@xdxer/dingtalk-agent 0.1.4-beta.16 → 0.1.4-beta.18

package/CHANGELOG.md

@@ -2,6 +2,48 @@
 
 All notable changes to `@xdxer/dingtalk-agent` are documented here. The project follows semantic versioning; prerelease entries describe release candidates and do not imply that Live canaries or registry publication have completed.
 
+## 0.1.4-beta.18 - 2026-07-20
+
+### Added
+
+- `dingtalk-agent-eval/references/local-connector-smoke.md`: the local route for an Agent that is **not yet deployed** — a dedicated test robot driven by a `dws dev connect` connector against a local workspace. Covers egress ownership (`robot-connect`/`connector`), the workspace constraints that must hold before starting, a five-step runbook, `status=not_running` as the only teardown truth, and how it differs from the Robot Pool. It is explicitly not a fourth interactive channel: the other three test deployed artifacts.
+- `dingtalk-agent-eval/references/failure-to-case.md`: how a real failure becomes a regression case — the iteration path, the CLI-versus-Skill discrimination rule ("would bypassing this produce a worse reply, or a wrong side effect?"), and how to set up the with/without and current/previous comparisons without letting ordering effects read as gains.
+- The L0–L4 tier table with promotion rules now lives in the eval SKILL; the eight-item hard-gate checklist and the sandbox containment audit now live in `evidence-contract.md`; egress ownership and the Role Principal / Execution Subject / Input Channel split now live in `eval-topology.md`.
+
+### Changed
+
+- Testing methods are consolidated into the eval skill as the single source of truth. `docs/SELF-TEST.md` loses 191 lines of method content and keeps only this repository's own evidence, baselines and historical conclusions; `docs/ARCHITECTURE.md` and the Multica `PLATFORM.md` converge to pointers. This fixes a real defect: `docs/` is not part of the npm tarball, so shipped skill text was pointing users at files their installation does not contain.
+- The local smoke route no longer hardcodes `--channel claudecode`. It selects by whichever coding agent is actually installed, and states plainly that the Robot Pool still pins a single channel.
+- Fixed an error in the eval SKILL channel table: channel B's egress owner is the platform-side Agent, not the connector.
+- `dingtalk-agent-eval` 0.6.0 → 0.7.0.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag and a Git tag. No DingTalk write, robot binding, or Live canary was executed. Verification used targeted contract scenarios (20/28/34/56/62) plus a link check over the packaged skill tree, per the repository's current fast-verification discipline.
+
+## 0.1.4-beta.17 - 2026-07-20
+
+### Added
+
+- Interactive debug channels for a delivered Agent (`dingtalk-agent-eval/references/interactive-debug-channels.md`): three channels — platform CLI dispatch, your own DingTalk identity to a bound robot, and digital-employee identity (in development) — each with what it proves and explicitly does not prove, an A→B→C one-way escalation rule, and a four-way attribution tree for "no reply" (eligibility silence / channel not connected / runtime or task failure / genuinely wrong answer). The Compose skill hands off to eval after assembly instead of improvising acceptance criteria.
+- `platform trace` as a first-class evidence surface: the managed platform's persisted execution trace (task and session id, reasoning, every tool call, `failure_reason`, the skills actually in effect) is the only surface that reliably catches "the reply reads correctly but the assembly is broken". Synced across the eval SKILL, the evidence contract, the topology table and the lab catalog schema enum.
+- Skill version state model replacing a single boolean: `missing / current / modified / outdated / ahead / unknown`, backed by a whole-tree `contentHash` so a body edit that skips a version bump is still detected. `skill status` reports `installedVersion → skillVersion (state)`; `doctor` prints the same and folds already-installed platform skills into the report without letting opt-in skills affect `ready`; `dta upgrade` reports before/after/bundled/state per skill.
+- `scripts/check-skill-versions.mjs`, wired into `release:check`: a skill whose body changed against the baseline without a version bump, or whose version regressed, fails the gate.
+- Contract scenario 62 `SkillVersionDrift` covering the four drift states, the downgrade refusal and its `--allow-downgrade` recovery, doctor grading, and content-hash detection.
+
+### Changed
+
+- `dingtalk-agent-eval` joins the default skill suite. Testing methods are consolidated into that skill, so a machine without it has no path to any testing guidance; `setup` and `skill install` now install three skills.
+- Skill updates fail closed: a local copy newer than the bundled one is refused unless `--allow-downgrade`, and every install/upgrade re-reads the canonical copy afterwards — exit code 0 with a non-`current` readback is now an error rather than a silent success.
+- `multica-external` declares `metadata.version` for the first time. Without it the empty-string comparison was always true, so the skill reported `current` permanently and could never be upgraded.
+- `src/version.ts` extracted so the npm package and skills share one semver implementation; prerelease comparison changed from whole-string collation to dot-identifier segments.
+- OpenCode/Multica real acceptance chain (from the branch's earlier work): JSON-stringified prompts accepted, `agent.displayName` added, and the skill load smoke verified against a strict structured allowlist.
+- Stale `skills/<name>/` paths left by the core/platforms reorganization corrected in AGENTS.md, CLAUDE.md, CONTRIBUTING.md, the eval catalog template and three lab fixtures; the frozen 2026-07-16 baselines are deliberately left untouched.
+
+### Release boundary
+
+- Distribution is limited to the public npm `beta` dist-tag and a Git tag. No DingTalk write, robot binding, or Live canary was executed for this release: the interactive-channel documentation is verified against source and CLI help output only, and the version mechanism is verified by deterministic contract scenarios. Live waivers from beta.9 remain unchanged.
+
 ## 0.1.4-beta.16 - 2026-07-20
 
