@xdxer/dingtalk-agent 0.1.4-beta.1 → 0.1.4-beta.10

package/dist/bin/dingtalk-agent.js

@@ -9,22 +9,35 @@
 //
 // 因为：文档会被漏读、误读、自我说服；**撞到闸门上就没得商量。**
 import { parseArgs } from 'node:util';
-import { join, resolve } from 'node:path';
-import { readFileSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
 import { spawn, spawnSync } from 'node:child_process';
 import * as cfgmod from '../src/config.js';
-import * as kbmod from '../src/kb.js';
-import * as runsmod from '../src/runs.js';
-import * as dutymod from '../src/duty.js';
-import { boot } from '../src/boot.js';
 import { init } from '../src/init.js';
 import { ackDispatch, listPendingDispatches, prepareSession } from '../src/sessions.js';
 import { readEventFile, consumeNdjson, heartbeatEvent } from '../src/driver.js';
 import { findRun, previewAction, executeAction } from '../src/actions.js';
 import { resolvePackageRoot } from '../src/package-root.js';
 import { bootstrap } from '../src/bootstrap.js';
+import { loadAgentBindings } from '../src/agent-bindings.js';
+import { auditAgent } from '../src/agent-audit.js';
+import { applyAgentEnhancement, planAgentEnhancement, } from '../src/agent-enhance.js';
+import { doctorLab, runLab, teardownLab, verifyLab } from '../src/lab.js';
+import { runRobotEvaluation } from '../src/robot-evals.js';
+import { runOpenCodeEvaluation } from '../src/opencode-evals.js';
+import { runStorageEvaluation } from '../src/storage-evals.js';
+import { runPersonalEventEvaluation } from '../src/personal-event-evals.js';
 import { doctor } from '../src/doctor.js';
+import { doctorDevelopmentWorkspace, inspectAgentProject, showDevelopmentWorkspace, } from '../src/development-workspace.js';
+import { applyOpenCodeWorkspace, evalOpenCodeWorkspace, planOpenCodeWorkspace, runOpenCodeWorkspace, useOpenCodeWorkspace, } from '../src/opencode-provider.js';
+import { inspectMulticaWorkspace, listMulticaWorkspaceResources, planMulticaWorkspace, statusMulticaWorkspace, } from '../src/multica-provider.js';
+import { applyMulticaDeployment, listMulticaDeployments, planMulticaDeployment, statusMulticaDeployment, } from '../src/multica-deploy.js';
+import { applyObservation, applyPromotion, listPromotions, planObservation, planPromotion, statusPromotion, } from '../src/promotion.js';
 import { setup } from '../src/setup.js';
+import { upgradeAgent } from '../src/upgrade.js';
+import { checkpointTask, showTaskCheckpoint } from '../src/memory/task-checkpoints.js';
+import { upsertOperationalMemory } from '../src/memory/operational.js';
+import { proposeMemoryCandidate, publishMemoryCandidate, reviewMemoryCandidate, showMemoryCandidate, } from '../src/memory/candidates.js';
 import { installGlobalSkill, skillStatus, uninstallGlobalSkill, upgradeGlobalSkill, } from '../src/skill-manager.js';
 const PACKAGE_ROOT = resolvePackageRoot(import.meta.url);
 const PACKAGE_JSON = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8'));
@@ -33,50 +46,41 @@ const PACKAGE_JSON = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'),
 const ROOT = process.env.DTA_ROOT
     ? resolve(process.env.DTA_ROOT)
     : (cfgmod.findRoot(process.cwd()) || process.cwd());
+const PROJECT_START = process.env.DTA_ROOT ? resolve(process.env.DTA_ROOT) : process.cwd();
 const HELP = `
-dingtalk-agent —— Skill-first 的钉钉数字员工行为容器
+dta —— 给 Agent 安装钉钉员工的基础行为和工作环境
 
-  首次使用（无全局命令时: npx --yes --registry=https://registry.npmjs.org @xdxer/dingtalk-agent@${PACKAGE_JSON.version} setup）
-  setup                        用户级安装 CLI、修复 PATH、安装 Skill、检查 DWS
-  doctor                       检查 PATH / Node / DWS / Skill / Agent 客户端
+装好后，Agent 可以：
+  · 判断 @、单聊和群消息是否应该回应
+  · 通过 DWS 回复消息、协作并使用钉钉标准产品
+  · 从本地目录或钉钉文档加载身份、记忆和知识
 
-  Skill（不要求 Workspace）
-  skill install                安装全局 Basic Behavior（Claude Code + Codex + OpenCode）
-  skill status                 检查版本、漂移和客户端可发现性
-  skill upgrade                升级本工具管理的全局 Skill
-  skill uninstall              安全卸载本工具管理的全局 Skill
-    通用: [--dry-run] [--json] [--discard-local-changes]
+开始使用：
+  dta setup             首次配置 CLI、DWS 和基础行为 Skill
+  dta bootstrap --json  为当前 Agent 会话加载工作区
+  dta agent enhance / audit  安全增强已有仓库，再审计定义、存储与 Skill 真加载
+  dta info / dta workspace doctor <name>  查看 Project 并只读诊断 Workspace
+  dta deploy ... / dta promote ...  预览 Multica 受控部署或已验版本晋级
 
-  每个 Agent Session（不要求 init）
-  bootstrap                    发现当前本地 Workspace；不修改项目文件
-    [--storage <uri>]          local-dir:<path> | dingtalk-doc:<node-or-url>
-    [--state-dir <path>]       远端文档只读快照目录
-    [--profile <dws-profile>] [--json]
+维护环境：
+  dta doctor            检查哪里没装好，并给出修复提示
+  dta upgrade           自升级，再重新检查完整环境
+  dta skill status      查看 Claude Code、Codex、OpenCode 能否发现 Skill
 
-  可信事件模式（可选；需要一次 init）
-  init [--context-id X]        仅为 Prepared Run 建最小 Workspace
-  prepare --event-file <file|-> 事件 → Session → Run
-  act ack                       对原消息贴「收到」;不代表接单
-  act reply --text "…"          引用回复原消息
-  act ask --text "…"            只问一个真正阻塞的问题
-  act silence [--reason "…"]    不外发,但留下行为回执
-    通用: [--run <path>] [--dry-run] [--json]
-
-  smoke                         极简本地验收（不写钉钉）
-  eval contract / behavior      完整合同或模型行为评测
-
-  help runtime                  事件宿主与 controller 命令
-  help adapters                 可选 DWS listen 适配器
-  help legacy                   查看兼容的本体、KB、值班与进化命令
+接入钉钉事件和可靠外发：dta help runtime
 `;
 const RUNTIME_HELP = `
 dingtalk-agent 可信事件运行时（可选宿主能力）
 
   init [--context-id X] [--memory <uri>] [--knowledge <uri>]
-  prepare --event-file <file|->
+  prepare --event-file <file|-> [--perception-file <file>]
   run --stdin | --event-file <file> | --heartbeat
   dispatch pending
   dispatch ack --event-id X --run-id X
+  task show --json
+  task checkpoint --input checkpoint.json --expect-revision N
+  memory operational upsert --provider provider.json --input record.json [--live --yes]
+  memory candidate propose|show|review|publish
   act ack|reply|ask|silence
 
 这些命令负责目标冻结、Session/Run、Wait、幂等和回执；普通 Agent Session 不必使用。
@@ -90,19 +94,90 @@ dingtalk-agent 可选 Driver / 开发联调适配器
 
 listen 不是 Agent 主入口。Claude Code、DWS 云端或其他宿主都可以直接提供事件。
 `;
-const LEGACY_HELP = `
-dingtalk-agent 兼容命令（不属于 P0 四对象主链）
+const LAB_HELP = `
+dingtalk-agent 真实世界联调控制面
+
+  lab doctor --manifest lab/manifest.local.json
+  lab run --manifest <file> --event-file <file> --case-id <id> [--reply <text>]
+  lab verify --evidence <run-dir>
+  lab teardown --manifest <file> --evidence <run-dir>
+  lab eval --pool <pool.local.json> --suite <suite.json> [--lanes stateless,stateful]
+  lab eval --engine opencode --workspace <agent-dir> --suite <suite.json> [--cases id1,id2] [--runs 3] [--previous-skill <dir>]
+  lab eval --engine storage --workspace <agent-dir> --suite <remote-state.json> [--execute --live --yes]
+  lab eval --engine personal-event --workspace <agent-dir> --suite <suite.json> [--execute --live --yes]
+
+mock-integration 还要求 DTA_LAB_FAKE_DWS=1；robot/personal Live 必须显式 --live --yes。
+lab eval 默认只输出计划；Robot Live 用 --live --yes，OpenCode A/B 用 --execute --yes。
+Remote State 用 --execute --yes 读取 DWS/调用模型，再加 --live 才执行唯一写探针。
+OpenCode 对照强制验证每个 Basic Skill 的 load probe；提供 --previous-skill 时运行 current/previous，不连接 DWS。
+Lab 只管理 allowlist、预算、marker、证据和清理；事件触发器仍在外部。
+`;
+const AGENT_HELP = `
+dingtalk-agent 开发者装配验收
+
+  agent audit [--bindings agent.bindings.json] [--require-skill <name>]
+  agent audit [--bindings <file>] [--require-skill <name>] --verify-load --yes
+  agent audit [--bindings <file>] --load-report <agent-audit-load-evidence.json> [--remote-report <report.json>]
+  agent enhance --role-skill <name>[,<name>] [--project-name <name>] [--dry-run] [--json]
+  agent enhance --role-skill <name>[,<name>] --plan-id <current-plan-id> --yes [--json]
+
+默认只做本地静态审计，不访问 DWS、不调用模型；状态为 partial 时返回退出码 2。
+--verify-load --yes 会运行隔离的 OpenCode load probe，但仍不访问钉钉。
+远端语义状态由 storage eval 独立验收，再通过 --remote-report 绑定证据。
+`;
+const WORKSPACE_HELP = `
+dingtalk-agent Project / Development Workspace
+
+  info [--json]
+  workspace list [--json]
+  workspace show <name> [--json]
+  workspace doctor <name> [--json]
+  workspace plan <multica-name> [--json]
+  workspace inspect <multica-name> [--execute --yes] [--json]
+  workspace remote-list <multica-name> [--execute --yes] [--json]
+  workspace status <multica-name> [--json]
+  workspace create <name> [--dry-run | --yes] [--json]
+  workspace use <name> [--json]
+  workspace run <name> --prompt-file <file> [--execute --yes] [--json]
+  workspace eval <name> --suite <file> [--execute --yes] [--runs N] [--json]
+
+命令会从当前目录向上发现 dingtalk-agent.json；旧 workspace@1 只读显示为 legacy-prepared。
+Multica plan/status 默认不调用 Provider；inspect/remote-list 只有 --execute --yes 才读取当前 profile 和远端 scope。
+Multica readback 只保存脱敏事实，不执行 create/update/apply/deploy；OpenCode create 只物化本地环境。
+这些命令都不访问 DWS；Multica 远端写入只通过 dta deploy 的冻结 plan 闸门。
+`;
+const DEPLOY_HELP = `
+dingtalk-agent Multica 受控部署
 
-  boot
-  kb mount|list|sync|search
-  duty --check|--run|--list
-  todo
-  log / feedback / runs / evolve
+  deploy --workspace <name> --dry-run [--json]
+  deploy --workspace <name> --plan-id <id> --yes [--no-wait] [--json]
+  deploy --workspace <name> --status [--operation-id <id>] [--json]
+  deploy --workspace <name> --status --operation-id <id> --execute --yes [--json]
+  deploy --workspace <name> --list [--json]
+  deploy --workspace <name> --retire --dry-run [--json]
+  deploy --workspace <name> --retire --plan-id <id> --yes [--json]
 
-这些能力继续可用，但新增 Agent 应先安装全局 Skill；只有可信事件宿主才需要 runtime。
+dry-run 不启动 Multica。apply/retire 必须携带当前 planId；scope 或源码漂移会在写入前拒绝。
+status 默认只验本地脱敏 operation/Receipt；--execute --yes 才做远端独立回读。
+deploy 只管理 Agent、完整 Skill tree、assignment 和 load smoke，不创建机器人、Webhook、Autopilot 或定时 Trigger。
 `;
-function fail(msg, code = 1) {
-    console.error(msg);
+const PROMOTION_HELP = `
+dingtalk-agent 已验版本晋级与反馈候选
+
+  promote --policy <file> --route <id> --dry-run [--json]
+  promote --policy <file> --route <id> --plan-id <id> --yes [--no-wait] [--json]
