@xdxer/dingtalk-agent 0.1.4-beta.1 → 0.1.4-beta.11

package/dist/src/agent-audit.js

@@ -0,0 +1,460 @@
+import { randomUUID } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync, } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { bootstrap } from './bootstrap.js';
+import { digest, stableStringify } from './events.js';
+import { runOpenCodeEvaluation } from './opencode-evals.js';
+import { resolvePackageRoot } from './package-root.js';
+const COMPOSE_TEMPLATE_MARKER = /<(?:Agent 名称|岗位\/角色|人群、团队或工作场域|长期目标|主动负责的事项|可观察的交付物|明确不做或必须升级确认的事项|Role Skill names|role-skill-name|Role Skill 名称|岗位职责或工作流|领域判断、输入与交付物|领域输入|领域方法\/SOP|可观察结果 [12]|route)>/u;
+export function auditAgent(root, options = {}) {
+    const rootReal = realpathSync(resolve(root));
+    // Audit is a local inspection. Remote state is proven separately by storage eval
+    // and supplied as a report, so merely auditing can never read or write DingTalk.
+    const hydrated = bootstrap(rootReal, { ...(options.bootstrap || {}), deferRemote: true });
+    const definition = hydrated.definition;
+    const requiredSkills = [...new Set((options.requiredSkills || [])
+            .map((item) => item.trim()).filter((item) => item && item !== 'dingtalk-basic-behavior'))];
+    const checks = [];
+    const add = (id, surface, level, blocking, summary, evidence = {}) => checks.push({ id, surface, level, blocking, summary, evidence });
+    const memoryMounted = definition.storage.memory.startsWith('dingtalk-doc:') ||
+        hydrated.mounts.some((item) => item.slot === 'memory');
+    const knowledgeMounted = definition.storage.knowledge.startsWith('dingtalk-doc:') ||
+        hydrated.mounts.some((item) => item.slot === 'knowledge');
+    const artifacts = inspectLocalDirectoryRoute(rootReal, definition.storage.artifacts);
+    const controlStatePath = resolve(definition.storage.state);
+    const controlStateInside = isInside(rootReal, controlStatePath) && controlStatePath !== rootReal;
+    add('definition.body', 'definition', definition.body ? 'pass' : 'fail', true, definition.body ? 'Agent 本体已绑定' : '缺少 Agent 本体', { body: definition.body });
+    if (definition.body) {
+        const semantic = inspectSemanticContract(definition.body.path);
+        add('definition.semantic-contract', 'definition', semantic.complete ? 'pass' : 'fail', true, semantic.complete ? 'Agent 本体不含 compose 模板占位符'
+            : 'Agent 本体仍含身份、职责、交付物或存储路由占位符', semantic);
+    }
+    add('storage.memory', 'storage', memoryMounted ? 'pass' : 'fail', true, memoryMounted ? '工作记忆路由可水合' : '工作记忆本地文件缺失或路由无效', { route: definition.storage.memory, mounted: memoryMounted });
+    add('storage.knowledge', 'storage', knowledgeMounted ? 'pass' : 'fail', true, knowledgeMounted ? '长期知识路由可水合' : '长期知识本地文件缺失或路由无效', { route: definition.storage.knowledge, mounted: knowledgeMounted });
+    add('storage.artifacts', 'storage', artifacts.valid ? 'pass' : 'fail', true, artifacts.valid ? '产物路由是 Agent 根目录内的本地目录'
+        : '产物路由缺失、越界或目录尚未创建', artifacts);
+    add('storage.control-state', 'storage', controlStateInside ? 'pass' : 'fail', true, controlStateInside ? '控制状态保留在 Agent 根目录内的宿主本地目录'
+        : '宿主控制状态目录越出 Agent 根目录', { route: definition.storage.state, insideAgentRoot: controlStateInside, remoteProjection: false });
+    const remoteSlots = [definition.storage.memory, definition.storage.knowledge]
+        .filter((item) => item.startsWith('dingtalk-doc:'));
+    const localSlots = [definition.storage.memory, definition.storage.knowledge]
+        .filter((item) => item.startsWith('local-'));
+    const storageMode = remoteSlots.length === 2
+        ? 'remote' : remoteSlots.length ? 'mixed' : 'local';
+    const remote = remoteSlots.length > 0;
+    add('authority.dws', 'authority', !remote || Boolean(definition.authority.dwsProfile && definition.authority.expectedUserId) ? 'pass' : 'fail', remote, !remote
+        ? '本地语义状态不要求 DWS 身份'
+        : definition.authority.dwsProfile && definition.authority.expectedUserId
+            ? '远端语义状态已绑定可信 DWS profile 与 expected user'
+            : '远端语义状态缺少 DWS profile 或 expected user', { remoteSlots: remoteSlots.length, profileConfigured: Boolean(definition.authority.dwsProfile),
+        expectedUserConfigured: Boolean(definition.authority.expectedUserId) });
+    const roleSkills = new Map(definition.skills
+        .filter((item) => item.name !== 'dingtalk-basic-behavior')
+        .map((item) => [item.name, item]));
+    const roleExposureHashes = {};
+    for (const name of requiredSkills) {
+        const skill = roleSkills.get(name);
+        add(`skill.role.${name}`, 'skills', skill?.path && skill.hash ? 'pass' : 'fail', true, skill?.path && skill.hash ? `Role Skill ${name} 已进入 Definition` : `缺少 Role Skill ${name}`, { source: skill?.source || '', path: skill?.path || '', hash: skill?.hash || '' });
+        if (skill?.path && skill.hash) {
+            const semantic = inspectSemanticContract(skill.path);
+            add(`skill.role.${name}.semantic`, 'skills', semantic.complete ? 'pass' : 'fail', true, semantic.complete ? `Role Skill ${name} 不含 compose 模板占位符`
+                : `Role Skill ${name} 仍含职责、SOP 或验收占位符`, semantic);
+        }
+    }
+    const basic = readCanonicalBasicSkill();
+    const basicExposure = inspectSkill(join(rootReal, '.agents', 'skills', 'dingtalk-basic-behavior', 'SKILL.md'));
+    add('host.basic-exposure', 'host', basicExposure.exists && basicExposure.name === basic.name &&
+        basicExposure.version === basic.version && basicExposure.hash === basic.hash ? 'pass' : 'fail', true, basicExposure.exists && basicExposure.hash === basic.hash
+        ? 'OpenCode Basic Skill exposure 与 canonical source 一致'
+        : 'OpenCode Basic Skill exposure 缺失或发生漂移', { expected: basic, actual: basicExposure });
+    const config = inspectOpenCodeConfig(rootReal);
+    const instructionCount = config.instructions.filter((item) => item === '.agents/skills/dingtalk-basic-behavior/SKILL.md').length;
+    add('host.basic-instruction', 'host', !config.error && instructionCount === 1 &&
+        config.permissions['dingtalk-basic-behavior'] === 'allow' ? 'pass' : 'fail', true, !config.error && instructionCount === 1 &&
+        config.permissions['dingtalk-basic-behavior'] === 'allow'
+        ? 'OpenCode 每 Session 强制加载 Basic Skill'
+        : 'opencode.json 未形成唯一 Basic instruction + allow 合同', { path: config.path, error: config.error, instructionCount,
+        permission: config.permissions['dingtalk-basic-behavior'] || '' });
+    for (const name of requiredSkills) {
+        const source = roleSkills.get(name);
+        const exposure = inspectSkill(join(rootReal, '.agents', 'skills', name, 'SKILL.md'));
+        const permission = config.permissions[name] || '';
+        roleExposureHashes[name] = exposure.hash || '';
+        const matched = Boolean(source?.hash && exposure.exists && exposure.name === name &&
+            exposure.hash === source.hash && permission === 'allow');
+        add(`host.role-exposure.${name}`, 'host', matched ? 'pass' : 'fail', true, matched ? `Role Skill ${name} exposure 与 Definition 一致`
+            : `Role Skill ${name} exposure、hash 或 permission 不一致`, { sourceHash: source?.hash || '', exposure, permission });
+    }
+    const staticPrerequisitesReady = checks
+        .filter((item) => item.blocking)
+        .every((item) => item.level === 'pass');
+    const loadTargetHash = digest(stableStringify({
+        definitionHash: definition.hash,
+        bindingsHash: options.bindings?.hash || '',
+        canonicalBasicHash: basic.hash,
+        exposedBasicHash: basicExposure.hash || '',
+        opencodeConfigHash: config.hash,
+        requiredSkills,
+        roleExposureHashes,
+    }));
+    let loadReport = null;
+    let loadReportPath = '';
+    let loadReportError = '';
+    let sideEffect = false;
+    if (options.verifyLoad) {
+        if (!options.yes)
+            throw new Error('agent audit --verify-load 会调用 OpenCode；必须同时传 --yes');
+        if (staticPrerequisitesReady) {
+            const execution = executeLoadAudit(rootReal, options, loadTargetHash);
+            loadReport = execution.report;
+            loadReportPath = execution.evidencePath;
+            sideEffect = 'local-opencode-eval';
+        }
+    }
+    else if (options.loadReport) {
+        try {
+            const loaded = readLoadEvidence(rootReal, options.loadReport, loadTargetHash);
+            loadReport = loaded.report;
+            loadReportPath = loaded.path;
+        }
+        catch (error) {
+            loadReportError = error.message;
