.push({ path: file, reason: 'missing' });
+      continue;
+    }
+    if (!expectedExists) {
+      if (current.exists !== false) {
+        mismatches.push({ path: file, reason: 'reappeared', current });
+      }
+      continue;
+    }
+    if (
+      current.size !== Number(expected.size) ||
+      current.sha256 !== String(expected.sha256 || '').toLowerCase()
+    ) {
+      mismatches.push({
+        path: file,
+        reason: 'changed',
+        expected: {
+          size: Number(expected.size),
+          sha256: String(expected.sha256 || '').toLowerCase(),
+        },
+        current,
+      });
+    }
+  }
+  return {
+    valid: mismatches.length === 0,
+    checked: expectedFiles.length,
+    mismatches,
+  };
+}
+
+function assertCandidateBundleFilesCurrent(candidate, cwd = process.cwd()) {
+  const inspection = inspectCandidateBundleFiles(candidate, cwd);
+  if (inspection.valid) return inspection;
+  const error = new Error(
+    `CANDIDATE_INPUTS_CHANGED: sealed candidate 的发布输入已变化: ${inspection.mismatches
+      .slice(0, 8)
+      .map(item => `${item.path}(${item.reason})`)
+      .join(', ')}`
+  );
+  error.code = 'CANDIDATE_INPUTS_CHANGED';
+  error.details = inspection;
+  throw error;
+}
+
 function releaseExecutionPath(changeId, deploymentId, cwd = process.cwd()) {
   const base = path.join(
     cwd,
@@ -706,7 +925,10 @@ function isRecoverablePostActivationDeploymentError(error, deployment) {
 }
 
 module.exports = {
+  assertCandidateBundleFilesCurrent,
+  assertCandidateEnvironmentBindingsCurrent,
   bindEnvironmentTarget,
+  buildCandidateEnvironmentBindings,
   buildSideEffectPolicyDiff,
   buildCandidateBundle,
   canonicalJson,
@@ -718,6 +940,8 @@ module.exports = {
   normalizeSideEffectPolicyInput,
   normalizeTargetName,
   hasStateResourceMappings,
+  inspectCandidateBundleFiles,
+  inspectCandidateEnvironmentBindings,
   managedTargetDeploymentFile,
   readCandidate,
   readJsonInput,