@xdxer/dingtalk-agent 0.1.4-beta.8 → 0.1.4-beta.9

package/dist/src/personal-event-evals.js

@@ -0,0 +1,595 @@
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync, } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { dirname, join, relative, resolve } from 'node:path';
+import { must as loadConfig } from './config.js';
+import { digest, normalizeEvent, stableStringify } from './events.js';
+import { doctorLab, loadLabManifest, runLab, teardownLab, verifyLab, } from './lab.js';
+import { isCancelCommand } from './waits.js';
+import { readJson } from './sessions.js';
+import * as dws from './dws.js';
+const SCENARIOS = new Set([
+    'host-loading', 'conversation-contract', 'authority-and-egress', 'task-lifecycle',
+    'memory-and-storage', 'workspace-and-artifacts', 'platform-reliability',
+]);
+const ACTIONS = new Set(['reply', 'ask', 'silence']);
+const INVOCATION_MODES = new Set(['mention', 'dm', 'ambient', 'continuation']);
+const RESPONSE_DECISIONS = new Set(['engage', 'silent', 'inspect']);
+const RESUME_MODES = new Set(['start', 'resume', 'cancel']);
+const SILENCE_REASONS = new Set([
+    'unmentioned', 'already_answered', 'no_value', 'policy_denied', 'unsupported',
+    'heartbeat_noop',
+]);
+/**
+ * Phase 9 只编排可信 personal-event → Prepared Run → Action Gate → DWS → readback。
+ * 事件订阅仍由外部 Adapter 负责，模型表达也继续由 L1/OpenCode 单独评测。
+ */
+export function runPersonalEventEvaluation(root, workspacePath, suitePath, options = {}) {
+    const workspace = safeInside(root, workspacePath, true, 'Workspace');
+    const suiteFile = safeInside(root, suitePath, true, 'suite');
+    const suite = validateSuite(readJsonFile(suiteFile, 'personal-event suite'));
+    const manifest = loadLabManifest(workspace, suite.manifest);
+    if (!['mock-integration', 'personal-event'].includes(manifest.mode)) {
+        throw new Error('personal-event eval 只接受 mock-integration 或 personal-event manifest');
+    }
+    if (resolve(workspace, suite.evidenceRoot) === resolve(workspace, manifest.evidenceRoot)) {
+        throw new Error('personal-event eval evidenceRoot 必须与单 case Lab evidenceRoot 分开');
+    }
+    const doctor = doctorLab(workspace, suite.manifest);
+    if (!doctor.ready)
+        throw new Error(`personal-event Lab preflight 失败: ${summarizeDoctor(doctor)}`);
+    const prepared = prepareCases(workspace, suite, manifest);
+    const expectedOutward = prepared.reduce((sum, item) => sum + (item.spec.duplicateOf ? 0 : item.spec.expected.newOutwardEffects), 0);
+    if (expectedOutward !== suite.maxOutwardActions) {
+        throw new Error(`personal-event suite outward budget 不一致: cases=${expectedOutward}, suite=${suite.maxOutwardActions}`);
+    }
+    const physicalRuns = prepared.filter((item) => !item.spec.duplicateOf).length;
+    if (physicalRuns > manifest.budgets.maxRuns) {
+        throw new Error(`personal-event suite 需要 ${physicalRuns} 个 Run，超过 manifest ${manifest.budgets.maxRuns}`);
+    }
+    const plan = {
+        $schema: 'dingtalk-agent/personal-event-eval-plan@1',
+        ready: manifest.mode === 'mock-integration' || suite.liveAuthorized === 'yes',
+        executeRequired: true,
+        sideEffect: false,
+        dingtalkSideEffect: false,
+        id: suite.id,
+        workspace: relative(realpathSync(root), workspace) || '.',
+        suite: relative(realpathSync(root), suiteFile),
+        mode: manifest.mode,
+        liveAuthorized: suite.liveAuthorized,
+        egressOwner: manifest.egressOwner,
+        eventAdapter: 'external-dws-event-consume',
+        triggerOwnedByDta: false,
+        executionGate: manifest.mode === 'mock-integration'
+            ? '--execute --yes with verified fake DWS'
+            : 'suite.liveAuthorized=yes + --execute --live --yes',
+        maxOutwardActions: suite.maxOutwardActions,
+        physicalRuns,
+        requiredSkills: suite.requiredSkills,
+        cases: prepared.map((item) => ({
+            id: item.spec.id,
+            scenario: item.spec.scenario,
+            risk: item.spec.risk,
+            action: item.spec.action,
+            duplicateOf: item.spec.duplicateOf || null,
