@xdxer/dingtalk-agent 0.1.4-beta.1 → 0.1.4-beta.11

package/dist/src/lab.js

@@ -0,0 +1,679 @@
+// 真实世界联调控制面：只管理测试授权、预算、marker、证据与清理。
+// 业务动作仍走 prepareSession + Action Gate + typed DWS，不在这里复制命令面。
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, writeFileSync, } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { basename, delimiter, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { normalizeEvent, digest, stableStringify } from './events.js';
+import { executeAction } from './actions.js';
+import { prepareSession, readJson } from './sessions.js';
+import { loadWorkspace } from './workspace.js';
+import * as dws from './dws.js';
+export function loadLabManifest(root, file) {
+    const path = safeInside(root, file, true);
+    let value;
+    try {
+        value = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`Lab manifest 不是合法 JSON: ${error.message}`);
+    }
+    return validateManifest(root, value);
+}
+export function doctorLab(root, file) {
+    const checks = [];
+    let manifest = null;
+    try {
+        manifest = loadLabManifest(root, file);
+        checks.push({ id: 'manifest', passed: true, detail: `${manifest.id}/${manifest.mode}` });
+    }
+    catch (error) {
+        checks.push({ id: 'manifest', passed: false, detail: String(error.message || error) });
+    }
+    if (manifest) {
+        checks.push({
+            id: 'synthetic-only', passed: manifest.syntheticOnly === true,
+            detail: 'Lab 只允许合成数据。',
+        });
+        checks.push({
+            id: 'single-egress', passed: expectedEgress(manifest.mode) === manifest.egressOwner,
+            detail: `${manifest.mode} → ${manifest.egressOwner}`,
+        });
+        checks.push({
+            id: 'budget', passed: manifest.budgets.maxOutwardActions === 1 &&
+                manifest.budgets.maxRuns > 0 && manifest.budgets.maxRuns <= 20,
+            detail: JSON.stringify(manifest.budgets),
+        });
+        checks.push({
+            id: 'evidence-root', passed: isInside(resolve(root), resolve(root, manifest.evidenceRoot)),
+            detail: resolve(root, manifest.evidenceRoot),
+        });
+        try {
+            assertWorkspaceBindings(root, manifest);
+            checks.push({ id: 'workspace-binding', passed: true, detail: manifest.resources.workspace || '.' });
+        }
+        catch (error) {
+            checks.push({ id: 'workspace-binding', passed: false, detail: String(error.message || error) });
+        }
+        if (manifest.mode === 'mock-integration') {
+            let fakeDetail = '';
+            try {
+                fakeDetail = assertFakeDws();
+            }
+            catch (error) {
+                fakeDetail = String(error.message || error);
+            }
+            checks.push({
+                id: 'fake-dws', passed: fakeDetail.startsWith('verified:'),
+                detail: fakeDetail,
+            });
+        }
+    }
+    return {
+        $schema: 'dingtalk-agent/lab-doctor@1',
+        ready: checks.every((item) => item.passed),
+        sideEffect: false,
+        manifest: manifest ? redactManifest(manifest) : null,
+        checks,
+    };
+}
+export function runLab(root, cfg, manifestFile, rawEvent, options) {
+    const manifest = loadLabManifest(root, manifestFile);
+    assertWorkspaceBindings(root, manifest);
+    assertRunAuthorization(manifest, options);
+    if (manifest.mode === 'robot-connect') {
+        if (rawEvent)
+            throw new Error('robot-connect Lab 不接受 event-file；由 connector 接收合成消息');
+        return runRobotLab(root, manifest, options);
+    }
+    if (!rawEvent)
+        throw new Error(`${manifest.mode} Lab 需要 --event-file`);
+    return runPreparedLab(root, cfg, manifest, rawEvent, options);
+}
+export function verifyLab(root, evidence) {
+    const evidencePath = safeInside(root, evidence, true);
+    let manifest = {};
+    try {
