@xdxer/dingtalk-agent 0.1.4-beta.8 → 0.1.4-beta.9

package/dist/src/development-workspace.js

@@ -0,0 +1,729 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readFileSync, readdirSync, realpathSync, statSync, } from 'node:fs';
+import { basename, dirname, join, parse, relative, resolve } from 'node:path';
+import { findExecutable } from './doctor.js';
+import { digest, stableStringify } from './events.js';
+import { resolvePackageRoot } from './package-root.js';
+import { loadWorkspace, workspacePath } from './workspace.js';
+export const PROJECT_FILE = 'dingtalk-agent.json';
+export const CURRENT_WORKSPACE_FILE = '.dingtalk-agent/current-workspace';
+export const WORKSPACE_STATE_ROOT = '.dingtalk-agent/state/workspaces';
+export const LEGACY_WORKSPACE_NAME = 'legacy-prepared';
+const PROJECT_KEYS = new Set(['$schema', 'name', 'dtaVersion', 'agent', 'workspaces']);
+const AGENT_KEYS = new Set(['definition', 'skills']);
+const WORKSPACE_KEYS = new Set(['stage', 'provider', 'storage', 'authority']);
+const OPENCODE_KEYS = new Set(['kind', 'model']);
+const MULTICA_KEYS = new Set([
+    'kind', 'profile', 'workspaceIdFrom', 'runtimeIdFrom', 'agentIdFrom',
+]);
+const STORAGE_KEYS = new Set(['memory', 'knowledge', 'artifacts']);
+const AUTHORITY_KEYS = new Set(['dwsProfileFrom', 'expectedUserIdFrom']);
+const STATE_KEYS = new Set([
+    '$schema', 'workspace', 'provider', 'status', 'binding', 'desiredHash', 'observedHash',
+    'lastPlanId', 'lastReceiptId', 'lastEvalId',
+]);
+const STATE_STATUSES = new Set([
+    'declared', 'resolving', 'planned', 'applying', 'verifying',
+    'ready', 'drifted', 'failed', 'retired',
+]);
+const SECRET_KEY = /(?:secret|token|cookie|password|credentials?)$/i;
+const NAME = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/;
+const ENV_REF = /^env:[A-Z_][A-Z0-9_]*$/;
+export function findAgentProjectRoot(start = process.cwd()) {
+    let directory = resolve(start);
+    if (existsSync(directory) && !statSync(directory).isDirectory())
+        directory = dirname(directory);
+    while (true) {
+        if (existsSync(join(directory, PROJECT_FILE)) || existsSync(workspacePath(directory))) {
+            return realpathSync(directory);
+        }
+        const parent = dirname(directory);
+        if (parent === directory || directory === parse(directory).root)
+            return null;
+        directory = parent;
+    }
+}
+export function inspectAgentProject(start = process.cwd(), cliVersion = '') {
+    const loaded = loadAgentProject(start);
+    const currentWorkspace = readCurrentWorkspace(loaded.root);
+    const declared = Object.entries(loaded.manifest.workspaces)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([name, workspace]) => declaredView(loaded, name, workspace, currentWorkspace));
+    if (loaded.legacy && !(LEGACY_WORKSPACE_NAME in loaded.manifest.workspaces)) {
+        declared.push(legacyView(loaded, loaded.legacy, currentWorkspace));
+    }
+    if (currentWorkspace && !declared.some((item) => item.name === currentWorkspace)) {
+        throw new Error(`current-workspace 指向未知 Workspace: ${currentWorkspace}`);
+    }
+    return {
+        $schema: 'dingtalk-agent/info@1',
+        root: loaded.root,
+        source: loaded.source,
+        manifest: loaded.manifestPath ? relative(loaded.root, loaded.manifestPath) : '',
+        manifestHash: loaded.manifestHash,
+        project: {
+            name: loaded.manifest.name,
+            dtaVersion: loaded.manifest.dtaVersion,
+            compatibleWithCli: !cliVersion || versionSatisfies(cliVersion, loaded.manifest.dtaVersion),
+            definition: loaded.manifest.agent.definition,
+            skills: [...loaded.manifest.agent.skills],
+        },
+        currentWorkspace,
+        workspaces: declared,
+        sideEffect: false,
+        dingtalkSideEffect: false,
+    };
+}
+export function showDevelopmentWorkspace(start, name, cliVersion = '') {
+    const info = inspectAgentProject(start, cliVersion);
+    const workspace = info.workspaces.find((item) => item.name === name);
+    if (!workspace)
+        throw new Error(`Project 未声明 Workspace: ${name}`);
+    return workspace;
+}
+export function doctorDevelopmentWorkspace(start, name, options = {}) {
+    const cliVersion = options.cliVersion || '';
+    const env = options.env || process.env;
+    const info = inspectAgentProject(start, cliVersion);
+    const workspace = info.workspaces.find((item) => item.name === name);
+    if (!workspace)
+        throw new Error(`Project 未声明 Workspace: ${name}`);
+    const checks = [];
+    const add = (id, surface, level, blocking, summary, evidence = {}, fix) => checks.push({ id, surface, level, blocking, summary, evidence, ...(fix ? { fix } : {}) });