+            continuationOf: item.spec.continuationOf || null,
+            expected: item.spec.expected,
+            marker: manifest.mode === 'personal-event' ? '<validated-live-marker>' : '<generated-at-run>',
+        })),
+        gates: [
+            'suite liveAuthorized + CLI execute/live/yes',
+            'manifest/workspace identity and single egress',
+            'tenant/conversation/actor allowlist',
+            'Definition and Basic/Role Skill snapshot',
+            'Response Gate and expected action',
+            'Intent/Attempt/Receipt journal',
+            'same message id + exact text independent readback',
+            'duplicate Receipt replay with unchanged attempt',
+            'Wait resume/cancel Session continuity',
+            'teardown with no Lab-owned connector',
+        ],
+        doctor,
+    };
+    if (!options.execute)
+        return plan;
+    const mock = manifest.mode === 'mock-integration';
+    if (mock) {
+        if (options.live)
+            throw new Error('mock personal-event eval 不接受 --live');
+    }
+    else {
+        if (suite.liveAuthorized !== 'yes') {
+            throw new Error('personal-event Live 未授权：suite.liveAuthorized 必须是 yes');
+        }
+        if (!options.live || !options.yes) {
+            throw new Error('personal-event Live 必须同时传 --execute --live --yes');
+        }
+    }
+    if (!options.yes)
+        throw new Error('personal-event eval 执行必须显式传 --yes');
+    const evaluationId = `personal_event_${Date.now()}_${randomUUID().slice(0, 8)}`;
+    const evidenceRoot = safeEvidenceRoot(workspace, options.out || suite.evidenceRoot);
+    const evaluationRoot = join(evidenceRoot, evaluationId);
+    mkdirSync(evaluationRoot, { recursive: true });
+    writeJson(join(evaluationRoot, 'plan.json'), plan);
+    writeJson(join(evaluationRoot, 'suite.redacted.json'), redactSuite(suite));
+    const cfg = loadConfig(workspace);
+    const results = [];
+    const completed = new Map();
+    const uniqueEvidence = new Set();
+    const teardowns = [];
+    let outwardEffects = 0;
+    let failure = null;
+    let activeCaseId = 'pre-case';
+    let identityVerified = false;
+    try {
+        activeCaseId = 'identity-preflight';
+        const identityReadback = dws.getSelf(manifest.dws.profile);
+        writeJson(join(evaluationRoot, 'identity-readback.json'), identityReadback);
+        const actualUserId = findString(identityReadback, ['userId', 'userid', 'user_id']);
+        if (!actualUserId || actualUserId !== manifest.dws.expectedUserId) {
+            throw new Error('personal-event DWS 执行身份与 manifest expectedUserId 不一致');
+        }
+        identityVerified = true;
+        for (const item of prepared) {
+            activeCaseId = item.spec.id;
+            const relation = item.spec.duplicateOf
+                ? (completed.get(item.spec.duplicateOf) || null)
+                : item.spec.continuationOf
+                    ? (completed.get(item.spec.continuationOf) || null)
+                    : null;
+            if ((item.spec.duplicateOf || item.spec.continuationOf) && !relation) {
+                throw new Error(`case=${item.spec.id} 引用的前置 case 没有完成`);
+            }
+            const source = item.spec.duplicateOf
+                ? prepared.find((candidate) => candidate.spec.id === item.spec.duplicateOf)
+                : item;
+            const sourceSpec = source.spec;
+            const beforeAttemptHash = relation?.evidencePath
+                ? fileHash(join(relation.evidencePath, 'action-attempt.json')) : '';
+            let output;
+            try {
+                output = runLab(workspace, cfg, suite.manifest, source.rawEvent, {
+                    caseId: sourceSpec.id,
+                    action: sourceSpec.action,
+                    replyText: sourceSpec.text,
+                    silenceReason: sourceSpec.silenceReason,
+                    perception: source.perception,
+                    useEventCorrelation: true,
+                    markerOverride: mock
+                        ? (item.spec.duplicateOf ? relation?.marker : item.marker)