+        manifest = readJson(join(evidencePath, 'manifest.redacted.json'));
+    }
+    catch { /* required-file check below reports it */ }
+    const required = [
+        'manifest.redacted.json', 'event.json', 'invocation.json', 'enriched-invocation.json',
+        'action-intent.json', 'action-attempt.json', 'action-receipt.json',
+        'platform-readback.json', 'teardown.json',
+    ];
+    if (manifest.mode && manifest.mode !== 'robot-connect') {
+        required.push('identity.json', 'run.json', 'response-gate.json', 'resume.json', 'agent-definition.json', 'skill-manifest.json');
+    }
+    const checks = required.map((name) => ({
+        id: `file:${name}`,
+        passed: existsSync(join(evidencePath, name)),
+        detail: name,
+    }));
+    let marker = '';
+    let receipt = {};
+    let intent = {};
+    let readback = {};
+    let attempt = {};
+    try {
+        const event = readJson(join(evidencePath, 'event.json'));
+        intent = readJson(join(evidencePath, 'action-intent.json'));
+        attempt = readJson(join(evidencePath, 'action-attempt.json'));
+        receipt = readJson(join(evidencePath, 'action-receipt.json'));
+        readback = readJson(join(evidencePath, 'platform-readback.json'));
+        marker = extractMarker(String(event.message?.text || intent.payload?.text || ''));
+    }
+    catch (error) {
+        checks.push({ id: 'parse', passed: false, detail: String(error.message || error) });
+    }
+    const actionKind = String(intent.kind || '');
+    const silence = actionKind === 'silence';
+    checks.push({
+        id: 'marker', passed: Boolean(marker && (silence || stableStringify(intent).includes(marker))),
+        detail: marker || 'missing',
+    });
+    checks.push({
+        id: 'receipt', passed: receipt.outcome === 'confirmed' && receipt.verified === true,
+        detail: `${receipt.outcome || 'missing'}/${String(receipt.verified)}`,
+    });
+    const markerCount = countTextOccurrences(readback, marker);
+    const platformPassed = silence
+        ? readback.sideEffect === false && attempt.transportStarted === false && markerCount === 0
+        : manifest.mode === 'robot-connect'
+            ? hasQueryableReadback(readback) && markerCount >= 1
+            : hasQueryableReadback(readback) && markerCount === 1;
+    checks.push({
+        id: 'platform-readback', passed: platformPassed,
+        detail: `kind=${actionKind || manifest.mode || 'unknown'} markerCount=${markerCount}; ${JSON.stringify(readback).slice(0, 240)}`,
+    });
+    const report = {
+        $schema: 'dingtalk-agent/lab-assertions@1',
+        passed: checks.every((item) => item.passed),
+        engine: receipt.verified === true ? 'pass' : 'fail',
+        platform: hasQueryableReadback(readback) ? 'visible' : 'unverified',
+        userFeedback: 'not-collected',
+        marker,
+        markerCount,
+        action: actionKind || null,
+        checks,
+        verifiedAt: new Date().toISOString(),
+    };
+    writeJson(join(evidencePath, 'assertions.json'), report);
+    return report;
+}
+export function teardownLab(root, manifestFile, evidence, options = {}) {
+    const manifest = loadLabManifest(root, manifestFile);
+    const evidencePath = safeInside(root, evidence, true);
+    let external = null;
+    if (manifest.mode === 'robot-connect') {
+        assertLiveConfirmation(options);
+        const robot = manifest.resources.robot;
+        const stop = dws.run([
+            'dev', 'connect', 'stop', '--robot-client-id', robot.robotClientId,
+            '--yes', ...profileArgs(manifest.dws.profile),
+        ], { allowFail: true, retries: 0 });
+        const status = dws.run([
+            'dev', 'connect', 'status', '--robot-client-id', robot.robotClientId,
+            '--json', ...profileArgs(manifest.dws.profile),
+        ], { allowFail: true, retries: 0 });
+        external = { stop, status };
+    }
+    const checks = [];