+  promote --status [--promotion-id <id>] [--json]
+  promote --list [--json]
+  observe --promotion-id <id> --input <observation.json> --dry-run [--json]
+  observe --promotion-id <id> --input <observation.json> --yes [--json]
+
+Promotion 只接受指定 suite 的 load/hard/surface gate 与精确 W2 evidence hash，并委托 W4 deploy。
+Observe 只写 gitignored、proposed、不可直接发布的 Eval candidate；不修改 AGENTS.md、Prompt、Skill 或 Trigger。
+`;
+function fail(msg, code = 1, hint = '') {
+    console.error(`错误: ${msg}`);
+    if (hint)
+        console.error(`提示: ${hint}`);
     process.exit(code);
 }
 const argv = process.argv.slice(2);
@@ -112,15 +187,11 @@ try {
     await main();
 }
 catch (e) {
-    if (e.exitCode)
-        process.exit(e.exitCode);
-    fail(String(e.message || e), 2);
+    const error = e;
+    const message = String(error?.message || error);
+    fail(message, Number(error?.exitCode) || 2, errorHint(message));
 }
 async function main() {
-    if (cmd === 'help' && sub === 'legacy') {
-        console.log(LEGACY_HELP);
-        return;
-    }
     if (cmd === 'help' && sub === 'runtime') {
         console.log(RUNTIME_HELP);
         return;
@@ -129,6 +200,29 @@ async function main() {
         console.log(ADAPTER_HELP);
         return;
     }
+    if (cmd === 'help' && sub === 'lab') {
+        console.log(LAB_HELP);
+        return;
+    }
+    if (cmd === 'help' && sub === 'agent') {
+        console.log(AGENT_HELP);
+        return;
+    }
+    if (cmd === 'help' && sub === 'workspace') {
+        console.log(WORKSPACE_HELP);
+        return;
+    }
+    if (cmd === 'help' && sub === 'deploy') {
+        console.log(DEPLOY_HELP);
+        return;
+    }
+    if (cmd === 'help' && ['promote', 'observe'].includes(sub || '')) {
+        console.log(PROMOTION_HELP);
+        return;
+    }
+    if (cmd === 'help' && sub) {
+        fail(`不认识的帮助主题: ${sub}`, 1, '运行 dta --help 回到产品入口；事件宿主可用 dta help runtime。');
+    }
     if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') {
         console.log(HELP);
         return;
@@ -137,7 +231,387 @@ async function main() {
         console.log(PACKAGE_JSON.version);
         return;
     }
-    // ── setup / doctor：npx 永远可启动的首次使用入口。──
+    if (cmd === 'deploy') {
+        const { values: o, positionals } = parseArgs({
+            args: argv.slice(1), allowPositionals: true,
+            options: {
+                workspace: { type: 'string' }, json: { type: 'boolean' },
+                'dry-run': { type: 'boolean' }, yes: { type: 'boolean' },
+                'plan-id': { type: 'string' }, 'no-wait': { type: 'boolean' },
+                status: { type: 'boolean' }, list: { type: 'boolean' },
+                execute: { type: 'boolean' }, 'operation-id': { type: 'string' },
+                timeout: { type: 'string' }, 'smoke-timeout': { type: 'string' },
+                retire: { type: 'boolean' },
+            },
+        });
+        if (positionals.length)
+            fail('deploy 不接受位置参数；使用 --workspace <name>');
+        if (!o.workspace)
+            fail('deploy 必须显式传 --workspace <name>');
+        const modes = [
+            Boolean(o.status), Boolean(o.list), Boolean(o['dry-run']), Boolean(o.yes && !o.status),
+        ]
+            .filter(Boolean).length;
+        if (modes !== 1) {
+            fail('deploy 必须且只能选择 --dry-run、--yes、--status 或 --list 之一');
+        }
+        const timeoutMs = parseOptionalTimeout(o.timeout, '--timeout');
+        const smokeTimeoutMs = parseOptionalTimeout(o['smoke-timeout'], '--smoke-timeout');
+        let out;
+        if (o.list) {
+            if (o.execute || o['operation-id'] || o.retire || o['plan-id'] || o['no-wait'] ||
+                o.timeout || o['smoke-timeout']) {
+                fail('deploy --list 只接受 --workspace 和 --json');
+            }
+            out = listMulticaDeployments(PROJECT_START, o.workspace, PACKAGE_JSON.version);
+        }
+        else if (o.status) {
+            if (o.retire || o['plan-id'] || o['no-wait'] || o['dry-run'] || o['smoke-timeout']) {
+                fail('deploy --status 不接受 retire/plan-id/no-wait/dry-run/smoke-timeout');
+            }
+            if (Boolean(o.execute) !== Boolean(o.yes)) {
+                fail('deploy --status 远端 reconcile 必须同时传 --execute --yes');
+            }
+            out = statusMulticaDeployment(PROJECT_START, o.workspace, {
+                execute: o.execute, yes: o.yes, operationId: o['operation-id'], timeoutMs,
+                cliVersion: PACKAGE_JSON.version,
+            });
+        }
+        else if (o['dry-run']) {
+            if (o.execute || o['operation-id'] || o['plan-id'] || o['no-wait'] ||
+                o.timeout || o['smoke-timeout']) {
+                fail('deploy --dry-run 不接受 execute/operation-id/plan-id/no-wait/timeout/smoke-timeout');
+            }
+            out = planMulticaDeployment(PROJECT_START, o.workspace, {
+                action: o.retire ? 'retire' : 'apply', cliVersion: PACKAGE_JSON.version,
+            });
+        }
+        else {
+            if (o.execute || o['operation-id'] || o.status || o.list || o['dry-run']) {
+                fail('deploy apply 不接受 execute/operation-id/status/list/dry-run');
+            }
+            if (o.retire && (o['no-wait'] || o['smoke-timeout'])) {
+                fail('deploy --retire 不接受 no-wait/smoke-timeout');
+            }
+            out = applyMulticaDeployment(PROJECT_START, o.workspace, {
+                yes: o.yes, planId: o['plan-id'], noWait: o['no-wait'],
+                timeoutMs, smokeTimeoutMs, cliVersion: PACKAGE_JSON.version,
+            }, o.retire ? 'retire' : 'apply');
+        }
+        if (o.json)
+            console.log(JSON.stringify(out, null, 2));
+        else
+            printMulticaDeployment(out);
+        if ('passed' in out && out.passed === false && out.status !== 'verifying')
+            process.exitCode = 2;
+        return;
+    }
+    if (cmd === 'promote') {
+        const { values: o, positionals } = parseArgs({
+            args: argv.slice(1), allowPositionals: true,
+            options: {
+                policy: { type: 'string' }, route: { type: 'string' },
+                'dry-run': { type: 'boolean' }, yes: { type: 'boolean' }, json: { type: 'boolean' },
+                'plan-id': { type: 'string' }, status: { type: 'boolean' }, list: { type: 'boolean' },
+                'promotion-id': { type: 'string' }, 'no-wait': { type: 'boolean' },
+                timeout: { type: 'string' }, 'smoke-timeout': { type: 'string' },
+            },
+        });
+        if (positionals.length)
+            fail('promote 不接受位置参数');
+        const modes = [Boolean(o['dry-run']), Boolean(o.yes), Boolean(o.status), Boolean(o.list)]
+            .filter(Boolean).length;
+        if (modes !== 1)
+            fail('promote 必须且只能选择 --dry-run、--yes、--status 或 --list 之一');
+        let out;
+        if (o.list) {
+            if (o.policy || o.route || o['plan-id'] || o['promotion-id'] || o['no-wait'] ||
+                o.timeout || o['smoke-timeout'])
+                fail('promote --list 只接受 --json');
+            out = listPromotions(PROJECT_START);
+        }
+        else if (o.status) {
+            if (o.policy || o.route || o['plan-id'] || o['no-wait'] || o.timeout || o['smoke-timeout']) {
+                fail('promote --status 只接受 --promotion-id 和 --json');
+            }
+            out = statusPromotion(PROJECT_START, o['promotion-id'] || '');
+        }
+        else {
+            if (!o.policy || !o.route)
+                fail('promote dry-run/apply 必须传 --policy <file> --route <id>');
+            if (o['promotion-id'])
+                fail('promote dry-run/apply 不接受 --promotion-id');
+            if (o['dry-run']) {
+                if (o['plan-id'] || o['no-wait'] || o.timeout || o['smoke-timeout']) {
+                    fail('promote --dry-run 不接受 plan-id/no-wait/timeout/smoke-timeout');
+                }
+                out = planPromotion(PROJECT_START, o.policy, o.route, { cliVersion: PACKAGE_JSON.version });
+            }
+            else {
+                out = applyPromotion(PROJECT_START, o.policy, o.route, {
+                    yes: true, planId: o['plan-id'], noWait: o['no-wait'],
+                    timeoutMs: parseOptionalTimeout(o.timeout, '--timeout'),
+                    smokeTimeoutMs: parseOptionalTimeout(o['smoke-timeout'], '--smoke-timeout'),
+                    cliVersion: PACKAGE_JSON.version,
+                });
+            }
+        }
+        if (o.json)
+            console.log(JSON.stringify(out, null, 2));
+        else
+            printPromotion(out);
+        if ('passed' in out && out.passed === false && out.status !== 'verifying' && out.status !== 'missing') {
+            process.exitCode = 2;
+        }
+        return;
+    }
+    if (cmd === 'observe') {
+        const { values: o, positionals } = parseArgs({
+            args: argv.slice(1), allowPositionals: true,
+            options: {
+                'promotion-id': { type: 'string' }, input: { type: 'string' },
+                'dry-run': { type: 'boolean' }, yes: { type: 'boolean' }, json: { type: 'boolean' },
+            },
+        });
+        if (positionals.length)
+            fail('observe 不接受位置参数');
+        if (!o['promotion-id'] || !o.input) {
+            fail('observe 必须传 --promotion-id <id> --input <observation.json>');
+        }
+        if (Boolean(o['dry-run']) === Boolean(o.yes)) {
+            fail('observe 必须且只能选择 --dry-run 或 --yes');
+        }
+        const out = o['dry-run']
+            ? planObservation(PROJECT_START, o['promotion-id'], o.input)
+            : applyObservation(PROJECT_START, o['promotion-id'], o.input, { yes: true });
+        if (o.json)
+            console.log(JSON.stringify(out, null, 2));
+        else
+            printPromotion(out);
+        return;
+    }
+    // ── Project / Development Workspace：W1 只读发现、状态与 Provider 诊断。──