 ### Added

package/README.en.md

@@ -158,6 +158,7 @@ dta agent audit \
 | Install, upgrade, or troubleshoot | [Installation](docs/INSTALLATION.md) |
 | Understand evaluation and evidence levels | [Self-test](docs/SELF-TEST.md) |
 | Create or audit an Agent | [Compose Skill](skills/core/dingtalk-agent-compose/SKILL.md) |
+| Test or debug a delivered Agent | [Eval Skill](skills/core/dingtalk-agent-eval/SKILL.md) |
 | Read the shared behavior protocol | [Basic Behavior Skill](skills/core/dingtalk-basic-behavior/SKILL.md) |
 | Copy a complete example | [Example Agents](examples/agents) |
 

package/README.md

@@ -158,6 +158,7 @@ dta agent audit \
 | 安装、升级与排障 | [Installation](docs/INSTALLATION.md) |
 | 理解评测与证据分层 | [Self-test](docs/SELF-TEST.md) |
 | 创建或审计 Agent | [Compose Skill](skills/core/dingtalk-agent-compose/SKILL.md) |
+| 测试或调试已交付的 Agent | [Eval Skill](skills/core/dingtalk-agent-eval/SKILL.md) |
 | 查看公共行为协议 | [Basic Behavior Skill](skills/core/dingtalk-basic-behavior/SKILL.md) |
 | 复制完整示例 | [Example Agents](examples/agents) |
 

package/dist/bin/dingtalk-agent.js

@@ -57,7 +57,7 @@ dta —— 给 Agent 安装钉钉员工的基础行为和工作环境
   · 从本地目录或钉钉文档加载身份、记忆和知识
 
 开始使用：
-  dta setup             首次配置 CLI、DWS 和内置 Skill（基础行为 + Agent 装配）
+  dta setup             首次配置 CLI、DWS 和内置 Skill（基础行为 + Agent 装配 + 交付后评测）
   dta bootstrap --json  为当前 Agent 会话加载工作区
   dta agent enhance / audit  安全增强已有仓库，再审计定义、存储与 Skill 真加载
   dta info / dta workspace doctor <name>  查看 Project 并只读诊断 Workspace
@@ -66,7 +66,7 @@ dta —— 给 Agent 安装钉钉员工的基础行为和工作环境
 维护环境：
   dta doctor            检查哪里没装好，并给出修复提示
   dta upgrade           自升级，再重新检查完整环境
-  dta skill status      查看 Claude Code、Codex、OpenCode 能否发现内置 Skill（可加 name 只查一个）
+  dta skill status      查看内置 Skill 的版本状态与三个客户端能否发现（可加 name 只查一个）
 
 接入钉钉事件和可靠外发：dta help runtime
 `;
@@ -683,25 +683,27 @@ async function main() {
             allowPositionals: true,
             options: {
                 name: { type: 'string' }, 'dry-run': { type: 'boolean' }, json: { type: 'boolean' },
+                'allow-downgrade': { type: 'boolean' },
             },
         });
         if (positionals.length > 1)
             fail('skill 最多接受一个 Skill name');
         const name = o.name || positionals[0];
         const dryRun = Boolean(o['dry-run']);
+        const allowDowngrade = Boolean(o['allow-downgrade']);
         let out;
         if (sub === 'install') {
             out = name
-                ? installGlobalSkill(PACKAGE_ROOT, { dryRun, name })
-                : installBundledSkills(PACKAGE_ROOT, { dryRun });
+                ? installGlobalSkill(PACKAGE_ROOT, { dryRun, name, allowDowngrade })
+                : installBundledSkills(PACKAGE_ROOT, { dryRun, allowDowngrade });
         }
         else if (sub === 'status') {
             out = name ? skillStatus(PACKAGE_ROOT, { dryRun, name }) : skillSuiteStatus(PACKAGE_ROOT, { dryRun });
         }
         else if (sub === 'upgrade') {
             out = name
-                ? upgradeGlobalSkill(PACKAGE_ROOT, { dryRun, name })
-                : upgradeBundledSkills(PACKAGE_ROOT, { dryRun });
+                ? upgradeGlobalSkill(PACKAGE_ROOT, { dryRun, name, allowDowngrade })
+                : upgradeBundledSkills(PACKAGE_ROOT, { dryRun, allowDowngrade });
         }
         else if (sub === 'uninstall') {
             out = name
@@ -1534,8 +1536,13 @@ function printSkillStatus(out, action, dryRun) {
     console.log(`${prefix} ${verb}: ${out.name}`);
     console.log(`   manager=${out.manager}  bundled=${out.bundled.skillVersion || '-'}`);
     console.log(`   canonical=${out.canonical.path}`);
-    console.log(`   installed=${out.canonical.exists}  installedVersion=${out.canonical.installedVersion || '-'}  ` +
-        `current=${out.canonical.current}`);
+    console.log(`   installed=${out.canonical.exists}  ` +
+        `${out.canonical.installedVersion || '—'} → ${out.bundled.skillVersion}  ` +
+        `state=${out.canonical.state}`);
+    if (out.operation?.after) {
+        console.log(`   ${out.operation.before.installedVersion || '—'}(${out.operation.before.state})` +
+            ` → ${out.operation.after.installedVersion}(${out.operation.after.state})`);
+    }
     if (out.operation)
         console.log(`   delegated: ${out.operation.command}`);
     for (const client of out.clients) {