+    if (manifest.mode === 'robot-connect') {
+        checks.push({
+            id: 'connector-released',
+            passed: stableStringify(external).includes('not_running') ||
+                stableStringify(external).includes('stopped'),
+            detail: stableStringify(external),
+        });
+    }
+    else {
+        checks.push({
+            id: 'no-lab-owned-connector', passed: external === null,
+            detail: 'personal-event/mock Lab does not create or retain a connector',
+        });
+        try {
+            const intent = readJson(join(evidencePath, 'action-intent.json'));
+            const attempt = readJson(join(evidencePath, 'action-attempt.json'));
+            const receipt = readJson(join(evidencePath, 'action-receipt.json'));
+            checks.push({
+                id: 'terminal-receipt',
+                passed: receipt.outcome === 'confirmed' && receipt.verified === true &&
+                    receipt.actionId === intent.id &&
+                    (intent.kind === 'silence' || Boolean(attempt.startedAt)),
+                detail: `${intent.kind || 'missing'}/${receipt.outcome || 'missing'}/${String(receipt.verified)}`,
+            });
+        }
+        catch (error) {
+            checks.push({ id: 'terminal-receipt', passed: false, detail: String(error.message || error) });
+        }
+    }
+    const passed = checks.every((item) => item.passed);
+    const report = {
+        $schema: 'dingtalk-agent/lab-teardown@1',
+        status: passed ? 'complete' : 'incomplete',
+        passed,
+        mode: manifest.mode,
+        external,
+        checks,
+        completedAt: new Date().toISOString(),
+        note: manifest.mode === 'personal-event'
+            ? '消息不自动删除；本次 teardown 只确认没有 Lab 持有的 connector。'
+            : 'Lab 控制面已清理。',
+    };
+    writeJson(join(evidencePath, 'teardown.json'), report);
+    return report;
+}
+function runPreparedLab(root, cfg, manifest, originalEvent, options) {
+    assertRunBudget(root, manifest);
+    const caseId = safeCase(options.caseId);
+    const generatedMarker = options.markerOverride ||
+        `${manifest.markerPrefix}${caseId}-${randomUUID()}]`;
+    if (!generatedMarker.startsWith(`${manifest.markerPrefix}${caseId}-`) ||
+        !/^\[DTA-LAB-[^\]\r\n]+\]$/u.test(generatedMarker)) {
+        throw new Error(`Lab marker 必须绑定当前 case: ${caseId}`);
+    }
+    const rawEvent = manifest.mode === 'mock-integration'
+        ? addMarkerAndUniqueIds(originalEvent, generatedMarker)
+        : originalEvent;
+    const event = normalizeEvent(rawEvent);
+    const marker = manifest.mode === 'mock-integration'
+        ? generatedMarker : extractMarker(event.message.text);
+    if (!marker || !marker.startsWith(`${manifest.markerPrefix}${caseId}-`)) {
+        throw new Error(`Live 入站消息必须包含 ${manifest.markerPrefix}<case>-<uuid>] marker`);
+    }
+    assertAllowedEvent(manifest, event);
+    const prepareOptions = { perception: options.perception };
+    if (!options.useEventCorrelation) {
+        prepareOptions.sessionKey = `lab:${caseId}:${digest(marker).slice(0, 12)}`;
+    }
+    const dispatch = prepareSession(root, cfg, rawEvent, prepareOptions);
+    const action = options.action || 'reply';
+    const actionText = `${marker} ${String(options.replyText ||
+        (action === 'ask' ? '请补充一个阻塞信息。' : 'Lab canary reply')).trim()}`;
+    if (action !== 'silence' && actionText.length > manifest.budgets.maxTextCharacters) {
+        throw new Error(`Lab 回复超过预算 ${manifest.budgets.maxTextCharacters}`);
+    }
+    const evidencePath = evidencePathFor(root, manifest, dispatch.runId);
+    mkdirSync(evidencePath, { recursive: true });
+    writeEvidenceCommon(evidencePath, manifest, event, readJson(join(dispatch.cwd, 'context', 'invocation.json')), readJson(join(dispatch.cwd, 'context', 'enriched-invocation.json')));
+    copyPreparedContextEvidence(dispatch.cwd, evidencePath);