+    if (cmd === 'info') {
+        const { values: o } = parseArgs({
+            args: argv.slice(1), options: { json: { type: 'boolean' } },
+        });
+        const out = inspectAgentProject(PROJECT_START, PACKAGE_JSON.version);
+        if (o.json)
+            console.log(JSON.stringify(out, null, 2));
+        else
+            printProjectInfo(out);
+        return;
+    }
+    if (cmd === 'workspace') {
+        const { values: o, positionals } = parseArgs({
+            args: argv.slice(2), allowPositionals: true,
+            options: {
+                json: { type: 'boolean' }, yes: { type: 'boolean' },
+                'dry-run': { type: 'boolean' }, execute: { type: 'boolean' },
+                'prompt-file': { type: 'string' }, suite: { type: 'string' },
+                cases: { type: 'string' }, lanes: { type: 'string' }, runs: { type: 'string' },
+                out: { type: 'string' }, timeout: { type: 'string' },
+                'previous-skill': { type: 'string' },
+            },
+        });
+        if (sub === 'list') {
+            rejectWorkspaceOptions(o, ['json'], 'workspace list');
+            if (positionals.length)
+                fail('workspace list 不接受 Workspace name');
+            const info = inspectAgentProject(PROJECT_START, PACKAGE_JSON.version);
+            const out = {
+                $schema: 'dingtalk-agent/workspace-list@1',
+                root: info.root,
+                currentWorkspace: info.currentWorkspace,
+                workspaces: info.workspaces,
+                sideEffect: false,
+                dingtalkSideEffect: false,
+            };
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                printWorkspaceList(info);
+            return;
+        }
+        if (sub === 'show') {
+            rejectWorkspaceOptions(o, ['json'], 'workspace show');
+            if (positionals.length !== 1)
+                fail('workspace show 需要且只接受一个 Workspace name');
+            const workspace = showDevelopmentWorkspace(PROJECT_START, positionals[0], PACKAGE_JSON.version);
+            const out = {
+                $schema: 'dingtalk-agent/development-workspace@1',
+                ...workspace,
+                sideEffect: false,
+                dingtalkSideEffect: false,
+            };
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                printDevelopmentWorkspace(workspace);
+            return;
+        }
+        if (sub === 'doctor') {
+            rejectWorkspaceOptions(o, ['json'], 'workspace doctor');
+            if (positionals.length !== 1)
+                fail('workspace doctor 需要且只接受一个 Workspace name');
+            const out = doctorDevelopmentWorkspace(PROJECT_START, positionals[0], {
+                cliVersion: PACKAGE_JSON.version,
+            });
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                printDevelopmentWorkspaceDoctor(out);
+            if (!out.ready)
+                process.exitCode = 2;
+            return;
+        }
+        if (sub === 'plan') {
+            rejectWorkspaceOptions(o, ['json', 'dry-run'], 'workspace plan');
+            if (positionals.length !== 1)
+                fail('workspace plan 需要且只接受一个 Multica Workspace name');
+            const out = planMulticaWorkspace(PROJECT_START, positionals[0], {
+                cliVersion: PACKAGE_JSON.version,
+            });
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                printMulticaWorkspaceOperation(out);
+            if (out.blocking.length)
+                process.exitCode = 2;
+            return;
+        }
+        if (sub === 'inspect') {
+            rejectWorkspaceOptions(o, ['json', 'execute', 'yes', 'out', 'timeout'], 'workspace inspect');
+            if (positionals.length !== 1)
+                fail('workspace inspect 需要且只接受一个 Multica Workspace name');
+            if (Boolean(o.execute) !== Boolean(o.yes)) {
+                fail('workspace inspect 读取远端时必须同时传 --execute --yes');
+            }
+            const timeoutMs = o.timeout === undefined ? undefined : Number(o.timeout);
+            const out = inspectMulticaWorkspace(PROJECT_START, positionals[0], {
+                execute: o.execute, yes: o.yes, out: o.out, timeoutMs,
+                cliVersion: PACKAGE_JSON.version,
+            });
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                printMulticaWorkspaceOperation(out);
+            if (o.execute && 'passed' in out && !out.passed)
+                process.exitCode = 2;
+            return;
+        }
+        if (sub === 'remote-list') {
+            rejectWorkspaceOptions(o, ['json', 'execute', 'yes', 'timeout'], 'workspace remote-list');
+            if (positionals.length !== 1)
+                fail('workspace remote-list 需要且只接受一个 Multica Workspace name');
+            if (Boolean(o.execute) !== Boolean(o.yes)) {
+                fail('workspace remote-list 读取远端时必须同时传 --execute --yes');
+            }
+            const timeoutMs = o.timeout === undefined ? undefined : Number(o.timeout);
+            const out = listMulticaWorkspaceResources(PROJECT_START, positionals[0], {
+                execute: o.execute, yes: o.yes, timeoutMs, cliVersion: PACKAGE_JSON.version,
+            });
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                printMulticaWorkspaceOperation(out);
+            if (o.execute && 'passed' in out && !out.passed)
+                process.exitCode = 2;
+            return;
+        }
+        if (sub === 'status') {
+            rejectWorkspaceOptions(o, ['json'], 'workspace status');
+            if (positionals.length !== 1)
+                fail('workspace status 需要且只接受一个 Multica Workspace name');
+            const out = statusMulticaWorkspace(PROJECT_START, positionals[0], PACKAGE_JSON.version);
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                printMulticaWorkspaceOperation(out);
+            if (!out.readyForApply)
+                process.exitCode = 2;
+            return;
+        }
+        if (sub === 'create') {
+            rejectWorkspaceOptions(o, ['json', 'yes', 'dry-run'], 'workspace create');
+            if (positionals.length !== 1)
+                fail('workspace create 需要且只接受一个 Workspace name');
+            if (o.yes && o['dry-run'])
+                fail('workspace create 的 --dry-run 与 --yes 不能同时使用');
+            const out = o.yes
+                ? applyOpenCodeWorkspace(PROJECT_START, positionals[0], {
+                    yes: true, cliVersion: PACKAGE_JSON.version,
+                })
+                : planOpenCodeWorkspace(PROJECT_START, positionals[0], PACKAGE_JSON.version);
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                printOpenCodeWorkspaceOperation(out);
+            return;
+        }
+        if (sub === 'use') {
+            rejectWorkspaceOptions(o, ['json'], 'workspace use');
+            if (positionals.length !== 1)
+                fail('workspace use 需要且只接受一个 Workspace name');
+            const out = useOpenCodeWorkspace(PROJECT_START, positionals[0], PACKAGE_JSON.version);
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                console.log(`✅ current workspace: ${out.previous || '-'} → ${out.current}`);
+            return;
+        }
+        if (sub === 'run') {
+            rejectWorkspaceOptions(o, ['json', 'yes', 'execute', 'prompt-file', 'out', 'timeout'], 'workspace run');
+            if (positionals.length !== 1 || !o['prompt-file']) {
+                fail('workspace run 需要一个 Workspace name 和 --prompt-file <file>');
+            }
+            const timeoutMs = o.timeout === undefined ? undefined : Number(o.timeout);
+            const prompt = readProjectText(PROJECT_START, o['prompt-file'], 'workspace run prompt');
+            const out = runOpenCodeWorkspace(PROJECT_START, positionals[0], prompt, {
+                execute: o.execute, yes: o.yes, timeoutMs, out: o.out,
+            });
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else if (out.$schema === 'dingtalk-agent/opencode-workspace-run-plan@1') {
+                console.log(`DRY-RUN workspace=${out.workspace} model=${out.model} prompt=${out.promptHash}`);
+            }
+            else {
+                console.log(`${out.passed ? '✅' : '❌'} workspace run ${out.runId}`);
+                if (out.execution?.answer)
+                    console.log(out.execution.answer);
+                if (out.evidencePath)
+                    console.log(`evidence=${out.evidencePath}`);
+            }
+            if (o.execute && !out.passed)
+                process.exitCode = 2;
+            return;
+        }
+        if (sub === 'eval') {
+            rejectWorkspaceOptions(o, ['json', 'yes', 'execute', 'suite', 'cases', 'lanes', 'runs', 'out', 'previous-skill'], 'workspace eval');
+            if (positionals.length !== 1 || !o.suite) {
+                fail('workspace eval 需要一个 Workspace name 和 --suite <file>');
+            }
+            const lanes = String(o.lanes || '').split(',').map((item) => item.trim()).filter(Boolean);
+            const invalid = lanes.filter((item) => !['stateless', 'stateful', 'role'].includes(item));
+            if (invalid.length)
+                fail(`workspace eval lanes 非法: ${invalid.join(',')}`);
+            const cases = String(o.cases || '').split(',').map((item) => item.trim()).filter(Boolean);
+            const runs = o.runs === undefined ? undefined : Number(o.runs);
+            const out = evalOpenCodeWorkspace(PROJECT_START, positionals[0], o.suite, {
+                lanes: lanes, caseIds: cases, runs, out: o.out,
+                previousSkill: o['previous-skill'], execute: o.execute, yes: o.yes,
+            });
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                printLab(out.report || out);
+            if (o.execute && !out.passed)
+                process.exitCode = 2;
+            return;
+        }
