@xdxer/dingtalk-agent 0.1.4-beta.8 → 0.1.4-beta.9

package/dist/src/agent-bindings.js

@@ -0,0 +1,132 @@
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { relative, resolve } from 'node:path';
+import { digest, stableStringify } from './events.js';
+const ROOT_KEYS = new Set([
+    '$schema', 'agent', 'skills', 'memory', 'knowledge', 'artifacts', 'stateDir', 'authority',
+]);
+const AUTHORITY_KEYS = new Set(['profile', 'expectedUserId']);
+export function loadAgentBindings(root, input) {
+    const rootReal = realpathSync(resolve(root));
+    const candidate = resolve(rootReal, input);
+    if (!isInside(rootReal, candidate)) {
+        throw new Error(`Agent bindings 必须位于当前 Agent 根目录内: ${input}`);
+    }
+    if (!existsSync(candidate))
+        throw new Error(`Agent bindings 不存在: ${input}`);
+    const path = realpathSync(candidate);
+    if (!isInside(rootReal, path))
+        throw new Error(`Agent bindings 真实路径越界: ${input}`);
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (error) {
+        throw new Error(`Agent bindings 不是合法 JSON: ${error.message}`);
+    }
+    const value = objectValue(raw, 'Agent bindings');
+    assertExactKeys(value, ROOT_KEYS, 'Agent bindings');
+    if (value.$schema !== 'dingtalk-agent/agent-bindings@1') {
+        throw new Error(`Agent bindings schema 非法: ${String(value.$schema || '-')}`);
+    }
+    const authority = objectValue(value.authority, 'Agent bindings authority');
+    assertExactKeys(authority, AUTHORITY_KEYS, 'Agent bindings authority');
+    const bindings = {
+        $schema: 'dingtalk-agent/agent-bindings@1',
+        agent: storage(value.agent, ['local-dir'], 'agent'),
+        skills: storage(value.skills, ['local-dir', 'local-md'], 'skills'),
+        memory: storage(value.memory, ['local-md', 'dingtalk-doc'], 'memory'),
+        knowledge: storage(value.knowledge, ['local-md', 'dingtalk-doc'], 'knowledge'),
+        artifacts: storage(value.artifacts, ['local-dir'], 'artifacts'),
+        stateDir: localStateDir(value.stateDir),
+        authority: {
+            profile: optionalString(authority.profile, 'authority.profile'),
+            expectedUserId: optionalString(authority.expectedUserId, 'authority.expectedUserId'),
+        },
+    };
+    assertLocalRoutesStayInside(rootReal, bindings);
+    return {
+        path,
+        hash: digest(stableStringify(bindings)),
+        value: bindings,
+        context: {
+            agent: bindings.agent,
+            skills: bindings.skills,
+            memory: bindings.memory,
+            knowledge: bindings.knowledge,
+            artifacts: bindings.artifacts,
+            stateDir: bindings.stateDir,
+            profile: bindings.authority.profile,
+            expectedUserId: bindings.authority.expectedUserId,
+        },
+    };
+}
+function assertLocalRoutesStayInside(root, bindings) {
+    for (const [label, uri] of Object.entries({
+        agent: bindings.agent, skills: bindings.skills, memory: bindings.memory,
+        knowledge: bindings.knowledge, artifacts: bindings.artifacts,
+    })) {
+        if (!uri.startsWith('local-'))
+            continue;
+        const ref = uri.slice(uri.indexOf(':') + 1);
+        const candidate = resolve(root, ref);
+        if (!isInside(root, candidate))
+            throw new Error(`${label} 本地路径越出 Agent 根目录: ${ref}`);
+        if (existsSync(candidate) && !isInside(root, realpathSync(candidate))) {
+            throw new Error(`${label} 本地真实路径越出 Agent 根目录: ${ref}`);
+        }
+    }
+    const state = resolve(root, bindings.stateDir);
+    if (!isInside(root, state))
+        throw new Error(`stateDir 越出 Agent 根目录: ${bindings.stateDir}`);
+    if (state === root)
+        throw new Error('stateDir 必须是 Agent 根目录内的独立私有目录，不能等于根目录');
+    if (existsSync(state) && !isInside(root, realpathSync(state))) {
+        throw new Error(`stateDir 真实路径越出 Agent 根目录: ${bindings.stateDir}`);
+    }
+}
+function storage(value, providers, label) {
+    const text = requiredString(value, label);
+    const separator = text.indexOf(':');
+    const provider = separator < 0 ? '' : text.slice(0, separator);
