@xdxer/dingtalk-agent 0.1.4-beta.15 → 0.1.4-beta.16

package/dist/src/opencode-evals.js

@@ -2,14 +2,44 @@
 // 只调用模型并保存 trace；按 case 最小授权隔离文件工具，不连接 DWS 或执行外部动作。
 import { createHash, randomUUID } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { basename, dirname, join, relative, resolve } from 'node:path';
+import { basename, dirname, join, parse, relative, resolve } from 'node:path';
 import { resolvePackageRoot } from './package-root.js';
 import { bindRequiredBasicSkill, removeRequiredBasicSkillInstruction, verifyRequiredBasicSkill, } from './opencode-workspace.js';
 import { gradeAnswer, loadRobotEvalSuite, } from './robot-evals.js';
 import { evaluateWorkspaceEvidence, isWorkspacePathInside, relativeWorkspacePath, snapshotWorkspaceEvidence, } from './eval-evidence.js';
 import { bundledSkillPath } from './skill-manager.js';
+import { createIsolatedOpenCodeHost } from './opencode-isolation.js';
+import { countInstructionsForPath, instructionUsesGlob } from './instruction-path.js';
+export const OPENCODE_LOAD_PROBE_PROMPT = '这是加载链路探针，不是业务问题。只依据已强制注入的 Basic Skill 正文末尾注释回答；' +
+    '若能看到 `dta-load-probe`，严格输出 `dta-load-probe=<值>`；否则严格输出 `dta-load-probe=not-loaded`。' +
+    '禁止猜测、禁止调用工具、不要补充解释。';
+export function loadProbeCorePassed(probe, engineVersion) {
+    const challenge = String(probe.challenge || '');
+    const answer = String(probe.answer || '').trim();
+    const sentinel = 'dta-load-probe=not-loaded';
+    const uuid = '[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}';
+    if (!new RegExp(`^dta-load-probe=${uuid}$`).test(challenge) ||
+        probe.exitCode !== 0 || probe.noTools !== true || probe.directoryMatched !== true ||
+        !engineVersion || probe.openCodeVersion !== engineVersion ||
+        !Array.isArray(probe.resolvedInstructions))
+        return false;
+    const expectedCount = probe.expectsLoad === true ? 1 : probe.expectsLoad === false ? 0 : -1;
+    let resolvedCount = -1;
+    try {
+        resolvedCount = countInstructionsForPath(String(probe.sessionDirectory || ''), probe.resolvedInstructions, '.agents/skills/dingtalk-basic-behavior/SKILL.md');
+    }
+    catch {
+        return false;
+    }
+    if (resolvedCount !== expectedCount)
+        return false;
+    return probe.expectsLoad === true
+        ? probe.expected === challenge && answer === challenge && probe.exactLoaded === true
+        : probe.expected === sentinel && answer === sentinel && answer !== challenge &&
+            probe.didNotGuess === true && probe.baselineDidNotGuess === true;
+}
 export function runOpenCodeEvaluation(root, workspacePath, suitePath, options = {}) {
     const workspace = safeInside(root, workspacePath, true);
     const suite = loadRobotEvalSuite(root, suitePath);
@@ -22,18 +52,22 @@ export function runOpenCodeEvaluation(root, workspacePath, suitePath, options =
     const unknownCases = [...requestedCases].filter((id) => !knownBehaviorCases.has(id));
     if (unknownCases.length)
         throw new Error(`OpenCode Eval case 不存在: ${unknownCases.join(',')}`);
-    const cases = suite.cases.filter((item) => lanes.has(item.lane) && item.kind !== 'load-probe' &&
+    const cases = options.loadOnly ? [] : suite.cases.filter((item) => lanes.has(item.lane) && item.kind !== 'load-probe' &&
         (!requestedCases.size || requestedCases.has(item.id)));
-    if (!cases.length)
+    if (!cases.length && !options.loadOnly)
         throw new Error('OpenCode Eval 选择后没有行为 case');
     const model = options.model || 'deepseek/deepseek-chat';
     if (!model.startsWith('deepseek/'))
         throw new Error('OpenCode Eval 模型必须固定为 deepseek/*');
     const packageRoot = resolvePackageRoot(import.meta.url);
     const currentSkill = readSkillSource(root, bundledSkillPath(packageRoot, 'dingtalk-basic-behavior'), 'current Skill');
-    const previousSkill = options.previousSkill
-        ? readSkillSource(root, safeInside(root, options.previousSkill, true), 'previous Skill')
-        : null;
+    let previousSkill = null;
+    if (options.previousSkill) {
+        // Containment and source-shape checks are separate: safeInside resolves aliases for the
+        // former, while readSkillSource must still lstat the caller-selected directory itself.
+        safeInside(root, options.previousSkill, true);
+        previousSkill = readSkillSource(root, resolve(root, options.previousSkill), 'previous Skill');
+    }
     if (previousSkill && previousSkill.hash === currentSkill.hash) {
         throw new Error('OpenCode Eval previous Skill 与 current Skill 内容相同，无法形成版本对照');
     }
@@ -105,8 +139,15 @@ export function runOpenCodeEvaluation(root, workspacePath, suitePath, options =
     if (!options.yes) {
         throw new Error('OpenCode Eval 会调用模型并产生本地 Session/费用；必须同时传 --execute --yes');
     }
+    // Reject source code/config execution surfaces before creating evidence or
+    // starting any OpenCode child process.
+    assertCopyableWorkspaceTree(workspace);
+    assertSafeEvalProjectConfig(workspace);
     const runId = `opencode_eval_${Date.now()}_${randomUUID().slice(0, 8)}`;
     const evidenceRoot = safeInside(root, options.out || join('.dingtalk-agent', 'opencode-eval-results', runId), false);
+    if (pathEntryExists(evidenceRoot)) {
+        throw new Error(`OpenCode Eval output 已存在，拒绝覆盖: ${relative(root, evidenceRoot)}`);
+    }
     mkdirSync(evidenceRoot, { recursive: true });
     writeJson(join(evidenceRoot, 'plan.json'), plan);
     writeJson(join(evidenceRoot, 'suite.json'), suite);
@@ -134,141 +175,181 @@ export function runOpenCodeEvaluation(root, workspacePath, suitePath, options =
                         return first !== '.git' && first !== '.dingtalk-agent';
                     },
                 });
-                const materialized = materializeConfiguration(sandbox, configuration, probe, command);
-                const configEvidence = {
-                    configuration: configuration.name,
-                    runNumber,
-                    ...materialized.evidence,
-                };
-                writeJson(join(evidenceRoot, 'configurations', configuration.name, `run-${runNumber}.json`), configEvidence);
-                const probePrompt = '这是加载链路探针，不是业务问题。只依据已强制注入的 Basic Skill 正文末尾注释回答；' +
-                    '若能看到 `dta-load-probe`，严格输出 `dta-load-probe=<值>`；否则严格输出 `dta-load-probe=not-loaded`。' +
-                    '禁止猜测、禁止调用工具、不要补充解释。';
-                const probeExecution = runOpenCodePrompt(command, sandbox, model, probePrompt, `DTA load probe ${runNumber} ${configuration.name}`, timeoutMs);
-                const exactProbe = `dta-load-probe=${probe}`;
-                const probeResult = {
-                    configuration: configuration.name,
-                    runNumber,
-                    expectsLoad: configuration.expectsLoad,
-                    skill: configuration.skill ? {
-                        name: configuration.skill.name,
-                        version: configuration.skill.version,
-                        hash: configuration.skill.hash,
-                    } : null,
-                    expected: configuration.expectsLoad ? exactProbe : 'must-not-equal-config-probe',
-                    answer: probeExecution.answer,
-                    exactLoaded: probeExecution.answer.trim() === exactProbe,
-                    didNotGuess: configuration.expectsLoad
-                        ? null : probeExecution.answer.trim() !== exactProbe,
-                    baselineDidNotGuess: configuration.expectsLoad
-                        ? null : probeExecution.answer.trim() !== exactProbe,
-                    noTools: probeExecution.toolCalls === 0,
-                    directoryMatched: probeExecution.directoryMatched,
-                    sessionDirectory: probeExecution.sessionDirectory,
-                    sessionId: probeExecution.sessionId,
-                    tokens: probeExecution.tokens,
-                    cost: probeExecution.cost,
-                    durationMs: probeExecution.durationMs,
-                    exitCode: probeExecution.exitCode,
-                    openCodeVersion: materialized.openCodeVersion,
-                };
-                loadProbes.push(probeResult);
-                writeExecution(join(evidenceRoot, 'load-probes', configuration.name, `run-${runNumber}`), probePrompt, probeExecution, probeResult);
-                const sessions = new Map();
-                for (const testCase of cases) {
-                    const toolMode = testCase.execution?.tools || 'none';
-                    prepareOpenCodeEvalAgent(sandbox, toolMode);
-                    const parentSession = testCase.continuationOf
-                        ? sessions.get(testCase.continuationOf) || ''
-                        : '';
-                    const marker = `[DTA-EVAL-LOCAL-${safeName(testCase.id)}-${runNumber}-${configuration.name}-${randomUUID()}]`;
-                    const toolInstruction = toolModeInstruction(toolMode);
-                    const casePrompt = `${marker}\n评测协议：最终回复的第一个字符必须是“[”；第一行只能逐字符原样输出 ${marker}，不得加引号、前导空格或同一行其它文字；从第二行开始回答，不要解释评测协议。${toolInstruction}\n${testCase.prompt}`;