+    add('project.schema', 'project', 'pass', true, 'Project manifest/schema 可解析', {
+        source: info.source, manifestHash: info.manifestHash,
+    });
+    add('project.version', 'project', info.project.compatibleWithCli ? 'pass' : 'fail', true, info.project.compatibleWithCli ? 'Project 声明兼容当前 dta 版本' : 'Project dtaVersion 与当前 CLI 不兼容', { required: info.project.dtaVersion, actual: cliVersion || 'unknown' }, '升级 CLI，或在审阅兼容性后更新 dingtalk-agent.json#dtaVersion');
+    const definition = inspectLocalFile(info.root, info.project.definition);
+    add('definition.file', 'definition', definition.valid ? 'pass' : 'fail', true, definition.valid ? 'Agent Definition 位于 Project 内且可读' : 'Agent Definition 缺失、越界或不是文件', definition, `修复 ${info.project.definition}`);
+    for (const [slot, uri] of Object.entries(workspace.storage)) {
+        const local = inspectStorageRoute(info.root, uri);
+        const blocking = !uri.startsWith('dingtalk-doc:') && !(workspace.legacy && slot === 'artifacts');
+        add(`storage.${slot}`, 'storage', local.valid ? 'pass' : blocking ? 'fail' : 'warn', blocking, local.valid ? `${slot} Storage route 可解析`
+            : uri.startsWith('dingtalk-doc:') ? `${slot} 是远端语义路由，W1 不执行 DWS 回读`
+                : `${slot} 本地 Storage route 缺失或越界`, { route: uri, ...local }, local.fix);
+    }
+    if (workspace.state) {
+        add('state.provider', 'state', workspace.drift.includes('provider') ? 'fail' : 'pass', true, workspace.drift.includes('provider') ? 'State Provider 与声明不一致' : 'State Provider 与声明一致', { declared: workspace.provider.kind, observed: workspace.state.provider });
+        add('state.desired-hash', 'state', workspace.drift.includes('desiredHash') ? 'fail' : 'pass', true, workspace.drift.includes('desiredHash') ? 'State desiredHash 已漂移' : 'State desiredHash 与声明一致', { desiredHash: workspace.desiredHash, stateDesiredHash: workspace.state.desiredHash });
+        add('state.status', 'state', workspace.state.status === 'ready' ? 'pass' : 'fail', true, workspace.state.status === 'ready' ? 'Provider state 已回读为 ready'
+            : `Provider state 尚未 ready: ${workspace.state.status}`, { status: workspace.state.status });
+        const observedHashValid = /^[a-f0-9]{64}$/.test(workspace.state.observedHash);
+        add('state.observed-hash', 'state', observedHashValid ? 'pass' : 'fail', true, observedHashValid ? 'Provider observedHash 是稳定 sha256' : 'ready state 缺少有效 observedHash', { configured: Boolean(workspace.state.observedHash) });
+    }
+    else {
+        const required = !workspace.legacy;
+        add('state.present', 'state', required ? 'fail' : 'warn', required, required ? '尚无 Provider 回读 state；Workspace 只完成声明，尚未就绪'
+            : 'Legacy adapter 不要求新的 Provider state', {
+            expectedPath: workspace.statePath,
+        });
+    }
+    if (workspace.provider.kind === 'opencode') {
+        inspectOpenCodeWorkspace(info, workspace, env, add);
+    }
+    else if (workspace.provider.kind === 'multica') {
+        inspectDeclaredMulticaWorkspace(workspace, env, add);
+    }
+    else {
+        add('provider.legacy', 'provider', 'pass', true, 'Legacy Prepared Workspace 已通过 workspace@1 parser 只读加载', {
+            provider: workspace.provider.kind, state: 'adapter-only',
+        });
+    }
+    const missing = checks.filter((check) => check.blocking && check.level !== 'pass')
+        .map((check) => check.id);
+    return {
+        $schema: 'dingtalk-agent/workspace-doctor@1',
+        ready: missing.length === 0,
+        workspace: workspace.name,
+        provider: workspace.provider.kind,
+        desiredHash: workspace.desiredHash,
+        observedHash: workspace.observedHash,
+        status: workspace.status,
+        checks,
+        missing,
+        configSources: workspace.configSources,
+        sideEffect: false,
+        dingtalkSideEffect: false,
+    };
+}
+function loadAgentProject(start) {
+    const root = findAgentProjectRoot(start);
+    if (!root) {
+        throw new Error(`找不到 ${PROJECT_FILE} 或 ${workspacePath('<project>')}；请在 Agent Project 内运行`);
+    }
+    const manifestPath = join(root, PROJECT_FILE);
+    const legacyPath = workspacePath(root);
+    if (existsSync(legacyPath) && (lstatSync(legacyPath).isSymbolicLink() || !isInside(root, realpathSync(legacyPath)))) {
+        throw new Error('Legacy workspace manifest 不能是越界符号链接');
+    }
+    const legacy = existsSync(legacyPath) ? loadWorkspace(root) : null;
+    if (!existsSync(manifestPath)) {
+        if (!legacy)
+            throw new Error(`找不到 ${PROJECT_FILE}`);
+        const manifest = syntheticLegacyProject(root, legacy);