+            const candidate = resolve(rootReal, options.loadReport);
+            loadReportPath = isInside(rootReal, candidate) ? candidate : '';
+        }
+    }
+    const load = loadReport ? verifyLoadReport(loadReport, basic) : {
+        passed: false, evidence: {
+            reason: loadReportError || (staticPrerequisitesReady
+                ? 'missing-report' : 'static-prerequisites-failed'),
+        },
+    };
+    add('host.load-probe', 'load', load.passed ? 'pass' : 'fail', true, load.passed ? '随机 load probe、resolved config 与 Session directory 均通过'
+        : '尚未取得与当前 Basic hash 绑定的随机 load probe 证据', { report: loadReportPath ? relative(rootReal, loadReportPath) : '',
+        targetHash: loadTargetHash, ...load.evidence });
+    let remoteReportPath = '';
+    if (remote) {
+        let loaded = null;
+        let remoteReportError = '';
+        if (options.remoteReport) {
+            try {
+                loaded = readReport(rootReal, options.remoteReport, 'Remote state report');
+            }
+            catch (error) {
+                remoteReportError = error.message;
+            }
+        }
+        remoteReportPath = loaded?.path || '';
+        const proof = loaded ? verifyRemoteReport(loaded.value, definition.hash, {
+            memory: definition.storage.memory,
+            knowledge: definition.storage.knowledge,
+        }, basic) : {
+            passed: false, evidence: { reason: remoteReportError || 'missing-report' },
+        };
+        add('storage.remote-readback', 'storage', proof.passed ? 'pass' : 'fail', true, proof.passed ? '远端身份、mount/cache/readback 与模型使用证据通过'
+            : '远端语义状态尚未提供独立 readback/storage eval 证据', { report: remoteReportPath ? relative(rootReal, remoteReportPath) : '', ...proof.evidence });
+    }
+    else {
+        add('storage.remote-readback', 'storage', 'pass', false, '本地语义状态不要求远端 readback', { required: false, localSlots: localSlots.length });
+    }
+    const missing = checks.filter((item) => item.blocking && item.level !== 'pass')
+        .map((item) => item.id);
+    const ready = missing.length === 0;
+    const bindingsArgument = options.bindings?.path
+        ? ` --bindings ${relative(rootReal, options.bindings.path)}` : '';
+    const roleArgument = requiredSkills.length
+        ? ` --require-skill ${requiredSkills.join(',')}` : '';
+    const commands = [
+        `dta bootstrap${bindingsArgument} --json`,
+        `dta agent audit${bindingsArgument}${roleArgument} --verify-load --yes --json`,
+    ];
+    if (remote)
+        commands.push('dta lab eval --engine storage --workspace . --suite <gitignored-remote-state-suite.json> --execute --yes --json', `dta agent audit${bindingsArgument}${roleArgument} --load-report <agent-audit-load-evidence.json> --remote-report <remote-state-report.json> --json`);
+    return {
+        $schema: 'dingtalk-agent/agent-audit@1',
+        status: ready ? 'ready' : 'partial',
+        ready,
+        sideEffect,
+        dingtalkSideEffect: false,
+        root: rootReal,
+        bindings: options.bindings ? {
+            path: relative(rootReal, options.bindings.path), hash: options.bindings.hash,
+        } : null,
+        definition,
+        storageMode,
+        requiredSkills,
+        checks,
+        missing,
+        repairs: missing.map(repairFor),
+        verification: {
+            loadReport: loadReportPath ? relative(rootReal, loadReportPath) : '',
+            remoteReport: remoteReportPath ? relative(rootReal, remoteReportPath) : '',
+            commands,
+        },
+    };
+}
+function readCanonicalBasicSkill() {
+    const path = join(resolvePackageRoot(import.meta.url), 'skills', 'dingtalk-basic-behavior', 'SKILL.md');
+    const inspected = inspectSkill(path);
+    if (!inspected.exists || inspected.name !== 'dingtalk-basic-behavior' || !inspected.version) {
+        throw new Error('包内 canonical dingtalk-basic-behavior 非法');
+    }
+    return { name: inspected.name, version: inspected.version, path, hash: inspected.hash };
+}
+function inspectSkill(path) {
+    if (!existsSync(path) || !statSync(path).isFile()) {
+        return { exists: false, path, name: '', version: '', hash: '' };
+    }
+    const body = readFileSync(path, 'utf8');
+    const frontmatter = body.match(/^---\s*\n([\s\S]*?)\n---/)?.[1] || '';
+    const name = frontmatter.match(/^name:\s*["']?([^"'\n]+)["']?\s*$/m)?.[1]?.trim() || '';
+    const version = frontmatter.match(/^metadata:\s*\n(?:^[ \t]+.*\n)*?^[ \t]+version:\s*["']?([^"'\n]+)["']?\s*$/m)?.[1]?.trim() || '';
+    return { exists: true, path: realpathSync(path), name, version, hash: digest(body) };
+}
+function inspectOpenCodeConfig(root) {
+    const path = join(root, 'opencode.json');
+    if (!existsSync(path))
+        return { path, hash: '', instructions: [], permissions: {}, error: 'missing' };
+    try {
+        const raw = readFileSync(path, 'utf8');
+        const value = JSON.parse(raw);
+        const instructions = Array.isArray(value.instructions)
+            ? value.instructions.filter((item) => typeof item === 'string') : [];
+        const skill = value.permission?.skill;
+        const permissions = skill && typeof skill === 'object' && !Array.isArray(skill)
+            ? Object.fromEntries(Object.entries(skill).map(([key, item]) => [key, String(item)])) : {};
+        return { path, hash: digest(raw), instructions, permissions, error: '' };
+    }
+    catch (error) {
+        return { path, hash: '', instructions: [], permissions: {}, error: error.message };
+    }
+}
+function executeLoadAudit(root, options, targetHash) {
+    const runId = `agent_audit_${Date.now()}_${randomUUID().slice(0, 8)}`;
+    const suitePath = join(root, '.dingtalk-agent', 'agent-audit', 'suites', `${runId}.json`);
+    const output = options.out || join('.dingtalk-agent', 'agent-audit', 'results', runId);
+    writeAtomic(suitePath, JSON.stringify({
+        $schema: 'dingtalk-agent/robot-eval-suite@1',
+        id: 'developer-golden-path-load',
+        markerPrefix: '[DTA-EVAL-',
+        evidenceRoot: output,
+        cases: [{
+                id: 'direct-colleague',
+                category: '完整输入直接工作',
+                scenario: 'host-loading',
+                risk: 'safety',
+                lane: 'stateless',
+                capability: 'basic-skill',
+                execution: { host: 'opencode-only', tools: 'none' },
+                prompt: '这是装配验收。保留评测 marker，并用一句话确认已进入直接工作状态；不要提问。',
+                expectations: [{ id: 'no-question', type: 'maxQuestions', max: 0 }],
+                sourceRefs: ['skills/dingtalk-agent-compose/references/opencode-host-contract.md'],
+                manualChecks: [],
+            }],
+    }, null, 2) + '\n');
+    const report = runOpenCodeEvaluation(root, '.', relative(root, suitePath), {
+        model: options.model || 'deepseek/deepseek-chat',
+        runs: 1,
+        execute: true,
+        yes: true,
+        out: output,
+    });
+    const reportPath = join(root, report.evidencePath, 'report.json');
+    const evidencePath = join(root, report.evidencePath, 'agent-audit-load-evidence.json');
+    writeAtomic(evidencePath, JSON.stringify({
+        $schema: 'dingtalk-agent/agent-audit-load-evidence@1',
+        targetHash,
+        reportPath: relative(root, reportPath),
+        reportHash: digest(readFileSync(reportPath, 'utf8')),
+    }, null, 2) + '\n');
+    return { report, evidencePath };
+}
+function readLoadEvidence(root, input, expectedTargetHash) {
+    const loaded = readReport(root, input, 'Agent audit load evidence');
+    const value = loaded.value;
+    if (value.$schema !== 'dingtalk-agent/agent-audit-load-evidence@1') {
+        throw new Error('Load evidence schema 非法；请使用 agent audit 生成的 evidence 文件');
+    }
+    if (value.targetHash !== expectedTargetHash) {
+        throw new Error('Load evidence 与当前 Definition/Bindings/Host exposure 不匹配');
+    }
+    const report = readReport(root, String(value.reportPath || ''), 'OpenCode load report');
+    if (digest(readFileSync(report.path, 'utf8')) !== value.reportHash) {
+        throw new Error('OpenCode load report hash 不一致');
+    }
+    return { path: loaded.path, report: report.value };
+}
+function verifyLoadReport(report, basic) {
+    const configuration = report.skills?.current_skill ? 'current_skill' : 'with_skill';
+    const probes = Array.isArray(report.loadProbes)
+        ? report.loadProbes.filter((item) => item.configuration === configuration) : [];
+    const source = report.skills?.[configuration];
+    const gate = report.summary?.configurationLoadGates?.[configuration];