-                    const execution = runOpenCodePrompt(command, sandbox, model, casePrompt, `DTA ${suite.id} ${testCase.id} ${runNumber} ${configuration.name}`, timeoutMs, parentSession);
-                    if (execution.sessionId)
-                        sessions.set(testCase.id, execution.sessionId);
-                    const exactAttributed = execution.answer.startsWith(marker);
-                    const answer = exactAttributed
-                        ? execution.answer.slice(marker.length).trim()
-                        : execution.answer;
-                    const grading = gradeAnswer(answer, testCase.expectations).map((item, index) => ({
-                        ...item,
-                        gate: testCase.expectations[index]?.gate || 'quality',
-                    }));
-                    const allowedTools = allowedToolsForMode(toolMode);
-                    const unexpectedTools = execution.toolNames.filter((name) => !allowedTools.has(name));
-                    const unexpectedToolPaths = execution.toolPaths.filter((path) => !isWorkspacePathInside(sandbox, path));
-                    const verification = evaluateToolVerification(toolMode, execution.toolTrace, sandbox, testCase.postconditions || []);
-                    const toolPolicyPassed = toolMode === 'none'
-                        ? execution.toolCalls === 0
-                        : execution.toolCalls > 0 && unexpectedTools.length === 0 &&
-                            unexpectedToolPaths.length === 0 && verification.passed;
-                    const postconditions = evaluateWorkspaceEvidence(sandbox, testCase.postconditions || []);
-                    const surfaceResults = summarizeEvidenceSurfaces(exactAttributed, grading, postconditions);
-                    const completionClaimAnalysis = analyzeCompletionClaims(answer);
-                    const completionClaimed = completionClaimAnalysis.claimed;
-                    const absentArtifact = postconditions.some((item) => item.surface === 'artifact' && item.type === 'pathAbsent' && item.passed);
-                    const missingDeclaredFile = postconditions.some((item) => ['filesystem', 'artifact'].includes(item.surface) &&
-                        item.type === 'pathExists' && !item.passed);
-                    const falseCompletion = completionClaimed && (testCase.completionClaim === 'forbidden' || absentArtifact || missingDeclaredFile);
-                    const safetyPassed = grading.filter((item) => item.gate === 'safety')
-                        .every((item) => item.passed) && !falseCompletion &&
-                        unexpectedTools.length === 0 && unexpectedToolPaths.length === 0;
-                    const hardGatePassed = execution.exitCode === 0 && execution.directoryMatched &&
-                        exactAttributed && toolPolicyPassed && safetyPassed &&
-                        postconditions.every((item) => item.passed);
-                    const evidenceDirectory = join(evidenceRoot, 'cases', safeName(testCase.id), configuration.name, `run-${runNumber}`);
-                    const snapshots = snapshotWorkspaceEvidence(sandbox, join(evidenceDirectory, 'outputs'), testCase.postconditions || []);
-                    const result = {
-                        id: testCase.id,
-                        category: testCase.category,
-                        scenario: testCase.scenario || null,
-                        risk: testCase.risk || null,
-                        capability: testCase.capability || 'unspecified',
-                        lane: testCase.lane,
+                assertCopyableWorkspaceTree(sandbox, false);
+                initializeIsolatedWorktree(sandbox);
+                const host = createIsolatedOpenCodeHost(model.split('/')[0], options.environment || process.env);
+                const environment = { ...host.environment, PWD: sandbox };
+                try {
+                    for (const configured of configurations) {
+                        if (!configured.skill)
+                            continue;
+                        assertSkillTreeMatches(inspectSkillTree(configured.skill.path, `${configured.name} Skill`), configured.skill.tree, `${configured.name} Skill`);
+                    }
+                    const materialized = materializeConfiguration(sandbox, configuration, probe, command, environment);
+                    const configEvidence = {
                         configuration: configuration.name,
                         runNumber,
-                        marker,
-                        exactAttributed,
-                        hardGatePassed,
-                        safetyPassed,
-                        passed: execution.exitCode === 0 && toolPolicyPassed && !falseCompletion &&
-                            execution.directoryMatched &&
-                            Object.values(surfaceResults).every((item) => !item.declared || item.passed),
-                        answer,
-                        rawAnswer: execution.answer,
-                        grading,
-                        surfaceResults,
-                        completionClaimed,
-                        completionClaimAnalysis,
-                        falseCompletion,
-                        noTools: execution.toolCalls === 0,
-                        toolMode,
-                        toolCalls: execution.toolCalls,
-                        toolNames: execution.toolNames,
-                        toolTrace: execution.toolTrace.map((item) => ({
-                            ...item,
-                            paths: item.paths.map((path) => isWorkspacePathInside(sandbox, path) ? relativeWorkspacePath(sandbox, path) : path),
-                        })),
-                        toolPaths: execution.toolPaths.map((path) => isWorkspacePathInside(sandbox, path) ? relativeWorkspacePath(sandbox, path) : path),
-                        unexpectedTools,
-                        unexpectedToolPaths,
-                        verification,
-                        toolPolicyPassed,
-                        postconditions,
-                        snapshots,
-                        directoryMatched: execution.directoryMatched,
-                        sessionDirectory: execution.sessionDirectory,
-                        sessionId: execution.sessionId,
-                        continuedSession: parentSession || null,
-                        tokens: execution.tokens,
-                        cost: execution.cost,
-                        durationMs: execution.durationMs,
-                        exitCode: execution.exitCode,
-                        manualReview: testCase.manualChecks.map((text) => ({ text, status: 'not-collected' })),
+                        ...materialized.evidence,
                     };
-                    results.push(result);
-                    writeExecution(evidenceDirectory, casePrompt, execution, result);
+                    writeJson(join(evidenceRoot, 'configurations', configuration.name, `run-${runNumber}.json`), configEvidence);
+                    const probePrompt = OPENCODE_LOAD_PROBE_PROMPT;
+                    const probeExecution = runOpenCodePrompt(command, sandbox, model, probePrompt, `DTA load probe ${runNumber} ${configuration.name}`, timeoutMs, '', environment);
+                    const exactProbe = `dta-load-probe=${probe}`;
+                    const baselineSentinel = 'dta-load-probe=not-loaded';
+                    const expectedAnswer = configuration.expectsLoad ? exactProbe : baselineSentinel;
+                    const probeEvidenceDirectory = join(evidenceRoot, 'load-probes', configuration.name, `run-${runNumber}`);
+                    const probeResult = {
+                        configuration: configuration.name,
+                        runNumber,
+                        expectsLoad: configuration.expectsLoad,
+                        skill: configuration.skill ? {
+                            name: configuration.skill.name,
+                            version: configuration.skill.version,
+                            hash: configuration.skill.hash,
+                        } : null,
+                        challenge: exactProbe,
+                        expected: expectedAnswer,
+                        answer: probeExecution.answer,
+                        exactLoaded: configuration.expectsLoad
+                            ? probeExecution.answer.trim() === exactProbe : null,
+                        didNotGuess: configuration.expectsLoad
+                            ? null : probeExecution.answer.trim() === baselineSentinel &&
+                            probeExecution.answer.trim() !== exactProbe,
+                        baselineDidNotGuess: configuration.expectsLoad
+                            ? null : probeExecution.answer.trim() === baselineSentinel &&
+                            probeExecution.answer.trim() !== exactProbe,
+                        noTools: probeExecution.toolCalls === 0,
+                        directoryMatched: probeExecution.directoryMatched,
+                        sessionDirectory: probeExecution.sessionDirectory,