+        return {
+            root, source: 'legacy', manifestPath: '', manifest,
+            manifestHash: digest(stableStringify(manifest)), legacy,
+        };
+    }
+    if (lstatSync(manifestPath).isSymbolicLink()) {
+        throw new Error(`${PROJECT_FILE} 不能是符号链接`);
+    }
+    let raw;
+    let source = '';
+    try {
+        source = readFileSync(manifestPath, 'utf8');
+        raw = JSON.parse(source);
+    }
+    catch (error) {
+        throw new Error(`${PROJECT_FILE} 不是合法 JSON: ${error.message}`);
+    }
+    rejectSecretLikeKeys(raw, PROJECT_FILE);
+    const manifest = validateProjectManifest(raw, root);
+    return {
+        root, source: 'manifest', manifestPath: realpathSync(manifestPath), manifest,
+        manifestHash: digest(stableStringify(manifest)), legacy,
+    };
+}
+function validateProjectManifest(value, root) {
+    const input = objectValue(value, 'Project manifest');
+    assertExactKeys(input, PROJECT_KEYS, 'Project manifest');
+    if (input.$schema !== 'dingtalk-agent/project@1') {
+        throw new Error('Project manifest 缺少 dingtalk-agent/project@1 schema');
+    }
+    const name = stableName(input.name, 'Project name');
+    const dtaVersion = requiredString(input.dtaVersion, 'dtaVersion');
+    const agentInput = objectValue(input.agent, 'Project agent');
+    assertExactKeys(agentInput, AGENT_KEYS, 'Project agent');
+    const definition = safeRelativePath(root, requiredString(agentInput.definition, 'agent.definition'), 'agent.definition', false);
+    if (!Array.isArray(agentInput.skills) || agentInput.skills.length === 0) {
+        throw new Error('agent.skills 必须是非空 string[]');
+    }
+    const skills = agentInput.skills.map((item, index) => stableName(item, `agent.skills[${index}]`));
+    if (new Set(skills).size !== skills.length)
+        throw new Error('agent.skills 不能包含重复项');
+    if (!skills.includes('dingtalk-basic-behavior')) {
+        throw new Error('agent.skills 必须显式包含 dingtalk-basic-behavior');
+    }
+    const workspaceInput = objectValue(input.workspaces, 'Project workspaces');
+    const workspaces = {};
+    for (const [workspaceName, rawWorkspace] of Object.entries(workspaceInput)) {
+        stableName(workspaceName, `Workspace name ${workspaceName}`);
+        if (workspaceName === LEGACY_WORKSPACE_NAME) {
+            throw new Error(`${LEGACY_WORKSPACE_NAME} 是 legacy adapter 保留名称`);
+        }
+        workspaces[workspaceName] = validateDeclaredWorkspace(rawWorkspace, root, workspaceName);
+    }
+    return {
+        $schema: 'dingtalk-agent/project@1', name, dtaVersion,
+        agent: { definition, skills }, workspaces,
+    };
+}
+function validateDeclaredWorkspace(value, root, name) {
+    const input = objectValue(value, `Workspace ${name}`);
+    assertAllowedKeys(input, WORKSPACE_KEYS, `Workspace ${name}`);
+    for (const required of ['stage', 'provider', 'storage']) {
+        if (!(required in input))
+            throw new Error(`Workspace ${name} 缺少字段: ${required}`);
+    }
+    const stage = requiredString(input.stage, `Workspace ${name}.stage`);
+    if (!['dev', 'test', 'staging', 'prod'].includes(stage)) {
+        throw new Error(`Workspace ${name}.stage 非法: ${stage}`);
+    }
+    const providerInput = objectValue(input.provider, `Workspace ${name}.provider`);
+    const kind = requiredString(providerInput.kind, `Workspace ${name}.provider.kind`);
+    let provider;
+    if (kind === 'opencode') {
+        assertExactKeys(providerInput, OPENCODE_KEYS, `Workspace ${name}.provider`);
+        provider = { kind, model: requiredString(providerInput.model, `Workspace ${name}.provider.model`) };
+    }
+    else if (kind === 'multica') {
+        assertAllowedKeys(providerInput, MULTICA_KEYS, `Workspace ${name}.provider`);
+        for (const required of ['kind', 'profile', 'workspaceIdFrom', 'runtimeIdFrom']) {
+            if (!(required in providerInput)) {
+                throw new Error(`Workspace ${name}.provider 缺少字段: ${required}`);
+            }
+        }
+        provider = {
+            kind,
+            profile: requiredString(providerInput.profile, `Workspace ${name}.provider.profile`),
+            workspaceIdFrom: envReference(providerInput.workspaceIdFrom, `${name}.workspaceIdFrom`),
+            runtimeIdFrom: envReference(providerInput.runtimeIdFrom, `${name}.runtimeIdFrom`),
+            ...(providerInput.agentIdFrom === undefined ? {} : {
+                agentIdFrom: envReference(providerInput.agentIdFrom, `${name}.agentIdFrom`),
+            }),
+        };
+    }
+    else {
+        throw new Error(`Workspace ${name}.provider.kind 只支持 opencode / multica`);