+        fail(`不认识的 workspace 子命令: ${sub || '(缺失)'}`, 1, `可用命令: dta workspace list | show | doctor | plan | inspect | remote-list | status | create | use | run | eval${suggest(sub || '', ['list', 'show', 'doctor', 'plan', 'inspect', 'remote-list', 'status', 'create', 'use', 'run', 'eval'], 'dta workspace')}`);
+    }
+    // ── setup / upgrade / doctor：机器级安装与环境闭环。──
     if (cmd === 'setup') {
         const { values: o } = parseArgs({
             args: argv.slice(1),
@@ -174,19 +648,39 @@ async function main() {
             process.exitCode = 2;
         return;
     }
+    if (cmd === 'upgrade') {
+        const { values: o } = parseArgs({
+            args: argv.slice(1),
+            options: {
+                channel: { type: 'string' }, version: { type: 'string' }, prefix: { type: 'string' },
+                'dry-run': { type: 'boolean' }, force: { type: 'boolean' }, json: { type: 'boolean' },
+            },
+        });
+        const out = upgradeAgent(PACKAGE_ROOT, {
+            channel: o.channel,
+            version: o.version, prefix: o.prefix,
+            dryRun: o['dry-run'], force: o.force,
+        });
+        if (o.json)
+            console.log(JSON.stringify(out, null, 2));
+        else
+            printUpgrade(out);
+        if (!out.dryRun && !out.ready)
+            process.exitCode = 2;
+        return;
+    }
     // ── skill：唯一一次性的主入口；完全不依赖 Workspace。──
     if (cmd === 'skill') {
-        const { values: o } = parseArgs({
+        const { values: o, positionals } = parseArgs({
             args: argv.slice(2),
+            allowPositionals: true,
             options: {
-                'dry-run': { type: 'boolean' }, json: { type: 'boolean' },
-                'discard-local-changes': { type: 'boolean' },
+                name: { type: 'string' }, 'dry-run': { type: 'boolean' }, json: { type: 'boolean' },
             },
         });
-        const options = {
-            dryRun: o['dry-run'],
-            discardLocalChanges: o['discard-local-changes'],
-        };
+        if (positionals.length > 1)
+            fail('skill 最多接受一个 Skill name');
+        const options = { dryRun: o['dry-run'], name: o.name || positionals[0] };
         let out;
         if (sub === 'install')
             out = installGlobalSkill(PACKAGE_ROOT, options);
@@ -197,7 +691,7 @@ async function main() {
         else if (sub === 'uninstall')
             out = uninstallGlobalSkill(PACKAGE_ROOT, options);
         else
-            fail('skill 的子命令: install / status / upgrade / uninstall');
+            fail(`不认识的 skill 子命令: ${sub || '(缺失)'}`, 1, `可用命令: dta skill install | status | upgrade | uninstall${suggest(sub || '', ['install', 'status', 'upgrade', 'uninstall'], 'dta skill')}`);
         if (o.json)
             console.log(JSON.stringify(out, null, 2));
         else
@@ -209,18 +703,27 @@ async function main() {
         const { values: o } = parseArgs({
             args: argv.slice(1),
             options: {
-                storage: { type: 'string' }, 'state-dir': { type: 'string' },
-                profile: { type: 'string' }, json: { type: 'boolean' },
+                agent: { type: 'string' }, storage: { type: 'string' },
+                memory: { type: 'string' }, knowledge: { type: 'string' },
+                skills: { type: 'string' }, artifacts: { type: 'string' },
+                'state-dir': { type: 'string' }, profile: { type: 'string' },
+                'expected-user-id': { type: 'string' }, bindings: { type: 'string' },
+                json: { type: 'boolean' },
             },
         });
+        const loaded = loadConventionalBindings(o.bindings);
         const out = bootstrap(ROOT, {
-            storage: o.storage, stateDir: o['state-dir'], profile: o.profile,
+            agent: o.agent, storage: o.storage,
+            memory: o.memory, knowledge: o.knowledge, skills: o.skills,
+            artifacts: o.artifacts, stateDir: o['state-dir'], profile: o.profile,
+            expectedUserId: o['expected-user-id'], context: loaded?.context,
         });
         if (o.json)
             console.log(JSON.stringify(out, null, 2));
         else {
             console.log(`✅ ${out.mode === 'workspace' ? '已装载 Workspace' : '直接会话模式'}`);
             console.log(`   scope=${out.scopeId}  initialized=${out.initialized}`);
+            console.log(`   agent=${out.definition.id}  definition=${out.definition.status}`);
             if (!out.mounts.length)
                 console.log('   没有发现持久上下文；这不是错误，也不需要自动 init。');
             for (const mount of out.mounts)
@@ -229,6 +732,189 @@ async function main() {
         }
         return;
     }
+    // ── agent audit：本地定义、Host exposure、真加载与存储证据的稳定验收面。──
+    if (cmd === 'agent') {
+        if (!['audit', 'enhance'].includes(sub || ''))
+            fail(`不认识的 agent 子命令: ${sub || '(缺失)'}`, 1, `可用命令: dta agent audit / dta agent enhance${suggest(sub || '', ['audit', 'enhance'], 'dta agent')}`);
+        if (sub === 'enhance') {
+            const { values: o } = parseArgs({
+                args: argv.slice(2),
+                options: {
+                    bindings: { type: 'string' }, 'project-name': { type: 'string' },
+                    'role-skill': { type: 'string' }, model: { type: 'string' },
+                    memory: { type: 'string' }, knowledge: { type: 'string' },
+                    artifacts: { type: 'string' }, 'state-dir': { type: 'string' },
+                    profile: { type: 'string' }, 'expected-user-id': { type: 'string' },
+                    'plan-id': { type: 'string' }, 'dry-run': { type: 'boolean' },
+                    yes: { type: 'boolean' }, json: { type: 'boolean' },
+                },
+            });
+            if (o.yes && o['dry-run'])
+                fail('agent enhance 的 --dry-run 与 --yes 不能同时使用');
+            if (!o.yes && o['plan-id'])
+                fail('agent enhance plan 不接受 --plan-id；它由 dry-run 生成');
+            const options = {
+                bindings: o.bindings, projectName: o['project-name'],
+                roleSkills: o['role-skill']?.split(','), model: o.model,
+                memory: o.memory, knowledge: o.knowledge, artifacts: o.artifacts,
+                stateDir: o['state-dir'], profile: o.profile,
+                expectedUserId: o['expected-user-id'], cliVersion: PACKAGE_JSON.version,
+                planId: o['plan-id'], yes: o.yes,
+            };
+            const out = o.yes
+                ? applyAgentEnhancement(ROOT, options)
+                : planAgentEnhancement(ROOT, options);
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else
+                printAgentEnhance(out);
+            if ('$schema' in out && out.$schema === 'dingtalk-agent/agent-enhancement-plan@1' && !out.ready) {
+                process.exitCode = 2;
+            }
+            return;
+        }
+        const { values: o } = parseArgs({
+            args: argv.slice(2),
+            options: {
+                bindings: { type: 'string' }, agent: { type: 'string' }, storage: { type: 'string' },
+                memory: { type: 'string' }, knowledge: { type: 'string' },
+                skills: { type: 'string' }, artifacts: { type: 'string' },
+                'state-dir': { type: 'string' }, profile: { type: 'string' },
+                'expected-user-id': { type: 'string' }, 'require-skill': { type: 'string' },
+                'verify-load': { type: 'boolean' }, yes: { type: 'boolean' },
+                model: { type: 'string' }, out: { type: 'string' },
+                'load-report': { type: 'string' }, 'remote-report': { type: 'string' },
+                json: { type: 'boolean' },
+            },
+        });
+        const loaded = loadConventionalBindings(o.bindings);
+        const out = auditAgent(ROOT, {
+            bootstrap: {
+                agent: o.agent, storage: o.storage,
+                memory: o.memory, knowledge: o.knowledge, skills: o.skills,
+                artifacts: o.artifacts, stateDir: o['state-dir'], profile: o.profile,
+                expectedUserId: o['expected-user-id'], context: loaded?.context,
+            },
+            bindings: loaded ? { path: loaded.path, hash: loaded.hash } : undefined,
+            requiredSkills: o['require-skill']?.split(','),
+            verifyLoad: o['verify-load'], yes: o.yes, model: o.model, out: o.out,
+            loadReport: o['load-report'], remoteReport: o['remote-report'],
+        });
+        if (o.json)
+            console.log(JSON.stringify(out, null, 2));
+        else
+            printAgentAudit(out);
+        if (!out.ready)
+            process.exitCode = 2;
+        return;
+    }
+    // ── lab：测试控制面；默认无副作用，Live 必须 manifest + --live --yes。──
+    if (cmd === 'lab') {
+        const { values: o } = parseArgs({
+            args: argv.slice(2),
+            options: {
+                manifest: { type: 'string' }, evidence: { type: 'string' },
+                'event-file': { type: 'string' }, 'case-id': { type: 'string' },
+                pool: { type: 'string' }, suite: { type: 'string' }, lanes: { type: 'string' },
+                cases: { type: 'string' },
+                engine: { type: 'string' }, workspace: { type: 'string' }, model: { type: 'string' },
+                runs: { type: 'string' }, out: { type: 'string' },
+                'previous-skill': { type: 'string' }, execute: { type: 'boolean' },
+                reply: { type: 'string' }, input: { type: 'string' },
+                live: { type: 'boolean' }, yes: { type: 'boolean' }, json: { type: 'boolean' },
+            },
+        });
+        let out;
+        if (sub === 'doctor') {
+            if (!o.manifest)
+                fail('lab doctor 需要 --manifest <file>');
+            out = doctorLab(ROOT, o.manifest);
+            if (!out.ready)
+                process.exitCode = 2;
+        }
+        else if (sub === 'run') {
+            if (!o.manifest || !o['case-id'])