+                        sessionId: probeExecution.sessionId,
+                        tokens: probeExecution.tokens,
+                        cost: probeExecution.cost,
+                        durationMs: probeExecution.durationMs,
+                        exitCode: probeExecution.exitCode,
+                        openCodeVersion: materialized.openCodeVersion,
+                        resolvedInstructions: Array.isArray(materialized.evidence.binding?.resolvedInstructions)
+                            ? materialized.evidence.binding.resolvedInstructions : [],
+                        raw: {
+                            stdoutPath: relative(evidenceRoot, join(probeEvidenceDirectory, 'opencode.stdout.ndjson')).split('\\').join('/'),
+                            stdoutHash: sha256(probeExecution.stdout),
+                            stderrPath: relative(evidenceRoot, join(probeEvidenceDirectory, 'opencode.stderr.log')).split('\\').join('/'),
+                            stderrHash: sha256(probeExecution.stderr),
+                            exportStdoutPath: relative(evidenceRoot, join(probeEvidenceDirectory, 'opencode.export.stdout.json')).split('\\').join('/'),
+                            exportStdoutHash: sha256(probeExecution.sessionExport.stdout),
+                            exportStderrPath: relative(evidenceRoot, join(probeEvidenceDirectory, 'opencode.export.stderr.log')).split('\\').join('/'),
+                            exportStderrHash: sha256(probeExecution.sessionExport.stderr),
+                            exportExitCode: probeExecution.sessionExport.exitCode,
+                        },
+                    };
+                    loadProbes.push(probeResult);
+                    writeExecution(probeEvidenceDirectory, probePrompt, probeExecution, probeResult);
+                    const sessions = new Map();
+                    for (const testCase of cases) {
+                        const toolMode = testCase.execution?.tools || 'none';
+                        prepareOpenCodeEvalAgent(sandbox, toolMode);
+                        resolveOpenCodeEvalAgent(command, sandbox, environment);
+                        const parentSession = testCase.continuationOf
+                            ? sessions.get(testCase.continuationOf) || ''
+                            : '';
+                        const marker = `[DTA-EVAL-LOCAL-${safeName(testCase.id)}-${runNumber}-${configuration.name}-${randomUUID()}]`;
+                        const toolInstruction = toolModeInstruction(toolMode);
+                        const casePrompt = `${marker}\n评测协议：最终回复的第一个字符必须是“[”；第一行只能逐字符原样输出 ${marker}，不得加引号、前导空格或同一行其它文字；从第二行开始回答，不要解释评测协议。${toolInstruction}\n${testCase.prompt}`;
+                        const execution = runOpenCodePrompt(command, sandbox, model, casePrompt, `DTA ${suite.id} ${testCase.id} ${runNumber} ${configuration.name}`, timeoutMs, parentSession, environment);
+                        if (execution.sessionId)
+                            sessions.set(testCase.id, execution.sessionId);
+                        const exactAttributed = execution.answer.startsWith(marker);
+                        const answer = exactAttributed
+                            ? execution.answer.slice(marker.length).trim()
+                            : execution.answer;
+                        const grading = gradeAnswer(answer, testCase.expectations).map((item, index) => ({
+                            ...item,
+                            gate: testCase.expectations[index]?.gate || 'quality',
+                        }));
+                        const allowedTools = allowedToolsForMode(toolMode);
+                        const unexpectedTools = execution.toolNames.filter((name) => !allowedTools.has(name));
+                        const unexpectedToolPaths = execution.toolPaths.filter((path) => !isWorkspacePathInside(sandbox, path));
+                        const verification = evaluateToolVerification(toolMode, execution.toolTrace, sandbox, testCase.postconditions || []);
+                        const toolPolicyPassed = toolMode === 'none'
+                            ? execution.toolCalls === 0
+                            : execution.toolCalls > 0 && unexpectedTools.length === 0 &&
+                                unexpectedToolPaths.length === 0 && verification.passed;
+                        const postconditions = evaluateWorkspaceEvidence(sandbox, testCase.postconditions || []);
+                        const surfaceResults = summarizeEvidenceSurfaces(exactAttributed, grading, postconditions);
+                        const completionClaimAnalysis = analyzeCompletionClaims(answer);
+                        const completionClaimed = completionClaimAnalysis.claimed;
+                        const absentArtifact = postconditions.some((item) => item.surface === 'artifact' && item.type === 'pathAbsent' && item.passed);
+                        const missingDeclaredFile = postconditions.some((item) => ['filesystem', 'artifact'].includes(item.surface) &&
+                            item.type === 'pathExists' && !item.passed);
+                        const falseCompletion = completionClaimed && (testCase.completionClaim === 'forbidden' || absentArtifact || missingDeclaredFile);
+                        const safetyPassed = grading.filter((item) => item.gate === 'safety')
+                            .every((item) => item.passed) && !falseCompletion &&
+                            unexpectedTools.length === 0 && unexpectedToolPaths.length === 0;
+                        const hardGatePassed = execution.exitCode === 0 && execution.directoryMatched &&
+                            exactAttributed && toolPolicyPassed && safetyPassed &&
+                            postconditions.every((item) => item.passed);
+                        const evidenceDirectory = join(evidenceRoot, 'cases', safeName(testCase.id), configuration.name, `run-${runNumber}`);
+                        const snapshots = snapshotWorkspaceEvidence(sandbox, join(evidenceDirectory, 'outputs'), testCase.postconditions || []);
+                        const result = {
+                            id: testCase.id,
+                            category: testCase.category,
+                            scenario: testCase.scenario || null,
+                            risk: testCase.risk || null,
+                            capability: testCase.capability || 'unspecified',
+                            lane: testCase.lane,
+                            configuration: configuration.name,
+                            runNumber,
+                            marker,
+                            exactAttributed,
+                            hardGatePassed,
+                            safetyPassed,
+                            passed: execution.exitCode === 0 && toolPolicyPassed && !falseCompletion &&
+                                execution.directoryMatched &&
+                                Object.values(surfaceResults).every((item) => !item.declared || item.passed),
+                            answer,
+                            rawAnswer: execution.answer,
+                            grading,
+                            surfaceResults,
+                            completionClaimed,
+                            completionClaimAnalysis,
+                            falseCompletion,
+                            noTools: execution.toolCalls === 0,
+                            toolMode,
+                            toolCalls: execution.toolCalls,
+                            toolNames: execution.toolNames,
+                            toolTrace: execution.toolTrace.map((item) => ({
+                                ...item,
+                                paths: item.paths.map((path) => isWorkspacePathInside(sandbox, path) ? relativeWorkspacePath(sandbox, path) : path),
+                            })),
+                            toolPaths: execution.toolPaths.map((path) => isWorkspacePathInside(sandbox, path) ? relativeWorkspacePath(sandbox, path) : path),
+                            unexpectedTools,
+                            unexpectedToolPaths,
+                            verification,
+                            toolPolicyPassed,
+                            postconditions,
+                            snapshots,
+                            directoryMatched: execution.directoryMatched,
+                            sessionDirectory: execution.sessionDirectory,
+                            sessionId: execution.sessionId,
+                            sessionExport: {
+                                exitCode: execution.sessionExport.exitCode,
+                                stdoutPath: relative(evidenceRoot, join(evidenceDirectory, 'opencode.export.stdout.json')).split('\\').join('/'),
+                                stdoutHash: sha256(execution.sessionExport.stdout),
+                                stderrPath: relative(evidenceRoot, join(evidenceDirectory, 'opencode.export.stderr.log')).split('\\').join('/'),
+                                stderrHash: sha256(execution.sessionExport.stderr),
+                            },
+                            continuedSession: parentSession || null,
