@hcmai/sdk 0.3.3 → 0.3.5

package/dist/index.js

@@ -516,6 +516,9 @@ var CliErrorCode = /* @__PURE__ */ ((CliErrorCode2) => {
   CliErrorCode2["IDENTITY_NOT_IN_ENV"] = "IDENTITY_NOT_IN_ENV";
   CliErrorCode2["TOKEN_EXPIRED"] = "TOKEN_EXPIRED";
   CliErrorCode2["NO_ACTIVE_ENV"] = "NO_ACTIVE_ENV";
+  CliErrorCode2["SKILL_ID_CONFLICT"] = "SKILL_ID_CONFLICT";
+  CliErrorCode2["SKILL_SOURCE_UNREACHABLE"] = "SKILL_SOURCE_UNREACHABLE";
+  CliErrorCode2["SYNC_SOURCE_UNSUPPORTED"] = "SYNC_SOURCE_UNSUPPORTED";
   return CliErrorCode2;
 })(CliErrorCode || {});
 var CODE_TO_EXIT = {
@@ -546,10 +549,14 @@ var CODE_TO_EXIT = {
   ["IDENTITY_ALREADY_EXISTS" /* IDENTITY_ALREADY_EXISTS */]: 5 /* CONFIG_ERROR */,
   ["IDENTITY_NOT_IN_ENV" /* IDENTITY_NOT_IN_ENV */]: 5 /* CONFIG_ERROR */,
   ["TOKEN_EXPIRED" /* TOKEN_EXPIRED */]: 2 /* AUTH_ERROR */,
-  ["NO_ACTIVE_ENV" /* NO_ACTIVE_ENV */]: 5 /* CONFIG_ERROR */
+  ["NO_ACTIVE_ENV" /* NO_ACTIVE_ENV */]: 5 /* CONFIG_ERROR */,
+  ["SKILL_ID_CONFLICT" /* SKILL_ID_CONFLICT */]: 3 /* BUSINESS_ERROR */,
+  // 🔴 装坏了不是网络问题：报 network 会让顾问先去查 VPN。
+  ["SKILL_SOURCE_UNREACHABLE" /* SKILL_SOURCE_UNREACHABLE */]: 5 /* CONFIG_ERROR */,
+  ["SYNC_SOURCE_UNSUPPORTED" /* SYNC_SOURCE_UNSUPPORTED */]: 1 /* USAGE_ERROR */
 };
 function exitCodeFor(code) {
-  return CODE_TO_EXIT[code];
+  return CODE_TO_EXIT[code] ?? 1 /* USAGE_ERROR */;
 }
 
 // src/errors/cli-error.ts
@@ -581,6 +588,10 @@ var CliError = class extends Error {
     if (this.traceId) parts.push(`[traceId: ${this.traceId}]`);
     if (this.profile) parts.push(`[profile: ${this.profile}]`);
     let out = parts.join(" ");
+    const details = this.context?.details;
+    const detailText = formatDetails(details);
+    if (detailText) out += `
+  \u8BE6\u60C5: ${detailText}`;
     const nextStep = this.context?.nextStep;
     if (typeof nextStep === "string" && nextStep) out += `
   \u4E0B\u4E00\u6B65: ${nextStep}`;
@@ -633,6 +644,19 @@ function fromAxiosError(err, profile) {
     cause: err
   });
 }
+function formatDetails(details) {
+  if (details === void 0 || details === null) return void 0;
+  if (typeof details === "string") return details.trim() || void 0;
+  if (typeof details === "number" || typeof details === "boolean") return String(details);
+  let text;
+  try {
+    text = JSON.stringify(details);
+  } catch {
+    return void 0;
+  }
+  if (!text || text === "{}" || text === "[]") return void 0;
+  return text.length > 800 ? `${text.slice(0, 800)}\u2026\uFF08\u5DF2\u622A\u65AD\uFF09` : text;
+}
 
 // src/config/env.ts
 async function saveEnv(name, cfg) {
@@ -1044,18 +1068,18 @@ async function action(http, model, actionName, input) {
   if (scope === "object" && !input.id) {
     throw new Error(`object action ${model}.${actionName} requires id`);
   }
-  const path6 = scope === "object" ? `/api/models/${model}/${input.id}/action/${actionName}` : `/api/models/${model}/action/${actionName}`;
+  const path7 = scope === "object" ? `/api/models/${model}/${input.id}/action/${actionName}` : `/api/models/${model}/action/${actionName}`;
   const resp = await (async () => {
     if (method === "GET") {
-      return http.get(path6, { params: queryParams(input) });
+      return http.get(path7, { params: queryParams(input) });
     }
     if (method === "DELETE") {
-      return http.delete(path6, { params: queryParams(input) });
+      return http.delete(path7, { params: queryParams(input) });
     }
     if (method === "PUT") {
-      return http.put(path6, scope === "object" ? objectBody(input) : classBody(input));
+      return http.put(path7, scope === "object" ? objectBody(input) : classBody(input));
     }
-    return http.post(path6, scope === "object" ? objectBody(input) : classBody(input));
+    return http.post(path7, scope === "object" ? objectBody(input) : classBody(input));
   })();
   return resp.data;
 }