+    const reference = separator < 0 ? '' : text.slice(separator + 1).trim();
+    if (!providers.includes(provider) || !reference) {
+        throw new Error(`${label} Storage 非法；允许 ${providers.map((item) => `${item}:<ref>`).join(' / ')}`);
+    }
+    return text;
+}
+function localStateDir(value) {
+    const text = requiredString(value, 'stateDir');
+    if (/^[a-z][a-z0-9-]*:/i.test(text)) {
+        throw new Error('stateDir 必须是宿主本地目录，不能是远端 Provider URI');
+    }
+    return text;
+}
+function requiredString(value, label) {
+    if (typeof value !== 'string' || !value.trim())
+        throw new Error(`${label} 必须是非空字符串`);
+    return value.trim();
+}
+function optionalString(value, label) {
+    if (typeof value !== 'string')
+        throw new Error(`${label} 必须是字符串`);
+    return value.trim();
+}
+function objectValue(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`${label} 必须是 JSON object`);
+    }
+    return value;
+}
+function assertExactKeys(value, allowed, label) {
+    const unknown = Object.keys(value).filter((key) => !allowed.has(key));
+    if (unknown.length)
+        throw new Error(`${label} 包含未知字段: ${unknown.join(', ')}`);
+    const missing = [...allowed].filter((key) => !(key in value));
+    if (missing.length)
+        throw new Error(`${label} 缺少字段: ${missing.join(', ')}`);
+}
+function isInside(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === '' || (rel !== '..' && !rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`));
+}
+//# sourceMappingURL=agent-bindings.js.map

package/dist/src/agent-bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-bindings.js","sourceRoot":"","sources":["../../src/agent-bindings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAChE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE7C,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAuBrD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW;CAC1F,CAAC,CAAA;AACF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAA;AAE7D,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,EAAE,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAA;IAEjF,IAAI,GAAY,CAAA;IAChB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAAC,CAAC;IACpD,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;IAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAA;IAChD,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAA;IACnD,IAAI,KAAK,CAAC,OAAO,KAAK,iCAAiC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAA;IAC1E,eAAe,CAAC,SAAS,EAAE,cAAc,EAAE,0BAA0B,CAAC,CAAA;IAEtE,MAAM,QAAQ,GAAkB;QAC9B,OAAO,EAAE,iCAAiC;QAC1C,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QACnD,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC;QAClE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,QAAQ,CAAC;QACrE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,WAAW,CAAC;QAC9E,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;QAC/D,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC;QACvC,SAAS,EAAE;YACT,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;YAC/D,cAAc,EAAE,cAAc,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC;SACrF;KACF,CAAA;IACD,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;IAC/C,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvC,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO;YACnC,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,cAAc;SAClD;KACF,CAAA;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,QAAuB;IACxE,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QACxC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC7D,CAAC,EAAE,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAQ;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACpC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,GAAG,EAAE,CAAC,CAAA;QACpF,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,GAAG,EAAE,CAAC,CAAA;QACxD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC1F,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC7E,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,SAAmB,EAAE,KAAa;IACjE,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACvE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACnG,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC9C,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW,CAAC,CAAA;IACpF,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAA;IACjE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,KAAgC,CAAA;AACzC,CAAC;AAED,SAAS,eAAe,CACtB,KAA8B,EAAE,OAAoB,EAAE,KAAa;IAEnE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;IACrE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7E,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAA;IAC7D,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IACrC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;AAC1G,CAAC","sourcesContent":["import { existsSync, readFileSync, realpathSync } from 'node:fs'\nimport { relative, resolve } from 'node:path'\nimport type { BootstrapOptions } from './bootstrap.js'\nimport { digest, stableStringify } from './events.js'\n\nexport interface AgentBindings {\n  $schema: 'dingtalk-agent/agent-bindings@1'\n  agent: string\n  skills: string\n  memory: string\n  knowledge: string\n  artifacts: string\n  stateDir: string\n  authority: {\n    profile: string\n    expectedUserId: string\n  }\n}\n\nexport interface LoadedAgentBindings {\n  path: string\n  hash: string\n  value: AgentBindings\n  context: NonNullable<BootstrapOptions['context']>\n}\n\nconst ROOT_KEYS = new Set([\n  '$schema', 'agent', 'skills', 'memory', 'knowledge', 'artifacts', 'stateDir', 'authority',\n])\nconst AUTHORITY_KEYS = new Set(['profile', 'expectedUserId'])\n\nexport function loadAgentBindings(root: string, input: string): LoadedAgentBindings {\n  const rootReal = realpathSync(resolve(root))\n  const candidate = resolve(rootReal, input)\n  if (!isInside(rootReal, candidate)) {\n    throw new Error(`Agent bindings 必须位于当前 Agent 根目录内: ${input}`)\n  }\n  if (!existsSync(candidate)) throw new Error(`Agent bindings 不存在: ${input}`)\n  const path = realpathSync(candidate)\n  if (!isInside(rootReal, path)) throw new Error(`Agent bindings 真实路径越界: ${input}`)\n\n  let raw: unknown\n  try { raw = JSON.parse(readFileSync(path, 'utf8')) }\n  catch (error) { throw new Error(`Agent bindings 不是合法 JSON: ${error.message}`) }\n  const value = objectValue(raw, 'Agent bindings')\n  assertExactKeys(value, ROOT_KEYS, 'Agent bindings')\n  if (value.$schema !== 'dingtalk-agent/agent-bindings@1') {\n    throw new Error(`Agent bindings schema 非法: ${String(value.$schema || '-')}`)\n  }\n  const authority = objectValue(value.authority, 'Agent bindings authority')\n  assertExactKeys(authority, AUTHORITY_KEYS, 'Agent bindings authority')\n\n  const bindings: AgentBindings = {\n    $schema: 'dingtalk-agent/agent-bindings@1',\n    agent: storage(value.agent, ['local-dir'], 'agent'),\n    skills: storage(value.skills, ['local-dir', 'local-md'], 'skills'),\n    memory: storage(value.memory, ['local-md', 'dingtalk-doc'], 'memory'),\n    knowledge: storage(value.knowledge, ['local-md', 'dingtalk-doc'], 'knowledge'),\n    artifacts: storage(value.artifacts, ['local-dir'], 'artifacts'),\n    stateDir: localStateDir(value.stateDir),\n    authority: {\n      profile: optionalString(authority.profile, 'authority.profile'),\n      expectedUserId: optionalString(authority.expectedUserId, 'authority.expectedUserId'),\n    },\n  }\n  assertLocalRoutesStayInside(rootReal, bindings)\n  return {\n    path,\n    hash: digest(stableStringify(bindings)),\n    value: bindings,\n    context: {\n      agent: bindings.agent,\n      skills: bindings.skills,\n      memory: bindings.memory,\n      knowledge: bindings.knowledge,\n      artifacts: bindings.artifacts,\n      stateDir: bindings.stateDir,\n      profile: bindings.authority.profile,\n      expectedUserId: bindings.authority.expectedUserId,\n    },\n  }\n}\n\nfunction assertLocalRoutesStayInside(root: string, bindings: AgentBindings): void {\n  for (const [label, uri] of Object.entries({\n    agent: bindings.agent, skills: bindings.skills, memory: bindings.memory,\n    knowledge: bindings.knowledge, artifacts: bindings.artifacts,\n  })) {\n    if (!uri.startsWith('local-')) continue\n    const ref = uri.slice(uri.indexOf(':') + 1)\n    const candidate = resolve(root, ref)\n    if (!isInside(root, candidate)) throw new Error(`${label} 本地路径越出 Agent 根目录: ${ref}`)\n    if (existsSync(candidate) && !isInside(root, realpathSync(candidate))) {\n      throw new Error(`${label} 本地真实路径越出 Agent 根目录: ${ref}`)\n    }\n  }\n  const state = resolve(root, bindings.stateDir)\n  if (!isInside(root, state)) throw new Error(`stateDir 越出 Agent 根目录: ${bindings.stateDir}`)\n  if (state === root) throw new Error('stateDir 必须是 Agent 根目录内的独立私有目录，不能等于根目录')\n  if (existsSync(state) && !isInside(root, realpathSync(state))) {\n    throw new Error(`stateDir 真实路径越出 Agent 根目录: ${bindings.stateDir}`)\n  }\n}\n\nfunction storage(value: unknown, providers: string[], label: string): string {\n  const text = requiredString(value, label)\n  const separator = text.indexOf(':')\n  const provider = separator < 0 ? '' : text.slice(0, separator)\n  const reference = separator < 0 ? '' : text.slice(separator + 1).trim()\n  if (!providers.includes(provider) || !reference) {\n    throw new Error(`${label} Storage 非法；允许 ${providers.map((item) => `${item}:<ref>`).join(' / ')}`)\n  }\n  return text\n}\n\nfunction localStateDir(value: unknown): string {\n  const text = requiredString(value, 'stateDir')\n  if (/^[a-z][a-z0-9-]*:/i.test(text)) {\n    throw new Error('stateDir 必须是宿主本地目录，不能是远端 Provider URI')\n  }\n  return text\n}\n\nfunction requiredString(value: unknown, label: string): string {\n  if (typeof value !== 'string' || !value.trim()) throw new Error(`${label} 必须是非空字符串`)\n  return value.trim()\n}\n\nfunction optionalString(value: unknown, label: string): string {\n  if (typeof value !== 'string') throw new Error(`${label} 必须是字符串`)\n  return value.trim()\n}\n\nfunction objectValue(value: unknown, label: string): Record<string, unknown> {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} 必须是 JSON object`)\n  }\n  return value as Record<string, unknown>\n}\n\nfunction assertExactKeys(\n  value: Record<string, unknown>, allowed: Set<string>, label: string,\n): void {\n  const unknown = Object.keys(value).filter((key) => !allowed.has(key))\n  if (unknown.length) throw new Error(`${label} 包含未知字段: ${unknown.join(', ')}`)\n  const missing = [...allowed].filter((key) => !(key in value))\n  if (missing.length) throw new Error(`${label} 缺少字段: ${missing.join(', ')}`)\n}\n\nfunction isInside(root: string, candidate: string): boolean {\n  const rel = relative(root, candidate)\n  return rel === '' || (rel !== '..' && !rel.startsWith(`..${process.platform === 'win32' ? '\\\\' : '/'}`))\n}\n"]}

package/dist/src/agent-definition.js

@@ -0,0 +1,182 @@
+import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { basename, dirname, join, relative, resolve } from 'node:path';
+import { digest, stableStringify } from './events.js';
+export function buildBootstrapDefinition(mounts, config, workspace = null) {
+    const bodyMount = mounts.find((item) => item.slot === 'body') ||
+        mounts.find((item) => item.slot === 'profile') ||
+        mounts.find((item) => item.slot === 'workspace') || null;
+    const discoveredSkills = mounts
+        .filter((item) => item.slot.startsWith('skill:'))
+        .map((item) => {
+        const metadata = readSkillMetadata(item.path);
+        return {
+            name: metadata.name || item.slot.slice('skill:'.length),
+            version: metadata.version, source: item.source,
+            path: item.path, hash: item.hash,
+        };
+    });
+    const configuredSkills = discoveredSkills.length
+        ? discoveredSkills
+        : (workspace?.skills || []).map((name) => ({
+            name, version: '', source: `workspace:${name}`, path: '', hash: '',
+        }));
+    const skills = configuredSkills.some((item) => item.name === 'dingtalk-basic-behavior')
+        ? configuredSkills
+        : [{
+                name: 'dingtalk-basic-behavior', version: '',
+                source: 'bundled:dingtalk-basic-behavior', path: '', hash: '',
+            }, ...configuredSkills];
+    const sourcePath = config.sourcePath ? resolve(config.sourcePath) : '';
+    const gitRevision = sourcePath ? readGitRevision(sourcePath) : '';
+    const sourceKind = workspace
+        ? 'workspace'
+        : config.source.startsWith('dingtalk-doc:')