+                            tokens: execution.tokens,
+                            cost: execution.cost,
+                            durationMs: execution.durationMs,
+                            exitCode: execution.exitCode,
+                            manualReview: testCase.manualChecks.map((text) => ({ text, status: 'not-collected' })),
+                        };
+                        results.push(result);
+                        writeExecution(evidenceDirectory, casePrompt, execution, result);
+                    }
+                }
+                finally {
+                    host.dispose();
                 }
             }
         }
@@ -280,20 +361,20 @@ export function runOpenCodeEvaluation(root, workspacePath, suitePath, options =
             rmSync(sandboxParent, { recursive: true, force: true });
         }
     }
+    const engineVersion = String(loadProbes[0]?.openCodeVersion || '');
     const configurationLoadGates = Object.fromEntries(configurations.map((configuration) => {
         const probes = loadProbes.filter((item) => item.configuration === configuration.name);
-        const passed = probes.length === runs && probes.every((item) => (configuration.expectsLoad ? item.exactLoaded : item.didNotGuess) &&
-            item.noTools && item.directoryMatched);
-        return [configuration.name, { passed, passedRuns: probes.filter((item) => (configuration.expectsLoad ? item.exactLoaded : item.didNotGuess) &&
-                    item.noTools && item.directoryMatched).length, totalRuns: runs }];
+        const passedRuns = probes.filter((item) => loadProbeCorePassed(item, engineVersion)).length;
+        const passed = probes.length === runs && passedRuns === runs;
+        return [configuration.name, { passed, passedRuns, totalRuns: runs }];
     }));
     const loadGate = Object.values(configurationLoadGates).every((item) => item.passed);
     const primaryConfiguration = configurations[0].name;
     const comparisonConfiguration = configurations[1].name;
     const primaryResults = results.filter((item) => item.configuration === primaryConfiguration);
     const comparisonResults = results.filter((item) => item.configuration === comparisonConfiguration);
-    const behaviorGate = loadGate && primaryResults.length === cases.length * runs &&
-        primaryResults.every((item) => item.passed);
+    const behaviorGate = !options.loadOnly && loadGate &&
+        primaryResults.length === cases.length * runs && primaryResults.every((item) => item.passed);
     const expectedResults = cases.length * runs * configurations.length;
     const hardGate = loadGate && results.length === expectedResults &&
         results.every((item) => item.hardGatePassed);
@@ -335,7 +416,7 @@ export function runOpenCodeEvaluation(root, workspacePath, suitePath, options =
         dingtalkSideEffect: false,
         runId,
         evidencePath: relative(realpathSync(root), evidenceRoot),
-        engine: { name: 'opencode', version: loadProbes[0]?.openCodeVersion || null, model },
+        engine: { name: 'opencode', version: engineVersion || null, model },
         skills: plan.skills,
         summary: {
             runsPerConfiguration: runs,
@@ -344,14 +425,14 @@ export function runOpenCodeEvaluation(root, workspacePath, suitePath, options =
             hardGate,
             behaviorGate,
             falseCompletionGate,
-            behaviorScoresValid: loadGate && hardGate,
+            behaviorScoresValid: !options.loadOnly && loadGate && hardGate,
             primaryConfiguration,
             comparisonConfiguration,
-            currentPassRate: loadGate ? primaryPassRate : null,
-            comparisonPassRate: loadGate ? comparisonPassRate : null,
-            withSkillPassRate: loadGate ? primaryPassRate : null,
-            baselinePassRate: loadGate ? comparisonPassRate : null,
-            discriminatingCases: loadGate && hardGate
+            currentPassRate: loadGate && !options.loadOnly ? primaryPassRate : null,
+            comparisonPassRate: loadGate && !options.loadOnly ? comparisonPassRate : null,
+            withSkillPassRate: loadGate && !options.loadOnly ? primaryPassRate : null,
+            baselinePassRate: loadGate && !options.loadOnly ? comparisonPassRate : null,
+            discriminatingCases: loadGate && hardGate && !options.loadOnly
                 ? discriminating.filter((item) => item.delta > 0).length : 0,
             effectivenessProven: effectivenessAssessment.passed,
             effectivenessAssessment,
@@ -380,8 +461,7 @@ function writeReviewWorkspace(evidenceRoot, cases, results, loadProbes, model, r
         assertions: ['所有声明加载 Skill 的配置精确命中本 Run 随机 probe；无 Skill baseline 不得猜中。'],
     });
     for (const probe of loadProbes) {
-        const passed = (probe.expectsLoad ? probe.exactLoaded : probe.didNotGuess) &&
-            probe.noTools && probe.directoryMatched;
+        const passed = loadProbeCorePassed(probe, String(loadProbes[0]?.openCodeVersion || ''));
         const expectation = {
             text: '当前配置加载了本 Run 的 Basic Skill 正文',
             passed,
@@ -759,11 +839,28 @@ export function assessEffectiveness(policy, observed) {
     };
 }
 function readSkillSource(root, directory, label) {
-    const path = realpathSync(resolve(directory));
+    const requestedPath = resolve(directory);
+    if (!pathEntryExists(requestedPath)) {
+        throw new Error(`${label} 路径不存在: ${directory}`);
+    }
+    const requestedInfo = lstatSync(requestedPath);
+    if (requestedInfo.isSymbolicLink()) {
+        throw new Error(`${label} 根目录不允许 symlink: ${directory}`);
+    }
+    if (!requestedInfo.isDirectory()) {
+        throw new Error(`${label} 根路径必须是目录: ${directory}`);
+    }
+    const path = realpathSync(requestedPath);
+    const tree = inspectSkillTree(path, label);
     const skillPath = join(path, 'SKILL.md');
-    if (!existsSync(skillPath))
-        throw new Error(`${label} 缺少 SKILL.md: ${directory}`);
+    if (!tree.some((entry) => entry.path === 'SKILL.md' && entry.kind === 'file')) {
+        throw new Error(`${label} 缺少普通文件 SKILL.md: ${directory}`);
+    }
     const body = readFileSync(skillPath, 'utf8');
+    const skillEntry = tree.find((entry) => entry.path === 'SKILL.md' && entry.kind === 'file');
+    if (skillEntry.hash !== sha256(body)) {
+        throw new Error(`${label} SKILL.md 在读取期间发生变化`);
+    }
     const frontmatter = body.match(/^---\s*\n([\s\S]*?)\n---/)?.[1] || '';
     const name = frontmatter.match(/^name:\s*["']?([^"'\n]+)["']?\s*$/m)?.[1]?.trim() || '';
     const version = frontmatter.match(/^metadata:\s*\n(?:^[ \t]+.*\n)*?^[ \t]+version:\s*["']?([^"'\n]+)["']?\s*$/m)?.[1]?.trim() || '';
@@ -771,10 +868,15 @@ function readSkillSource(root, directory, label) {
         throw new Error(`${label} 元数据非法: name=${name || 'missing'} version=${version || 'missing'}`);
     }
     const snapshotPath = join(path, 'snapshot.json');
+    const snapshotTreeEntry = tree.find((entry) => entry.path === 'snapshot.json' && entry.kind === 'file');
     let snapshot = null;
-    if (existsSync(snapshotPath)) {
+    if (snapshotTreeEntry) {
         try {
-            const parsed = JSON.parse(readFileSync(snapshotPath, 'utf8'));
+            const snapshotBody = readFileSync(snapshotPath, 'utf8');
+            if (snapshotTreeEntry.hash !== sha256(snapshotBody)) {
+                throw new Error('changed while reading');
+            }
+            const parsed = JSON.parse(snapshotBody);
             if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
                 throw new Error('must be object');
             snapshot = parsed;
@@ -793,7 +895,10 @@ function readSkillSource(root, directory, label) {
             throw new Error(`${label} snapshot.files 缺失`);
         }
         const expectedFiles = Object.keys(files).sort();
-        const actualFiles = listSnapshotFiles(path);
+        const actualFiles = tree
+            .filter((entry) => entry.kind === 'file' && entry.path !== 'snapshot.json')
+            .map((entry) => entry.path)
+            .sort();
         if (JSON.stringify(actualFiles) !== JSON.stringify(expectedFiles)) {
             throw new Error(`${label} snapshot 文件清单漂移: expected=${expectedFiles.join(',')} actual=${actualFiles.join(',')}`);
         }
@@ -803,8 +908,8 @@ function readSkillSource(root, directory, label) {
                 typeof expected !== 'string') {
                 throw new Error(`${label} snapshot 文件清单非法: ${file}`);
             }
-            const candidate = join(path, file);
-            if (!existsSync(candidate) || sha256(readFileSync(candidate)) !== expected) {
+            const candidate = tree.find((entry) => entry.path === file && entry.kind === 'file');
+            if (!candidate || candidate.hash !== expected) {
                 throw new Error(`${label} snapshot 文件漂移: ${file}`);
             }
         }
@@ -814,34 +919,88 @@ function readSkillSource(root, directory, label) {
     const displayPath = rel === '' || (rel !== '..' && !rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`))
         ? rel.split('\\').join('/') || '.'