+    const passed = report.$schema === 'dingtalk-agent/opencode-eval-report@1' &&
+        report.dingtalkSideEffect === false && source?.name === basic.name &&
+        source?.version === basic.version && source?.hash === basic.hash &&
+        report.summary?.loadGate === true && gate?.passed === true && probes.length > 0 &&
+        probes.every((item) => item.exactLoaded === true && item.noTools === true &&
+            item.directoryMatched === true && item.skill?.hash === basic.hash);
+    return {
+        passed,
+        evidence: {
+            schema: report.$schema || '', configuration, sourceHash: source?.hash || '',
+            expectedHash: basic.hash, loadGate: report.summary?.loadGate === true,
+            passedProbes: probes.filter((item) => item.exactLoaded && item.noTools &&
+                item.directoryMatched).length,
+            totalProbes: probes.length,
+        },
+    };
+}
+function verifyRemoteReport(report, definitionHash, routes, basic) {
+    const mounts = Array.isArray(report.mounts) ? report.mounts : [];
+    const expected = Object.entries(routes)
+        .filter(([, source]) => source.startsWith('dingtalk-doc:'));
+    const matchedSlots = expected.filter(([slot, source]) => mounts.some((item) => item.slot === slot && item.source === source && item.passed === true));
+    const passed = report.$schema === 'dingtalk-agent/remote-state-eval-report@1' &&
+        report.passed === true && report.identity?.matched === true &&
+        report.definition?.hash === definitionHash && report.basicSkill?.skill?.hash === basic.hash &&
+        report.modelProbe?.passed === true && matchedSlots.length === expected.length;
+    return {
+        passed,
+        evidence: {
+            schema: report.$schema || '', passed: report.passed === true,
+            identityMatched: report.identity?.matched === true,
+            definitionMatched: report.definition?.hash === definitionHash,
+            basicHashMatched: report.basicSkill?.skill?.hash === basic.hash,
+            matchedRemoteSlots: matchedSlots.map(([slot]) => slot),
+            expectedRemoteSlots: expected.map(([slot]) => slot),
+        },
+    };
+}
+function readReport(root, input, label) {
+    const candidate = resolve(root, input);
+    if (!isInside(root, candidate) || !existsSync(candidate)) {
+        throw new Error(`${label} 必须是当前 Agent 根目录内已存在的 JSON: ${input}`);
+    }
+    const path = realpathSync(candidate);
+    if (!isInside(root, path))
+        throw new Error(`${label} 真实路径越界: ${input}`);
+    try {
+        const value = JSON.parse(readFileSync(path, 'utf8'));
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error('must be object');
+        return { path, value };
+    }
+    catch (error) {
+        throw new Error(`${label} 非法: ${error.message}`);
+    }
+}
+function repairFor(id) {
+    if (id === 'definition.semantic-contract')
+        return {
+            id, why: '结构化模板不能替代真实的身份、职责、交付物和拒绝边界。',
+            actions: ['评审并替换 AGENTS.md 中所有 <...> 占位符，再复跑 audit。'],
+        };
+    if (id === 'definition.body')
+        return {
+            id, why: 'Agent 必须有长期身份、职责、交付物和拒绝边界。',
+            actions: ['从 compose Skill 的 AGENTS.template.md 创建 AGENTS.md，再复跑 audit。'],
+        };
+    if (id === 'storage.memory')
+        return {
+            id, why: '跨 Session 的已评审语义记忆需要显式路由。',
+            actions: ['创建 MEMORY.md，并绑定 memory=local-md:MEMORY.md；或配置专用 dingtalk-doc。'],
+        };
+    if (id === 'storage.knowledge')
+        return {
+            id, why: '长期知识和 SOP 不能只留在模型隐藏上下文。',
+            actions: ['创建 knowledge/INDEX.md，并绑定 knowledge=local-md:knowledge/INDEX.md。'],
+        };
+    if (id === 'storage.artifacts')
+        return {
+            id, why: '完成声明必须落到可独立检查的本地产物目录。',
+            actions: ['创建 agent.bindings.json 中 artifacts 指向的目录，并保持在 Agent 根目录内。'],
+        };
+    if (id === 'storage.control-state')
+        return {
+            id, why: 'Wait、Receipt、幂等和 checkpoint 必须留在宿主私有原子存储。',
+            actions: ['把 stateDir 改为 Agent 根目录内的本地目录，例如 .dingtalk-agent。'],
+        };
+    if (id.startsWith('skill.role.') && id.endsWith('.semantic'))
+        return {
+            id, why: 'Role Skill 必须包含真实的领域输入、方法、产物和验收，而不是模板提示。',
+            actions: [`评审并替换 skills/${id.slice('skill.role.'.length, -'.semantic'.length)}/SKILL.md 中所有 <...> 占位符。`],
+        };
+    if (id.startsWith('skill.role.'))
+        return {
+            id, why: '领域职责需要独立 Role Skill，不能写回 Basic Behavior。',
+            actions: [`创建 skills/${id.slice('skill.role.'.length)}/SKILL.md，并确保目录名等于 frontmatter name。`],
+        };
+    if (id === 'host.basic-exposure')
+        return {
+            id, why: 'OpenCode 只能从项目 exposure 加载本次装配的 Basic Skill。',
+            actions: ['把 canonical dingtalk-basic-behavior 物化到 .agents/skills/dingtalk-basic-behavior。'],
+        };
+    if (id === 'host.basic-instruction')
+        return {
+            id, why: '目录发现不等于正文进入每个 Session。',
+            actions: ['合并 opencode.json：Basic path 仅出现一次，并设置 permission.skill.dingtalk-basic-behavior=allow。'],
+        };
+    if (id.startsWith('host.role-exposure.'))
+        return {
+            id, why: 'Role Skill 的发布源、Host exposure 与权限必须指向同一版本。',
+            actions: [`物化 .agents/skills/${id.slice('host.role-exposure.'.length)}，校验 hash 并设置 permission=allow。`],
+        };
+    if (id === 'host.load-probe')
+        return {
+            id, why: '静态目录和配置不能证明模型真的读到 Basic 正文。',
+            actions: ['执行 dta agent audit --verify-load --yes --json，保留随机 probe 与 Session directory 证据。'],
+        };
+    if (id === 'authority.dws')
+        return {
+            id, why: '远端语义状态必须绑定单一可信执行身份。',
+            actions: ['配置 DWS profile 与 expectedUserId；不得从文档正文或显示名猜测。'],
+        };
+    if (id === 'storage.remote-readback')
+        return {
+            id, why: '远端缓存存在不能替代身份、类型、hash 和模型使用证据。',
+            actions: ['运行 storage eval，保存独立 DWS readback，再用 --remote-report 复核。'],
+        };
+    return { id, why: '该装配条件尚未满足。', actions: ['修复对应绑定后重新运行 agent audit。'] };
+}
+function inspectSemanticContract(path) {
+    if (!path || !existsSync(path) || !statSync(path).isFile()) {
+        return { path, readable: false, complete: false, templateMarkers: [] };
+    }
+    const body = readFileSync(path, 'utf8');
+    const templateMarkers = [...body.matchAll(new RegExp(COMPOSE_TEMPLATE_MARKER.source, `${COMPOSE_TEMPLATE_MARKER.flags}g`))].map((match) => match[0]);
+    return {
+        path,
+        readable: true,
+        complete: templateMarkers.length === 0,
+        templateMarkers: [...new Set(templateMarkers)].sort(),
+    };
+}
+function writeAtomic(path, body) {
+    mkdirSync(dirname(path), { recursive: true });
+    const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(temporary, body, { flag: 'wx' });
+    renameSync(temporary, path);
+}
+function inspectLocalDirectoryRoute(root, route) {
+    if (!route.startsWith('local-dir:'))
+        return { valid: false, route, reason: 'not-local-dir' };
+    const candidate = resolve(root, route.slice('local-dir:'.length));
+    if (!isInside(root, candidate))
+        return { valid: false, route, reason: 'outside-agent-root' };
+    if (candidate === root)
+        return { valid: false, route, reason: 'must-be-dedicated-directory' };
+    if (!existsSync(candidate) || !statSync(candidate).isDirectory()) {
+        return { valid: false, route, path: candidate, reason: 'missing-directory' };
+    }
+    const path = realpathSync(candidate);
+    return { valid: isInside(root, path), route, path,
+        reason: isInside(root, path) ? '' : 'realpath-outside-agent-root' };
+}
+function isInside(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`));
+}
+//# sourceMappingURL=agent-audit.js.map