+    }
+    const storageInput = objectValue(input.storage, `Workspace ${name}.storage`);
+    assertAllowedKeys(storageInput, STORAGE_KEYS, `Workspace ${name}.storage`);
+    const memory = storageRoute(storageInput.memory, ['local-md', 'dingtalk-doc'], `${name}.memory`, root);
+    const knowledge = storageRoute(storageInput.knowledge, ['local-md', 'dingtalk-doc'], `${name}.knowledge`, root);
+    const artifacts = storageInput.artifacts === undefined ? undefined
+        : storageRoute(storageInput.artifacts, ['local-dir'], `${name}.artifacts`, root);
+    let authority;
+    if (input.authority !== undefined) {
+        const authorityInput = objectValue(input.authority, `Workspace ${name}.authority`);
+        assertExactKeys(authorityInput, AUTHORITY_KEYS, `Workspace ${name}.authority`);
+        authority = {
+            dwsProfileFrom: envReference(authorityInput.dwsProfileFrom, `${name}.dwsProfileFrom`),
+            expectedUserIdFrom: envReference(authorityInput.expectedUserIdFrom, `${name}.expectedUserIdFrom`),
+        };
+    }
+    if (provider.kind === 'multica' && !authority) {
+        throw new Error(`Workspace ${name} 的 multica Provider 必须声明 authority env 来源`);
+    }
+    return { stage, provider, storage: { memory, knowledge, ...(artifacts ? { artifacts } : {}) },
+        ...(authority ? { authority } : {}) };
+}
+function declaredView(loaded, name, workspace, currentWorkspace) {
+    const artifacts = workspace.storage.artifacts ||
+        `local-dir:.dingtalk-agent/artifacts/${name}`;
+    const storage = { ...workspace.storage, artifacts };
+    const sourceHash = projectSourceHash(loaded.root, loaded.manifest);
+    const desiredHash = digest(stableStringify({
+        project: loaded.manifest.name,
+        agent: loaded.manifest.agent,
+        workspace: name,
+        stage: workspace.stage,
+        provider: workspace.provider,
+        storage,
+        authority: workspace.authority || null,
+        sourceHash,
+    }));
+    const statePath = join(loaded.root, WORKSPACE_STATE_ROOT, `${name}.json`);
+    const state = existsSync(statePath)
+        ? loadDevelopmentWorkspaceState(statePath, name, loaded.root) : null;
+    const drift = [];
+    if (state && state.provider !== workspace.provider.kind)
+        drift.push('provider');
+    if (state && state.desiredHash !== desiredHash)
+        drift.push('desiredHash');
+    const status = drift.length ? 'drifted' : state?.status || 'declared';
+    return {
+        name,
+        stage: workspace.stage,
+        provider: { ...workspace.provider },
+        storage,
+        authority: workspace.authority || null,
+        sourceHash,
+        desiredHash,
+        observedHash: state?.observedHash || '',
+        status,
+        current: currentWorkspace === name,
+        legacy: false,
+        statePath: relative(loaded.root, statePath),
+        state,
+        drift,
+        configSources: collectConfigSources(workspace),
+    };
+}
+function legacyView(loaded, spec, currentWorkspace) {
+    const storage = {
+        memory: spec.mounts.memory,
+        knowledge: spec.mounts.knowledge,
+        artifacts: 'local-dir:.dingtalk-agent/artifacts/legacy-prepared',
+    };
+    const desiredHash = digest(stableStringify({ provider: 'local-prepared', workspace: spec }));
+    return {
+        name: LEGACY_WORKSPACE_NAME,
+        stage: 'dev',
+        provider: { kind: 'local-prepared', contextId: spec.contextId, fieldId: spec.fieldId },
+        storage,
+        authority: spec.dws.profile || spec.dws.expectedUserId ? {
+            dwsProfileFrom: 'legacy:workspace.dws.profile',
+            expectedUserIdFrom: 'legacy:workspace.dws.expectedUserId',
+        } : null,
+        sourceHash: digest(stableStringify({ definition: spec.mounts.profile, skills: spec.skills })),
+        desiredHash,
+        observedHash: desiredHash,
+        status: 'ready',
+        current: currentWorkspace === LEGACY_WORKSPACE_NAME,
+        legacy: true,
+        statePath: relative(loaded.root, workspacePath(loaded.root)),
+        state: null,
+        drift: [],
+        configSources: ['legacy:.dingtalk-agent/workspace.json'],
+    };
+}
+function projectSourceHash(root, manifest) {
+    const sources = {
+        definition: localContentHash(root, manifest.agent.definition),
+        opencode: localContentHash(root, 'opencode.json'),
+    };
+    for (const name of manifest.agent.skills) {
+        const ref = name === 'dingtalk-basic-behavior'
+            ? `.agents/skills/${name}` : `skills/${name}`;
+        sources[`skill:${name}`] = localContentHash(root, ref);
+        const exposure = `.agents/skills/${name}`;