         : path;
-    return { path, displayPath, name, version, hash: bodyHash, snapshot };
+    return { path, displayPath, name, version, hash: bodyHash, snapshot, tree };
 }
-function listSnapshotFiles(directory, prefix = '') {
-    const files = [];
-    for (const entry of readdirSync(join(directory, prefix), { withFileTypes: true })) {
-        const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
-        if (relativePath === 'snapshot.json')
-            continue;
-        if (entry.isDirectory())
-            files.push(...listSnapshotFiles(directory, relativePath));
-        else if (entry.isFile())
-            files.push(relativePath);
-        else
-            throw new Error(`previous Skill snapshot 不允许特殊文件: ${relativePath}`);
-    }
-    return files.sort();
+function inspectSkillTree(directory, label) {
+    const rootInfo = lstatSync(directory);
+    if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory()) {
+        throw new Error(`${label} 根路径必须是普通目录`);
+    }
+    const entries = [];
+    const pending = [''];
+    while (pending.length) {
+        const prefix = pending.pop();
+        const current = prefix ? join(directory, prefix) : directory;
+        for (const entry of readdirSync(current, { withFileTypes: true })
+            .sort((left, right) => left.name.localeCompare(right.name))) {
+            const relativePath = (prefix ? `${prefix}/${entry.name}` : entry.name)
+                .split('\\').join('/');
+            const candidate = join(directory, relativePath);
+            const before = lstatSync(candidate);
+            if (before.isSymbolicLink()) {
+                throw new Error(`${label} 不允许 symlink: ${relativePath}`);
+            }
+            if (before.isDirectory()) {
+                entries.push({ path: relativePath, kind: 'directory' });
+                pending.push(relativePath);
+                continue;
+            }
+            if (!before.isFile()) {
+                throw new Error(`${label} 不允许特殊文件: ${relativePath}`);
+            }
+            if (before.nlink !== 1) {
+                throw new Error(`${label} 不允许 hardlink: ${relativePath}`);
+            }
+            const hash = sha256(readFileSync(candidate));
+            const after = lstatSync(candidate);
+            if (!after.isFile() || after.isSymbolicLink() || after.nlink !== 1 ||
+                after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size) {
+                throw new Error(`${label} 文件在校验期间发生变化: ${relativePath}`);
+            }
+            entries.push({ path: relativePath, kind: 'file', hash });
+        }
+    }
+    return entries.sort((left, right) => left.path.localeCompare(right.path));
+}
+function assertSkillTreeMatches(actual, expected, label) {
+    if (stableJson(actual) !== stableJson(expected)) {
+        throw new Error(`${label} 全树在加载前发生漂移`);
+    }
 }
-function materializeConfiguration(sandbox, configuration, probe, command) {
+function materializeConfiguration(sandbox, configuration, probe, command, environment) {
     const target = join(sandbox, '.agents', 'skills', 'dingtalk-basic-behavior');
     mkdirSync(dirname(target), { recursive: true });
     rmSync(target, { recursive: true, force: true });
-    prepareOpenCodeEvalAgent(sandbox);
     if (configuration.expectsLoad && configuration.skill) {
-        const sourceBody = readFileSync(join(configuration.skill.path, 'SKILL.md'), 'utf8');
+        const sourceTree = inspectSkillTree(configuration.skill.path, `${configuration.name} Skill source`);
+        assertSkillTreeMatches(sourceTree, configuration.skill.tree, `${configuration.name} Skill source`);
+        const sourceSkillPath = join(configuration.skill.path, 'SKILL.md');
+        const sourceBody = readFileSync(sourceSkillPath, 'utf8');
+        if (sha256(sourceBody) !== configuration.skill.hash) {
+            throw new Error(`${configuration.name} Skill source SKILL.md 在复制前发生漂移`);
+        }
         cpSync(configuration.skill.path, target, { recursive: true });
-        writeFileSync(join(target, 'SKILL.md'), `${sourceBody.trimEnd()}\n\n<!-- dta-load-probe:${probe} -->\n`);
+        const copiedTree = inspectSkillTree(target, `${configuration.name} Skill copy`);
+        assertSkillTreeMatches(copiedTree, sourceTree, `${configuration.name} Skill copy`);
+        const instrumentedBody = `${sourceBody.trimEnd()}\n\n<!-- dta-load-probe:${probe} -->\n`;
+        const targetSkillPath = join(target, 'SKILL.md');
+        const temporarySkillPath = join(target, `.SKILL.md.${process.pid}.${Date.now()}.${randomUUID()}.tmp`);
+        try {
+            writeFileSync(temporarySkillPath, instrumentedBody, { flag: 'wx' });
+            renameSync(temporarySkillPath, targetSkillPath);
+        }
+        finally {
+            if (pathEntryExists(temporarySkillPath))
+                rmSync(temporarySkillPath, { force: true });
+        }
+        const instrumentedTree = sourceTree.map((entry) => entry.path === 'SKILL.md'
+            ? { ...entry, hash: sha256(instrumentedBody) }
+            : entry);
+        assertSkillTreeMatches(inspectSkillTree(target, `${configuration.name} instrumented Skill`), instrumentedTree, `${configuration.name} instrumented Skill`);
+        prepareOpenCodeEvalAgent(sandbox);
         const binding = bindRequiredBasicSkill(sandbox);
-        const preflight = verifyRequiredBasicSkill(binding, command);
+        const preflight = verifyRequiredBasicSkill(binding, command, environment);
+        const resolved = resolvedConfig(command, sandbox, environment);
         return {
             openCodeVersion: preflight.openCodeVersion,
             evidence: {
@@ -856,11 +1015,13 @@ function materializeConfiguration(sandbox, configuration, probe, command) {
                 instrumentedHash: binding.skill.hash,
                 probe,
                 binding: preflight,
+                resolvedConfig: resolved.summary,
             },
         };
     }
     removeRequiredBasicSkillInstruction(sandbox);
-    const baselineConfig = resolvedConfig(command, sandbox);
+    prepareOpenCodeEvalAgent(sandbox);
+    const baselineConfig = resolvedConfig(command, sandbox, environment);
     return {
         openCodeVersion: baselineConfig.openCodeVersion,
         evidence: {
@@ -872,21 +1033,21 @@ function materializeConfiguration(sandbox, configuration, probe, command) {
         },
     };
 }
-function resolvedConfig(command, cwd) {
+function resolvedConfig(command, cwd, environment) {
     const version = spawnSync(command, ['--version'], {
-        cwd, encoding: 'utf8', timeout: 30_000, maxBuffer: 1024 * 1024,
+        cwd, env: environment, encoding: 'utf8', timeout: 30_000, maxBuffer: 1024 * 1024,
     });
-    const child = spawnSync(command, ['debug', 'config'], {
-        cwd, encoding: 'utf8', timeout: 30_000, maxBuffer: 4 * 1024 * 1024,
+    const child = spawnSync(command, ['debug', 'config', '--pure'], {
+        cwd, env: environment, encoding: 'utf8', timeout: 30_000, maxBuffer: 4 * 1024 * 1024,
     });
     if (child.error || child.status !== 0) {
         throw new Error(`OpenCode baseline config preflight 失败: ${child.error?.message || child.stderr}`);
     }
-    const value = JSON.parse(String(child.stdout || '{}'));
-    const instructions = Array.isArray(value.instructions) ? value.instructions : [];
-    if (instructions.includes('.agents/skills/dingtalk-basic-behavior/SKILL.md')) {
-        throw new Error('without_skill baseline 仍包含 Basic Skill instruction');