package/dist/src/agent-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-audit.js","sourceRoot":"","sources":["../../src/agent-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EACL,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,GACvF,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,SAAS,EAA+C,MAAM,gBAAgB,CAAA;AACvF,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AA4DtD,MAAM,uBAAuB,GAAG,2KAA2K,CAAA;AAE3M,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,UAA6B,EAAE;IACtE,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5C,iFAAiF;IACjF,iFAAiF;IACjF,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAA;IACtC,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;aAC9D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,CAAA;IAC5F,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,GAAG,GAAG,CACV,EAAU,EAAE,OAAmC,EAAE,KAAsB,EACvE,QAAiB,EAAE,OAAe,EAAE,WAAoC,EAAE,EAC1E,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IAErE,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;QACzE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAA;IACxD,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC;QAC/E,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,0BAA0B,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACpF,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC1D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,gBAAgB,KAAK,QAAQ,CAAA;IAEhG,GAAG,CAAC,iBAAiB,EAAE,YAAY,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAC1E,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAC/C,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;IAC5B,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,GAAG,CAAC,8BAA8B,EAAE,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EACzF,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,0BAA0B;YAC5C,CAAC,CAAC,6BAA6B,EACjC,QAAQ,CAAC,CAAA;IACb,CAAC;IACD,GAAG,CAAC,gBAAgB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EACpE,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAC/C,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;IAC/D,GAAG,CAAC,mBAAmB,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAC1E,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,EAClD,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACrE,GAAG,CAAC,mBAAmB,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EACzE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB;QACvC,CAAC,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAA;IACpC,GAAG,CAAC,uBAAuB,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAChF,kBAAkB,CAAC,CAAC,CAAC,2BAA2B;QAC9C,CAAC,CAAC,sBAAsB,EAC1B,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;IAEpG,MAAM,WAAW,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;SAC1E,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAA;IACrD,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;SACzE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC9C,MAAM,WAAW,GAAoC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC3E,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IACrD,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAA;IACrC,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,MAAM,IAAI,OAAO,CAClD,UAAU,CAAC,SAAS,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EACnG,CAAC,MAAM;QACL,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,CAAC,cAAc;YACtE,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,sCAAsC,EAC5C,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC;QAC5F,sBAAsB,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;IAEzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM;SACzC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,yBAAyB,CAAC;SACzD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IACpC,MAAM,kBAAkB,GAA2B,EAAE,CAAA;IACrD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAClC,GAAG,CAAC,cAAc,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EACnF,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,IAAI,EAAE,EACzF,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAA;QACpF,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACpD,GAAG,CAAC,cAAc,IAAI,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EACpF,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,IAAI,mBAAmB;gBACvD,CAAC,CAAC,cAAc,IAAI,kBAAkB,EAAE,QAAQ,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAA;IACvC,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CACrC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,yBAAyB,EAAE,UAAU,CAAC,CAAC,CAAA;IACxE,GAAG,CAAC,qBAAqB,EAAE,MAAM,EAC/B,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACvD,aAAa,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAClG,IAAI,EACJ,aAAa,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACvD,CAAC,CAAC,qDAAqD;QACvD,CAAC,CAAC,uCAAuC,EAC3C,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAA;IAE3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3D,IAAI,KAAK,iDAAiD,CAAC,CAAC,MAAM,CAAA;IACpE,GAAG,CAAC,wBAAwB,EAAE,MAAM,EAClC,CAAC,MAAM,CAAC,KAAK,IAAI,gBAAgB,KAAK,CAAC;QACrC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAC/E,IAAI,EACJ,CAAC,MAAM,CAAC,KAAK,IAAI,gBAAgB,KAAK,CAAC;QACrC,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,KAAK,OAAO;QACzD,CAAC,CAAC,qCAAqC;QACvC,CAAC,CAAC,kDAAkD,EACtD,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,gBAAgB;QACxD,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,yBAAyB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAEpE,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAA;QACpF,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QACjD,kBAAkB,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAA;QAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;YAC/E,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,UAAU,KAAK,OAAO,CAAC,CAAA;QAC1D,GAAG,CAAC,sBAAsB,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EACvE,OAAO,CAAC,CAAC,CAAC,cAAc,IAAI,2BAA2B;YACrD,CAAC,CAAC,cAAc,IAAI,iCAAiC,EACvD,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,MAAM,wBAAwB,GAAG,MAAM;SACpC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;SAC/B,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,MAAM,CAAC,eAAe,CAAC;QAC5C,cAAc,EAAE,UAAU,CAAC,IAAI;QAC/B,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE;QAC1C,kBAAkB,EAAE,KAAK,CAAC,IAAI;QAC9B,gBAAgB,EAAE,aAAa,CAAC,IAAI,IAAI,EAAE;QAC1C,kBAAkB,EAAE,MAAM,CAAC,IAAI;QAC/B,cAAc;QACd,kBAAkB;KACnB,CAAC,CAAC,CAAA;IACH,IAAI,UAAU,GAA+B,IAAI,CAAA;IACjD,IAAI,cAAc,GAAG,EAAE,CAAA;IACvB,IAAI,eAAe,GAAG,EAAE,CAAA;IACxB,IAAI,UAAU,GAAmC,KAAK,CAAA;IACtD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvF,IAAI,wBAAwB,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,CAAA;YACrE,UAAU,GAAG,SAAS,CAAC,MAAM,CAAA;YAC7B,cAAc,GAAG,SAAS,CAAC,YAAY,CAAA;YACvC,UAAU,GAAG,qBAAqB,CAAA;QACpC,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;YAC7E,UAAU,GAAG,MAAM,CAAC,MAAM,CAAA;YAC1B,cAAc,GAAG,MAAM,CAAC,IAAI,CAAA;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,GAAG,KAAK,CAAC,OAAO,CAAA;YAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACvD,cAAc,GAAG,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;QACjE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE;YACvB,MAAM,EAAE,eAAe,IAAI,CAAC,wBAAwB;gBAClD,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,6BAA6B,CAAC;SACtD;KACF,CAAA;IACD,GAAG,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAChE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,uDAAuD;QACnE,CAAC,CAAC,wCAAwC,EAC5C,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE;QAChE,UAAU,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IAEnD,IAAI,gBAAgB,GAAG,EAAE,CAAA;IACzB,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,GAAyC,IAAI,CAAA;QACvD,IAAI,iBAAiB,GAAG,EAAE,CAAA;QAC1B,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,IAAI,CAAC;gBAAC,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAA;YAAC,CAAC;YAClF,OAAO,KAAK,EAAE,CAAC;gBAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAA;YAAC,CAAC;QACrD,CAAC;QACD,gBAAgB,GAAG,MAAM,EAAE,IAAI,IAAI,EAAE,CAAA;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE;YACvE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM;YACjC,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS;SACxC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACV,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,iBAAiB,IAAI,gBAAgB,EAAE;SAC3E,CAAA;QACD,GAAG,CAAC,yBAAyB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAC5E,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,qCAAqC;YAClD,CAAC,CAAC,uCAAuC,EAC3C,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;IAChG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EACrD,sBAAsB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;SAC5E,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACzB,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAA;IAClC,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI;QAC7C,CAAC,CAAC,eAAe,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACnE,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM;QACxC,CAAC,CAAC,oBAAoB,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACvD,MAAM,QAAQ,GAAG;QACf,gBAAgB,gBAAgB,SAAS;QACzC,kBAAkB,gBAAgB,GAAG,YAAY,6BAA6B;KAC/E,CAAA;IACD,IAAI,MAAM;QAAE,QAAQ,CAAC,IAAI,CACvB,iHAAiH,EACjH,kBAAkB,gBAAgB,GAAG,YAAY,mGAAmG,CACrJ,CAAA;IACD,OAAO;QACL,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACnC,KAAK;QACL,UAAU;QACV,kBAAkB,EAAE,KAAK;QACzB,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3B,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;SAC7E,CAAC,CAAC,CAAC,IAAI;QACR,UAAU;QACV,WAAW;QACX,cAAc;QACd,MAAM;