@@ -1788,7 +1812,7 @@ var WsClient = class {
       });
     }
     this.ws = new WebSocket(this.opts.endpoint);
-    return new Promise((resolve3, reject) => {
+    return new Promise((resolve4, reject) => {
       const settle = (fn) => {
         off();
         fn();
@@ -1827,7 +1851,7 @@ var WsClient = class {
           this.intentionalClose = false;
           this.sessionId = msg.sessionId;
           this.startHeartbeat();
-          settle(resolve3);
+          settle(resolve4);
           this.ws.on("message", this.persistentOnMessage);
           this.ws.on("close", this.persistentOnClose);
           this.ws.on("error", this.persistentOnClose);
@@ -2097,13 +2121,13 @@ async function sendMessageAndStream(ws, prompt, opts = {}) {
   ws.send(cmd);
   const events = {
     [Symbol.asyncIterator]: () => ({
-      next: () => new Promise((resolve3) => {
+      next: () => new Promise((resolve4) => {
         if (queue.length) {
-          resolve3({ value: queue.shift(), done: false });
+          resolve4({ value: queue.shift(), done: false });
         } else if (done) {
-          resolve3({ value: void 0, done: true });
+          resolve4({ value: void 0, done: true });
         } else {
-          waiters.push(resolve3);
+          waiters.push(resolve4);
         }
       })
     })
@@ -5011,18 +5035,18 @@ async function listTenantMeta(http, opts = {}) {
   const items = payload?.items ?? payload?.list ?? payload?.records ?? [];
   return { items, total: payload?.total, raw: payload };
 }
-async function getTenantMeta(http, path6) {
-  const resp = await http.get("/api/tenant-meta/meta", { params: { path: path6 } });
+async function getTenantMeta(http, path7) {
+  const resp = await http.get("/api/tenant-meta/meta", { params: { path: path7 } });
   const payload = resp.data?.data ?? resp.data;
   if (typeof payload === "string") return payload;
   return String(payload?.content ?? "");
 }
-async function saveTenantMeta(http, path6, content) {
-  const resp = await http.put("/api/tenant-meta/meta", { content }, { params: { path: path6 } });
+async function saveTenantMeta(http, path7, content) {
+  const resp = await http.put("/api/tenant-meta/meta", { content }, { params: { path: path7 } });
   return resp.data?.data ?? resp.data;
 }
-async function deleteTenantMeta(http, path6) {
-  const resp = await http.delete("/api/tenant-meta/meta", { params: { path: path6 } });
+async function deleteTenantMeta(http, path7) {
+  const resp = await http.delete("/api/tenant-meta/meta", { params: { path: path7 } });
   return resp.data?.data ?? resp.data;
 }
 
@@ -5124,14 +5148,14 @@ function resolveSkillInstallOrder(manifest2, targetId) {
     throw invalid(`\u6280\u80FD\u76EE\u5F55\u4E2D\u4E0D\u5B58\u5728 ${targetId}`);
   }
   const state = /* @__PURE__ */ new Map();
-  const path6 = [];
+  const path7 = [];
   const order = [];
   const visit = (id, requiredBy) => {
     const current = state.get(id);
     if (current === "done") return;
     if (current === "visiting") {
-      const cycleStart = path6.indexOf(id);
-      const cycle = [...path6.slice(Math.max(0, cycleStart)), id];
+      const cycleStart = path7.indexOf(id);
+      const cycle = [...path7.slice(Math.max(0, cycleStart)), id];
       throw invalid(`\u6280\u80FD\u4F9D\u8D56\u5B58\u5728\u73AF: ${cycle.join(" -> ")}`);
     }
     const skill = byId.get(id);
@@ -5140,11 +5164,11 @@ function resolveSkillInstallOrder(manifest2, targetId) {
     }
     assertSafeSkillId(skill.id);
     state.set(id, "visiting");
-    path6.push(id);
+    path7.push(id);
     for (const required of normalizeRequirements(skill.requires, skill.id)) {
       visit(required, skill.id);
     }
-    path6.pop();
+    path7.pop();
     state.set(id, "done");
     order.push(skill);
   };
@@ -5235,30 +5259,517 @@ async function resetSettingItem(http, domain, namespace, settingKey, revision) {