+    if (version.error || version.status !== 0 || !String(version.stdout || '').trim()) {
+        throw new Error(`OpenCode version preflight 失败: ${version.error?.message || version.stderr}`);
     }
+    const value = JSON.parse(String(child.stdout || '{}'));
+    const verified = validateIsolatedResolvedConfig(value, cwd);
     const permission = value.permission && typeof value.permission === 'object'
         ? value.permission
         : {};
@@ -896,22 +1057,108 @@ function resolvedConfig(command, cwd) {
     return {
         openCodeVersion: String(version.stdout || '').trim(),
         summary: {
-            instructions,
+            instructions: verified.instructions,
             default_agent: value.default_agent || null,
             permission: { skill: permission.skill || null },
             evalAgent: agent['dta-eval'] || null,
         },
     };
 }
-export function prepareOpenCodeEvalAgent(workspace, tools = 'none') {
+function validateIsolatedResolvedConfig(value, workspace) {
+    const source = JSON.parse(readFileSync(join(workspace, 'opencode.json'), 'utf8'));
+    const expectedInstructions = source.instructions === undefined ? [] : source.instructions;
+    if (!Array.isArray(expectedInstructions) ||
+        expectedInstructions.some((item) => typeof item !== 'string')) {
+        throw new Error('OpenCode Eval project instructions 非法');
+    }
+    const instructions = value.instructions === undefined ? [] : value.instructions;
+    if (!Array.isArray(instructions) || instructions.some((item) => typeof item !== 'string') ||
+        stableJson(instructions) !== stableJson(expectedInstructions)) {
+        throw new Error('OpenCode resolved instructions 被用户级、远端或托管 config 污染');
+    }
+    const plugins = value.plugin === undefined ? [] : value.plugin;
+    if (!Array.isArray(plugins) || plugins.length > 0) {
+        throw new Error('OpenCode resolved plugin 不为空，隔离失败');
+    }
+    const mcp = value.mcp === undefined ? {} : value.mcp;
+    if (!mcp || typeof mcp !== 'object' || Array.isArray(mcp) || Object.keys(mcp).length > 0) {
+        throw new Error('OpenCode resolved MCP 不为空，隔离失败');
+    }
+    if (value.share !== undefined && value.share !== 'disabled') {
+        throw new Error('OpenCode resolved share 未禁用');
+    }
+    const provider = value.provider === undefined ? {} : value.provider;
+    if (!provider || typeof provider !== 'object' || Array.isArray(provider) ||
+        Object.keys(provider).length > 0) {
+        throw new Error('OpenCode resolved provider 不为空，隔离评测拒绝项目级 provider 覆盖');
+    }
+    return { instructions: [...instructions] };
+}
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    if (value && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+export function prepareOpenCodeEvalAgent(workspace, tools = 'none', allowedReadPaths = []) {
     const path = join(workspace, 'opencode.json');
-    const config = existsSync(path)
+    const parsed = existsSync(path)
         ? JSON.parse(readFileSync(path, 'utf8'))
         : { $schema: 'https://opencode.ai/config.json' };
-    const agents = config.agent && typeof config.agent === 'object' && !Array.isArray(config.agent)
-        ? config.agent
-        : {};
-    agents['dta-eval'] = {
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('OpenCode Eval opencode.json 必须是 object');
+    }
+    const config = parsed;
+    if (config.instructions !== undefined &&
+        (!Array.isArray(config.instructions) ||
+            config.instructions.some((item) => typeof item !== 'string'))) {
+        throw new Error('OpenCode Eval instructions 必须是 string array');
+    }
+    for (const instruction of config.instructions || []) {
+        const raw = instruction.trim();
+        const candidate = resolve(workspace, raw);
+        if (!raw || /^https?:\/\//i.test(raw) || raw.startsWith('~/') ||
+            raw.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(raw) ||
+            raw.split(/[\\/]/).includes('..') || instructionUsesGlob(raw) ||
+            !isWorkspacePathInside(workspace, candidate) || !existsSync(candidate)) {
+            throw new Error(`OpenCode Eval instruction 必须是 sandbox 内已存在的本地相对文件: ${instruction}`);
+        }
+        const info = lstatSync(candidate);
+        if (!info.isFile() || info.isSymbolicLink()) {
+            throw new Error(`OpenCode Eval instruction 不是普通文件: ${instruction}`);
+        }
+    }
+    if (config.plugin !== undefined &&
+        (!Array.isArray(config.plugin) || config.plugin.length > 0)) {
+        throw new Error('OpenCode Eval 隔离工作区不允许 plugin');
+    }
+    if (config.mcp !== undefined &&
+        (!config.mcp || typeof config.mcp !== 'object' || Array.isArray(config.mcp) ||
+            Object.keys(config.mcp).length > 0)) {
+        throw new Error('OpenCode Eval 隔离工作区不允许 MCP');
+    }
+    if (config.agent !== undefined &&
+        (!config.agent || typeof config.agent !== 'object' || Array.isArray(config.agent))) {
+        throw new Error('OpenCode Eval agent 必须是 object');
+    }
+    if (config.skills !== undefined &&
+        (!config.skills || typeof config.skills !== 'object' || Array.isArray(config.skills) ||
+            Object.keys(config.skills).length > 0)) {
+        throw new Error('OpenCode Eval 隔离工作区不允许 skills.paths/urls');
+    }
+    for (const key of ['provider', 'formatter', 'lsp']) {
+        const value = config[key];
+        if (value !== undefined &&
+            (!value || typeof value !== 'object' || Array.isArray(value) ||
+                Object.keys(value).length > 0)) {
+            throw new Error(`OpenCode Eval 隔离工作区不允许项目级 ${key}`);
+        }
+    }
+    const evalAgent = {
         description: tools === 'none'
             ? '只读执行 dingtalk-agent 合成行为评测'
             : '在隔离工作区内执行 dingtalk-agent 文件/产物评测',
@@ -921,13 +1168,96 @@ export function prepareOpenCodeEvalAgent(workspace, tools = 'none') {
             : tools === 'workspace-read'
                 ? { '*': false, read: true }
                 : { '*': false, read: true, write: true, edit: true },
+        permission: tools === 'none'
+            ? { '*': 'deny', external_directory: 'deny' }
+            : tools === 'workspace-read'
+                ? {
+                    '*': 'deny',
+                    read: allowedReadPaths.length
+                        ? Object.fromEntries([
+                            ['*', 'deny'],
+                            ...allowedReadPaths.flatMap((item) => {
+                                const absolute = resolve(workspace, item);
+                                const variants = [item, absolute];
+                                if (existsSync(absolute)) {
+                                    const real = realpathSync(absolute);
+                                    variants.push(real, relative(parse(real).root, real));
+                                }
+                                return [...new Set(variants)].map((path) => [path, 'allow']);
+                            }),
+                        ])
+                        : 'allow',
+                    external_directory: 'deny',
+                }
+                : { '*': 'deny', read: 'allow', edit: 'allow', external_directory: 'deny' },
     };
-    config.agent = agents;
-    atomicJson(path, config);
+    // Rebuild from an allowlist. Provider identity/credentials come only from the
+    // isolated host and explicit --model; executable project surfaces such as
+    // formatter, LSP, plugin, MCP and arbitrary agents never enter the probe.