+        sources[`exposure:${name}`] = localContentHash(root, exposure);
+    }
+    return digest(stableStringify(sources));
+}
+function localContentHash(root, ref) {
+    const candidate = resolve(root, ref);
+    if (!isInside(root, candidate) || !existsSync(candidate))
+        return '';
+    const actual = realpathSync(candidate);
+    if (!isInside(root, actual))
+        throw new Error(`Project source 真实路径越界: ${ref}`);
+    const stat = lstatSync(actual);
+    if (stat.isSymbolicLink())
+        throw new Error(`Project source 不允许符号链接: ${ref}`);
+    if (stat.isFile())
+        return sha256(readFileSync(actual));
+    if (!stat.isDirectory())
+        throw new Error(`Project source 类型非法: ${ref}`);
+    const entries = [];
+    const visit = (directory, prefix = '') => {
+        for (const entry of readdirSorted(directory)) {
+            const path = join(directory, entry.name);
+            const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
+            if (entry.isSymbolicLink())
+                throw new Error(`Project source 不允许符号链接: ${ref}/${relativePath}`);
+            if (entry.isDirectory())
+                visit(path, relativePath);
+            else if (entry.isFile())
+                entries.push({ path: relativePath, hash: sha256(readFileSync(path)) });
+            else
+                throw new Error(`Project source 类型非法: ${ref}/${relativePath}`);
+        }
+    };
+    visit(actual);
+    return digest(stableStringify(entries));
+}
+function readdirSorted(directory) {
+    return readdirSync(directory, { withFileTypes: true })
+        .sort((a, b) => a.name.localeCompare(b.name));
+}
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function loadDevelopmentWorkspaceState(path, workspace, root) {
+    if (lstatSync(path).isSymbolicLink())
+        throw new Error(`Workspace state 不能是符号链接: ${path}`);
+    if (!isInside(root, realpathSync(path)))
+        throw new Error(`Workspace state 真实路径越出 Project: ${path}`);
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`Workspace state 不是合法 JSON: ${error.message}`);
+    }
+    rejectSecretLikeKeys(raw, 'Workspace state');
+    const input = objectValue(raw, 'Workspace state');
+    assertExactKeys(input, STATE_KEYS, 'Workspace state');
+    if (input.$schema !== 'dingtalk-agent/workspace-state@1') {
+        throw new Error('Workspace state 缺少 dingtalk-agent/workspace-state@1 schema');
+    }
+    if (input.workspace !== workspace) {
+        throw new Error(`Workspace state 名称不一致: ${String(input.workspace)} != ${workspace}`);
+    }
+    const provider = requiredString(input.provider, 'Workspace state provider');
+    if (!['opencode', 'multica'].includes(provider))
+        throw new Error(`Workspace state provider 非法: ${provider}`);
+    const status = requiredString(input.status, 'Workspace state status');
+    if (!STATE_STATUSES.has(status))
+        throw new Error(`Workspace state status 非法: ${status}`);
+    const bindingInput = objectValue(input.binding, 'Workspace state binding');
+    const binding = Object.fromEntries(Object.entries(bindingInput).map(([key, item]) => [
+        key, optionalString(item, `Workspace state binding.${key}`),
+    ]));
+    return {
+        $schema: 'dingtalk-agent/workspace-state@1', workspace, provider, status, binding,
+        desiredHash: requiredString(input.desiredHash, 'Workspace state desiredHash'),
+        observedHash: optionalString(input.observedHash, 'Workspace state observedHash'),
+        lastPlanId: optionalString(input.lastPlanId, 'Workspace state lastPlanId'),
+        lastReceiptId: optionalString(input.lastReceiptId, 'Workspace state lastReceiptId'),
+        lastEvalId: optionalString(input.lastEvalId, 'Workspace state lastEvalId'),
+    };
+}
+function inspectOpenCodeWorkspace(info, workspace, env, add) {
+    const executable = findExecutable('opencode', env);
+    add('provider.opencode-cli', 'provider', executable ? 'pass' : 'fail', true, executable ? 'OpenCode CLI 可执行' : 'PATH 找不到 opencode', { executable: executable || '' }, '安装 OpenCode，并确认 opencode --version 可执行');
+    add('provider.opencode-model', 'provider', workspace.provider.model ? 'pass' : 'fail', true, workspace.provider.model ? 'OpenCode model 已显式声明' : 'OpenCode model 缺失', { model: workspace.provider.model || '' });
+    const basicPath = '.agents/skills/dingtalk-basic-behavior/SKILL.md';
+    const basic = inspectLocalFile(info.root, basicPath);
+    const canonicalBasic = inspectLocalFile(resolvePackageRoot(import.meta.url), 'skills/dingtalk-basic-behavior/SKILL.md');
+    const basicMatched = basic.valid && canonicalBasic.valid && basic.hash === canonicalBasic.hash;