 function parseSettingAssignment(raw) {
   const eq = raw.indexOf("=");
   if (eq <= 0) throw new Error(`--set \u9700\u8981 namespace.key=value \u5F62\u6001\uFF0C\u6536\u5230 "${raw}"`);
-  const path6 = raw.slice(0, eq).trim();
+  const path7 = raw.slice(0, eq).trim();
   const value = raw.slice(eq + 1);
-  const dot = path6.lastIndexOf(".");
-  if (dot <= 0) throw new Error(`--set \u7684\u952E\u9700\u542B namespace\uFF0C\u5982 security.password.passwordPolicy=complex\uFF0C\u6536\u5230 "${path6}"`);
-  return { namespace: path6.slice(0, dot), settingKey: path6.slice(dot + 1), value };
+  const dot = path7.lastIndexOf(".");
+  if (dot <= 0) throw new Error(`--set \u7684\u952E\u9700\u542B namespace\uFF0C\u5982 security.password.passwordPolicy=complex\uFF0C\u6536\u5230 "${path7}"`);
+  return { namespace: path7.slice(0, dot), settingKey: path7.slice(dot + 1), value };
+}
+
+// src/fde/layout.ts
+import { createHash as createHash2 } from "crypto";
+import { mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import * as path6 from "path";
+var UNSAFE = /[^A-Za-z0-9._-]/g;
+function slug(value) {
+  return (value || "unknown").replace(UNSAFE, "_");
+}
+function safeSegment(value) {
+  const raw = value || "unknown";
+  const digest = createHash2("sha256").update(raw, "utf8").digest("hex").slice(0, 10);
+  return `${slug(raw)}-${digest}`;
+}
+function tenantSegment(value) {
+  return safeSegment(value);
+}
+function isInside(p, container) {
+  const rel = path6.relative(container, p);
+  if (rel === "") return true;
+  if (path6.isAbsolute(rel)) return false;
+  return !rel.split(path6.sep).includes("..");
+}
+function hasDotDotComponent(rel) {
+  return rel.split(/[/\\]/).includes("..");
+}
+var ReconLayout = class {
+  root;
+  tenantId;
+  sourceKey;
+  dir;
+  constructor(root, tenantId, sourceKey) {
+    this.root = root;
+    this.tenantId = String(tenantId);
+    this.sourceKey = sourceKey;
+    this.dir = path6.join(
+      this.root,
+      "recon",
+      tenantSegment(this.tenantId),
+      safeSegment(sourceKey)
+    );
+    const container = path6.resolve(this.root, "recon");
+    if (!isInside(path6.resolve(this.dir), container)) {
+      throw new LayoutContainmentError(
+        `\u79DF\u6237\u6BB5\u8D8A\u754C\uFF0C\u62D2\u7EDD\u6784\u9020\u4EA7\u7269\u76EE\u5F55\uFF1AtenantId=${JSON.stringify(tenantId)}\uFF08\u4EA7\u7269\u6839 ${container}\uFF09`
+      );
+    }
+  }
+  /**
+   * 把相对路径解析成绝对路径，并过两道**互相印证**的遏制闸。
+   *
+   * 🔴 `rel` 里会嵌入**现爬的 modelKey**：`meta/<k>.model.json`、`valuedomain/<k>.json`、
+   * `mapping/<k>.json`。服务端说什么，这里就拼什么。
+   *
+   * 实测分档（沿用 Python 侧 2026-08-16 的实跑结论）：
+   *   `../evil`     → 规范化后**仍在产物根内**，写成 `<产物根>/evil.json`。第二道闸**拦不住**。
+   *   `../models`   → 同上，**顶掉 recon 自己的模型名册**，写入方拿到「成功」，产物里没有留痕。
+   *   `../../evil`  → 真的逃出产物根 ⇒ 第二道闸拦得住。
+   *   `/etc/passwd` → 前导 `/` 被路径规范化吃掉，落在 `valuedomain/etc/passwd.json`。
+   * ⇒ 真正的危害不是「逃出产物根」（那一档本来就拦得住），是「**逃出预期子目录、
+   *   静默顶掉同级产物**」——`models.json` / `fingerprint.json` / `gates.json` 全在射程内。
+   *
+   * ⚠️ 拒绝而不是消毒：消毒会让 `meta/<modelKey>.json` 不再能按 modelKey grep 回去。
+   */
+  resolvePath(rel, createParents = true) {
+    const p = path6.join(this.dir, rel);
+    if (hasDotDotComponent(rel)) {
+      throw new LayoutContainmentError(
+        `\u4EA7\u7269\u76F8\u5BF9\u8DEF\u5F84\u542B \`..\` \u5206\u91CF\uFF0C\u62D2\u7EDD\u5199\u5165\uFF1A${JSON.stringify(rel)}\uFF08\u4F1A\u8D8A\u51FA\u9884\u671F\u5B50\u76EE\u5F55\u3001\u9759\u9ED8\u9876\u6389\u540C\u7EA7\u4EA7\u7269\uFF1B\u4EA7\u7269\u6839 ${this.dir}\uFF09`
+      );
+    }
+    if (!isInside(path6.resolve(p), path6.resolve(this.dir))) {
+      throw new LayoutContainmentError(
+        `\u4EA7\u7269\u76F8\u5BF9\u8DEF\u5F84\u8D8A\u754C\uFF0C\u62D2\u7EDD\u5199\u5165\uFF1A${JSON.stringify(rel)}\uFF08\u4EA7\u7269\u6839 ${this.dir}\uFF09`
+      );
+    }