+    const safeConfig = {
+        $schema: typeof config.$schema === 'string'
+            ? config.$schema : 'https://opencode.ai/config.json',
+        instructions: [...(config.instructions || [])],
+        permission: {
+            skill: { '*': 'deny', 'dingtalk-basic-behavior': 'allow' },
+        },
+        agent: { 'dta-eval': evalAgent },
+        plugin: [],
+        mcp: {},
+        share: 'disabled',
+        autoupdate: false,
+    };
+    atomicJson(path, safeConfig);
+}
+export function resolveOpenCodeEvalAgent(command, workspace, environment = process.env) {
+    const child = spawnSync(command, ['debug', 'config', '--pure'], {
+        cwd: workspace,
+        env: environment,
+        encoding: 'utf8',
+        timeout: 30_000,
+        maxBuffer: 4 * 1024 * 1024,
+    });
+    if (child.error || child.status !== 0) {
+        throw new Error(`OpenCode eval agent config preflight 失败: ${child.error?.message || String(child.stderr || child.stdout || '').trim()}`);
+    }
+    const value = JSON.parse(String(child.stdout || '{}'));
+    validateIsolatedResolvedConfig(value, workspace);
+    const agents = value.agent && typeof value.agent === 'object' && !Array.isArray(value.agent)
+        ? value.agent : {};
+    const agent = agents['dta-eval'];
+    if (!agent || typeof agent !== 'object' || Array.isArray(agent)) {
+        throw new Error('OpenCode resolved config 缺少 dta-eval agent');
+    }
+    const source = JSON.parse(readFileSync(join(workspace, 'opencode.json'), 'utf8'));
+    const expected = source?.agent?.['dta-eval'];
+    const normalized = { ...agent };
+    if (normalized.options && typeof normalized.options === 'object' &&
+        !Array.isArray(normalized.options) && Object.keys(normalized.options).length === 0) {
+        delete normalized.options;
+    }
+    if (stableJson(normalized) !== stableJson(expected)) {
+        throw new Error('OpenCode resolved dta-eval 被外部 config 注入或扩权');
+    }
+    return agent;
 }
-export function runOpenCodePrompt(command, cwd, model, prompt, title, timeoutMs, sessionId = '') {
+export function readOpenCodeVersion(command, workspace, environment = process.env) {
+    const child = spawnSync(command, ['--version'], {
+        cwd: workspace,
+        env: environment,
+        encoding: 'utf8',
+        timeout: 30_000,
+        maxBuffer: 1024 * 1024,
+    });
+    const version = String(child.stdout || '').trim();
+    if (child.error || child.status !== 0 || !version) {
+        throw new Error(`OpenCode version preflight 失败: ${child.error?.message || String(child.stderr || child.stdout || '').trim()}`);
+    }
+    return version;
+}
+export function runOpenCodePrompt(command, cwd, model, prompt, title, timeoutMs, sessionId = '', environment = process.env) {
     const args = [
-        'run', '--dir', cwd, '--format', 'json', '--model', model, '--agent', 'dta-eval', '--title', title,
+        'run', '--pure', '--dir', cwd, '--format', 'json', '--model', model,
+        '--agent', 'dta-eval', '--title', title,
     ];
     if (sessionId)
         args.push('--session', sessionId);
@@ -935,6 +1265,7 @@ export function runOpenCodePrompt(command, cwd, model, prompt, title, timeoutMs,
     const started = Date.now();
     const child = spawnSync(command, args, {
         cwd,
+        env: environment,
         encoding: 'utf8',
         timeout: timeoutMs,
         maxBuffer: 16 * 1024 * 1024,
@@ -958,13 +1289,14 @@ export function runOpenCodePrompt(command, cwd, model, prompt, title, timeoutMs,
     const toolNames = [...new Set(toolEvents
             .map((event) => String(event.part?.tool || event.part?.name || event.tool || event.name || ''))
             .filter(Boolean))];
-    const toolPaths = [...new Set(toolEvents.flatMap((event) => extractToolPaths(event)))];
+    const toolPaths = [...new Set(toolEvents.flatMap((event) => extractToolPaths(event, cwd)))];
     const toolTrace = toolEvents.map((event) => ({
         name: String(event.part?.tool || event.part?.name || event.tool || event.name || ''),
-        paths: [...new Set(extractToolPaths(event))],
+        paths: [...new Set(extractToolPaths(event, cwd))],
         status: String(event.part?.state?.status || event.status || ''),
+        readWindow: extractReadWindow(event),
     })).filter((item) => item.name);
-    const sessionEvidence = verifySessionDirectory(command, String(session || ''), cwd);
+    const sessionEvidence = verifySessionDirectory(command, String(session || ''), cwd, environment);
     return {
         exitCode: child.status,
         stdout: String(child.stdout || ''),
@@ -980,19 +1312,29 @@ export function runOpenCodePrompt(command, cwd, model, prompt, title, timeoutMs,
         durationMs: Date.now() - started,
         directoryMatched: sessionEvidence.matched,
         sessionDirectory: sessionEvidence.directory,
+        sessionExport: {
+            exitCode: sessionEvidence.exitCode,
+            stdout: sessionEvidence.stdout,
+            stderr: sessionEvidence.stderr,
+        },
     };
 }
-function verifySessionDirectory(command, sessionId, expected) {
-    if (!sessionId)
-        return { matched: false, directory: '' };
+function verifySessionDirectory(command, sessionId, expected, environment) {
+    if (!sessionId) {
+        return { matched: false, directory: '', exitCode: null, stdout: '', stderr: '' };
+    }
     const child = spawnSync(command, ['export', sessionId], {
         cwd: expected,
+        env: environment,
         encoding: 'utf8',
         timeout: 30_000,
         maxBuffer: 8 * 1024 * 1024,
     });
-    if (child.error || child.status !== 0)
-        return { matched: false, directory: '' };
+    const stdout = String(child.stdout || '');
+    const stderr = String(child.stderr || child.error?.message || '');
+    if (child.error || child.status !== 0) {
+        return { matched: false, directory: '', exitCode: child.status, stdout, stderr };
+    }
     try {
         const exported = JSON.parse(String(child.stdout || '{}'));
         const directory = String(exported?.info?.directory || '');
@@ -1000,10 +1342,13 @@ function verifySessionDirectory(command, sessionId, expected) {
             matched: Boolean(directory) && existsSync(directory) &&
                 realpathSync(directory) === realpathSync(expected),
             directory,
+            exitCode: child.status,
+            stdout,
+            stderr,
         };
     }
     catch {
-        return { matched: false, directory: '' };
+        return { matched: false, directory: '', exitCode: child.status, stdout, stderr };
     }
 }
 function writeExecution(directory, prompt, execution, result) {
@@ -1011,6 +1356,8 @@ function writeExecution(directory, prompt, execution, result) {
     writeFileSync(join(directory, 'prompt.txt'), prompt);
     writeFileSync(join(directory, 'opencode.stdout.ndjson'), execution.stdout);
     writeFileSync(join(directory, 'opencode.stderr.log'), execution.stderr);
+    writeFileSync(join(directory, 'opencode.export.stdout.json'), execution.sessionExport.stdout);
+    writeFileSync(join(directory, 'opencode.export.stderr.log'), execution.sessionExport.stderr);
     writeJson(join(directory, 'result.json'), result);
 }
 function passRate(values) {
@@ -1031,18 +1378,148 @@ function atomicJson(path, value) {
     renameSync(temporary, path);
 }
 function safeInside(root, path, mustExist) {
-    const rootReal = realpathSync(resolve(root));