+                        : undefined,
+                    live: mock ? false : options.live,
+                    yes: true,
+                });
+            }
+            catch (error) {
+                const failedEvidence = String(error.evidencePath || '');
+                if (failedEvidence)
+                    uniqueEvidence.add(failedEvidence);
+                throw error;
+            }
+            uniqueEvidence.add(output.evidencePath);
+            const result = evaluateCase(workspace, suite, item.spec, output, relation, beforeAttemptHash);
+            results.push(result);
+            completed.set(item.spec.id, result);
+            outwardEffects += result.newOutwardEffects;
+            writeJson(join(evaluationRoot, 'cases', `${safeName(item.spec.id)}.json`), result);
+            if (!result.passed)
+                throw new Error(`case=${item.spec.id} 硬门禁失败`);
+            if (outwardEffects > suite.maxOutwardActions) {
+                throw new Error(`personal-event outward budget 超限: ${outwardEffects}/${suite.maxOutwardActions}`);
+            }
+        }
+    }
+    catch (error) {
+        failure = {
+            stage: activeCaseId,
+            error: String(error.message || error),
+            occurredAt: new Date().toISOString(),
+        };
+        writeJson(join(evaluationRoot, 'failure.json'), failure);
+    }
+    finally {
+        for (const evidencePath of uniqueEvidence) {
+            try {
+                const teardown = teardownLab(workspace, suite.manifest, evidencePath);
+                const verified = verifyLab(workspace, evidencePath);
+                teardowns.push({ evidencePath: relative(workspace, evidencePath), teardown, verified });
+            }
+            catch (error) {
+                teardowns.push({
+                    evidencePath: relative(workspace, evidencePath),
+                    error: String(error.message || error),
+                });
+            }
+        }
+        writeJson(join(evaluationRoot, 'teardown.json'), teardowns);
+    }
+    const teardownPassed = teardowns.length === physicalRuns &&
+        teardowns.every((item) => item.teardown?.passed === true && item.verified?.passed === true);
+    const allPassed = !failure && results.length === suite.cases.length &&
+        results.every((item) => item.passed) && outwardEffects === suite.maxOutwardActions &&
+        teardownPassed;
+    const report = {
+        $schema: 'dingtalk-agent/personal-event-eval-report@1',
+        passed: allPassed,
+        sideEffect: mock ? 'fake-dws-only' : 'dedicated-personal-event-resources',
+        dingtalkSideEffect: !mock,
+        evaluationId,
+        evidencePath: relative(workspace, evaluationRoot),
+        mode: manifest.mode,
+        liveAuthorized: suite.liveAuthorized,
+        eventAdapter: 'external-dws-event-consume',
+        triggerOwnedByDta: false,
+        identityVerified,
+        outwardEffects,
+        maxOutwardActions: suite.maxOutwardActions,
+        results,
+        teardown: { passed: teardownPassed, results: teardowns },
+        failure,
+        limitations: [
+            'Event subscription/capture is external and is not created by this runner.',
+            'Scripted actions validate the kernel and platform path; model expression remains an L1/OpenCode gate.',
+            'User feedback is not inferred from delivery receipts.',
+        ],
+    };
+    writeJson(join(evaluationRoot, 'report.json'), report);
+    return report;
+}
+function prepareCases(workspace, suite, manifest) {
+    const prepared = [];
+    const byId = new Map();
+    for (const spec of suite.cases) {
+        if (spec.duplicateOf) {
+            const source = byId.get(spec.duplicateOf);
+            if (!source)
+                throw new Error(`case=${spec.id} duplicateOf 必须引用前面的 case`);
+            prepared.push({ ...source, spec, marker: source.marker });
+            byId.set(spec.id, prepared.at(-1));
+            continue;
+        }
+        if (!spec.eventFile)
+            throw new Error(`case=${spec.id} 缺少 eventFile`);