+    if (createParents) {
+      mkdirSync(path6.dirname(p), { recursive: true });
+    }
+    return p;
+  }
+  writeJson(rel, obj) {
+    const p = this.resolvePath(rel);
+    writeFileSync(p, JSON.stringify(obj, null, 2), "utf8");
+    return p;
+  }
+  writeJsonl(rel, rows) {
+    const p = this.resolvePath(rel);
+    let body = "";
+    for (const row of rows) body += `${JSON.stringify(row)}
+`;
+    writeFileSync(p, body, "utf8");
+    return p;
+  }
+  writeText(rel, text) {
+    const p = this.resolvePath(rel);
+    writeFileSync(p, text, "utf8");
+    return p;
+  }
+  /**
+   * 逐行读一份 JSONL 产物。
+   *
+   * 🔴 与 `readJson` 同走那两道越界闸——同一个收口点不能一半有闸一半没有。
+   * 🔴 **跳过空行**（末尾换行是 `writeJsonl` 必然产生的），但**不跳过坏行**：
+   * 坏行原样抛，因为「这一行读不出来」和「这个产物没有这一行」是两件事。
+   */
+  readJsonlRows(rel) {
+    const body = readFileSync2(this.resolvePath(rel, false), "utf8");
+    const rows = [];
+    for (const line of body.split("\n")) {
+      const trimmed = line.trim();
+      if (trimmed) rows.push(JSON.parse(trimmed));
+    }
+    return rows;
+  }
+  readJson(rel) {
+    return JSON.parse(readFileSync2(this.resolvePath(rel, false), "utf8"));
+  }
+};
+var LayoutContainmentError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LayoutContainmentError";
+  }
+};
+
+// src/fde/fingerprint.ts
+import { createHash as createHash3 } from "crypto";
+var GATE_COMPONENTS = [
+  "tenantMetaManifestDigest",
+  "extensionSource",
+  "modelListHash"
+];
+var BLIND_SPOTS = "\u4EA7\u54C1\u5347\u7EA7\uFF1Amanifest \u53EA\u8BFB\u79DF\u6237 workspace \u7684 metas/ \u76EE\u5F55\uFF0C\u4EA7\u54C1\u5347\u7EA7\u6539\u7684\u662F\u5B89\u88C5\u5305\u5185 _metas/\uFF0C\u56DB\u5143\u7EC4\u4E0D\u4F1A\u53D8\u2014\u2014\u8BE5\u573A\u666F\u7684\u9632\u7EBF\u53EA\u6709\u884C\u4E3A\u63A2\u9488\u4E00\u6761\u3002 | \u540C\u5B57\u8282\u6570\u5185\u5BB9\u66FF\u6362\uFF1A\u6E05\u5355\u53EA\u7ED9 name/size/lastModified\uFF0C\u628A\u6807\u7B7E\u300C\u90E8\u95E8\u300D\u6539\u6210\u300C\u673A\u6784\u300D\u5728 UTF-8 \u4E0B\u6070\u597D\u90FD\u662F 6 \u5B57\u8282\uFF0C\u6458\u8981\u4E0D\u53D8\u3002\u21D2 \u5B57\u6BB5\u540D\u53EB ManifestDigest \u800C\u975E Fingerprint\uFF0C\u540D\u5B57\u5FC5\u987B\u8BF4\u5B9E\u8BDD\u3002";
+var MODELS_PATH = "/api/system/models";
+var MANIFEST_PATH = "/api/tenant-meta/list";
+var VERSION_PATH = "/api/version/backend";
+var META_PATH = "/api/models/{model}/meta";
+var EXTENSION_SOURCE_HEADER = "x-hcm-extension-source";
+var MAX_SOURCE_PROBES = 50;
+var MAX_MANIFEST_PAGES = 200;
+var GATE_SOURCES = [MODELS_PATH, MANIFEST_PATH, META_PATH];
+function modelEntries(body) {
+  if (!isPlainObject2(body)) return [];
+  const raw = body.models;
+  if (!Array.isArray(raw)) return [];
+  return raw.filter(isPlainObject2);
+}
+function modelKeys(body) {
+  return modelEntries(body).map((m) => typeof m.modelKey === "string" ? m.modelKey : "").filter((k) => k !== "").sort();
+}
+async function probeExtensionSource(probe, keys) {
+  let attempted = 0;
+  let answered = 0;
+  for (const key of [...keys].sort().slice(0, MAX_SOURCE_PROBES)) {
+    attempted += 1;
+    const out = await probe.get(META_PATH.replace("{model}", key));
+    if (out.error !== "ok") continue;
+    answered += 1;
+    const value = out.headers[EXTENSION_SOURCE_HEADER];
+    if (value) return { sourceKey: value, probeModelKey: key, attempted, answered };
+  }
+  return { sourceKey: "", probeModelKey: "", attempted, answered };
+}
+async function fetchManifestRows(probe, failures) {
+  const rows = [];
+  let page = 0;
+  const pageSize = 200;
+  for (; ; ) {
+    const out = await probe.get(MANIFEST_PATH, { page, pageSize });
+    if (out.error !== "ok" || !isPlainObject2(out.body)) {
+      failures.push(MANIFEST_PATH);
+      break;
+    }
+    const body = out.body;
+    const chunk = body.data ?? [];
+    if (!Array.isArray(chunk)) {
+      failures.push(MANIFEST_PATH);
+      break;