+                fail('lab run 需要 --manifest 和 --case-id');
+            const rawEvent = o['event-file']
+                ? readEventFile(o['event-file']) : null;
+            out = runLab(ROOT, cfgmod.must(ROOT), o.manifest, rawEvent, {
+                caseId: o['case-id'], replyText: o.reply, inputText: o.input,
+                live: o.live, yes: o.yes,
+            });
+        }
+        else if (sub === 'verify') {
+            if (!o.evidence)
+                fail('lab verify 需要 --evidence <run-dir>');
+            out = verifyLab(ROOT, o.evidence);
+            if (!out.passed)
+                process.exitCode = 2;
+        }
+        else if (sub === 'teardown') {
+            if (!o.manifest || !o.evidence)
+                fail('lab teardown 需要 --manifest 和 --evidence');
+            out = teardownLab(ROOT, o.manifest, o.evidence, { live: o.live, yes: o.yes });
+        }
+        else if (sub === 'eval') {
+            if (!o.suite)
+                fail('lab eval 需要 --suite');
+            const lanes = String(o.lanes || '').split(',').map((item) => item.trim()).filter(Boolean);
+            const invalid = lanes.filter((item) => !['stateless', 'stateful', 'role'].includes(item));
+            if (invalid.length)
+                fail(`lab eval lanes 非法: ${invalid.join(',')}`);
+            const cases = String(o.cases || '').split(',').map((item) => item.trim()).filter(Boolean);
+            const engine = o.engine || 'robot';
+            if (engine === 'opencode') {
+                if (!o.workspace)
+                    fail('OpenCode eval 需要 --workspace <agent-dir>');
+                const runs = o.runs === undefined ? undefined : Number(o.runs);
+                out = runOpenCodeEvaluation(ROOT, o.workspace, o.suite, {
+                    lanes: lanes, model: o.model, runs,
+                    caseIds: cases, previousSkill: o['previous-skill'],
+                    execute: o.execute, yes: o.yes, out: o.out,
+                });
+                if (o.execute && !out.passed)
+                    process.exitCode = 2;
+            }
+            else if (engine === 'storage') {
+                if (!o.workspace)
+                    fail('Remote State eval 需要 --workspace <agent-dir>');
+                out = runStorageEvaluation(ROOT, o.workspace, o.suite, {
+                    model: o.model, execute: o.execute, live: o.live, yes: o.yes, out: o.out,
+                });
+                if (o.execute && !out.passed)
+                    process.exitCode = 2;
+            }
+            else if (engine === 'personal-event') {
+                if (!o.workspace)
+                    fail('Personal Event eval 需要 --workspace <agent-dir>');
+                out = runPersonalEventEvaluation(ROOT, o.workspace, o.suite, {
+                    execute: o.execute, live: o.live, yes: o.yes, out: o.out,
+                });
+                if (o.execute && !out.passed)
+                    process.exitCode = 2;
+            }
+            else if (engine === 'robot') {
+                if (!o.pool)
+                    fail('Robot eval 需要 --pool <pool.local.json>');
+                out = runRobotEvaluation(ROOT, o.pool, o.suite, {
+                    lanes: lanes, live: o.live, yes: o.yes,
+                });
+                if (o.live && !out.passed)
+                    process.exitCode = 2;
+            }
+            else {
+                fail(`lab eval engine 非法: ${engine}；只支持 robot、opencode、storage 或 personal-event`);
+            }
+        }
+        else {
+            fail(`不认识的 lab 子命令: ${sub || '(缺失)'}`, 1, '可用命令: dta lab doctor | run | verify | teardown | eval；详见 dta help lab。');
+        }
+        if (o.json)
+            console.log(JSON.stringify(out, null, 2));
+        else
+            printLab(out);
+        return;
+    }
     // ── init ──
     if (cmd === 'init') {
         const { values: o } = parseArgs({
@@ -253,6 +939,7 @@ async function main() {
             options: {
                 'event-file': { type: 'string' }, field: { type: 'string' },
                 'session-key': { type: 'string' }, 'context-id': { type: 'string' },
+                'perception-file': { type: 'string' },
                 json: { type: 'boolean' },
             },
         });
@@ -261,6 +948,7 @@ async function main() {
             fail('prepare 需要 --event-file <file|->');
         const out = prepareSession(ROOT, cfg, readEventFile(file), {
             fieldId: o.field, sessionKey: o['session-key'], contextId: o['context-id'],
+            perception: o['perception-file'] ? readEventFile(o['perception-file']) : undefined,
         });
         printDispatch(out, o.json);
         return;
@@ -274,12 +962,14 @@ async function main() {
                 stdin: { type: 'boolean' }, 'event-file': { type: 'string' },
                 field: { type: 'string' }, 'session-key': { type: 'string' },
                 'context-id': { type: 'string' },
+                'perception-file': { type: 'string' },
                 heartbeat: { type: 'boolean' }, 'heartbeat-key': { type: 'string' },
                 'heartbeat-event-id': { type: 'string' },
             },
         });
         const options = {
             fieldId: o.field, sessionKey: o['session-key'], contextId: o['context-id'],
+            perception: o['perception-file'] ? readEventFile(o['perception-file']) : undefined,
         };
         const modes = [Boolean(o.stdin), Boolean(o.heartbeat), Boolean(o['event-file'] || positionals[0])];
         if (modes.filter(Boolean).length !== 1) {
@@ -391,6 +1081,133 @@ async function main() {
         }
         fail('dispatch 的子命令: pending / ack');
     }
+    // ── task：Session 语义 checkpoint；revision CAS，不承担 Wait/锁/Receipt。──
+    if (cmd === 'task') {
+        const cfg = cfgmod.must(ROOT);
+        const { values: o } = parseArgs({
+            args: argv.slice(2),
+            options: {
+                input: { type: 'string' }, session: { type: 'string' },
+                'expect-revision': { type: 'string' }, json: { type: 'boolean' },
+            },
+        });
+        let out;
+        if (sub === 'show') {
+            out = showTaskCheckpoint(ROOT, cfg, {
+                sessionPath: o.session || process.env.DTA_SESSION,
+                runPath: process.env.DTA_RUN,
+            });
+        }
+        else if (sub === 'checkpoint') {
+            if (!o.input || o['expect-revision'] === undefined) {
+                fail('task checkpoint 需要 --input 和 --expect-revision');
+            }
+            const expectedRevision = Number(o['expect-revision']);
+            out = checkpointTask(ROOT, cfg, readEventFile(o.input), expectedRevision, {
+                sessionPath: o.session || process.env.DTA_SESSION,
+                runPath: process.env.DTA_RUN,
+            });
+        }
+        else {
+            fail('task 的子命令: show / checkpoint');
+        }
+        if (o.json)
+            console.log(JSON.stringify(out, null, 2));
+        else if (!out.found)
+            console.log('当前 Session 尚无 Task checkpoint。');
+        else {
+            console.log(`✅ Task ${out.checkpoint.taskId} · ${out.checkpoint.status}`);
+            console.log(`   revision=${out.checkpoint.revision}  hash=${out.hash}`);
+            console.log(`   next=${out.checkpoint.nextAction || '-'}`);
+        }
+        return;
+    }
+    // ── memory：Provider-neutral 语义路由；当前首个远端事实源是 AI 表格。──
+    if (cmd === 'memory') {
+        const action = argv[2];
+        if (sub === 'operational' && action === 'upsert') {
+            const { values: o } = parseArgs({
+                args: argv.slice(3),
+                options: {
+                    provider: { type: 'string' }, input: { type: 'string' },
+                    live: { type: 'boolean' }, yes: { type: 'boolean' }, json: { type: 'boolean' },
+                },
+            });
+            const providerPath = o.provider || process.env.DTA_OPERATIONAL_MEMORY_PROVIDER;
+            if (!providerPath || !o.input) {
+                fail('memory operational upsert 需要 --provider（或 DTA_OPERATIONAL_MEMORY_PROVIDER）和 --input');
+            }
+            const out = upsertOperationalMemory(readEventFile(providerPath), readEventFile(o.input), { execute: Boolean(o.live), yes: Boolean(o.yes) });
+            if (o.json || !o.live)
+                console.log(JSON.stringify(out, null, 2));
+            else {
+                console.log(`${out.verified ? '✅' : '⚠️'} Operational Memory · ${out.mode}`);
+                console.log(`   record=${out.recordId || '-'}  verification=${out.verification}`);
+            }
+            if (out.mode === 'uncertain')
+                process.exitCode = 2;
+            return;
+        }
+        if (sub === 'candidate') {
+            const { values: o } = parseArgs({
+                args: argv.slice(3),
+                options: {
+                    input: { type: 'string' }, id: { type: 'string' }, target: { type: 'string' },
+                    decision: { type: 'string' }, reviewer: { type: 'string' }, reason: { type: 'string' },
+                    'state-dir': { type: 'string' }, 'expect-revision': { type: 'string' },
+                    'expect-target-hash': { type: 'string' },
+                    live: { type: 'boolean' }, yes: { type: 'boolean' }, json: { type: 'boolean' },
+                },
+            });
+            const options = { stateDir: o['state-dir'], runPath: process.env.DTA_RUN };
+            let out;
+            if (action === 'propose') {
+                if (!o.input)
+                    fail('memory candidate propose 需要 --input');
+                out = proposeMemoryCandidate(ROOT, readEventFile(o.input), options);
+            }
+            else if (action === 'show') {
+                if (!o.id)
+                    fail('memory candidate show 需要 --id');
+                out = showMemoryCandidate(ROOT, o.id, options);
+            }
+            else if (action === 'review') {