+    add('skills.basic-exposure', 'skills', basicMatched ? 'pass' : 'fail', true, basicMatched ? 'Basic Skill exposure 与当前 canonical source 一致'
+        : 'Basic Skill exposure 缺失、越界或 hash 漂移', { exposure: basic, canonicalHash: canonicalBasic.hash || '' }, `重新物化 ${basicPath}`);
+    const configPath = join(info.root, 'opencode.json');
+    const configFile = inspectLocalFile(info.root, 'opencode.json');
+    let configError = '';
+    let instructionCount = 0;
+    let permission = '';
+    let permissions = {};
+    if (configFile.valid) {
+        try {
+            const config = JSON.parse(readFileSync(configPath, 'utf8'));
+            const instructions = Array.isArray(config.instructions) ? config.instructions : [];
+            instructionCount = instructions.filter((item) => item === basicPath).length;
+            const skillPermissions = config.permission?.skill;
+            permissions = skillPermissions && typeof skillPermissions === 'object' &&
+                !Array.isArray(skillPermissions)
+                ? Object.fromEntries(Object.entries(skillPermissions).map(([key, value]) => [key, String(value)]))
+                : {};
+            permission = permissions['dingtalk-basic-behavior'] || '';
+        }
+        catch (error) {
+            configError = error.message;
+        }
+    }
+    else
+        configError = configFile.exists ? 'outside-or-not-file' : 'missing';
+    const configValid = !configError && instructionCount === 1 && permission === 'allow';
+    add('skills.basic-instruction', 'skills', configValid ? 'pass' : 'fail', true, configValid ? 'OpenCode config 强制加载且允许 Basic Skill' : 'OpenCode Basic instruction/permission 合同不完整', { path: 'opencode.json', error: configError, instructionCount, permission }, '运行 compose/bind 流程生成唯一 Basic instruction 与 allow permission');
+    for (const name of info.project.skills.filter((item) => item !== 'dingtalk-basic-behavior')) {
+        const source = inspectLocalFile(info.root, `skills/${name}/SKILL.md`);
+        const exposure = inspectLocalFile(info.root, `.agents/skills/${name}/SKILL.md`);
+        const matched = source.valid && exposure.valid && source.hash === exposure.hash &&
+            permissions[name] === 'allow';
+        add(`skills.role.${name}`, 'skills', matched ? 'pass' : 'fail', true, matched ? `Role Skill ${name} source/exposure hash 与 permission 一致`
+            : `Role Skill ${name} source、exposure hash 或 permission 不一致`, { source, exposure, permission: permissions[name] || '' }, `运行 compose/bind 流程物化 ${name}`);
+    }
+    const managedRef = workspace.state?.binding.managedPath || '';
+    if (managedRef) {
+        const managedHash = localContentHash(info.root, managedRef);
+        const matched = Boolean(managedHash && managedHash === workspace.state?.observedHash &&
+            workspace.state?.binding.sourceHash === workspace.sourceHash &&
+            workspace.state?.binding.model === workspace.provider.model);
+        add('provider.managed-integrity', 'provider', matched ? 'pass' : 'fail', true, matched ? 'Managed Workspace、source/model 与 observed hash 一致'
+            : 'Managed Workspace 缺失或 source/model/observed hash 漂移', {
+            path: managedRef,
+            actualHash: managedHash,
+            expectedHash: workspace.state?.observedHash || '',
+            sourceMatched: workspace.state?.binding.sourceHash === workspace.sourceHash,
+            modelMatched: workspace.state?.binding.model === workspace.provider.model,
+        }, `重新执行 dta workspace create ${workspace.name} --yes`);
+    }
+    const loadVerified = workspace.state?.status === 'ready' && Boolean(workspace.state.lastReceiptId || workspace.state.lastEvalId);
+    add('provider.load-proof', 'provider', loadVerified ? 'pass' : 'warn', false, loadVerified
+        ? 'Provider state 已绑定通过的随机 load/eval 证据；详情见 lastReceiptId/lastEvalId'
+        : '尚未取得随机 load probe；先执行 workspace run/eval', {
+        executed: Boolean(workspace.state?.lastReceiptId || workspace.state?.lastEvalId),
+        lastReceiptId: workspace.state?.lastReceiptId || '',
+        lastEvalId: workspace.state?.lastEvalId || '',
+    });
+}
+function inspectDeclaredMulticaWorkspace(workspace, env, add) {
+    const executable = findExecutable('multica', env);
+    add('provider.multica-cli', 'provider', executable ? 'pass' : 'fail', true, executable ? 'Multica CLI 可执行' : 'PATH 找不到 multica；仅当前 Multica Workspace 不就绪', { executable: executable || '' }, '安装 Multica CLI；其他 Provider Workspace 不受影响');
+    const refs = [
+        ['workspace-id', workspace.provider.workspaceIdFrom],
+        ['runtime-id', workspace.provider.runtimeIdFrom],