+    }
+    rows.push(...chunk.filter(isPlainObject2));
+    const totalPages = typeof body.totalPages === "number" ? body.totalPages : 0;
+    page += 1;
+    if (page >= totalPages || chunk.length === 0) break;
+    if (page >= MAX_MANIFEST_PAGES) {
+      failures.push(`${MANIFEST_PATH}#page-cap`);
+      break;
+    }
+  }
+  return rows;
+}
+function manifestDigest(rows) {
+  const lines = rows.map((r) => `${r.name}|${r.size}|${r.lastModified}`).sort();
+  return sha2562(lines.join("\n"));
+}
+async function computeFingerprint(probe, opts = {}) {
+  const ttlDays = opts.ttlDays ?? 30;
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const failures = [];
+  const modelsOut = await probe.get(MODELS_PATH);
+  const modelsOk = modelsOut.error === "ok" && isPlainObject2(modelsOut.body);
+  if (!modelsOk) failures.push(MODELS_PATH);
+  const models = modelsOk ? modelEntries(modelsOut.body) : [];
+  const keys = modelsOk ? modelKeys(modelsOut.body) : [];
+  if (modelsOut.error === "ok" && keys.length === 0) {
+    failures.push(`${MODELS_PATH}#empty-model-list`);
+  }
+  const p = await probeExtensionSource(probe, keys);
+  let sourceKey = p.sourceKey;
+  if (!sourceKey) {
+    failures.push(
+      p.answered > 0 ? `${META_PATH}#X-HCM-Extension-Source` : `${META_PATH}#no-meta-answered`
+    );
+    sourceKey = "unknown";
+  }
+  const hashLines = models.map((m) => `${m.modelKey ?? ""}|${m.type ?? ""}`).sort();
+  const modelHash = sha2562(hashLines.join("\n"));
+  const rows = await fetchManifestRows(probe, failures);
+  const versionOut = await probe.get(VERSION_PATH);
+  let backendVersion;
+  if (versionOut.error === "ok" && versionOut.body !== null && versionOut.body !== void 0) {
+    backendVersion = versionOut.body;
+  } else {
+    failures.push(VERSION_PATH);
+    backendVersion = { version: "unavailable" };
+  }
+  return {
+    tenantMetaManifestDigest: manifestDigest(rows),
+    manifestEntryCount: rows.length,
+    extensionSource: sourceKey,
+    // 🔴 记下**是从哪个模型探到的**：让「这个值是谁给的」在产物里留痕。
+    extensionSourceProbe: p.probeModelKey,
+    // 🔴 没有这两个数，`extensionSource: "unknown"` 就是一个**不可追问的结论**。
+    extensionSourceProbeAttempted: p.attempted,
+    extensionSourceProbeAnswered: p.answered,
+    modelListHash: modelHash,
+    modelCount: models.length,
+    backendVersion,
+    capabilities: probe.capabilities,
+    createdAt: `${now().toISOString().slice(0, 19)}Z`,
+    ttlDays,
+    coverageNotes: {
+      gateComponents: [...GATE_COMPONENTS],
+      blindSpots: BLIND_SPOTS,
+      // 空数组 = 三个端点都真取到了；非空 = 这份四元组是**残的**，
+      // 上面那些 0 和空摘要不代表环境真的空。
+      fetchFailures: failures
+    }
+  };
+}
+function compareFingerprint(recorded, current) {
+  const diffs = GATE_COMPONENTS.filter((c) => recorded[c] !== current[c]);
+  if (recorded.capabilities !== current.capabilities) diffs.push("capabilities");
+  for (const [fp, tag] of [
+    [recorded, "recorded"],
+    [current, "current"]
+  ]) {
+    const notes = fp.coverageNotes;
+    if (!isPlainObject2(notes) || !("fetchFailures" in notes)) {
+      diffs.push(`incomplete:${tag}:coverageNotes-missing`);
+      continue;
+    }
+    const raw = notes.fetchFailures;
+    const list = Array.isArray(raw) ? raw : [];
+    const gateFailures = [...new Set(list.map(String))].filter((x) => GATE_SOURCES.some((s) => x.startsWith(s))).sort();
+    for (const f of gateFailures) diffs.push(`incomplete:${tag}:${f}`);
+  }
+  return diffs;
+}
+function sha2562(s) {
+  return createHash3("sha256").update(s, "utf8").digest("hex");
+}
+function isPlainObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+// src/fde/doctor.ts
+var DOCTOR_ANCHORS = [
+  "connectivity",
+  "identity",
+  "config-admin",
+  "layer"
+];
+async function runDoctor(probe, identity) {
+  const checks = [];
+  const modelsOut = await probe.get(MODELS_PATH);
+  const connected = modelsOut.error === "ok";