+                if (!o.id || !o.decision || !o.reviewer || !o.reason ||
+                    o['expect-revision'] === undefined) {
+                    fail('memory candidate review 需要 --id/--decision/--reviewer/--reason/--expect-revision');
+                }
+                out = reviewMemoryCandidate(ROOT, o.id, o.decision, o.reviewer, o.reason, Number(o['expect-revision']), options);
+            }
+            else if (action === 'publish') {
+                if (!o.id || !o.target || o['expect-revision'] === undefined) {
+                    fail('memory candidate publish 需要 --id/--target/--expect-revision');
+                }
+                out = publishMemoryCandidate(ROOT, o.id, readEventFile(o.target), Number(o['expect-revision']), o['expect-target-hash'] || '', {
+                    ...options,
+                    execute: Boolean(o.yes || o.live),
+                    yes: Boolean(o.yes),
+                    live: Boolean(o.live),
+                });
+            }
+            else {
+                fail('memory candidate 的子命令: propose / show / review / publish');
+            }
+            if (o.json)
+                console.log(JSON.stringify(out, null, 2));
+            else if (action === 'publish') {
+                console.log(`${out.verified ? '✅' : out.mode === 'dry-run' ? '🔎' : '⚠️'} Candidate ${o.id}`);
+                console.log(`   mode=${out.mode} targetHash=${out.currentTargetHash}`);
+            }
+            else {
+                console.log(`✅ Candidate ${out.candidate.id} · ${out.candidate.status}`);
+                console.log(`   revision=${out.candidate.revision}  path=${out.path}`);
+            }
+            if (action === 'publish' && out.mode === 'uncertain')
+                process.exitCode = 2;
+            return;
+        }
+        fail('memory 当前支持: operational upsert / candidate propose|show|review|publish');
+    }
     // ── act：元语化动作；目标/身份/预算/状态转移都由 Run 固定 ──
     if (cmd === 'act') {
         const kind = sub;
@@ -423,284 +1240,70 @@ async function main() {
             process.exitCode = 2;
         return;
     }
-    // ── eval：宿主评测入口；shadow 永不调用 act / DWS。──
-    if (cmd === 'eval') {
-        const script = sub === 'contract'
-            ? join(PACKAGE_ROOT, 'evals', 'run-contract-evals.mjs')
-            : sub === 'shadow'
-                ? join(PACKAGE_ROOT, 'evals', 'runners', 'claude-shadow.mjs')
-                : sub === 'behavior'
-                    ? join(PACKAGE_ROOT, 'evals', 'run-shadow-evals.mjs')
-                    : '';
-        if (!script)
-            fail('eval 的子命令: contract / shadow / behavior');
-        const childEnv = { ...process.env };
-        // 合同评测会创建隔离工作区；继承宿主 DTA_ROOT 会让 Action Gate 错读外层 control store。
-        delete childEnv.DTA_ROOT;
-        const child = spawnSync(process.execPath, [script, ...argv.slice(2)], {
-            cwd: ROOT,
-            env: childEnv,
-            stdio: 'inherit',
-        });
-        if (child.error)
-            throw child.error;
-        if (child.signal)
-            throw new Error(`评测进程被 ${child.signal} 终止`);
-        process.exitCode = child.status ?? 2;
-        return;
+    fail(`不认识的命令: ${cmd}`, 1, `运行 dta --help 查看全部命令${suggest(cmd, [
+        'setup', 'upgrade', 'doctor', 'skill', 'bootstrap', 'init', 'prepare', 'run', 'dispatch', 'task', 'memory', 'act',
+        'agent',
+        'info', 'workspace',
+    ])}`);
+}
+function loadConventionalBindings(input) {
+    const conventional = 'agent.bindings.json';
+    const selected = input || (existsSync(resolve(ROOT, conventional)) ? conventional : '');
+    return selected ? loadAgentBindings(ROOT, selected) : null;
+}
+function errorHint(message) {
+    if (/unknown option|未知选项|unexpected argument/i.test(message)) {
+        return '检查参数拼写；运行 dta --help 查看当前版本支持的参数。';
     }
-    if (cmd === 'smoke') {
-        const script = join(PACKAGE_ROOT, 'evals', 'run-contract-evals.mjs');
-        const childEnv = { ...process.env };
-        delete childEnv.DTA_ROOT;
-        const child = spawnSync(process.execPath, [script, '--smoke'], {
-            cwd: ROOT, env: childEnv, stdio: 'inherit',
-        });
-        if (child.error)
-            throw child.error;
-        if (child.signal)
-            throw new Error(`Smoke 被 ${child.signal} 终止`);
-        process.exitCode = child.status ?? 2;
-        return;
+    if (/找不到当前 Run|必须由能访问 DTA_ROOT 的宿主侧执行/.test(message)) {
+        return 'act 只能用于可信事件 Run；先由宿主执行 dta prepare --event-file <file>，再进入返回的 cwd。';
     }
-    // ── kb ──
-    if (cmd === 'kb') {
-        const cfg = cfgmod.must(ROOT);
-        const { values: o } = parseArgs({
-            args: argv.slice(2), allowPositionals: true,
-            options: {
-                name: { type: 'string' }, from: { type: 'string' }, own: { type: 'string' },
-                sync: { type: 'string' }, local: { type: 'string' }, force: { type: 'boolean' },
-            },
-        });
-        if (sub === 'mount') {
-            if (!o.name || !o.from)
-                fail('要 --name 和 --from。源的写法见 --help');
-            kbmod.parseSource(o.from); // 写错了当场炸
-            const own = o.own || kbmod.EXTERNAL;
-            const sync = o.sync || (own === kbmod.OWNED ? kbmod.PUSH : kbmod.PULL);
-            if (own === kbmod.OWNED && sync === kbmod.PULL) {
-                fail('owned 的真值在 Git,不该 pull —— 那会把远端的东西覆盖到本地。\n' +
-                    '  **所有权决定真值方向。** owned → push;external → pull。');
-            }
-            const local = o.local || join('.cache/kb', o.name);
-            cfg.kb = (cfg.kb || []).filter((k) => k.name !== o.name);
-            cfg.kb.push({ name: o.name, from: o.from, own, sync, local });
-            cfgmod.save(ROOT, cfg);
-            console.log(`✅ 挂上「${o.name}」 ${o.from}`);
-            console.log(`   所有权=${own} · 同步=${sync} · 落在 ${local}`);
-            console.log(own === kbmod.OWNED
-                ? '   （真值在 Git,钉钉是暴露层。人在钉钉里改了 → sync 时会【停下来问】,不盲覆盖。）'
-                : '   （真值在钉钉,本地只是【可丢弃的缓存】。过期了 kb search 会警告。）');
-            return;
-        }
-        if (sub === 'list') {
-            if (!cfg.kb?.length)
-                return console.log('一个都没挂。 kb mount --help');
-            for (const kb of cfg.kb) {
-                const s = kbmod.stale(kb);
-                console.log(`  ${s ? '⚠️' : '·'} ${kb.name.padEnd(14)} ${kb.own.padEnd(9)} ${kb.sync.padEnd(5)} ${kb.from}`);
-                console.log(`     落在 ${kb.local}  上次同步 ${kb._syncedAt || '从未'}${s ? '  ← **过期了,不许拿来回答**' : ''}`);
-            }
-            return;
-        }
-        if (sub === 'sync') {
-            const targets = (cfg.kb || []).filter((k) => !o.name || k.name === o.name);
-            if (!targets.length)
-                fail('没有这个知识库。 kb list');
-            for (const kb of targets) {
-                if (kb.sync === kbmod.NONE) {
-                    console.log(`  skip   ${kb.name}（sync=none）`);
-                    continue;
-                }
-                if (kb.sync === kbmod.PULL)
-                    kbmod.pull(kb, ROOT, o.force);
-                else
-                    kbmod.push(kb, ROOT, o.force);
-            }
-            cfgmod.save(ROOT, cfg);
-            return;
-        }
-        if (sub === 'search') {
-            const kw = argv[2];
-            if (!kw)
-                fail('要给关键词。 kb search "<关键词>"');
-            kbmod.search(cfg, ROOT, kw);
-            return;
-        }
-        fail('kb 的子命令: mount / list / sync / search');
+    if (/OpenCode/.test(message)) {
+        return '检查 OpenCode 版本、模型认证与项目 Skill/config；运行 dta workspace doctor <name> 查看精确缺口。';
     }
-    // ── boot ──
-    if (cmd === 'boot') {
-        boot(cfgmod.must(ROOT), ROOT);
-        return;
+    if (/Multica|multica/.test(message)) {
+        return '先运行 dta workspace plan <name> 和 doctor；确认 profile/ID 来源后，再用 inspect --execute --yes 做只读回读。';
     }
-    // ── duty ──
-    if (cmd === 'duty') {
-        const cfg = cfgmod.must(ROOT);
-        const { values: o } = parseArgs({
-            args: argv.slice(1), allowPositionals: true,
-            options: { check: { type: 'boolean' }, run: { type: 'string' },
-                list: { type: 'boolean' }, force: { type: 'boolean' } },
-        });
-        const duties = dutymod.loadDuties(cfg, ROOT);
-        if (o.list) {
-            const ks = Object.keys(duties);
-            console.log(ks.length ? ks.join('\n')
-                : '(值班表是空的 —— 母体出厂如此,这是【正确】的。在 .dingtalk-agent/config.json 的 duties 里加。)');
-            return;
-        }
-        if (o.run) {
-            const fn = duties[o.run];
-            if (!fn)
-                fail(`没有这个值班: ${o.run}（有: ${Object.keys(duties).join('、') || '无'}）`);
-            const s = fn();
-            if (s.kind === '交付' && !dutymod.inDeliver() && !o.force) {
-                return console.log(`⏸ 「${o.run}」是外发动作,静默时段顺延,**不打扰第三方**。`);
-            }
-            if (s.done)
-                return console.log(`✅ 「${o.run}」已完成,本拍无需执行。${s.detail}`);
-            console.log(`【${o.run}】该做了。${s.gap}`);
-            console.log(`  剧本: ${s.playbook || '(没写剧本 —— 这个值班不合格)'}`);
-            console.log(`  ⚠️ 送达【回读确认】之后才准记 pass。没送达就写 pass = 自己骗自己。`);
-            return;
-        }
-        // --check（默认）
-        console.log('值班表（**完成状态在数据里,不在记忆里**;幂等,漏拍下一拍自愈）');
-        console.log(`  现在 ${runsmod.now().slice(11, 16)} · ${dutymod.inNight() ? '夜间窗口(重活可跑)' : '白天(重活挂起)'} · 外发窗口${dutymod.inDeliver() ? '开' : '关'}`);
-        const ids = Object.keys(duties);
-        if (!ids.length) {
-            console.log('\n  (值班表是空的 —— 母体出厂如此。)');
-            return;
-        }
-        const todo = [];
-        for (const id of ids) {
-            const s = duties[id]();
-            const mark = s.done ? '✅ 已完成' : (s.due ? '⬜ 待补齐' : '⏸ 不在窗口');
-            console.log(`  ${s.id.padEnd(8)} [${s.kind}] ${mark}  ${s.detail}${s.gap ? '  → ' + s.gap : ''}`);
-            if (!s.done && s.due)