+    writeJson(join(evidencePath, 'teardown.json'), {
+        $schema: 'dingtalk-agent/lab-teardown@1', status: 'pending', mode: manifest.mode,
+    });
+    let receipt;
+    try {
+        receipt = executeAction(dispatch.cwd, action, action === 'silence'
+            ? { reason: options.silenceReason || 'unmentioned' }
+            : { text: actionText });
+    }
+    catch (error) {
+        const failure = error;
+        if (failure.receipt?.actionId) {
+            const failedActionRoot = resolve(root, cfg.runtime.eventIndexRoot, 'actions', dispatch.runId, failure.receipt.actionId);
+            if (existsSync(failedActionRoot)) {
+                copyActionEvidence(failedActionRoot, evidencePath, failure.receipt, action);
+            }
+        }
+        writeJson(join(evidencePath, 'failure.json'), {
+            $schema: 'dingtalk-agent/lab-failure@1',
+            stage: 'action', action, runId: dispatch.runId,
+            error: String(failure.message || error), occurredAt: new Date().toISOString(),
+        });
+        failure.evidencePath = evidencePath;
+        throw failure;
+    }
+    try {
+        const actionRoot = findActionRoot(root, cfg, dispatch.runId, receipt.actionId);
+        copyActionEvidence(actionRoot, evidencePath, receipt, action);
+        const assertions = verifyLab(root, evidencePath);
+        return {
+            $schema: 'dingtalk-agent/lab-run@1',
+            mode: manifest.mode,
+            marker,
+            action,
+            evidencePath,
+            dispatch,
+            receipt,
+            assertions,
+        };
+    }
+    catch (error) {
+        const failure = error;
+        writeJson(join(evidencePath, 'failure.json'), {
+            $schema: 'dingtalk-agent/lab-failure@1',
+            stage: 'evidence-collection', action, runId: dispatch.runId,
+            error: String(failure.message || error), occurredAt: new Date().toISOString(),
+        });
+        failure.evidencePath = evidencePath;
+        throw failure;
+    }
+}
+function copyPreparedContextEvidence(runPath, evidencePath) {
+    copyJson(join(runPath, 'run.json'), join(evidencePath, 'run.json'));
+    copyJson(join(runPath, 'context', 'response-gate.json'), join(evidencePath, 'response-gate.json'));
+    copyJson(join(runPath, 'context', 'resume.json'), join(evidencePath, 'resume.json'));
+    copyJson(join(runPath, 'context', 'agent-definition', 'definition.json'), join(evidencePath, 'agent-definition.json'));
+    copyJson(join(runPath, 'context', 'skills', 'manifest.json'), join(evidencePath, 'skill-manifest.json'));
+}
+function copyActionEvidence(actionRoot, evidencePath, receipt, action) {
+    copyJson(join(actionRoot, 'intent.json'), join(evidencePath, 'action-intent.json'));
+    const attemptPath = join(actionRoot, 'attempt.json');
+    if (existsSync(attemptPath))
+        copyJson(attemptPath, join(evidencePath, 'action-attempt.json'));
+    else
+        writeJson(join(evidencePath, 'action-attempt.json'), {
+            $schema: 'dingtalk-agent/action-attempt@1', actionId: receipt.actionId,
+            transportStarted: false, reason: 'local-no-side-effect',
+        });
+    const identityPath = join(actionRoot, 'identity.json');
+    if (existsSync(identityPath))
+        copyJson(identityPath, join(evidencePath, 'identity.json'));
+    else
+        writeJson(join(evidencePath, 'identity.json'), {
+            $schema: 'dingtalk-agent/action-identity@1', required: false,
+            reason: 'local-no-side-effect',
+        });
+    writeJson(join(evidencePath, 'action-receipt.json'), receipt);
+    const transportResultPath = join(actionRoot, 'transport-result.json');
+    if (existsSync(transportResultPath)) {
+        copyJson(transportResultPath, join(evidencePath, 'transport-result.json'));
+    }
+    const verificationPath = join(actionRoot, 'verification.json');