+            ? 'dingtalk-doc'
+            : gitRevision ? 'git-checkout' : 'local-folder';
+    const id = cleanId(workspace?.id || (sourcePath ? basename(sourcePath) : config.source));
+    return finalize({
+        $schema: 'dingtalk-agent/agent-definition@1',
+        id,
+        source: { kind: sourceKind, uri: config.source, revision: gitRevision },
+        body: bodyMount ? { path: bodyMount.path, hash: bodyMount.hash } : null,
+        skills,
+        storage: {
+            memory: config.memory, knowledge: config.knowledge,
+            artifacts: config.artifacts, state: config.state,
+        },
+        authority: {
+            dwsProfile: config.dwsProfile,
+            expectedUserId: config.expectedUserId,
+        },
+        configuration: config.origins,
+    });
+}
+/**
+ * Definition 与 Skill 一样按 Session 冻结。新 Run 只复制已验证的 Session 快照，
+ * 因而在线修改 WORKSPACE.md、DWS profile 或启用 Skill 不会改变同一件事的身份。
+ */
+export function snapshotPreparedDefinition(runPath, sessionPath, workspace, mounts, skillManifest) {
+    const sessionRoot = join(sessionPath, 'definition');
+    const definitionPath = join(sessionRoot, 'definition.json');
+    let definition;
+    if (existsSync(definitionPath)) {
+        definition = verifyDefinition(sessionRoot);
+    }
+    else {
+        mkdirSync(sessionRoot, { recursive: true });
+        const profile = mounts.find((item) => item.slot === 'profile');
+        let body = null;
+        if (profile?.snapshotPath) {
+            const source = join(runPath, profile.snapshotPath);
+            const destination = join(sessionRoot, 'body.md');
+            copyFileSync(source, destination);
+            const markdown = readFileSync(destination, 'utf8');
+            body = { path: 'body.md', hash: digest(markdown) };
+        }
+        definition = finalize({
+            $schema: 'dingtalk-agent/agent-definition@1',
+            id: cleanId(workspace.id),
+            source: {
+                kind: 'workspace', uri: `workspace:${workspace.id}`,
+                revision: digest(stableStringify(workspace)),
+            },
+            body,
+            skills: skillManifest.entries.map((entry) => ({
+                name: entry.name, version: entry.version, source: entry.sourcePath,
+                path: entry.snapshotPath, hash: entry.hash,
+            })),
+            storage: {
+                memory: workspace.mounts.memory,
+                knowledge: workspace.mounts.knowledge,
+                artifacts: 'session:artifacts',
+                state: 'session:control-state',
+            },
+            authority: {
+                dwsProfile: workspace.dws.profile,
+                expectedUserId: workspace.dws.expectedUserId,
+            },
+            configuration: {
+                agent: 'workspace', skills: 'workspace', memory: 'workspace',
+                knowledge: 'workspace', artifacts: 'convention', state: 'convention',
+                dwsProfile: 'workspace', expectedUserId: 'workspace',
+            },
+        });
+        writeAtomic(definitionPath, JSON.stringify(definition, null, 2) + '\n');
+    }
+    const destination = join(runPath, 'context', 'agent-definition');
+    rmSync(destination, { recursive: true, force: true });
+    cpSync(sessionRoot, destination, { recursive: true });
+    return definition;
+}
+export function verifyPreparedDefinition(runPath, expectedHash = '') {
+    return verifyDefinition(join(runPath, 'context', 'agent-definition'), expectedHash);
+}
+function finalize(input) {
+    const missing = [];
+    if (!input.body)
+        missing.push('body');
+    if (!input.skills.length)
+        missing.push('skills');
+    if (!input.storage.memory)
+        missing.push('storage.memory');
+    if (!input.storage.knowledge)
+        missing.push('storage.knowledge');
+    const unsigned = {
+        ...input,
+        status: missing.length ? 'partial' : 'ready',
+        missing,
+    };
+    return { ...unsigned, hash: digest(stableStringify(unsigned)) };
+}
+function verifyDefinition(root, expectedHash = '') {
+    const path = join(root, 'definition.json');
+    if (!existsSync(path))