+  const modelsBody = isObj(modelsOut.body) ? modelsOut.body : {};
+  checks.push({
+    anchor: "connectivity",
+    ok: connected,
+    detail: connected ? `\u6A21\u578B\u6E05\u5355\u53EF\u8FBE\uFF0C\u5171 ${modelsBody.totalCount ?? 0} \u4E2A\u6A21\u578B` : `\u4E0D\u53EF\u8FBE\uFF1A${modelsOut.error}\uFF08status=${modelsOut.status ?? "?"}\uFF09`
+  });
+  const keys = modelKeys(modelsOut.body);
+  const p = await probeExtensionSource(probe, keys);
+  checks.push({ anchor: "identity", ...judgeIdentity(identity) });
+  const manifestOut = await probe.get(MANIFEST_PATH, { page: 0, pageSize: 1 });
+  const caOk = manifestOut.error === "ok";
+  const manifestBody = isObj(manifestOut.body) ? manifestOut.body : {};
+  const total = caOk ? manifestBody.total ?? "?" : "?";
+  let caDetail;
+  if (caOk) {
+    caDetail = `\u79DF\u6237 meta \u6E05\u5355\u53EF\u8BFB\uFF0C\u5171 ${total} \u6761\uFF080 \u6761\u662F\u5408\u6CD5\u72B6\u6001\uFF1A\u514B\u9686\u5E93\u5E26\u5F97\u8D70 workspace \u7ED1\u5B9A\uFF0C\u5E26\u4E0D\u8D70 workspace \u6587\u4EF6\uFF09`;
+  } else if (manifestOut.status === 401 || manifestOut.status === 403) {
+    caDetail = `HTTP ${manifestOut.status}\uFF1A\u5F53\u524D\u8D26\u53F7**\u6CA1\u6709 configAdmin \u6743\u9650**\u3002\u627E\u5BA2\u6237\u7BA1\u7406\u5458\u52A0\u89D2\u8272\uFF1B\u8FD9\u4E0D\u662F\u7F51\u7EDC\u95EE\u9898`;
+  } else {
+    caDetail = `\u4E0D\u53EF\u8BFB\uFF1A${manifestOut.error}\uFF08status=${manifestOut.status ?? "?"}\uFF09\u3002\u5148\u6392\u8FDE\u901A/\u7F51\u5173\uFF0C\u518D\u8C08\u6743\u9650\u3002\u7F3A configAdmin \u65F6\u4E3B\u951A\u70B9\u7B97\u4E0D\u51FA\u6765`;
+  }
+  checks.push({ anchor: "config-admin", ok: caOk, detail: caDetail });
+  checks.push({
+    anchor: "layer",
+    ok: Boolean(p.sourceKey),
+    detail: layerDetail(p, connected)
+  });
+  return { ok: checks.every((c) => c.ok), checks };
+}
+function judgeIdentity(ident) {
+  if (ident === null) {
+    return { ok: false, detail: "\u672A\u7ECF\u672C\u5DE5\u5177\u767B\u5F55\uFF0C\u65E0\u6CD5\u6838\u5BF9 token \u5F52\u5C5E\u7684\u79DF\u6237" };
+  }
+  const want = String(ident.requestedTenantId ?? "").trim();
+  const got = String(ident.tenantId ?? "").trim();
+  if (!want) {
+    return {
+      ok: false,
+      detail: `\u672C\u5DE5\u5177\u6CA1\u6709\u8BB0\u4E0B\u300C\u4F60\u8981\u7684\u79DF\u6237\u300D\uFF08\u547D\u4EE4\u5C42\u672A\u586B requestedTenantId\uFF09\uFF0C\u65E0\u6CD5\u4E0E token \u5F52\u5C5E\u7684\u79DF\u6237 ${got || "(\u672A\u77E5)"} \u6838\u5BF9 \u2014\u2014 \u8FD9\u662F\u5DE5\u5177\u63A5\u7EBF\u95EE\u9898\uFF0C\u4E0D\u662F\u73AF\u5883\u95EE\u9898`
+    };
+  }
+  if (!got) {
+    return {
+      ok: false,
+      detail: `\u670D\u52A1\u7AEF\u767B\u5F55\u54CD\u5E94\u91CC\u6CA1\u6709 user.tenantId\uFF0C\u65E0\u6CD5\u6838\u5BF9\uFF08\u4F60\u8981\u7684\u662F ${want}\uFF09`
+    };
+  }
+  if (want !== got) {
+    return {
+      ok: false,
+      detail: `\u{1F534} **token \u5F52\u5C5E\u79DF\u6237 ${got}\uFF0C\u800C\u4F60\u8981\u7684\u662F ${want}** \u2014\u2014 \u4F60\u6B63\u5728\u722C\u53E6\u4E00\u4E2A\u79DF\u6237\uFF0C\u5148\u505C\u4E0B\u6765\u3002\u8FD9\u4E00\u5BF9\u8EAB\u4EFD\u4F1A\u968F\u8EAB\u4EFD\u6BB5\u843D\u8FDB\u4EA7\u7269\u7D22\u5F15\uFF0C\u6240\u4EE5\u722C\u5B8C\u4E4B\u540E\u5728\u4EA7\u7269\u91CC\u4E5F\u5BF9\u5F97\u51FA\u6765\uFF1B\u4F46**\u843D\u76D8\u8DEF\u5F84**\u4E0A\u90A3\u4E2A\u79DF\u6237\u6BB5\u53D6\u81EA\u4F60\u7ED9\u7684 \`--tenant\` \u2014\u2014 \u76EE\u5F55\u540D\u7167\u65E7\u662F\u4F60\u8981\u7684\u90A3\u4E2A\u53F7\u3002`
+    };
+  }
+  return {
+    ok: true,
+    detail: `\u79DF\u6237 ${got} \u6838\u5BF9\u4E00\u81F4\uFF1B\u767B\u5F55\u8EAB\u4EFD ${ident.username || "(\u672A\u77E5)"}\uFF0C\u89D2\u8272 ${JSON.stringify(ident.roles ?? [])}`
+  };
+}
+function layerDetail(p, connected) {
+  if (p.sourceKey) {