+    writeJson(join(evidencePath, 'platform-readback.json'), action === 'silence'
+        ? { status: 'confirmed', sideEffect: false, verification: 'local-no-side-effect' }
+        : existsSync(verificationPath)
+            ? readJson(verificationPath)
+            : { status: 'unverified', receipt });
+}
+function runRobotLab(root, manifest, options) {
+    assertRunBudget(root, manifest);
+    const robot = manifest.resources.robot;
+    const marker = `${manifest.markerPrefix}${safeCase(options.caseId)}-${randomUUID()}]`;
+    const input = `${marker} ${String(options.inputText || '7 + 5 等于多少？请直接回答。').trim()}`;
+    const runId = `robot_${digest(marker).slice(0, 20)}`;
+    const evidencePath = evidencePathFor(root, manifest, runId);
+    mkdirSync(evidencePath, { recursive: true });
+    let start = null;
+    let send = null;
+    let readback = null;
+    let stopped = null;
+    try {
+        start = dws.run([
+            'dev', 'connect', '--unified-app-id', robot.unifiedAppId,
+            '--channel', robot.channel, '--agent-workdir', resolve(root, manifest.resources.workspace),
+            '--allowed-users', robot.allowedUserId, '--agent-permission-mode', 'ask',
+            '--agent-approval-mode', 'ask', '--agent-memory=false', '--reply-card=false',
+            '--user-rate-limit', '5', '--agent-timeout', '120', '--daemon',
+            ...profileArgs(manifest.dws.profile),
+        ], { retries: 0 });
+        send = dws.run([
+            'chat', 'message', 'send', '--open-dingtalk-id', robot.botOpenDingTalkId,
+            '--text', input, '--uuid', randomUUID(), '--yes', ...profileArgs(manifest.dws.profile),
+        ], { retries: 0 });
+        readback = dws.run([
+            'chat', 'message', 'list', '--open-dingtalk-id', robot.botOpenDingTalkId,
+            '--direction', 'newer', '--limit', '20', ...profileArgs(manifest.dws.profile),
+        ], { retries: 1 });
+    }
+    finally {
+        stopped = dws.run([
+            'dev', 'connect', 'stop', '--robot-client-id', robot.robotClientId,
+            '--yes', ...profileArgs(manifest.dws.profile),
+        ], { allowFail: true, retries: 0 });
+    }
+    const visible = stableStringify(readback).includes(marker);
+    const event = {
+        $schema: 'dingtalk-agent/event@1', id: runId, kind: 'robot.synthetic',
+        message: { text: input },
+    };
+    writeEvidenceCommon(evidencePath, manifest, event, {
+        $schema: 'dingtalk-agent/invocation@1', mode: 'direct', authority: 'host',
+        eventId: runId, sessionKey: runId, occurredAt: null,
+        actor: null, target: null, conversation: null,
+    });
+    writeJson(join(evidencePath, 'action-intent.json'), {
+        $schema: 'dingtalk-agent/lab-connector-intent@1', kind: 'robot-smoke', marker, input,
+    });
+    writeJson(join(evidencePath, 'action-attempt.json'), { started: true, start, send });
+    writeJson(join(evidencePath, 'action-receipt.json'), {
+        $schema: 'dingtalk-agent/lab-connector-receipt@1', kind: 'robot-smoke',
+        outcome: visible ? 'confirmed' : 'uncertain', verified: visible,
+        verification: 'chat-message-list',
+    });
+    writeJson(join(evidencePath, 'platform-readback.json'), readback || {});
+    writeJson(join(evidencePath, 'teardown.json'), {
+        $schema: 'dingtalk-agent/lab-teardown@1', status: 'complete', stopped,
+        completedAt: new Date().toISOString(),
+    });
+    const assertions = verifyLab(root, evidencePath);
+    return { $schema: 'dingtalk-agent/lab-run@1', mode: manifest.mode,
+        marker, evidencePath, assertions };
+}
+function writeEvidenceCommon(evidencePath, manifest, event, invocation, enrichedInvocation = null) {
+    writeJson(join(evidencePath, 'manifest.redacted.json'), redactManifest(manifest));
+    writeJson(join(evidencePath, 'event.json'), event);
+    writeJson(join(evidencePath, 'invocation.json'), invocation);