+        throw new Error('Agent Definition snapshot 缺少 definition.json');
+    const value = JSON.parse(readFileSync(path, 'utf8'));
+    const { hash, ...unsigned } = value;
+    if (!hash || digest(stableStringify(unsigned)) !== hash || (expectedHash && hash !== expectedHash)) {
+        throw new Error('Agent Definition snapshot hash 不一致');
+    }
+    if (value.body) {
+        const rootPath = resolve(root);
+        const bodyPath = resolve(rootPath, value.body.path);
+        const rel = relative(rootPath, bodyPath);
+        if (rel === '..' || rel.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`)) {
+            throw new Error('Agent Definition body 必须位于 snapshot 内');
+        }
+        const body = readFileSync(bodyPath, 'utf8');
+        if (digest(body) !== value.body.hash)
+            throw new Error('Agent Definition body 内容漂移');
+    }
+    return value;
+}
+function readGitRevision(path) {
+    const run = spawnSync('git', ['-C', path, 'rev-parse', '--show-toplevel', 'HEAD'], {
+        encoding: 'utf8', timeout: 2_000,
+    });
+    if (run.status !== 0)
+        return '';
+    const lines = String(run.stdout || '').trim().split(/\r?\n/);
+    return lines.length >= 2 ? lines[1] : '';
+}
+function readSkillMetadata(path) {
+    if (!path || !existsSync(path))
+        return { name: '', version: '' };
+    const text = readFileSync(path, 'utf8');
+    const block = text.match(/^---\r?\n([\s\S]*?)\r?\n---/)?.[1] || '';
+    const scalar = (name) => block.match(new RegExp(`^${name}:\\s*['"]?([^'"\\r\\n]+)['"]?\\s*$`, 'm'))?.[1]?.trim() || '';
+    const nestedVersion = block.match(/^metadata:\s*\r?\n(?:[ \t]+.*\r?\n)*?[ \t]+version:\s*['"]?([^'"\r\n]+)['"]?\s*$/m)?.[1]?.trim() || '';
+    return { name: scalar('name'), version: nestedVersion || scalar('version') };
+}
+function writeAtomic(path, value) {
+    mkdirSync(dirname(path), { recursive: true });
+    const temp = `${path}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(temp, value, { flag: 'wx' });
+    renameSync(temp, path);
+}
+function cleanId(value) {
+    return value.replace(/^[a-z-]+:/, '').replace(/[^a-zA-Z0-9._-]+/g, '-')
+        .replace(/^-+|-+$/g, '') || 'agent';
+}
+//# sourceMappingURL=agent-definition.js.map

package/dist/src/agent-definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-definition.js","sourceRoot":"","sources":["../../src/agent-definition.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAC7E,aAAa,GACd,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAoBrD,MAAM,UAAU,wBAAwB,CACtC,MAAwB,EACxB,MAAwB,EACxB,YAAkC,IAAI;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,CAAA;IAC1D,MAAM,gBAAgB,GAAG,MAAM;SAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;SAChD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YACvD,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM;YAC9C,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;SACjC,CAAA;IACH,CAAC,CAAC,CAAA;IACJ,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM;QAC9C,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;SACnE,CAAC,CAAC,CAAA;IACL,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,yBAAyB,CAAC;QACrF,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,CAAC;gBACD,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE;gBAC5C,MAAM,EAAE,iCAAiC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;aAC9D,EAAE,GAAG,gBAAgB,CAAC,CAAA;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACtE,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACjE,MAAM,UAAU,GAAsC,SAAS;QAC7D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;YACzC,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAA;IACnD,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IACxF,OAAO,QAAQ,CAAC;QACd,OAAO,EAAE,mCAAmC;QAC5C,EAAE;QACF,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE;QACvE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;QACvE,MAAM;QACN,OAAO,EAAE;YACP,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS;YAClD,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK;SACjD;QACD,SAAS,EAAE;YACT,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC;QACD,aAAa,EAAE,MAAM,CAAC,OAAO;KAC9B,