+        const eventPath = safeInside(workspace, spec.eventFile, true, `case=${spec.id} eventFile`);
+        const rawEvent = readJsonFile(eventPath, `case=${spec.id} event`);
+        const event = normalizeEvent(rawEvent);
+        const marker = extractMarker(event.message.text);
+        if (manifest.mode === 'personal-event') {
+            const markers = event.message.text.match(/\[DTA-LAB-[^\]\r\n]{1,180}\]/gu) || [];
+            if (markers.length !== 1 || !marker.startsWith(`${manifest.markerPrefix}${spec.id}-`)) {
+                throw new Error(`case=${spec.id} Live event 必须有且只有一个绑定 case id 的 marker`);
+            }
+        }
+        assertAllowlisted(manifest, event, spec.id);
+        let perception;
+        if (spec.perceptionFile) {
+            perception = readJsonFile(safeInside(workspace, spec.perceptionFile, true, `case=${spec.id} perceptionFile`), `case=${spec.id} perception`);
+        }
+        if (spec.expected.resumeMode === 'cancel' && !isCancelCommand(event.message.text)) {
+            throw new Error(`case=${spec.id} 期望 cancel，但 event 不是显式 /stop 或 /cancel`);
+        }
+        const item = {
+            spec, rawEvent, perception,
+            marker: marker || `${manifest.markerPrefix}${spec.id}-${randomUUID()}]`,
+        };
+        prepared.push(item);
+        byId.set(spec.id, item);
+    }
+    assertCoverage(prepared);
+    return prepared;
+}
+function evaluateCase(workspace, suite, spec, output, relation, beforeAttemptHash) {
+    const evidencePath = String(output.evidencePath || '');
+    const invocation = readJson(join(evidencePath, 'invocation.json'));
+    const enriched = readJson(join(evidencePath, 'enriched-invocation.json'));
+    const responseGate = readJson(join(evidencePath, 'response-gate.json'));
+    const resume = readJson(join(evidencePath, 'resume.json'));
+    const definition = readJson(join(evidencePath, 'agent-definition.json'));
+    const skillManifest = readJson(join(evidencePath, 'skill-manifest.json'));
+    const receipt = readJson(join(evidencePath, 'action-receipt.json'));
+    const assertions = readJson(join(evidencePath, 'assertions.json'));
+    const attemptHash = fileHash(join(evidencePath, 'action-attempt.json'));
+    const skillNames = new Set((skillManifest.entries || []).map((entry) => entry.name));
+    const perceptionChecks = (spec.expected.perception || []).map((name) => ({
+        name,
+        passed: enriched.enrichments?.[name]?.status === 'available',
+        status: enriched.enrichments?.[name]?.status || 'missing',
+    }));
+    const checks = [
+        {
+            id: 'lab-assertions', passed: assertions.passed === true,
+            detail: stableStringify(assertions.checks || []),
+        },
+        {
+            id: 'invocation-mode', passed: invocation.mode === spec.expected.invocationMode,
+            detail: `${invocation.mode}/${spec.expected.invocationMode}`,
+        },
+        {
+            id: 'response-gate', passed: responseGate.decision === spec.expected.responseDecision,
+            detail: `${responseGate.decision}/${spec.expected.responseDecision}`,
+        },
+        {
+            id: 'resume-mode', passed: resume.mode === spec.expected.resumeMode,
+            detail: `${resume.mode}/${spec.expected.resumeMode}`,
+        },
+        {
+            id: 'definition-and-skills', passed: Boolean(definition.hash) &&
+                suite.requiredSkills.every((name) => skillNames.has(name)),
+            detail: `${definition.hash || 'missing'}; ${[...skillNames].join(',')}`,
+        },
+        {
+            id: 'receipt', passed: receipt.outcome === 'confirmed' && receipt.verified === true &&
+                receipt.kind === spec.action,
+            detail: `${receipt.kind}/${receipt.outcome}/${String(receipt.verified)}`,
+        },
+        {
+            id: 'marker-readback', passed: assertions.markerCount === spec.expected.markerCount,
+            detail: `${assertions.markerCount}/${spec.expected.markerCount}`,
+        },
+        {
+            id: 'perception', passed: perceptionChecks.every((item) => item.passed),