+    writeJson(join(evidencePath, 'enriched-invocation.json'), enrichedInvocation || {
+        $schema: 'dingtalk-agent/enriched-invocation@1',
+        status: 'base-only',
+        note: 'Phase 2 只记录基础 Invocation；Perception Enricher 在 Phase 3 接入。',
+    });
+}
+function validateManifest(root, value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Lab manifest 必须是 JSON object');
+    }
+    const input = value;
+    if (input.$schema !== 'dingtalk-agent/lab-manifest@1') {
+        throw new Error('Lab manifest schema 必须是 dingtalk-agent/lab-manifest@1');
+    }
+    if (!['mock-integration', 'robot-connect', 'personal-event'].includes(input.mode)) {
+        throw new Error(`Lab mode 非法: ${input.mode || '(missing)'}`);
+    }
+    if (input.syntheticOnly !== true)
+        throw new Error('Lab 必须声明 syntheticOnly=true');
+    if (input.egressOwner !== expectedEgress(input.mode)) {
+        throw new Error(`${input.mode} 的唯一出口必须是 ${expectedEgress(input.mode)}`);
+    }
+    if (!String(input.id || '').trim())
+        throw new Error('Lab manifest 缺少 id');
+    if (!String(input.markerPrefix || '').startsWith('[DTA-LAB-')) {
+        throw new Error('markerPrefix 必须以 [DTA-LAB- 开头');
+    }
+    if (!input.allowlist || !input.budgets || !input.resources || !input.dws) {
+        throw new Error('Lab manifest 缺少 allowlist / budgets / resources / dws');
+    }
+    for (const key of ['tenantIds', 'conversationIds', 'actorIds', 'resourceIds']) {
+        if (!Array.isArray(input.allowlist[key]) ||
+            input.allowlist[key].some((item) => typeof item !== 'string')) {
+            throw new Error(`Lab allowlist.${key} 必须是 string[]`);
+        }
+    }
+    if (input.mode !== 'robot-connect' &&
+        (!input.allowlist.tenantIds.length || !input.allowlist.conversationIds.length ||
+            !input.allowlist.actorIds.length)) {
+        throw new Error('Prepared Lab 必须显式 allowlist tenant / conversation / actor');
+    }
+    const budget = input.budgets;
+    if (!Number.isInteger(budget.maxRuns) || budget.maxRuns < 1 || budget.maxRuns > 20 ||
+        budget.maxOutwardActions !== 1 || !Number.isInteger(budget.maxTextCharacters) ||
+        budget.maxTextCharacters < 1 || budget.maxTextCharacters > 4000) {
+        throw new Error('Lab budgets 必须满足 maxRuns=1..20、maxOutwardActions=1、maxTextCharacters=1..4000');
+    }
+    if (!String(input.evidenceRoot || '').trim())
+        throw new Error('Lab 缺少 evidenceRoot');
+    safeInside(root, input.evidenceRoot, false);
+    if (!String(input.resources.workspace || '').trim())
+        throw new Error('Lab 缺少 resources.workspace');
+    safeInside(root, input.resources.workspace, true);
+    if (input.mode === 'robot-connect') {
+        const robot = input.resources.robot || {};
+        for (const key of ['unifiedAppId', 'robotClientId', 'botOpenDingTalkId', 'allowedUserId', 'channel']) {
+            if (!String(robot[key] || '').trim())
+                throw new Error(`robot-connect 缺少 resources.robot.${key}`);
+        }
+        const resources = input.allowlist.resourceIds;
+        if (![robot.unifiedAppId, robot.robotClientId, robot.botOpenDingTalkId]
+            .every((id) => resources.includes(id)) ||
+            !input.allowlist.actorIds.includes(robot.allowedUserId)) {
+            throw new Error('robot-connect 的 app/robot/bot 必须进入 resourceIds，allowed user 必须进入 actorIds');
+        }
+    }
+    else if (!String(input.dws.profile || '').trim() || !String(input.dws.expectedUserId || '').trim()) {
+        throw new Error('Prepared Lab 必须固定 dws.profile 与 expectedUserId');
+    }
+    return input;
+}
+function assertWorkspaceBindings(root, manifest) {
+    const workspaceRoot = safeInside(root, manifest.resources.workspace, true);
+    if (manifest.mode === 'robot-connect')
+        return;
+    const workspace = loadWorkspace(workspaceRoot);
+    if (workspace.dws.profile !== manifest.dws.profile ||