+    return `\u4F60\u7AD9\u5728 \`${p.sourceKey}\` \u8FD9\u4E00\u5C42\uFF08\u63A2\u81EA \`${p.probeModelKey}\` \u7684 meta\uFF09\u3002\u4E0D\u540C sourceKey \u7684 recon \u4EA7\u7269\u4E0D\u53EF\u4E92\u6362 \u2014\u2014 \u4E24\u4E2A FDE \u540C\u4E00\u6761\u547D\u4EE4\u4F1A\u5F97\u5230\u4E24\u4EFD\u4E0D\u540C\u7684\u4E8B\u5B9E\uFF0C\u90A3\u4E0D\u662F\u9648\u65E7\uFF0C\u662F\u7AD9\u5728\u4E0D\u540C\u7684\u5C42\u4E0A`;
+  }
+  if (p.attempted === 0) {
+    return connected ? "\u6A21\u578B\u6E05\u5355\u53D6\u5230\u4E86\uFF0C\u4F46\u91CC\u9762**\u4E00\u4E2A\u53EF\u7528 modelKey \u90FD\u6CA1\u6709**\uFF0C**\u4E00\u4E2A\u6A21\u578B\u90FD\u6CA1\u5F97\u8BD5** \u21D2 \u8FD9\u4E0D\u662F\u5C42\u7684\u95EE\u9898\uFF1A\u67E5\u6E05\u5355\u7684 modelKey \u952E\u540D\u662F\u4E0D\u662F\u88AB\u7F51\u5173\u6539\u5199\u3001\u6216\u5F53\u524D\u8D26\u53F7\u770B\u4E0D\u5230\u4EFB\u4F55\u6A21\u578B" : "\u6A21\u578B\u6E05\u5355\u6CA1\u53D6\u5230\uFF0C**\u4E00\u4E2A\u6A21\u578B\u90FD\u6CA1\u5F97\u8BD5** \u21D2 \u5148\u770B\u4E0A\u9762 connectivity \u90A3\u6761";
+  }
+  if (p.answered > 0) {
+    return `\u8BD5\u4E86 ${p.attempted} \u4E2A\u6A21\u578B\u7684 meta\uFF0C${p.answered} \u4E2A\u7B54\u5E94\u4E86\uFF0C\u4F46\u90FD\u6CA1\u56DE\u663E X-HCM-Extension-Source \u21D2 \u5148\u67E5\u53CD\u4EE3\u662F\u4E0D\u662F\u628A X-HCM-* \u54CD\u5E94\u5934\u5265\u4E86`;
+  }
+  return `\u8BD5\u4E86 ${p.attempted} \u4E2A\u6A21\u578B\u7684 meta\uFF0C**\u4E00\u4E2A\u90FD\u6CA1\u7B54\u5E94** \u21D2 \u5148\u67E5\u8FDE\u901A\u4E0E\u6743\u9650\uFF0C\u518D\u770B\u6A21\u578B\u6E05\u5355\u662F\u4E0D\u662F\u7A7A\u7684\u3002\u26A0\uFE0F \u672C\u5DE5\u5177\u53EA\u77E5\u9053\u300C\u4E00\u4E2A\u90FD\u6CA1\u7B54\u5E94\u300D\uFF0C**\u5206\u4E0D\u51FA**\u662F\u8FDE\u901A\u3001\u6743\u9650\u8FD8\u662F\u4E2D\u95F4\u6709\u4EBA\u6321\u4E86 \u2014\u2014 \u4E0A\u4E00\u6863\uFF08\u7B54\u5E94\u4E86\u4F46\u6CA1\u56DE\u663E X-HCM-* \u5934\uFF09\u624D\u6307\u5F97\u52A8\u53CD\u4EE3\uFF0C\u8FD9\u4E00\u6863\u6307\u4E0D\u52A8\u4EFB\u4F55\u4E00\u65B9`;
+}
+function isObj(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+var AUTH_INFO_PATH = "/api/auth/info";
+async function fetchReconIdentity(probe, requestedTenantId) {
+  const out = await probe.get(AUTH_INFO_PATH);
+  if (out.error !== "ok") return null;
+  const principal = toPrincipal(out.body);
+  if (!principal) return { requestedTenantId };
+  return {
+    requestedTenantId,
+    tenantId: principal.tenantId,
+    username: principal.username,
+    roles: principal.roles
+  };
+}
+
+// src/fde/probe.ts
+var STATUS_CLASS = {
+  401: "unauthorized",
+  403: "forbidden",
+  404: "not-found"
+};
+function classifyStatus(status) {
+  if (status >= 200 && status < 300) return "ok";
+  if (STATUS_CLASS[status]) return STATUS_CLASS[status];
+  if (status >= 500) return "server-error";
+  return "bad-response";
+}
+var CAPABILITIES_HEADER = "x-hcm-capabilities";
+function buildUrl(path7, params) {
+  const entries = Object.entries(params ?? {}).filter(([, v]) => v !== void 0 && v !== null);
+  if (entries.length === 0) return path7;
+  const qs = entries.map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(String(v))}`).join("&");
+  return `${path7}${path7.includes("?") ? "&" : "?"}${qs}`;
+}
+function lowerHeaders(raw) {
+  const out = {};
+  if (raw && typeof raw === "object") {
+    for (const [k, v] of Object.entries(raw)) {
+      out[k.toLowerCase()] = String(v);
+    }
+  }
+  return out;
+}
+function toOutcome(status, data, headers) {
+  const cls = classifyStatus(status);
+  if (status === 204) return { status, body: null, error: "ok", headers };
+  const empty = data === void 0 || data === null || typeof data === "string" && data.trim() === "";
+  if (empty) {
+    return { status, body: null, error: cls === "ok" ? "bad-response" : cls, headers };
+  }
+  if (typeof data === "string") {
+    try {
+      return { status, body: JSON.parse(data), error: cls, headers };