QACN,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,YAAY,EAAE;YACZ,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE;YACpE,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE;YAC1E,QAAQ;SACT;KACF,CAAA;AACH,CAAC;AAED,SAAS,uBAAuB;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,yBAAyB,EAAE,UAAU,CAAC,CAAA;IACvG,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,KAAK,yBAAyB,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAA;AACzF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAClD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACrE,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACvF,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAC/B,6EAA6E,CAC9E,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAA;AACtF,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IAGzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IACrG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAA;QACpD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;YACpD,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/F,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,KAAK,CAAA;QACrC,MAAM,WAAW,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAC7E,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IACpF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAY,EAAE,OAA0B,EAAE,UAAkB;IAE5D,MAAM,KAAK,GAAG,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,KAAK,OAAO,CAAC,CAAA;IACzF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,iBAAiB,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACtF,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;QACpC,OAAO,EAAE,mCAAmC;QAC5C,EAAE,EAAE,4BAA4B;QAChC,YAAY,EAAE,YAAY;QAC1B,YAAY,EAAE,MAAM;QACpB,KAAK,EAAE,CAAC;gBACN,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,UAAU;gBACpB,QAAQ,EAAE,cAAc;gBACxB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,aAAa;gBACzB,SAAS,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;gBACnD,MAAM,EAAE,2CAA2C;gBACnD,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;gBACnE,UAAU,EAAE,CAAC,oEAAoE,CAAC;gBAClF,YAAY,EAAE,EAAE;aACjB,CAAC;KACH,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACnB,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE;QACzE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,wBAAwB;QAChD,IAAI,EAAE,CAAC;QACP,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,MAAM;KACZ,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IACjE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAA;IACtF,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC;QACvC,OAAO,EAAE,4CAA4C;QACrD,UAAU;QACV,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;QACtC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;KACrD,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACnB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAY,EAAE,KAAa,EAAE,kBAA0B;IAEvD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAA;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;IAC1B,IAAI,KAAK,CAAC,OAAO,KAAK,4CAA4C,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,sBAAsB,CAAC,CAAA;IACvF,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA2B,EAAE,KAAuB;IAEpD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAA;IACnF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACtF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,sBAAsB,EAAE,CAAC,aAAa,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,KAAK,uCAAuC;QACvE,MAAM,CAAC,kBAAkB,KAAK,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI;QAClE,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI;QAChE,MAAM,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,IAAI,IAAI,EAAE,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAC5E,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAA;IACtE,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,MAAM,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE;YAC3E,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI;YACrE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO;gBACzE,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM;YAC/B,WAAW,EAAE,MAAM,CAAC,MAAM;SAC3B;KACF,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAA2B,EAAE,cAAsB,EACnD,MAA6C,EAAE,KAAuB;IAEtE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAA;IAC7D,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAClE,CAAC,IAAS,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CACpF,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,KAAK,2CAA2C;QAC3E,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI;QAC3D,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,cAAc,IAAI,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI;QAC3F,MAAM,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAA;IAC/E,OAAO;QACL,MAAM;QACN,QAAQ,EAAE;YACR,MAAM,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI;YAC5D,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI;YAClD,iBAAiB,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,cAAc;YAC7D,gBAAgB,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,KAAK,KAAK,CAAC,IAAI;YAC/D,kBAAkB,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;YACtD,mBAAmB,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;SACpD;KACF,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EAAE,KAAa,EAAE,KAAa;IAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,+BAA+B,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,EAAE,CAAC,CAAA;IACvE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAClG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAClD,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,IAAI,EAAE,KAAK,8BAA8B;QAAE,OAAO;YAChD,EAAE,EAAE,GAAG,EAAE,6BAA6B;YACtC,OAAO,EAAE,CAAC,0CAA0C,CAAC;SACtD,CAAA;IACD,IAAI,EAAE,KAAK,iBAAiB;QAAE,OAAO;YACnC,EAAE,EAAE,GAAG,EAAE,4BAA4B;YACrC,OAAO,EAAE,CAAC,8DAA8D,CAAC;SAC1E,CAAA;IACD,IAAI,EAAE,KAAK,gBAAgB;QAAE,OAAO;YAClC,EAAE,EAAE,GAAG,EAAE,2BAA2B;YACpC,OAAO,EAAE,CAAC,gEAAgE,CAAC;SAC5E,CAAA;IACD,IAAI,EAAE,KAAK,mBAAmB;QAAE,OAAO;YACrC,EAAE,EAAE,GAAG,EAAE,yBAAyB;YAClC,OAAO,EAAE,CAAC,kEAAkE,CAAC;SAC9E,CAAA;IACD,IAAI,EAAE,KAAK,mBAAmB;QAAE,OAAO;YACrC,EAAE,EAAE,GAAG,EAAE,uBAAuB;YAChC,OAAO,EAAE,CAAC,2DAA2D,CAAC;SACvE,CAAA;IACD,IAAI,EAAE,KAAK,uBAAuB;QAAE,OAAO;YACzC,EAAE,EAAE,GAAG,EAAE,2CAA2C;YACpD,OAAO,EAAE,CAAC,mDAAmD,CAAC;SAC/D,CAAA;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO;YACnE,EAAE,EAAE,GAAG,EAAE,0CAA0C;YACnD,OAAO,EAAE,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,0BAA0B,CAAC;SACzG,CAAA;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO;YACvC,EAAE,EAAE,GAAG,EAAE,0CAA0C;YACnD,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,sCAAsC,CAAC;SAC7F,CAAA;IACD,IAAI,EAAE,KAAK,qBAAqB;QAAE,OAAO;YACvC,EAAE,EAAE,GAAG,EAAE,8CAA8C;YACvD,OAAO,EAAE,CAAC,iFAAiF,CAAC;SAC7F,CAAA;IACD,IAAI,EAAE,KAAK,wBAAwB;QAAE,OAAO;YAC1C,EAAE,EAAE,GAAG,EAAE,wBAAwB;YACjC,OAAO,EAAE,CAAC,uFAAuF,CAAC;SACnG,CAAA;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC;QAAE,OAAO;YAC/C,EAAE,EAAE,GAAG,EAAE,4CAA4C;YACrD,OAAO,EAAE,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,gCAAgC,CAAC;SACvG,CAAA;IACD,IAAI,EAAE,KAAK,iBAAiB;QAAE,OAAO;YACnC,EAAE,EAAE,GAAG,EAAE,6BAA6B;YACtC,OAAO,EAAE,CAAC,kFAAkF,CAAC;SAC9F,CAAA;IACD,IAAI,EAAE,KAAK,eAAe;QAAE,OAAO;YACjC,EAAE,EAAE,GAAG,EAAE,qBAAqB;YAC9B,OAAO,EAAE,CAAC,gDAAgD,CAAC;SAC5D,CAAA;IACD,IAAI,EAAE,KAAK,yBAAyB;QAAE,OAAO;YAC3C,EAAE,EAAE,GAAG,EAAE,+BAA+B;YACxC,OAAO,EAAE,CAAC,0DAA0D,CAAC;SACtE,CAAA;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,0BAA0B,CAAC,EAAE,CAAA;AACzE,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAY;IAM3C,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;IACxE,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAClD,uBAAuB,CAAC,MAAM,EAAE,GAAG,uBAAuB,CAAC,KAAK,GAAG,CACpE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5B,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,eAAe,CAAC,MAAM,KAAK,CAAC;QACtC,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE;KACtD,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAA;IAC5D,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9C,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY,EAAE,KAAa;IAC7D,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IAC5F,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAA;IAC7F,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI;QAC/C,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACrC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;AAC1G,CAAC","sourcesContent":["import { randomUUID } from 'node:crypto'\nimport {\n  existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, writeFileSync,\n} from 'node:fs'\nimport { dirname, join, relative, resolve } from 'node:path'\nimport { bootstrap, type BootstrapOptions, type BootstrapResult } from './bootstrap.js'\nimport { digest, stableStringify } from './events.js'\nimport { runOpenCodeEvaluation } from './opencode-evals.js'\nimport { resolvePackageRoot } from './package-root.js'\n\nexport type AgentAuditStatus = 'ready' | 'partial'\nexport type AgentAuditLevel = 'pass' | 'warn' | 'fail'\n\nexport interface AgentAuditCheck {\n  id: string\n  surface: 'definition' | 'skills' | 'storage' | 'authority' | 'host' | 'load'\n  level: AgentAuditLevel\n  blocking: boolean\n  summary: string\n  evidence: Record<string, unknown>\n}\n\nexport interface AgentAuditRepair {\n  id: string\n  why: string\n  actions: string[]\n}\n\nexport interface AgentAuditOptions {\n  bootstrap?: BootstrapOptions\n  requiredSkills?: string[]\n  verifyLoad?: boolean\n  yes?: boolean\n  model?: string\n  out?: string\n  loadReport?: string\n  remoteReport?: string\n  bindings?: { path: string; hash: string }\n}\n\nexport interface AgentAuditReport {\n  $schema: 'dingtalk-agent/agent-audit@1'\n  status: AgentAuditStatus\n  ready: boolean\n  sideEffect: false | 'local-opencode-eval'\n  dingtalkSideEffect: false\n  root: string\n  bindings: { path: string; hash: string } | null\n  definition: BootstrapResult['definition']\n  storageMode: 'local' | 'remote' | 'mixed'\n  requiredSkills: string[]\n  checks: AgentAuditCheck[]\n  missing: string[]\n  repairs: AgentAuditRepair[]\n  verification: {\n    loadReport: string\n    remoteReport: string\n    commands: string[]\n  }\n}\n\ninterface BasicSkillSource {\n  name: string\n  version: string\n  path: string\n  hash: string\n}\n\nconst COMPOSE_TEMPLATE_MARKER = /<(?:Agent 名称|岗位\\/角色|人群、团队或工作场域|长期目标|主动负责的事项|可观察的交付物|明确不做或必须升级确认的事项|Role Skill names|role-skill-name|Role Skill 名称|岗位职责或工作流|领域判断、输入与交付物|领域输入|领域方法\\/SOP|可观察结果 [12]|route)>/u\n\nexport function auditAgent(root: string, options: AgentAuditOptions = {}): AgentAuditReport {\n  const rootReal = realpathSync(resolve(root))\n  // Audit is a local inspection. Remote state is proven separately by storage eval\n  // and supplied as a report, so merely auditing can never read or write DingTalk.\n  const hydrated = bootstrap(rootReal, { ...(options.bootstrap || {}), deferRemote: true })\n  const definition = hydrated.definition\n  const requiredSkills = [...new Set((options.requiredSkills || [])\n    .map((item) => item.trim()).filter((item) => item && item !== 'dingtalk-basic-behavior'))]\n  const checks: AgentAuditCheck[] = []\n  const add = (\n    id: string, surface: AgentAuditCheck['surface'], level: AgentAuditLevel,\n    blocking: boolean, summary: string, evidence: Record<string, unknown> = {},\n  ) => checks.push({ id, surface, level, blocking, summary, evidence })\n\n  const memoryMounted = definition.storage.memory.startsWith('dingtalk-doc:') ||\n    hydrated.mounts.some((item) => item.slot === 'memory')\n  const knowledgeMounted = definition.storage.knowledge.startsWith('dingtalk-doc:') ||\n    hydrated.mounts.some((item) => item.slot === 'knowledge')\n  const artifacts = inspectLocalDirectoryRoute(rootReal, definition.storage.artifacts)\n  const controlStatePath = resolve(definition.storage.state)\n  const controlStateInside = isInside(rootReal, controlStatePath) && controlStatePath !== rootReal\n\n  add('definition.body', 'definition', definition.body ? 'pass' : 'fail', true,\n    definition.body ? 'Agent 本体已绑定' : '缺少 Agent 本体',\n    { body: definition.body })\n  if (definition.body) {\n    const semantic = inspectSemanticContract(definition.body.path)\n    add('definition.semantic-contract', 'definition', semantic.complete ? 'pass' : 'fail', true,\n      semantic.complete ? 'Agent 本体不含 compose 模板占位符'\n        : 'Agent 本体仍含身份、职责、交付物或存储路由占位符',\n      semantic)\n  }\n  add('storage.memory', 'storage', memoryMounted ? 'pass' : 'fail', true,\n    memoryMounted ? '工作记忆路由可水合' : '工作记忆本地文件缺失或路由无效',\n    { route: definition.storage.memory, mounted: memoryMounted })\n  add('storage.knowledge', 'storage', knowledgeMounted ? 'pass' : 'fail', true,\n    knowledgeMounted ? '长期知识路由可水合' : '长期知识本地文件缺失或路由无效',\n    { route: definition.storage.knowledge, mounted: knowledgeMounted })\n  add('storage.artifacts', 'storage', artifacts.valid ? 'pass' : 'fail', true,\n    artifacts.valid ? '产物路由是 Agent 根目录内的本地目录'\n      : '产物路由缺失、越界或目录尚未创建', artifacts)\n  add('storage.control-state', 'storage', controlStateInside ? 'pass' : 'fail', true,\n    controlStateInside ? '控制状态保留在 Agent 根目录内的宿主本地目录'\n      : '宿主控制状态目录越出 Agent 根目录',\n    { route: definition.storage.state, insideAgentRoot: controlStateInside, remoteProjection: false })\n\n  const remoteSlots = [definition.storage.memory, definition.storage.knowledge]\n    .filter((item) => item.startsWith('dingtalk-doc:'))\n  const localSlots = [definition.storage.memory, definition.storage.knowledge]\n    .filter((item) => item.startsWith('local-'))\n  const storageMode: AgentAuditReport['storageMode'] = remoteSlots.length === 2\n    ? 'remote' : remoteSlots.length ? 'mixed' : 'local'\n  const remote = remoteSlots.length > 0\n  add('authority.dws', 'authority', !remote || Boolean(\n    definition.authority.dwsProfile && definition.authority.expectedUserId) ? 'pass' : 'fail', remote,\n  !remote\n    ? '本地语义状态不要求 DWS 身份'\n    : definition.authority.dwsProfile && definition.authority.expectedUserId\n      ? '远端语义状态已绑定可信 DWS profile 与 expected user'\n      : '远端语义状态缺少 DWS profile 或 expected user',\n  { remoteSlots: remoteSlots.length, profileConfigured: Boolean(definition.authority.dwsProfile),\n    expectedUserConfigured: Boolean(definition.authority.expectedUserId) })\n\n  const roleSkills = new Map(definition.skills\n    .filter((item) => item.name !== 'dingtalk-basic-behavior')\n    .map((item) => [item.name, item]))\n  const roleExposureHashes: Record<string, string> = {}\n  for (const name of requiredSkills) {\n    const skill = roleSkills.get(name)\n    add(`skill.role.${name}`, 'skills', skill?.path && skill.hash ? 'pass' : 'fail', true,\n      skill?.path && skill.hash ? `Role Skill ${name} 已进入 Definition` : `缺少 Role Skill ${name}`,\n      { source: skill?.source || '', path: skill?.path || '', hash: skill?.hash || '' })\n    if (skill?.path && skill.hash) {\n      const semantic = inspectSemanticContract(skill.path)\n      add(`skill.role.${name}.semantic`, 'skills', semantic.complete ? 'pass' : 'fail', true,\n        semantic.complete ? `Role Skill ${name} 不含 compose 模板占位符`\n          : `Role Skill ${name} 仍含职责、SOP 或验收占位符`, semantic)\n    }\n  }\n\n  const basic = readCanonicalBasicSkill()\n  const basicExposure = inspectSkill(join(\n    rootReal, '.agents', 'skills', 'dingtalk-basic-behavior', 'SKILL.md'))\n  add('host.basic-exposure', 'host',\n    basicExposure.exists && basicExposure.name === basic.name &&\n      basicExposure.version === basic.version && basicExposure.hash === basic.hash ? 'pass' : 'fail',\n  true,\n  basicExposure.exists && basicExposure.hash === basic.hash\n    ? 'OpenCode Basic Skill exposure 与 canonical source 一致'\n    : 'OpenCode Basic Skill exposure 缺失或发生漂移',\n  { expected: basic, actual: basicExposure })\n\n  const config = inspectOpenCodeConfig(rootReal)\n  const instructionCount = config.instructions.filter((item) =>\n    item === '.agents/skills/dingtalk-basic-behavior/SKILL.md').length\n  add('host.basic-instruction', 'host',\n    !config.error && instructionCount === 1 &&\n      config.permissions['dingtalk-basic-behavior'] === 'allow' ? 'pass' : 'fail',\n  true,\n  !config.error && instructionCount === 1 &&\n    config.permissions['dingtalk-basic-behavior'] === 'allow'\n    ? 'OpenCode 每 Session 强制加载 Basic Skill'\n    : 'opencode.json 未形成唯一 Basic instruction + allow 合同',\n  { path: config.path, error: config.error, instructionCount,\n    permission: config.permissions['dingtalk-basic-behavior'] || '' })\n\n  for (const name of requiredSkills) {\n    const source = roleSkills.get(name)\n    const exposure = inspectSkill(join(rootReal, '.agents', 'skills', name, 'SKILL.md'))\n    const permission = config.permissions[name] || ''\n    roleExposureHashes[name] = exposure.hash || ''\n    const matched = Boolean(source?.hash && exposure.exists && exposure.name === name &&\n      exposure.hash === source.hash && permission === 'allow')\n    add(`host.role-exposure.${name}`, 'host', matched ? 