+        workspace.dws.expectedUserId !== manifest.dws.expectedUserId) {
+        throw new Error('Lab manifest 的 DWS 身份与 Workspace Definition 不一致');
+    }
+    const fieldPath = join(workspaceRoot, 'fields', 'default', 'field.json');
+    const field = readJson(fieldPath);
+    if (field.transport?.egressOwner !== manifest.egressOwner ||
+        field.transport?.mode !== (manifest.mode === 'mock-integration' ? 'personal-event' : manifest.mode)) {
+        throw new Error('Lab manifest 的 mode/egressOwner 与 Field 不一致');
+    }
+}
+function assertRunAuthorization(manifest, options) {
+    if (!String(options.caseId || '').trim())
+        throw new Error('lab run 需要 --case-id');
+    if (manifest.mode === 'mock-integration') {
+        assertFakeDws();
+        if (options.live)
+            throw new Error('mock-integration 不接受 --live');
+        return;
+    }
+    assertLiveConfirmation(options);
+}
+function assertFakeDws() {
+    if (process.env.DTA_LAB_FAKE_DWS !== '1') {
+        throw new Error('mock-integration 必须设置 DTA_LAB_FAKE_DWS=1');
+    }
+    const declared = String(process.env.DTA_LAB_FAKE_DWS_PATH || '').trim();
+    if (!declared || !isAbsolute(declared)) {
+        throw new Error('mock-integration 必须设置存在的绝对 DTA_LAB_FAKE_DWS_PATH');
+    }
+    if (!existsSync(declared))
+        throw new Error(`DTA_LAB_FAKE_DWS_PATH 不存在: ${declared}`);
+    const actual = findExecutable('dws');
+    if (!actual || realpathSync(actual) !== realpathSync(declared)) {
+        throw new Error(`PATH 中的 dws 与 DTA_LAB_FAKE_DWS_PATH 不一致: ${actual || 'missing'}`);
+    }
+    const marker = `${realpathSync(declared)}.dta-fake`;
+    if (!existsSync(marker) || readFileSync(marker, 'utf8').trim() !== 'dingtalk-agent/fake-dws@1') {
+        throw new Error('fake DWS 缺少同路径 .dta-fake 身份标记');
+    }
+    return `verified:${realpathSync(declared)}`;
+}
+function findExecutable(name) {
+    for (const directory of String(process.env.PATH || '').split(delimiter)) {
+        if (!directory)
+            continue;
+        const candidate = join(directory, name);
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return '';
+}
+function assertLiveConfirmation(options) {
+    if (!options.live || !options.yes) {
+        throw new Error('Live Lab 会产生真实钉钉副作用；必须同时显式传入 --live --yes');
+    }
+}
+function assertAllowedEvent(manifest, event) {
+    const actorIds = [event.actor.id, event.actor.userId, event.actor.openDingTalkId].filter(Boolean);
+    if (!manifest.allowlist.tenantIds.includes(event.tenant.id)) {
+        throw new Error(`Lab tenant 不在 allowlist: ${event.tenant.id}`);
+    }
+    if (!manifest.allowlist.conversationIds.includes(event.conversation.id)) {
+        throw new Error(`Lab conversation 不在 allowlist: ${event.conversation.id}`);
+    }
+    if (!actorIds.some((id) => manifest.allowlist.actorIds.includes(id))) {
+        throw new Error(`Lab actor 不在 allowlist: ${actorIds.join('/')}`);
+    }
+}
+function addMarkerAndUniqueIds(raw, marker) {
+    const copy = JSON.parse(JSON.stringify(raw));
+    if (copy.$schema === 'dingtalk-agent/event@1') {
+        copy.id = `${String(copy.id || 'mock')}-${digest(marker).slice(0, 10)}`;
+        copy.message = { ...(copy.message || {}),
+            id: `${String(copy.message?.id || 'message')}-${digest(marker).slice(0, 10)}`,
+            text: `${marker} ${String(copy.message?.text || '')}`.trim() };
+        return copy;
+    }
+    if (typeof copy.data !== 'string')
+        throw new Error('mock event 缺少可注入 marker 的 data JSON');
+    const data = JSON.parse(copy.data);
+    const suffix = digest(marker).slice(0, 10);
+    data.event_id = `${String(data.event_id || 'mock')}-${suffix}`;
+    data.message_id = `${String(data.message_id || 'message')}-${suffix}`;
+    data.content = `${marker} ${String(data.content || '')}`.trim();
+    copy.data = JSON.stringify(data);
+    return copy;
+}