+        ['dws-profile', workspace.authority?.dwsProfileFrom || ''],
+        ['expected-user-id', workspace.authority?.expectedUserIdFrom || ''],
+    ];
+    for (const [id, ref] of refs) {
+        const variable = ref.startsWith('env:') ? ref.slice(4) : '';
+        const configured = Boolean(variable && env[variable]);
+        add(`authority.${id}`, 'authority', configured ? 'pass' : 'fail', true, configured ? `${id} 来源已解析` : `${id} 环境来源未设置`, { source: ref, configured }, `设置 ${ref || '<missing-env-ref>'}`);
+    }
+    const agentRef = workspace.provider.agentIdFrom || '';
+    const agentVariable = agentRef.startsWith('env:') ? agentRef.slice(4) : '';
+    const agentConfigured = Boolean(agentVariable && env[agentVariable]);
+    add('authority.agent-id', 'authority', agentRef && agentConfigured ? 'pass' : 'warn', false, agentRef
+        ? agentConfigured ? 'agent-id 可信来源已解析' : 'agent-id 来源未设置；只允许列候选，不按名称绑定'
+        : '未声明 agent-id；W3 只列候选，W4 create 后必须保存稳定 ID', { source: agentRef, configured: agentConfigured }, agentRef ? `设置 ${agentRef}` : '已有 Agent 时声明 provider.agentIdFrom；新 Agent 由 W4 apply 保存 ID');
+    const inspectionId = workspace.state?.binding.inspectionId || '';
+    add('provider.remote-inspect', 'provider', 'warn', false, inspectionId
+        ? '已有脱敏 Multica 只读 inspection；W4 load/smoke 前仍不能 ready'
+        : '尚未运行 Multica 只读 inspection；不会创建或更新远端资源', {
+        executed: Boolean(inspectionId), inspectionId, remoteWrite: false,
+    });
+}
+function inspectStorageRoute(root, uri) {
+    if (uri.startsWith('dingtalk-doc:')) {
+        return { valid: false, provider: 'dingtalk-doc', local: false, checked: false };
+    }
+    const separator = uri.indexOf(':');
+    const provider = uri.slice(0, separator);
+    const ref = uri.slice(separator + 1);
+    const inspected = provider === 'local-md'
+        ? inspectLocalFile(root, ref)
+        : inspectLocalDirectory(root, ref);
+    return { ...inspected, provider, local: true, checked: true };
+}
+function inspectLocalFile(root, ref) {
+    const inspected = inspectLocalPath(root, ref);
+    const valid = inspected.inside && inspected.exists && inspected.type === 'file';
+    return { ...inspected, valid, fix: valid ? undefined : `创建 Project 内文件 ${ref}` };
+}
+function inspectLocalDirectory(root, ref) {
+    const inspected = inspectLocalPath(root, ref);
+    const valid = inspected.inside && inspected.exists && inspected.type === 'directory';
+    return { ...inspected, valid, fix: valid ? undefined : `创建 Project 内目录 ${ref}` };
+}
+function inspectLocalPath(root, ref) {
+    const candidate = resolve(root, ref);
+    const inside = isInside(root, candidate);
+    if (!inside || !existsSync(candidate)) {
+        return { path: ref, inside, exists: false, type: 'missing' };
+    }
+    const actual = realpathSync(candidate);
+    const actualInside = isInside(root, actual);
+    const stat = statSync(actual);
+    return {
+        path: relative(root, actual), inside: actualInside, exists: true,
+        type: stat.isFile() ? 'file' : stat.isDirectory() ? 'directory' : 'other',
+        ...(stat.isFile() && actualInside ? { hash: digest(readFileSync(actual, 'utf8')) } : {}),
+    };
+}
+function syntheticLegacyProject(root, workspace) {
+    const definition = workspace.mounts.profile.startsWith('local-md:')
+        ? workspace.mounts.profile.slice('local-md:'.length) : 'WORKSPACE.md';
+    return {
+        $schema: 'dingtalk-agent/project@1',
+        name: stableName(basename(root) || 'legacy-agent', 'Legacy Project name'),
+        dtaVersion: '*',
+        agent: { definition, skills: [...workspace.skills] },
+        workspaces: {},
+    };
+}
+function readCurrentWorkspace(root) {
+    const path = join(root, CURRENT_WORKSPACE_FILE);
+    if (!existsSync(path))
+        return '';
+    if (lstatSync(path).isSymbolicLink())
+        throw new Error('current-workspace 不能是符号链接');
+    if (!isInside(root, realpathSync(path)))
+        throw new Error('current-workspace 真实路径越出 Project');
+    const value = readFileSync(path, 'utf8').trim();
+    return value ? stableName(value, 'current-workspace') : '';
+}
+function collectConfigSources(workspace) {
+    const sources = [
+        `manifest:provider.kind=${workspace.provider.kind}`,
+        `manifest:stage=${workspace.stage}`,
+    ];
+    if (workspace.provider.kind === 'opencode')
+        sources.push('manifest:provider.model');
+    else
+        sources.push('manifest:provider.profile', workspace.provider.workspaceIdFrom, workspace.provider.runtimeIdFrom, ...(workspace.provider.agentIdFrom ? [workspace.provider.agentIdFrom] : []));
+    if (workspace.authority)