-                todo.push(s.id);
-        }
-        if (todo.length) {
-            console.log(`\n本拍要做: ${todo.map((t) => 'duty --run ' + t).join('、')}`);
-            process.exit(1);
-        }
-        console.log('\n全部补齐,静默即可（**不要为此打扰主人**）');
-        return;
+    if (/\bDWS\b|\bdws\b/.test(message)) {
+        return '运行 dta doctor 检查 DWS 路径、版本和认证；需要登录时执行 dws auth login。';
     }
-    // ── 留痕与进化 ──
-    if (cmd === 'log' || cmd === 'logq') {
-        const { values: o } = parseArgs({
-            args: argv.slice(1),
-            options: { did: { type: 'string' }, asked: { type: 'string' }, kind: { type: 'string' },
-                secs: { type: 'string' }, r: { type: 'string' }, ev: { type: 'string' },
-                ch: { type: 'string' }, issue: { type: 'string' },
-                conv: { type: 'string' }, msg: { type: 'string' } },
-        });
-        if (!o.did)
-            fail('要 --did（我怎么答的）');
-        const t = runsmod.logq(ROOT, {
-            ...o, did: o.did, secs: +(o.secs || 0), r: o.r || 'pass',
-        });
-        console.log(`运行记录已落: runs/${runsmod.today()}.md @${t}`);
-        if (!o.conv)
-            console.log('  ⚠️ 没带 --conv —— 事后【拉不出对话流】,这一条基本没有训练价值。');
-        return;
+    if (/dingtalk-agent\.json|Project 未声明|current-workspace|Development Workspace/.test(message)) {
+        return '在 Agent Project 内运行 dta info；用 dta workspace list/show/doctor 检查声明和漂移。';
     }
-    if (cmd === 'feedback') {
-        const { values: o } = parseArgs({
-            args: argv.slice(1),
-            options: { kind: { type: 'string' }, text: { type: 'string' },
-                conv: { type: 'string' }, at: { type: 'string' } },
-        });
-        if (!o.kind || ![runsmod.FB_OK, runsmod.FB_MORE, runsmod.FB_FIX].includes(o.kind)) {
-            fail('--kind 只能是 认可 / 追问 / 纠正');
-        }
-        const day = runsmod.today();
-        const rows = runsmod.read(ROOT, day);
-        let cand = rows.filter((r) => r.asked);
-        if (o.conv)
-            cand = cand.filter((r) => r.conv === o.conv);
-        if (!cand.length)
-            fail(`今天没有可回填的问答行 —— **是不是答完忘了 logq?**`);
-        const tgt = o.at ? cand.find((r) => r.t === o.at) : cand[cand.length - 1];
-        if (!tgt)
-            fail(`找不到 t=${o.at} 的行`);
-        tgt.fb = o.kind;
-        if (o.text)
-            tgt.fbt = o.text.slice(0, 600);
-        runsmod.write(ROOT, day, rows);
-        console.log(`已回填: ${day} @${tgt.t} → 「${o.kind}」（原问: ${(tgt.asked || '').slice(0, 40)}）`);
-        return;
+    if (/skills CLI|\bnpx\b/.test(message)) {
+        return '确认 node、npm、npx 在 PATH 中；也可以复制错误中的 npx skills 命令单独执行。';
     }
-    if (cmd === 'runs') {
-        const { values: o } = parseArgs({
-            args: argv.slice(1),
-            options: { days: { type: 'string' }, conv: { type: 'string' },
-                issue: { type: 'string' }, top: { type: 'string' } },
-        });
-        let rows = runsmod.scan(ROOT, +(o.days || 1));
-        if (o.conv) {
-            rows = rows.filter((r) => r.conv === o.conv);
-            console.log(`【对话流】会话 ${o.conv} · ${rows.length} 条 —— **这就是训练素材**`);
-            for (const r of rows) {
-                console.log(`  ── ${r._day} ${r.t}  issue=${r.issue || '-'}  msg=${r.msg || '-'}`);
-                if (r.asked)
-                    console.log(`     主人: ${r.asked}`);
-                console.log(`     我  : ${r.did}   [${r.r}]`);
-                if (r.fb)
-                    console.log(`     反馈: ${r.fb}${r.fbt ? `  「${r.fbt}」` : ''}`);
-            }
-            if (!rows.length)
-                console.log('  (空 —— 这个会话没留痕。**没留痕 = 这些交互等于没发生过。**)');
-            return;
-        }
-        if (o.issue) {
-            const issue = o.issue;
-            rows = rows.filter((r) => (r.issue || '').startsWith(issue));
-        }
-        console.log(`运行记录 runs/ · ${rows.length} 条`);
-        for (const r of rows.slice(-(+(o.top || 30)))) {
-            console.log(`  ${r._day} ${r.t} [${(r.r || '').padEnd(11)}] ${(r.ch || '').padEnd(6)} ${(r.did || '').slice(0, 30)} ${r.fb ? '← ' + r.fb : ''}`);
-        }
-        return;
+    if (/升级目标|CLI 升级|npm view|npm install/.test(message)) {
+        return '检查 npm registry 与网络后重试 dta upgrade；可先运行 dta upgrade --dry-run 查看目标和完整命令。';
     }
-    if (cmd === 'evolve') {
-        const { values: o } = parseArgs({ args: argv.slice(1), options: { days: { type: 'string' } } });
-        const rows = runsmod.scan(ROOT, +(o.days || 7));
-        const ans = rows.filter((r) => r.asked);
-        const bad = ans.filter((r) => [runsmod.FB_FIX, runsmod.FB_MORE].includes(r.fb || ''));
-        const unk = ans.filter((r) => !r.fb);
-        const failed = rows.filter((r) => ['fail', 'unsupported', 'degraded'].includes(r.r));
-        console.log(`【进化清单】近 ${o.days || 7} 天`);
-        console.log(`  面向主人的回答 ${ans.length} 条 · 被【打回】${bad.length} 条 · 引擎层没答出来 ${failed.length} 条`);
-        if (unk.length)
-            console.log(`  ⚠️ ${unk.length} 条【没收到反馈就结案了】—— 答完没回填,这次交互等于白跑。`);
-        if (bad.length) {
-            console.log('\n── 主人打回的（**直接就是这周该改什么**）──');
-            for (const r of bad) {
-                console.log(`  ${r._day} ${r.t} [${r.fb}]  会话=${r.conv || '-'}`);
-                console.log(`     主人问: ${(r.asked || '').slice(0, 60)}`);
-                console.log(`     我答  : ${(r.did || '').slice(0, 60)}`);
-                console.log(`     他说  : ${r.fbt || '(没记下来)'}`);
-                console.log(`     复盘  : dingtalk-agent runs --conv ${r.conv || '<会话id>'}`);
-            }
-        }
-        if (!bad.length && !failed.length) {
-            console.log('\n  (没有打回,也没有失败 —— 要么真的都对,要么【没人回填反馈】。看上面那行。)');
-        }
-        return;
+    if (/Workspace|Field|Storage|contextId/.test(message)) {
+        return '先运行 dta bootstrap --json 查看当前上下文；确实需要持久 Workspace 时再运行 dta init。';
     }
-    // ── todo：把待办拉全（心跳收件用）──
-    if (cmd === 'todo') {
-        const dws = await import('../src/dws.js');
-        const all = dws.todosAll('false');
-        console.log(`未完成待办 ${all.length} 条（**已翻页拉全** —— 只看第一页会漏掉循环件）`);
-        for (const t of all)
-            console.log(`  ${t.taskId}  ${(t.subject || '').slice(0, 60)}`);
-        return;
+    return '运行 dta doctor 检查环境；运行 dta --help 查看可用命令。';
+}
+function suggest(input, candidates, prefix = 'dta') {
+    if (!input)
+        return '';
+    const ranked = candidates
+        .map((candidate) => ({ candidate, distance: editDistance(input, candidate) }))
+        .sort((a, b) => a.distance - b.distance);
+    const best = ranked[0];
+    return best && best.distance <= Math.max(2, Math.floor(best.candidate.length / 3))
+        ? `；你是否想输入 ${prefix} ${best.candidate}？`
+        : '';
+}
+function editDistance(a, b) {
+    const row = Array.from({ length: b.length + 1 }, (_, index) => index);
+    for (let i = 1; i <= a.length; i += 1) {
+        let previous = row[0];
+        row[0] = i;
+        for (let j = 1; j <= b.length; j += 1) {
+            const before = row[j];
+            row[j] = Math.min(row[j] + 1, row[j - 1] + 1, previous + (a[i - 1] === b[j - 1] ? 0 : 1));
+            previous = before;
+        }
     }
-    fail(`不认识的命令: ${cmd}\n${HELP}`);
+    return row[b.length];
 }
 function printDispatch(out, json = false) {
     if (json)
@@ -714,20 +1317,75 @@ function printDispatch(out, json = false) {
     console.log(`   allowed=${out.allowedActions.join(', ')}  default=${out.defaultAction}`);
     console.log('   Local 模式可直接用 cwd/env；生产模式由宿主 Broker 保留 DWS 与 control 权限。');
 }
+function printLab(out) {
+    const passed = out.ready ?? out.passed ?? out.assertions?.passed;
+    console.log(`${passed === false ? '❌' : '✅'} ${out.$schema || 'dingtalk-agent/lab'}`);
+    if (out.mode)
+        console.log(`   mode=${out.mode}`);
+    if (out.marker)
+        console.log(`   marker=${out.marker}`);
+    if (out.evidencePath)
+        console.log(`   evidence=${out.evidencePath}`);
+    if (Array.isArray(out.checks)) {
+        for (const check of out.checks) {
+            console.log(`   ${check.passed ? 'PASS' : 'FAIL'} ${check.id}: ${check.detail}`);
+        }
+    }
+}
+function printAgentAudit(out) {
+    console.log(`dingtalk-agent agent audit · ${out.ready ? 'READY' : 'PARTIAL'}`);
+    console.log(`   definition=${out.definition.hash}  storage=${out.storageMode}`);
+    console.log(`   dingtalkSideEffect=${out.dingtalkSideEffect}  sideEffect=${out.sideEffect}`);
+    for (const check of out.checks) {
+        const mark = check.level === 'pass' ? 'PASS' : check.level === 'warn' ? 'WARN' : 'FAIL';
+        console.log(`   ${mark} ${check.id}: ${check.summary}`);
+    }
+    if (out.repairs.length) {
+        console.log('\n修复建议:');
+        for (const repair of out.repairs) {
+            console.log(`  ${repair.id}: ${repair.why}`);
+            for (const action of repair.actions)
+                console.log(`    - ${action}`);
+        }
+    }
+}
+function printAgentEnhance(out) {
+    if (out.$schema === 'dingtalk-agent/agent-enhancement-plan@1') {
+        console.log(`dingtalk-agent agent enhance · ${out.ready ? 'READY PLAN' : 'BLOCKED'}`);
+        console.log(`   planId=${out.planId}  project=${out.projectName}`);
+        console.log(`   sideEffect=${out.sideEffect}  dingtalkSideEffect=${out.dingtalkSideEffect}`);
+        for (const operation of out.operations) {
+            console.log(`   ${operation.kind.toUpperCase()} ${operation.path}: ${operation.reason}`);
+        }
+        if (out.semanticReview.required) {
+            console.log(`   REVIEW ${out.semanticReview.files.join(', ')}: ${out.semanticReview.why}`);
+        }
+        for (const blocker of out.blockers)
+            console.log(`   BLOCK ${blocker}`);
+        if (out.ready)
+            console.log(`\nApply:\n  ${out.apply.command}`);
+        return;
+    }
+    console.log('dingtalk-agent agent enhance · APPLIED');