+            detail: stableStringify(perceptionChecks),
+        },
+    ];
+    if (spec.duplicateOf) {
+        checks.push({
+            id: 'duplicate-receipt',
+            passed: output.dispatch?.duplicate === true && receipt.duplicate === true &&
+                output.dispatch?.runId === relation?.runId && receipt.actionId === relation?.actionId &&
+                beforeAttemptHash === attemptHash,
+            detail: stableStringify({
+                dispatchDuplicate: output.dispatch?.duplicate, receiptDuplicate: receipt.duplicate,
+                runId: output.dispatch?.runId, expectedRunId: relation?.runId,
+                actionId: receipt.actionId, expectedActionId: relation?.actionId,
+                beforeAttemptHash, attemptHash,
+            }),
+        });
+    }
+    if (spec.continuationOf) {
+        checks.push({
+            id: 'session-continuity',
+            passed: output.dispatch?.sessionId === relation?.sessionId &&
+                output.dispatch?.runId !== relation?.runId,
+            detail: `${relation?.sessionId}/${relation?.runId} -> ${output.dispatch?.sessionId}/${output.dispatch?.runId}`,
+        });
+    }
+    return {
+        id: spec.id,
+        scenario: spec.scenario,
+        risk: spec.risk,
+        passed: checks.every((item) => item.passed),
+        action: spec.action,
+        marker: output.marker,
+        markerCount: assertions.markerCount,
+        newOutwardEffects: spec.duplicateOf ? 0 : spec.expected.newOutwardEffects,
+        sessionId: output.dispatch?.sessionId,
+        runId: output.dispatch?.runId,
+        actionId: receipt.actionId,
+        duplicate: Boolean(receipt.duplicate),
+        definitionHash: definition.hash,
+        skillManifestHash: skillManifest.hash,
+        invocationMode: invocation.mode,
+        responseDecision: responseGate.decision,
+        resumeMode: resume.mode,
+        attemptHash,
+        evidencePath,
+        evidenceRelative: relative(workspace, evidencePath),
+        checks,
+    };
+}
+function validateSuite(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('personal-event suite 必须是 JSON object');
+    }
+    const suite = value;
+    if (suite.$schema !== 'dingtalk-agent/personal-event-eval@1') {
+        throw new Error('personal-event suite schema 非法');
+    }
+    if (!String(suite.id || '').trim() || !String(suite.manifest || '').trim() ||
+        !String(suite.evidenceRoot || '').trim()) {
+        throw new Error('personal-event suite 缺少 id/manifest/evidenceRoot');
+    }
+    if (!['yes', 'no'].includes(suite.liveAuthorized)) {
+        throw new Error('personal-event suite liveAuthorized 必须是 yes 或 no');
+    }
+    if (!Array.isArray(suite.requiredSkills) || !suite.requiredSkills.includes('dingtalk-basic-behavior') ||
+        suite.requiredSkills.some((item) => !String(item || '').trim()) ||
+        new Set(suite.requiredSkills).size !== suite.requiredSkills.length) {
+        throw new Error('personal-event suite requiredSkills 必须包含 dingtalk-basic-behavior');
+    }
+    if (!Number.isInteger(suite.maxOutwardActions) || suite.maxOutwardActions < 1 ||
+        suite.maxOutwardActions > 20) {
+        throw new Error('personal-event suite maxOutwardActions 必须为 1..20');
+    }
+    if (!Array.isArray(suite.cases) || !suite.cases.length || suite.cases.length > 20) {
+        throw new Error('personal-event suite cases 必须为 1..20');
+    }
+    const ids = new Set();
+    const prior = new Map();
+    for (const item of suite.cases) {
+        if (!item || typeof item !== 'object' || Array.isArray(item) ||
+            !/^[a-z0-9][a-z0-9._-]*$/.test(String(item.id || '')) || ids.has(item.id)) {
+            throw new Error(`personal-event case id 非法或重复: ${item?.id || 'missing'}`);
+        }
+        ids.add(item.id);
+        if (!SCENARIOS.has(item.scenario) || !['safety', 'reliability', 'quality'].includes(item.risk) ||
+            !ACTIONS.has(item.action)) {
+            throw new Error(`case=${item.id} scenario/risk/action 非法`);
+        }
+        if (item.duplicateOf && item.continuationOf) {