+        sources.push(workspace.authority.dwsProfileFrom, workspace.authority.expectedUserIdFrom);
+    return [...new Set(sources)];
+}
+function storageRoute(value, providers, label, root) {
+    const text = requiredString(value, label);
+    const separator = text.indexOf(':');
+    const provider = separator < 0 ? '' : text.slice(0, separator);
+    const ref = separator < 0 ? '' : text.slice(separator + 1).trim();
+    if (!providers.includes(provider) || !ref) {
+        throw new Error(`${label} Storage 非法；允许 ${providers.map((item) => `${item}:<ref>`).join(' / ')}`);
+    }
+    if (provider.startsWith('local-'))
+        safeRelativePath(root, ref, label, true);
+    return `${provider}:${ref}`;
+}
+function safeRelativePath(root, input, label, allowMissing) {
+    if (input.includes('\0'))
+        throw new Error(`${label} 包含 NUL`); // defensive for non-POSIX callers
+    const candidate = resolve(root, input);
+    if (!isInside(root, candidate) || candidate === root)
+        throw new Error(`${label} 必须位于 Project 内: ${input}`);
+    if (existsSync(candidate)) {
+        const actual = realpathSync(candidate);
+        if (!isInside(root, actual))
+            throw new Error(`${label} 真实路径越出 Project: ${input}`);
+    }
+    else if (!allowMissing && !isInside(root, candidate)) {
+        throw new Error(`${label} 越出 Project: ${input}`);
+    }
+    return relative(root, candidate).split('\\').join('/');
+}
+function envReference(value, label) {
+    const text = requiredString(value, label);
+    if (!ENV_REF.test(text))
+        throw new Error(`${label} 必须是 env:UPPER_CASE_VAR 引用`);
+    return text;
+}
+function stableName(value, label) {
+    const text = requiredString(value, label);
+    if (!NAME.test(text))
+        throw new Error(`${label} 非法: ${text}`);
+    return text;
+}
+function requiredString(value, label) {
+    if (typeof value !== 'string' || !value.trim())
+        throw new Error(`${label} 必须是非空字符串`);
+    return value.trim();
+}
+function optionalString(value, label) {
+    if (typeof value !== 'string')
+        throw new Error(`${label} 必须是字符串`);
+    return value.trim();
+}
+function objectValue(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} 必须是 JSON object`);
+    }
+    return value;
+}
+function assertExactKeys(value, allowed, label) {
+    assertAllowedKeys(value, allowed, label);
+    const missing = [...allowed].filter((key) => !(key in value));
+    if (missing.length)
+        throw new Error(`${label} 缺少字段: ${missing.join(', ')}`);
+}
+function assertAllowedKeys(value, allowed, label) {
+    const unknown = Object.keys(value).filter((key) => !allowed.has(key));
+    if (unknown.length)
+        throw new Error(`${label} 包含未知字段: ${unknown.join(', ')}`);
+}
+function rejectSecretLikeKeys(value, label, path = []) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => rejectSecretLikeKeys(item, label, [...path, String(index)]));
+        return;
+    }
+    if (!value || typeof value !== 'object')
+        return;
+    for (const [key, item] of Object.entries(value)) {
+        const next = [...path, key];
+        if (SECRET_KEY.test(key)) {
+            throw new Error(`${label} 禁止凭据字段: ${next.join('.')}`);
+        }
+        rejectSecretLikeKeys(item, label, next);
+    }
+}
+function versionSatisfies(actualInput, rangeInput) {
+    const actual = parseVersion(actualInput);
+    const range = rangeInput.trim();
+    if (range === '*' || range === 'latest')
+        return true;
+    const operator = range.startsWith('^') ? '^' : range.startsWith('~') ? '~' : '=';
+    const expected = parseVersion(operator === '=' ? range : range.slice(1));
+    if (!actual || !expected)
+        return false;
+    if (operator === '=')
+        return actual.join('.') === expected.join('.');
+    if (compareVersion(actual, expected) < 0)
+        return false;
+    if (operator === '~')
+        return actual[0] === expected[0] && actual[1] === expected[1];
+    if (expected[0] > 0)
+        return actual[0] === expected[0];
+    if (expected[1] > 0)
+        return actual[0] === 0 && actual[1] === expected[1];
+    return actual[0] === 0 && actual[1] === 0 && actual[2] === expected[2];
+}
+function parseVersion(value) {
+    const match = value.trim().replace(/^v/, '').match(/^(\d+)\.(\d+)\.(\d+)/);
+    return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
+function compareVersion(a, b) {
+    for (let index = 0; index < 3; index += 1) {
+        if (a[index] !== b[index])
+            return a[index] - b[index];
+    }
+    return 0;
+}
+function isInside(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`));
+}
+//# sourceMappingURL=development-workspace.js.map