+    console.log(`   operation=${out.operationId}  planId=${out.planId}`);
+    console.log(`   changes=${out.changes.length}  idempotent=${out.idempotent}`);
+    if (out.backupRoot)
+        console.log(`   backup=${out.backupRoot}`);
+    console.log(`   audit=${out.audit.status}  missing=${out.audit.missing.join(', ') || '-'}`);
+}
 function printSkillStatus(out, action, dryRun) {
     const prefix = dryRun ? 'DRY-RUN' : '✅';
     const verb = action === 'status' ? '全局 Skill 状态' : `skill ${action}`;
     console.log(`${prefix} ${verb}: ${out.name}`);
-    console.log(`   bundled=${out.bundled.skillVersion || '-'}  hash=${out.bundled.hash.slice(0, 12)}`);
+    console.log(`   manager=${out.manager}  bundled=${out.bundled.skillVersion || '-'}`);
     console.log(`   canonical=${out.canonical.path}`);
-    console.log(`   installed=${out.canonical.exists}  managed=${out.canonical.managed}  ` +
-        `modified=${out.canonical.modified}  current=${out.canonical.current}`);
+    console.log(`   installed=${out.canonical.exists}  installedVersion=${out.canonical.installedVersion || '-'}  ` +
+        `current=${out.canonical.current}`);
+    if (out.operation)
+        console.log(`   delegated: ${out.operation.command}`);
     for (const client of out.clients) {
         console.log(`   ${client.label}=${client.state} (${client.discovery}: ${client.path})`);
     }
-    if (out.legacyCodex.conflict) {
-        console.log(`   ⚠️ legacy Codex 同名路径存在: ${out.legacyCodex.path}`);
-    }
     if (action === 'install' && !dryRun) {
         console.log('   新 Agent 会话将自动发现；当前会话未发现时请重启 Claude Code/Codex。');
     }
@@ -748,9 +1406,156 @@ function printDoctor(out) {
             console.log(`  ${step}`);
     }
 }
+function printProjectInfo(out) {
+    console.log(`dingtalk-agent Project · ${out.project.name}`);
+    console.log(`   root=${out.root}`);
+    console.log(`   source=${out.source}  manifest=${out.manifest || '(synthetic legacy)'}`);
+    console.log(`   hash=${out.manifestHash}  dta=${out.project.dtaVersion}`);
+    console.log(`   current=${out.currentWorkspace || '(not selected)'}`);
+    for (const workspace of out.workspaces) {
+        console.log(`   ${workspace.current ? '*' : '-'} ${workspace.name} · ${workspace.provider.kind} · ${workspace.status}`);
+    }
+}
+function printWorkspaceList(out) {
+    console.log(`dingtalk-agent workspaces · ${out.project.name}`);
+    if (!out.workspaces.length)
+        console.log('   尚未声明 Development Workspace。');
+    for (const workspace of out.workspaces) {
+        console.log(`   ${workspace.current ? '*' : '-'} ${workspace.name}  provider=${workspace.provider.kind}  ` +
+            `stage=${workspace.stage}  status=${workspace.status}`);
+    }
+}
+function printDevelopmentWorkspace(out) {
+    console.log(`dingtalk-agent workspace · ${out.name}`);
+    console.log(`   provider=${out.provider.kind}  stage=${out.stage}  status=${out.status}`);
+    console.log(`   desired=${out.desiredHash}  observed=${out.observedHash || '-'}`);
+    console.log(`   current=${out.current}  legacy=${out.legacy}`);
+    for (const [slot, route] of Object.entries(out.storage))
+        console.log(`   ${slot}=${route}`);
+    for (const source of out.configSources)
+        console.log(`   source=${source}`);
+}
+function printDevelopmentWorkspaceDoctor(out) {
+    console.log(`dingtalk-agent workspace doctor · ${out.workspace} · ${out.ready ? 'READY' : 'PARTIAL'}`);
+    console.log(`   provider=${out.provider}  status=${out.status}`);
+    console.log(`   sideEffect=${out.sideEffect}  dingtalkSideEffect=${out.dingtalkSideEffect}`);
+    for (const check of out.checks) {
+        const mark = check.level === 'pass' ? 'PASS' : check.level === 'warn' ? 'WARN' : 'FAIL';
+        console.log(`   ${mark} ${check.id}: ${check.summary}`);
+        if (check.fix && check.level !== 'pass')
+            console.log(`      fix: ${check.fix}`);
+    }
+}
+function printOpenCodeWorkspaceOperation(out) {
+    const applied = out.$schema === 'dingtalk-agent/opencode-workspace-apply@1';
+    console.log(`${applied ? out.applied ? '✅' : '↩️' : 'DRY-RUN'} OpenCode Workspace ${out.workspace}`);
+    console.log(`   action=${out.action}  model=${out.model}`);
+    console.log(`   desired=${out.desiredHash}  observed=${out.observedHash || '-'}`);
+    console.log(`   managed=${out.managedPath}`);
+    if (!applied && out.writes?.length)
+        console.log(`   writes=${out.writes.join(', ')}`);
+}
+function printMulticaWorkspaceOperation(out) {
+    const passed = out.passed ?? out.readyForApply ?? out.blocking?.length === 0;
+    const mode = out.remoteRead ? 'REMOTE-READ' : 'DRY-RUN';
+    console.log(`${passed ? '✅' : '⚠️'} ${mode} Multica Workspace ${out.workspace}`);
+    console.log(`   schema=${out.$schema}  profile=${out.profile || '-'}`);
+    if (out.planId)
+        console.log(`   plan=${out.planId}`);
+    if (out.inspectionId)
+        console.log(`   inspection=${out.inspectionId}`);
+    if (out.desiredHash)
+        console.log(`   desired=${out.desiredHash}`);
+    if (out.observedHash)
+        console.log(`   observed=${out.observedHash}`);
+    if (out.diff?.length)
+        console.log(`   diff=${out.diff.join(', ')}`);
+    if (out.blocking?.length)
+        console.log(`   blocking=${out.blocking.join(', ')}`);
+    if (out.failures?.length)
+        console.log(`   failures=${out.failures.join(', ')}`);
+    if (out.evidencePath)
+        console.log(`   evidence=${out.evidencePath}`);
+    console.log(`   remoteWrite=${out.remoteWrite}  dingtalkSideEffect=${out.dingtalkSideEffect}`);
+}
+function printMulticaDeployment(out) {
+    console.log(`Multica deploy: ${out.workspace || '<unknown>'}`);
+    if (out.planId)
+        console.log(`  plan: ${out.planId}`);
+    if (out.operationId)
+        console.log(`  operation: ${out.operationId}`);
+    if (out.receiptId)
+        console.log(`  receipt: ${out.receiptId}`);
+    if (out.action)
+        console.log(`  action: ${out.action}`);
+    if (out.status)
+        console.log(`  status: ${out.status}`);
+    if (typeof out.providerReady === 'boolean')
+        console.log(`  provider ready: ${out.providerReady}`);
+    if (Array.isArray(out.blocking) && out.blocking.length) {
+        console.log(`  blocking: ${out.blocking.join(', ')}`);
+    }
+    if (Array.isArray(out.failures) && out.failures.length) {
+        console.log(`  failures: ${out.failures.join(', ')}`);
+    }
+    if (out.triggerWrite === false)
+        console.log('  triggers: unchanged');
+}
+function printPromotion(out) {
+    console.log(`Promotion: ${out.promotionId || out.candidateId || out.candidate?.candidateId || '<none>'}`);
+    if (out.planId)
+        console.log(`  plan: ${out.planId}`);
+    if (out.routeId)
+        console.log(`  route: ${out.routeId}`);
+    if (out.status)
+        console.log(`  status: ${out.status}`);
+    if (out.target?.observedHash)
+        console.log(`  observed: ${out.target.observedHash}`);
+    if (out.candidatePath)
+        console.log(`  candidate: ${out.candidatePath}`);
+    if (out.candidate?.evidencePath)
+        console.log(`  candidate: ${out.candidate.evidencePath}`);
+    if (Array.isArray(out.blocking) && out.blocking.length)
+        console.log(`  blocking: ${out.blocking.join(', ')}`);
+    if (out.triggerWrite === false)
+        console.log('  triggers: unchanged');
+}
+function parseOptionalTimeout(value, label) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 100 || parsed > 300_000) {
+        fail(`${label} 必须是 100..300000 的整数毫秒`);
+    }
+    return parsed;
+}
+function readProjectText(start, ref, label) {
+    const root = inspectAgentProject(start, PACKAGE_JSON.version).root;
+    const candidate = resolve(root, ref);
+    const lexical = relative(root, candidate);
+    if (lexical === '..' || lexical.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`)) {
+        throw new Error(`${label} 必须位于 Agent Project 内: ${ref}`);
+    }
+    if (!existsSync(candidate))
+        throw new Error(`${label} 不存在: ${ref}`);
+    const actual = realpathSync(candidate);
+    const resolved = relative(root, actual);
+    if (resolved === '..' || resolved.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`)) {
+        throw new Error(`${label} 真实路径越出 Agent Project: ${ref}`);
+    }
+    return readFileSync(actual, 'utf8');
+}
+function rejectWorkspaceOptions(values, allowed, command) {
+    const extras = Object.entries(values)
+        .filter(([key, value]) => !allowed.includes(key) && value !== undefined && value !== false)
+        .map(([key]) => `--${key}`);
+    if (extras.length)
+        fail(`${command} 不接受参数: ${extras.join(', ')}`);
+}
 function printSetup(out) {
     console.log(`${out.dryRun ? 'DRY-RUN' : '✅'} dingtalk-agent setup`);
     console.log(`   CLI: ${out.cli.executable}`);
+    console.log(`   短命令: ${out.cli.alias}`);
     console.log(`   Skill: ${out.skill.canonical.path}`);
     if (!out.shell.pathReady) {
         console.log(`   当前 shell 尚未加载 PATH；本次终端执行: ${out.shell.activateCommand}`);
@@ -760,4 +1565,21 @@ function printSetup(out) {
     printDoctor(out.doctor);
     console.log(`\n开始使用: ${out.nextCommand}`);
 }
+function printUpgrade(out) {
+    const mark = out.dryRun ? 'DRY-RUN' : out.ready ? '✅' : '⚠️';
+    const relation = out.changed ? `${out.currentVersion} → ${out.targetVersion}` : `${out.targetVersion}（已是当前版本）`;
+    console.log(`${mark} dta upgrade: ${relation}`);
+    console.log(`   target=${out.target}`);
+    console.log(`   CLI=${out.executable}`);
+    if (out.dryRun) {
+        console.log(`   将执行: ${out.commands.install}`);
+        console.log(`   将复核: ${out.commands.verify}`);
+    }
+    else if (out.ready) {
+        console.log('   setup / DWS / Skill / Claude Code / Codex / OpenCode 全部 ready');
+    }
+    else {
+        console.log(`   CLI 已更新；环境复核未完全 ready，请运行: ${out.commands.verify}`);
+    }
+}
 //# sourceMappingURL=dingtalk-agent.js.map