+            throw new Error(`case=${item.id} 不能同时声明 duplicateOf 和 continuationOf`);
+        }
+        const sourceId = item.duplicateOf || item.continuationOf;
+        const source = sourceId ? prior.get(sourceId) : null;
+        if (sourceId && !source) {
+            throw new Error(`case=${item.id} 必须引用前面已经声明的 case: ${sourceId}`);
+        }
+        if (item.duplicateOf && (item.action !== source?.action ||
+            item.expected?.invocationMode !== source?.expected?.invocationMode ||
+            item.expected?.responseDecision !== source?.expected?.responseDecision ||
+            item.expected?.resumeMode !== source?.expected?.resumeMode)) {
+            throw new Error(`case=${item.id} duplicateOf 必须保持原 action/invocation/decision/resume`);
+        }
+        if (item.continuationOf && source?.action !== 'ask') {
+            throw new Error(`case=${item.id} continuationOf 必须引用 ask case`);
+        }
+        if (!item.duplicateOf && !String(item.eventFile || '').trim()) {
+            throw new Error(`case=${item.id} 缺少 eventFile`);
+        }
+        if (item.action !== 'silence' && !String(item.text || '').trim()) {
+            throw new Error(`case=${item.id} reply/ask 必须声明 text`);
+        }
+        if (item.action === 'silence' && !SILENCE_REASONS.has(String(item.silenceReason || ''))) {
+            throw new Error(`case=${item.id} silence 必须声明合法 silenceReason`);
+        }
+        if (!item.expected || !INVOCATION_MODES.has(item.expected.invocationMode) ||
+            !RESPONSE_DECISIONS.has(item.expected.responseDecision) ||
+            !RESUME_MODES.has(item.expected.resumeMode) ||
+            ![0, 1].includes(item.expected.newOutwardEffects) ||
+            ![0, 1].includes(item.expected.markerCount)) {
+            throw new Error(`case=${item.id} expected 非法`);
+        }
+        const shouldOutward = item.action === 'reply' || item.action === 'ask';
+        if (!item.duplicateOf && Number(shouldOutward) !== item.expected.newOutwardEffects) {
+            throw new Error(`case=${item.id} newOutwardEffects 与 action 不一致`);
+        }
+        if (item.expected.markerCount !== Number(shouldOutward)) {
+            throw new Error(`case=${item.id} markerCount 与 action 不一致`);
+        }
+        if (!Array.isArray(item.sourceRefs) || !item.sourceRefs.length) {
+            throw new Error(`case=${item.id} 必须声明 sourceRefs`);
+        }
+        if (item.expected.perception !== undefined &&
+            (!Array.isArray(item.expected.perception) ||
+                item.expected.perception.some((name) => !['quote', 'burst', 'identity'].includes(String(name))))) {
+            throw new Error(`case=${item.id} expected.perception 非法`);
+        }
+        prior.set(item.id, item);
+    }
+    return suite;
+}
+function assertCoverage(cases) {
+    const mentionReply = cases.some((item) => item.spec.action === 'reply' &&
+        item.spec.expected.invocationMode === 'mention' && !item.spec.duplicateOf);
+    const ambientSilence = cases.some((item) => item.spec.action === 'silence' &&
+        item.spec.expected.invocationMode === 'ambient');
+    const duplicate = cases.some((item) => Boolean(item.spec.duplicateOf));
+    const continuation = cases.some((item) => Boolean(item.spec.continuationOf) &&
+        item.spec.expected.resumeMode === 'resume');
+    const cancel = cases.some((item) => Boolean(item.spec.continuationOf) &&
+        item.spec.expected.resumeMode === 'cancel');
+    const perception = cases.some((item) => ['quote', 'burst', 'identity'].every((name) => item.spec.expected.perception?.includes(name)));
+    const missing = Object.entries({ mentionReply, ambientSilence, duplicate, continuation, cancel, perception })
+        .filter(([, value]) => !value).map(([name]) => name);
+    if (missing.length)
+        throw new Error(`personal-event suite 缺少经典场景: ${missing.join(', ')}`);
+}
+function assertAllowlisted(manifest, event, caseId) {
+    const actorIds = [event.actor.id, event.actor.userId, event.actor.openDingTalkId].filter(Boolean);
+    if (!manifest.allowlist.tenantIds.includes(event.tenant.id) ||