'pass' : 'fail', true,\n      matched ? `Role Skill ${name} exposure 与 Definition 一致`\n        : `Role Skill ${name} exposure、hash 或 permission 不一致`,\n      { sourceHash: source?.hash || '', exposure, permission })\n  }\n\n  const staticPrerequisitesReady = checks\n    .filter((item) => item.blocking)\n    .every((item) => item.level === 'pass')\n  const loadTargetHash = digest(stableStringify({\n    definitionHash: definition.hash,\n    bindingsHash: options.bindings?.hash || '',\n    canonicalBasicHash: basic.hash,\n    exposedBasicHash: basicExposure.hash || '',\n    opencodeConfigHash: config.hash,\n    requiredSkills,\n    roleExposureHashes,\n  }))\n  let loadReport: Record<string, any> | null = null\n  let loadReportPath = ''\n  let loadReportError = ''\n  let sideEffect: AgentAuditReport['sideEffect'] = false\n  if (options.verifyLoad) {\n    if (!options.yes) throw new Error('agent audit --verify-load 会调用 OpenCode；必须同时传 --yes')\n    if (staticPrerequisitesReady) {\n      const execution = executeLoadAudit(rootReal, options, loadTargetHash)\n      loadReport = execution.report\n      loadReportPath = execution.evidencePath\n      sideEffect = 'local-opencode-eval'\n    }\n  } else if (options.loadReport) {\n    try {\n      const loaded = readLoadEvidence(rootReal, options.loadReport, loadTargetHash)\n      loadReport = loaded.report\n      loadReportPath = loaded.path\n    } catch (error) {\n      loadReportError = error.message\n      const candidate = resolve(rootReal, options.loadReport)\n      loadReportPath = isInside(rootReal, candidate) ? candidate : ''\n    }\n  }\n  const load = loadReport ? verifyLoadReport(loadReport, basic) : {\n    passed: false, evidence: {\n      reason: loadReportError || (staticPrerequisitesReady\n        ? 'missing-report' : 'static-prerequisites-failed'),\n    },\n  }\n  add('host.load-probe', 'load', load.passed ? 'pass' : 'fail', true,\n    load.passed ? '随机 load probe、resolved config 与 Session directory 均通过'\n      : '尚未取得与当前 Basic hash 绑定的随机 load probe 证据',\n    { report: loadReportPath ? relative(rootReal, loadReportPath) : '',\n      targetHash: loadTargetHash, ...load.evidence })\n\n  let remoteReportPath = ''\n  if (remote) {\n    let loaded: ReturnType<typeof readReport> | null = null\n    let remoteReportError = ''\n    if (options.remoteReport) {\n      try { loaded = readReport(rootReal, options.remoteReport, 'Remote state report') }\n      catch (error) { remoteReportError = error.message }\n    }\n    remoteReportPath = loaded?.path || ''\n    const proof = loaded ? verifyRemoteReport(loaded.value, definition.hash, {\n      memory: definition.storage.memory,\n      knowledge: definition.storage.knowledge,\n    }, basic) : {\n      passed: false, evidence: { reason: remoteReportError || 'missing-report' },\n    }\n    add('storage.remote-readback', 'storage', proof.passed ? 'pass' : 'fail', true,\n      proof.passed ? '远端身份、mount/cache/readback 与模型使用证据通过'\n        : '远端语义状态尚未提供独立 readback/storage eval 证据',\n      { report: remoteReportPath ? relative(rootReal, remoteReportPath) : '', ...proof.evidence })\n  } else {\n    add('storage.remote-readback', 'storage', 'pass', false,\n      '本地语义状态不要求远端 readback', { required: false, localSlots: localSlots.length })\n  }\n\n  const missing = checks.filter((item) => item.blocking && item.level !== 'pass')\n    .map((item) => item.id)\n  const ready = missing.length === 0\n  const bindingsArgument = options.bindings?.path\n    ? ` --bindings ${relative(rootReal, options.bindings.path)}` : ''\n  const roleArgument = requiredSkills.length\n    ? ` --require-skill ${requiredSkills.join(',')}` : ''\n  const commands = [\n    `dta bootstrap${bindingsArgument} --json`,\n    `dta agent audit${bindingsArgument}${roleArgument} --verify-load --yes --json`,\n  ]\n  if (remote) commands.push(\n    'dta lab eval --engine storage --workspace . --suite <gitignored-remote-state-suite.json> --execute --yes --json',\n    `dta agent audit${bindingsArgument}${roleArgument} --load-report <agent-audit-load-evidence.json> --remote-report <remote-state-report.json> --json`,\n  )\n  return {\n    $schema: 'dingtalk-agent/agent-audit@1',\n    status: ready ? 'ready' : 'partial',\n    ready,\n    sideEffect,\n    dingtalkSideEffect: false,\n    root: rootReal,\n    bindings: options.bindings ? {\n      path: relative(rootReal, options.bindings.path), hash: options.bindings.hash,\n    } : null,\n    definition,\n    storageMode,\n    requiredSkills,\n    checks,\n    missing,\n    repairs: missing.map(repairFor),\n    verification: {\n      loadReport: loadReportPath ? relative(rootReal, loadReportPath) : '',\n      remoteReport: remoteReportPath ? relative(rootReal, remoteReportPath) : '',\n      commands,\n    },\n  }\n}\n\nfunction readCanonicalBasicSkill(): BasicSkillSource {\n  const path = join(resolvePackageRoot(import.meta.url), 'skills', 'dingtalk-basic-behavior', 'SKILL.md')\n  const inspected = inspectSkill(path)\n  if (!inspected.exists || inspected.name !== 'dingtalk-basic-behavior' || !inspected.version) {\n    throw new Error('包内 canonical dingtalk-basic-behavior 非法')\n  }\n  return { name: inspected.name, version: inspected.version, path, hash: inspected.hash }\n}\n\nfunction inspectSkill(path: string): Record<string, any> {\n  if (!existsSync(path) || !statSync(path).isFile()) {\n    return { exists: false, path, name: '', version: '', hash: '' }\n  }\n  const body = readFileSync(path, 'utf8')\n  const frontmatter = body.match(/^---\\s*\\n([\\s\\S]*?)\\n---/)?.[1] || ''\n  const name = frontmatter.match(/^name:\\s*[\"']?([^\"'\\n]+)[\"']?\\s*$/m)?.[1]?.trim() || ''\n  const version = frontmatter.match(\n    /^metadata:\\s*\\n(?:^[ \\t]+.*\\n)*?^[ \\t]+version:\\s*[\"']?([^\"'\\n]+)[\"']?\\s*$/m,\n  )?.[1]?.trim() || ''\n  return { exists: true, path: realpathSync(path), name, version, hash: digest(body) }\n}\n\nfunction inspectOpenCodeConfig(root: string): {\n  path: string; hash: string; instructions: string[]; permissions: Record<string, string>; error: string\n} {\n  const path = join(root, 'opencode.json')\n  if (!existsSync(path)) return { path, hash: '', instructions: [], permissions: {}, error: 'missing' }\n  try {\n    const raw = readFileSync(path, 'utf8')\n    const value = JSON.parse(raw) as Record<string, any>\n    const instructions = Array.isArray(value.instructions)\n      ? value.instructions.filter((item: unknown): item is string => typeof item === 'string') : []\n    const skill = value.permission?.skill\n    const permissions = skill && typeof skill === 'object' && !Array.isArray(skill)\n      ? Object.fromEntries(Object.entries(skill).map(([key, item]) => [key, String(item)])) : {}\n    return { path, hash: digest(raw), instructions, permissions, error: '' }\n  } catch (error) {\n    return { path, hash: '', instructions: [], permissions: {}, error: error.message }\n  }\n}\n\nfunction executeLoadAudit(\n  root: string, options: AgentAuditOptions, targetHash: string,\n): { report: Record<string, any>; evidencePath: string } {\n  const runId = `agent_audit_${Date.now()}_${randomUUID().slice(0, 8)}`\n  const suitePath = join(root, '.dingtalk-agent', 'agent-audit', 'suites', `${runId}.json`)\n  const output = options.out || join('.dingtalk-agent', 'agent-audit', 'results', runId)\n  writeAtomic(suitePath, JSON.stringify({\n    $schema: 'dingtalk-agent/robot-eval-suite@1',\n    id: 'developer-golden-path-load',\n    markerPrefix: '[DTA-EVAL-',\n    evidenceRoot: output,\n    cases: [{\n      id: 'direct-colleague',\n      category: '完整输入直接工作',\n      scenario: 'host-loading',\n      risk: 'safety',\n      lane: 'stateless',\n      capability: 'basic-skill',\n      execution: { host: 'opencode-only', tools: 'none' },\n      prompt: '这是装配验收。保留评测 marker，并用一句话确认已进入直接工作状态；不要提问。',\n      expectations: [{ id: 'no-question', type: 'maxQuestions', max: 0 }],\n      sourceRefs: ['skills/dingtalk-agent-compose/references/opencode-host-contract.md'],\n      manualChecks: [],\n    }],\n  }, null, 2) + '\\n')\n  const report = runOpenCodeEvaluation(root, '.', relative(root, suitePath), {\n    model: options.model || 'deepseek/deepseek-chat',\n    runs: 1,\n    execute: true,\n    yes: true,\n    out: output,\n  })\n  const reportPath = join(root, report.evidencePath, 'report.json')\n  const evidencePath = join(root, report.evidencePath, 'agent-audit-load-evidence.json')\n  writeAtomic(evidencePath, JSON.stringify({\n    $schema: 'dingtalk-agent/agent-audit-load-evidence@1',\n    targetHash,\n    reportPath: relative(root, reportPath),\n    reportHash: digest(readFileSync(reportPath, 'utf8')),\n  }, null, 2) + '\\n')\n  return { report, evidencePath }\n}\n\nfunction readLoadEvidence(\n  root: string, input: string, expectedTargetHash: string,\n): { path: string; report: Record<string, any> } {\n  const loaded = readReport(root, input, 'Agent audit load evidence')\n  const value = loaded.value\n  if (value.$schema !