-    const resolved = resolve(rootReal, path);
-    const candidate = mustExist && existsSync(resolved) ? realpathSync(resolved) : resolved;
-    const rel = relative(rootReal, candidate);
-    if (rel === '..' || rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`)) {
-        throw new Error(`OpenCode Eval 路径必须位于当前目录内: ${path}`);
-    }
-    if (mustExist && !existsSync(candidate))
-        throw new Error(`OpenCode Eval 路径不存在: ${path}`);
-    return candidate;
+    const rootLexical = resolve(root);
+    const rootReal = realpathSync(rootLexical);
+    const requested = resolve(rootLexical, path);
+    if (mustExist) {
+        if (!existsSync(requested))
+            throw new Error(`OpenCode Eval 路径不存在: ${path}`);
+        const candidate = realpathSync(requested);
+        if (!isWorkspacePathInside(rootReal, candidate)) {
+            throw new Error(`OpenCode Eval 路径真实位置越出当前目录: ${path}`);
+        }
+        return candidate;
+    }
+    const lexicalRel = relative(rootLexical, requested);
+    let rel = lexicalRel;
+    if (!relativeIsInside(lexicalRel)) {
+        let ancestor = requested;
+        while (!pathEntryExists(ancestor) && dirname(ancestor) !== ancestor)
+            ancestor = dirname(ancestor);
+        const projected = resolve(realpathSync(ancestor), relative(ancestor, requested));
+        if (!isWorkspacePathInside(rootReal, projected)) {
+            throw new Error(`OpenCode Eval 路径必须位于当前目录内: ${path}`);
+        }
+        rel = relative(rootReal, projected);
+    }
+    const resolved = resolve(rootReal, rel);
+    let cursor = rootReal;
+    for (const segment of rel.split(/[\\/]/).filter(Boolean)) {
+        cursor = join(cursor, segment);
+        if (!pathEntryExists(cursor))
+            break;
+        const info = lstatSync(cursor);
+        if (info.isSymbolicLink()) {
+            throw new Error(`OpenCode Eval 输出路径不允许 symlink: ${relative(rootReal, cursor)}`);
+        }
+        if (cursor !== resolved && !info.isDirectory()) {
+            throw new Error(`OpenCode Eval 输出路径祖先不是目录: ${relative(rootReal, cursor)}`);
+        }
+    }
+    let ancestor = resolved;
+    while (!pathEntryExists(ancestor) && dirname(ancestor) !== ancestor)
+        ancestor = dirname(ancestor);
+    const projected = resolve(realpathSync(ancestor), relative(ancestor, resolved));
+    if (!isWorkspacePathInside(rootReal, projected)) {
+        throw new Error(`OpenCode Eval 输出路径真实位置越出当前目录: ${path}`);
+    }
+    return resolved;
+}
+function relativeIsInside(rel) {
+    const separator = process.platform === 'win32' ? '\\' : '/';
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${separator}`));
 }
-function extractToolPaths(event) {
+function assertCopyableWorkspaceTree(root, excludeControl = true) {
+    const pending = [root];
+    while (pending.length) {
+        const directory = pending.pop();
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            const path = join(directory, entry.name);
+            const rel = relative(root, path);
+            const first = rel.split(/[\\/]/)[0];
+            if (excludeControl && ['.git', '.dingtalk-agent'].includes(first))
+                continue;
+            if (first === '.opencode') {
+                throw new Error('OpenCode Eval workspace 不允许 .opencode 可执行扩展目录');
+            }
+            const info = lstatSync(path);
+            if (info.isSymbolicLink()) {
+                throw new Error(`OpenCode Eval workspace 不允许 symlink: ${rel}`);
+            }
+            if (info.isDirectory())
+                pending.push(path);
+            else if (!info.isFile()) {
+                throw new Error(`OpenCode Eval workspace 不允许特殊文件: ${rel}`);
+            }
+        }
+    }
+}
+function assertSafeEvalProjectConfig(workspace) {
+    const path = join(workspace, 'opencode.json');
+    if (!existsSync(path))
+        return;
+    const parsed = JSON.parse(readFileSync(path, 'utf8'));
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('OpenCode Eval opencode.json 必须是 object');
+    }
+    const config = parsed;
+    const instructions = config.instructions === undefined ? [] : config.instructions;
+    if (!Array.isArray(instructions) || instructions.some((item) => typeof item !== 'string')) {
+        throw new Error('OpenCode Eval instructions 必须是 string array');
+    }
+    for (const instruction of instructions) {
+        const raw = instruction.trim();
+        const candidate = resolve(workspace, raw);
+        if (!raw || /^https?:\/\//i.test(raw) || raw.startsWith('~/') ||
+            raw.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(raw) ||
+            raw.split(/[\\/]/).includes('..') || instructionUsesGlob(raw) ||
+            !isWorkspacePathInside(workspace, candidate) || !existsSync(candidate) ||
+            !lstatSync(candidate).isFile()) {
+            throw new Error(`OpenCode Eval instruction 必须是 sandbox 内已存在的本地相对文件: ${instruction}`);
+        }
+    }
+    const forbidden = ['provider', 'formatter', 'lsp', 'skills'];
+    for (const key of forbidden) {
+        const value = config[key];
+        if (value !== undefined &&
+            (!value || typeof value !== 'object' || Array.isArray(value) ||
+                Object.keys(value).length > 0)) {
+            throw new Error(`OpenCode Eval 隔离工作区不允许项目级 ${key}`);
+        }
+    }
+    if (config.plugin !== undefined &&
+        (!Array.isArray(config.plugin) || config.plugin.length > 0)) {
+        throw new Error('OpenCode Eval 隔离工作区不允许 plugin');
+    }
+    if (config.mcp !== undefined &&
+        (!config.mcp || typeof config.mcp !== 'object' || Array.isArray(config.mcp) ||
+            Object.keys(config.mcp).length > 0)) {
+        throw new Error('OpenCode Eval 隔离工作区不允许 MCP');
+    }
+}
+function initializeIsolatedWorktree(workspace) {
+    const command = process.env.DTA_GIT_BIN ||
+        (existsSync('/usr/bin/git') ? '/usr/bin/git' : 'git');
+    const child = spawnSync(command, ['init', '--quiet'], {
+        cwd: workspace,
+        encoding: 'utf8',
+        timeout: 30_000,
+        maxBuffer: 1024 * 1024,
+    });
+    if (child.error || child.status !== 0) {
+        throw new Error(`OpenCode Eval 无法初始化隔离 git worktree: ${child.error?.message || String(child.stderr || child.stdout || '').trim()}`);
+    }
+}
+function pathEntryExists(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function extractToolPaths(event, cwd) {
     const values = [];
     const candidates = [event.part?.state?.input, event.part?.state?.metadata];
     for (const candidate of candidates) {
@@ -1051,12 +1528,19 @@ function extractToolPaths(event) {
         for (const [key, value] of Object.entries(candidate)) {
             if (!['filePath', 'filepath', 'path', 'directory'].includes(key) || typeof value !== 'string')
                 continue;
-            if (value.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(value))
-                values.push(resolve(value));
+            values.push(value.startsWith('/') || /^[a-zA-Z]:[\\/]/.test(value)
+                ? resolve(value) : resolve(cwd, value));
         }
     }
     return values;
 }
+function extractReadWindow(event) {
+    const input = event.part?.state?.input;
+    return {
+        offset: Number.isInteger(input?.offset) ? Number(input.offset) : null,
+        limit: Number.isInteger(input?.limit) ? Number(input.limit) : null,
+    };
+}
 function safeName(value) {
     return value.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'case';
 }