+        !manifest.allowlist.conversationIds.includes(event.conversation.id) ||
+        !actorIds.some((id) => manifest.allowlist.actorIds.includes(id))) {
+        throw new Error(`case=${caseId} event tenant/conversation/actor 不在 manifest allowlist`);
+    }
+}
+function redactSuite(suite) {
+    return {
+        ...suite,
+        manifest: '<gitignored-local-manifest>',
+        cases: suite.cases.map((item) => ({
+            ...item,
+            eventFile: item.eventFile ? '<gitignored-event-file>' : undefined,
+            perceptionFile: item.perceptionFile ? '<gitignored-perception-file>' : undefined,
+            text: item.text ? `<redacted:${digest(item.text).slice(0, 10)}>` : undefined,
+        })),
+    };
+}
+function summarizeDoctor(doctor) {
+    return (doctor.checks || []).filter((item) => !item.passed)
+        .map((item) => `${item.id}:${item.detail}`).join('; ') || 'not ready';
+}
+function extractMarker(text) {
+    return text.match(/\[DTA-LAB-[^\]\r\n]{1,180}\]/u)?.[0] || '';
+}
+function fileHash(path) {
+    return existsSync(path) ? digest(readFileSync(path).toString('base64')) : '';
+}
+function readJsonFile(path, label) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`${label} 不是合法 JSON: ${error.message}`);
+    }
+}
+function writeJson(path, value) {
+    mkdirSync(dirname(path), { recursive: true });
+    const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(temporary, JSON.stringify(value, null, 2) + '\n', { flag: 'wx' });
+    renameSync(temporary, path);
+}
+function safeInside(root, value, mustExist, label) {
+    const rootReal = realpathSync(resolve(root));
+    const candidate = resolve(rootReal, value);
+    const rel = relative(rootReal, candidate);
+    if (rel === '..' || rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`)) {
+        throw new Error(`${label} 必须位于 Workspace 内: ${value}`);
+    }
+    if (mustExist && !existsSync(candidate))
+        throw new Error(`${label} 不存在: ${value}`);
+    assertNoSymlinkAncestors(rootReal, candidate, label);
+    if (existsSync(candidate)) {
+        if (lstatSync(candidate).isSymbolicLink())
+            throw new Error(`${label} 不允许符号链接: ${value}`);
+        const actual = realpathSync(candidate);
+        const actualRel = relative(rootReal, actual);
+        if (actualRel === '..' || actualRel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`)) {
+            throw new Error(`${label} 真实路径越界: ${value}`);
+        }
+        return actual;
+    }
+    return candidate;
+}
+function safeEvidenceRoot(workspace, value) {
+    if (!String(value || '').trim() || value.split(/[\\/]/).includes('..')) {
+        throw new Error('evidenceRoot 非法');
+    }
+    const target = safeInside(workspace, value, false, 'evidenceRoot');
+    const rel = relative(realpathSync(resolve(workspace)), target).split('\\').join('/');
+    if (!rel.startsWith('.dingtalk-agent/')) {
+        throw new Error('personal-event 原始证据必须位于 Workspace 的 gitignored .dingtalk-agent/ 下');
+    }
+    return target;
+}
+function assertNoSymlinkAncestors(root, path, label) {
+    const rel = relative(resolve(root), resolve(path));
+    let current = resolve(root);
+    for (const part of rel.split(/[\\/]/).filter(Boolean)) {
+        current = join(current, part);
+        if (!existsSync(current))
+            break;
+        if (lstatSync(current).isSymbolicLink()) {
+            throw new Error(`${label} 不允许穿过符号链接`);
+        }
+    }
+}
+function safeName(value) {
+    return value.replace(/[^a-zA-Z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'case';
+}
+function findString(value, keys) {
+    if (!value || typeof value !== 'object')
+        return '';
+    for (const key of keys) {
+        const found = value[key];
+        if (found !== undefined && found !== null && String(found).trim())
+            return String(found).trim();
+    }
+    for (const child of Object.values(value)) {
+        const found = findString(child, keys);
+        if (found)
+            return found;
+    }
+    return '';
+}
+//# sourceMappingURL=personal-event-evals.js.map