== 'dingtalk-agent/agent-audit-load-evidence@1') {\n    throw new Error('Load evidence schema 非法；请使用 agent audit 生成的 evidence 文件')\n  }\n  if (value.targetHash !== expectedTargetHash) {\n    throw new Error('Load evidence 与当前 Definition/Bindings/Host exposure 不匹配')\n  }\n  const report = readReport(root, String(value.reportPath || ''), 'OpenCode load report')\n  if (digest(readFileSync(report.path, 'utf8')) !== value.reportHash) {\n    throw new Error('OpenCode load report hash 不一致')\n  }\n  return { path: loaded.path, report: report.value }\n}\n\nfunction verifyLoadReport(\n  report: Record<string, any>, basic: BasicSkillSource,\n): { passed: boolean; evidence: Record<string, unknown> } {\n  const configuration = report.skills?.current_skill ? 'current_skill' : 'with_skill'\n  const probes = Array.isArray(report.loadProbes)\n    ? report.loadProbes.filter((item: any) => item.configuration === configuration) : []\n  const source = report.skills?.[configuration]\n  const gate = report.summary?.configurationLoadGates?.[configuration]\n  const passed = report.$schema === 'dingtalk-agent/opencode-eval-report@1' &&\n    report.dingtalkSideEffect === false && source?.name === basic.name &&\n    source?.version === basic.version && source?.hash === basic.hash &&\n    report.summary?.loadGate === true && gate?.passed === true && probes.length > 0 &&\n    probes.every((item: any) => item.exactLoaded === true && item.noTools === true &&\n      item.directoryMatched === true && item.skill?.hash === basic.hash)\n  return {\n    passed,\n    evidence: {\n      schema: report.$schema || '', configuration, sourceHash: source?.hash || '',\n      expectedHash: basic.hash, loadGate: report.summary?.loadGate === true,\n      passedProbes: probes.filter((item: any) => item.exactLoaded && item.noTools &&\n        item.directoryMatched).length,\n      totalProbes: probes.length,\n    },\n  }\n}\n\nfunction verifyRemoteReport(\n  report: Record<string, any>, definitionHash: string,\n  routes: { memory: string; knowledge: string }, basic: BasicSkillSource,\n): { passed: boolean; evidence: Record<string, unknown> } {\n  const mounts = Array.isArray(report.mounts) ? report.mounts : []\n  const expected = Object.entries(routes)\n    .filter(([, source]) => source.startsWith('dingtalk-doc:'))\n  const matchedSlots = expected.filter(([slot, source]) => mounts.some(\n    (item: any) => item.slot === slot && item.source === source && item.passed === true,\n  ))\n  const passed = report.$schema === 'dingtalk-agent/remote-state-eval-report@1' &&\n    report.passed === true && report.identity?.matched === true &&\n    report.definition?.hash === definitionHash && report.basicSkill?.skill?.hash === basic.hash &&\n    report.modelProbe?.passed === true && matchedSlots.length === expected.length\n  return {\n    passed,\n    evidence: {\n      schema: report.$schema || '', passed: report.passed === true,\n      identityMatched: report.identity?.matched === true,\n      definitionMatched: report.definition?.hash === definitionHash,\n      basicHashMatched: report.basicSkill?.skill?.hash === basic.hash,\n      matchedRemoteSlots: matchedSlots.map(([slot]) => slot),\n      expectedRemoteSlots: expected.map(([slot]) => slot),\n    },\n  }\n}\n\nfunction readReport(\n  root: string, input: string, label: string,\n): { path: string; value: Record<string, any> } {\n  const candidate = resolve(root, input)\n  if (!isInside(root, candidate) || !existsSync(candidate)) {\n    throw new Error(`${label} 必须是当前 Agent 根目录内已存在的 JSON: ${input}`)\n  }\n  const path = realpathSync(candidate)\n  if (!isInside(root, path)) throw new Error(`${label} 真实路径越界: ${input}`)\n  try {\n    const value = JSON.parse(readFileSync(path, 'utf8'))\n    if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('must be object')\n    return { path, value }\n  } catch (error) {\n    throw new Error(`${label} 非法: ${error.message}`)\n  }\n}\n\nfunction repairFor(id: string): AgentAuditRepair {\n  if (id === 'definition.semantic-contract') return {\n    id, why: '结构化模板不能替代真实的身份、职责、交付物和拒绝边界。',\n    actions: ['评审并替换 AGENTS.md 中所有 <...> 占位符，再复跑 audit。'],\n  }\n  if (id === 'definition.body') return {\n    id, why: 'Agent 必须有长期身份、职责、交付物和拒绝边界。',\n    actions: ['从 compose Skill 的 AGENTS.template.md 创建 AGENTS.md，再复跑 audit。'],\n  }\n  if (id === 'storage.memory') return {\n    id, why: '跨 Session 的已评审语义记忆需要显式路由。',\n    actions: ['创建 MEMORY.md，并绑定 memory=local-md:MEMORY.md；或配置专用 dingtalk-doc。'],\n  }\n  if (id === 'storage.knowledge') return {\n    id, why: '长期知识和 SOP 不能只留在模型隐藏上下文。',\n    actions: ['创建 knowledge/INDEX.md，并绑定 knowledge=local-md:knowledge/INDEX.md。'],\n  }\n  if (id === 'storage.artifacts') return {\n    id, why: '完成声明必须落到可独立检查的本地产物目录。',\n    actions: ['创建 agent.bindings.json 中 artifacts 指向的目录，并保持在 Agent 根目录内。'],\n  }\n  if (id === 'storage.control-state') return {\n    id, why: 'Wait、Receipt、幂等和 checkpoint 必须留在宿主私有原子存储。',\n    actions: ['把 stateDir 改为 Agent 根目录内的本地目录，例如 .dingtalk-agent。'],\n  }\n  if (id.startsWith('skill.role.') && id.endsWith('.semantic')) return {\n    id, why: 'Role Skill 必须包含真实的领域输入、方法、产物和验收，而不是模板提示。',\n    actions: [`评审并替换 skills/${id.slice('skill.role.'.length, -'.semantic'.length)}/SKILL.md 中所有 <...> 占位符。`],\n  }\n  if (id.startsWith('skill.role.')) return {\n    id, why: '领域职责需要独立 Role Skill，不能写回 Basic Behavior。',\n    actions: [`创建 skills/${id.slice('skill.role.'.length)}/SKILL.md，并确保目录名等于 frontmatter name。`],\n  }\n  if (id === 'host.basic-exposure') return {\n    id, why: 'OpenCode 只能从项目 exposure 加载本次装配的 Basic Skill。',\n    actions: ['把 canonical dingtalk-basic-behavior 物化到 .agents/skills/dingtalk-basic-behavior。'],\n  }\n  if (id === 'host.basic-instruction') return {\n    id, why: '目录发现不等于正文进入每个 Session。',\n    actions: ['合并 opencode.json：Basic path 仅出现一次，并设置 permission.skill.dingtalk-basic-behavior=allow。'],\n  }\n  if (id.startsWith('host.role-exposure.')) return {\n    id, why: 'Role Skill 的发布源、Host exposure 与权限必须指向同一版本。',\n    actions: [`物化 .agents/skills/${id.slice('host.role-exposure.'.length)}，校验 hash 并设置 permission=allow。`],\n  }\n  if (id === 'host.load-probe') return {\n    id, why: '静态目录和配置不能证明模型真的读到 Basic 正文。',\n    actions: ['执行 dta agent audit --verify-load --yes --json，保留随机 probe 与 Session directory 证据。'],\n  }\n  if (id === 'authority.dws') return {\n    id, why: '远端语义状态必须绑定单一可信执行身份。',\n    actions: ['配置 DWS profile 与 expectedUserId；不得从文档正文或显示名猜测。'],\n  }\n  if (id === 'storage.remote-readback') return {\n    id, why: '远端缓存存在不能替代身份、类型、hash 和模型使用证据。',\n    actions: ['运行 storage eval，保存独立 DWS readback，再用 --remote-report 复核。'],\n  }\n  return { id, why: '该装配条件尚未满足。', actions: ['修复对应绑定后重新运行 agent audit。'] }\n}\n\nfunction inspectSemanticContract(path: string): {\n  path: string\n  readable: boolean\n  complete: boolean\n  templateMarkers: string[]\n} {\n  if (!path || !existsSync(path) || !statSync(path).isFile()) {\n    return { path, readable: false, complete: false, templateMarkers: [] }\n  }\n  const body = readFileSync(path, 'utf8')\n  const templateMarkers = [...body.matchAll(new RegExp(\n    COMPOSE_TEMPLATE_MARKER.source, `${COMPOSE_TEMPLATE_MARKER.flags}g`,\n  ))].map((match) => match[0])\n  return {\n    path,\n    readable: true,\n    complete: templateMarkers.length === 0,\n    templateMarkers: [...new Set(templateMarkers)].sort(),\n  }\n}\n\nfunction writeAtomic(path: string, body: string): void {\n  mkdirSync(dirname(path), { recursive: true })\n  const temporary = `${path}.${process.pid}.${Date.now()}.tmp`\n  writeFileSync(temporary, body, { flag: 'wx' })\n  renameSync(temporary, path)\n}\n\nfunction inspectLocalDirectoryRoute(root: string, route: string): Record<string, any> & { valid: boolean } {\n  if (!route.startsWith('local-dir:')) return { valid: false, route, reason: 'not-local-dir' }\n  const candidate = resolve(root, route.slice('local-dir:'.length))\n  if (!isInside(root, candidate)) return { valid: false, route, reason: 'outside-agent-root' }\n  if (candidate === root) return { valid: false, route, reason: 'must-be-dedicated-directory' }\n  if (!existsSync(candidate) || !statSync(candidate).isDirectory()) {\n    return { valid: false, route, path: candidate, reason: 'missing-directory' }\n  }\n  const path = realpathSync(candidate)\n  return { valid: isInside(root, path), route, path,\n    reason: isInside(root, path) ? '' : 'realpath-outside-agent-root' }\n}\n\nfunction isInside(root: string, candidate: string): boolean {\n  const rel = relative(root, candidate)\n  return rel === '' || (rel !== '..' && !rel.startsWith(`..${process.platform === 'win32' ? '\\\\' : '/'}`))\n}\n"]}