+function findActionRoot(root, cfg, runId, actionId) {
+    const path = resolve(root, cfg.runtime.eventIndexRoot, 'actions', runId, actionId);
+    if (!existsSync(path))
+        throw new Error(`Lab 找不到 Action journal: ${actionId}`);
+    return path;
+}
+function assertRunBudget(root, manifest) {
+    const evidenceRoot = safeInside(root, manifest.evidenceRoot, false);
+    if (!existsSync(evidenceRoot))
+        return;
+    const used = readdirSync(evidenceRoot, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory()).length;
+    if (used >= manifest.budgets.maxRuns) {
+        throw new Error(`Lab Run 预算已用完: ${used}/${manifest.budgets.maxRuns}；先 verify/teardown 并换新 Lab id`);
+    }
+}
+function evidencePathFor(root, manifest, runId) {
+    const evidenceRoot = safeInside(root, manifest.evidenceRoot, false);
+    return join(evidenceRoot, safeCase(runId));
+}
+function redactManifest(manifest) {
+    const redact = (value) => value
+        ? `<redacted:${digest(value).slice(0, 10)}>` : '';
+    return {
+        ...manifest,
+        dws: {
+            profile: redact(manifest.dws.profile),
+            expectedUserId: redact(manifest.dws.expectedUserId),
+        },
+        allowlist: Object.fromEntries(Object.entries(manifest.allowlist)
+            .map(([key, values]) => [key, values.map(redact)])),
+        resources: {
+            workspace: manifest.resources.workspace,
+            robot: manifest.resources.robot
+                ? Object.fromEntries(Object.entries(manifest.resources.robot)
+                    .map(([key, value]) => [key === 'channel' ? key : key, key === 'channel' ? value : redact(value)]))
+                : undefined,
+        },
+    };
+}
+function copyJson(from, to) {
+    if (!existsSync(from))
+        throw new Error(`Lab evidence 缺少 ${basename(from)}`);
+    writeJson(to, readJson(from));
+}
+function writeJson(path, value) {
+    mkdirSync(dirname(path), { recursive: true });
+    const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(temp, JSON.stringify(value, null, 2) + '\n', { flag: 'wx' });
+    renameSync(temp, path);
+}
+function extractMarker(text) {
+    return text.match(/\[DTA-LAB-[^\]\r\n]{1,180}\]/)?.[0] || '';
+}
+function hasQueryableReadback(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const text = stableStringify(value);
+    return /openMessageId|openMsgId|open_message_id|messages|records/.test(text);
+}
+function countTextOccurrences(value, needle) {
+    if (!needle || value === null || value === undefined)
+        return 0;
+    if (typeof value === 'string')
+        return value.split(needle).length - 1;
+    if (Array.isArray(value)) {
+        return value.reduce((sum, item) => sum + countTextOccurrences(item, needle), 0);
+    }
+    if (typeof value === 'object') {
+        let total = 0;
+        for (const item of Object.values(value)) {
+            total += countTextOccurrences(item, needle);
+        }
+        return total;
+    }
+    return 0;
+}
+function expectedEgress(mode) {
+    return mode === 'robot-connect' ? 'connector' : 'dingtalk-agent';
+}
+function safeInside(root, path, mustExist) {
+    const rootPath = existsSync(root) ? realpathSync(resolve(root)) : resolve(root);
+    const target = resolve(rootPath, path);
+    if (!isInside(rootPath, target))
+        throw new Error(`Lab 路径必须位于 Workspace 内: ${path}`);
+    if (mustExist && !existsSync(target))
+        throw new Error(`Lab 路径不存在: ${path}`);
+    return mustExist ? realpathSync(target) : target;
+}
+function isInside(root, path) {
+    const rel = relative(root, path);
+    return rel !== '..' && !rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`);
+}
+function safeCase(value) {
+    return String(value || '').replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'case';
+}
+function profileArgs(profile) {
+    return profile ? ['--profile', profile] : [];
+}
+//# sourceMappingURL=lab.js.map