+    } catch {
+      return { status, body: null, error: cls === "ok" ? "bad-response" : cls, headers };
+    }
+  }
+  return { status, body: data, error: cls, headers };
+}
+function httpProbe(http, capabilities) {
+  async function once(fn) {
+    try {
+      const res = await fn();
+      return toOutcome(res.status, res.data, lowerHeaders(res.headers));
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      const local = /Invalid URL|ERR_INVALID_URL|ERR_UNESCAPED_CHARACTERS/i.test(msg);
+      return { status: -1, body: null, error: local ? "bad-response" : "network", headers: {} };
+    }
+  }
+  const headers = { [CAPABILITIES_HEADER]: capabilities };
+  const probe = {
+    capabilities,
+    get(path7, params) {
+      return once(
+        () => http.get(buildUrl(path7, params), { headers, validateStatus: () => true })
+      );
+    },
+    post(path7, body) {
+      return once(
+        () => http.post(path7, body, {
+          headers: { ...headers, "content-type": "application/json" },
+          validateStatus: () => true
+        })
+      );
+    },
+    /**
+     * 🔴 **按原始路径回填、输入全覆盖**：调用方拿 `out[path]` 取结果，
+     * 少一个键就会读成 `undefined` 然后当成「没这个东西」。
+     * 🔴 一路炸不许拖垮整批——逐路径独立归类。
+     */
+    async getMany(paths) {
+      const pairs = await Promise.all(
+        paths.map(async (p) => [
+          p,
+          await probe.get(p).catch(() => networkOutcome())
+        ])
+      );
+      return Object.fromEntries(pairs);
+    },
+    async postMany(jobs) {
+      const pairs = await Promise.all(
+        jobs.map(async (j) => [
+          j.path,
+          await probe.post(j.path, j.body).catch(() => networkOutcome())
+        ])
+      );
+      return Object.fromEntries(pairs);
+    }
+  };
+  return probe;
+}
+function networkOutcome() {
+  return { status: -1, body: null, error: "network", headers: {} };
 }
 export {
+  AUTH_INFO_PATH,
+  BLIND_SPOTS,
   CliError,
   CliErrorCode,
   DEFAULT_AGENT_ID,
   DEFAULT_SESSION_TTL_SECONDS,
+  DOCTOR_ANCHORS,
+  EXTENSION_SOURCE_HEADER,
   ExitCode,
+  GATE_COMPONENTS,
   HcmClient,
+  LayoutContainmentError,
+  MANIFEST_PATH,
+  MAX_MANIFEST_PAGES,
+  MAX_SOURCE_PROBES,
+  META_PATH,
   MINI_CONTEXT_FILE,
   MINI_CONTEXT_KIND,
   MINI_CONTEXT_VERSION,
   MINI_PULL_MANIFEST_FILE,
   MINI_REMOTE_ROOT,
   MINI_STATE_DIR,
+  MODELS_PATH,
   PASSWORD_CHANGE_REQUIRED,
   PROACTIVE_REFRESH_MARGIN_SECONDS,
+  ReconLayout,
   RefStore,
   SDK_VERSION,
   TokenStore,
+  VERSION_PATH,
   WsClient,
   absoluteDownloadUrl,
   adminResetPassword,
@@ -5281,6 +5792,8 @@ export {
   classifyMessage,
   clearMetaCache,
   clearModelCache,
+  compareFingerprint,
+  computeFingerprint,
   conversationStateFile,
   create,
   createConversation,
@@ -5310,6 +5823,7 @@ export {
   fetchConversationTimeline,
   fetchConversationTimelineStrict,
   fetchRecentConversations,
+  fetchReconIdentity,
   fetchSkillCatalog,
   fetchSkillFile,
   fetchSkillMarkdown,
@@ -5328,6 +5842,7 @@ export {
   globalConfigFile,
   guessMimeType,
   hcmConfigDir,
+  httpProbe,
   identitiesDir,
   identityDir,
   identityMetaFile,
@@ -5353,6 +5868,8 @@ export {
   loginPat,
   matchSkills,
   migrateLegacyProfiles,
+  modelEntries,
+  modelKeys,
   needsRefresh,
   normalizeReferences,
   oneShot,
@@ -5365,6 +5882,7 @@ export {
   parseSkillFrontmatter,
   parseSkillRequirements,
   patchSettingDomain,
+  probeExtensionSource,
   profileDir,
   profileFile,
   pullMiniAppProject,
@@ -5382,8 +5900,10 @@ export {
   resolveChironBase,
   resolveRefs,
   resolveSkillInstallOrder,
+  runDoctor,
   runImport,
   runMiniSmokeChecks,
+  safeSegment,
   saveConversationState,
   saveEnv,
   saveGlobalConfig,
@@ -5393,6 +5913,7 @@ export {
   saveWorkspaceFileContent,
   sendMessageAndStream,
   snakeToCamel,
+  tenantSegment,
   toJson,
   toOrigin,
   toPrincipal,