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,WAAmB,EACnB,SAAwB,EACxB,MAAuB,EACvB,aAA4B;IAE5B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IACnD,MAAM,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAA;IAC3D,IAAI,UAA2B,CAAA;IAC/B,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/B,UAAU,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAA;IAC5C,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;QAC9D,IAAI,IAAI,GAA4B,IAAI,CAAA;QACxC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;YAChD,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;YAClD,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAA;QACpD,CAAC;QACD,UAAU,GAAG,QAAQ,CAAC;YACpB,OAAO,EAAE,mCAAmC;YAC5C,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE;gBACN,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,aAAa,SAAS,CAAC,EAAE,EAAE;gBACnD,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;aAC7C;YACD,IAAI;YACJ,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC5C,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU;gBAClE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI;aAC3C,CAAC,CAAC;YACH,OAAO,EAAE;gBACP,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;gBAC/B,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,SAAS;gBACrC,SAAS,EAAE,mBAAmB;gBAC9B,KAAK,EAAE,uBAAuB;aAC/B;YACD,SAAS,EAAE;gBACT,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO;gBACjC,cAAc,EAAE,SAAS,CAAC,GAAG,CAAC,cAAc;aAC7C;YACD,aAAa,EAAE;gBACb,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW;gBAC5D,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY;gBACpE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW;aACrD;SACF,CAAC,CAAA;QACF,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;IAChE,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,YAAY,GAAG,EAAE;IACzE,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,EAAE,YAAY,CAAC,CAAA;AACrF,CAAC;AAED,SAAS,QAAQ,CACf,KAA2D;IAE3D,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAG;QACf,GAAG,KAAK;QACR,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAkB,CAAC,CAAC,CAAC,OAAgB;QAC9D,OAAO;KACR,CAAA;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAA;AACjE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,YAAY,GAAG,EAAE;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAA;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACtF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAA;IACvE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,CAAA;IACnC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QACxC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE;QACjF,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK;KACjC,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC5D,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IAChE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAClE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAC9B,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,oCAAoC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC/F,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAC/B,mFAAmF,CACpF,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACpB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,aAAa,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAA;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAA;IACvD,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1C,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC;SACpE,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAA;AACvC,CAAC","sourcesContent":["import {\n  copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync,\n  writeFileSync,\n} from 'node:fs'\nimport { spawnSync } from 'node:child_process'\nimport { basename, dirname, join, relative, resolve } from 'node:path'\nimport { digest, stableStringify } from './events.js'\nimport type { AgentDefinition } from './types.js'\nimport type { BootstrapMount } from './bootstrap.js'\nimport type { SkillManifest } from './skills.js'\nimport type { MountSnapshot, WorkspaceSpec } from './workspace.js'\n\ntype Origin = AgentDefinition['configuration'][string]\n\nexport interface DefinitionConfig {\n  source: string\n  sourcePath?: string\n  memory: string\n  knowledge: string\n  artifacts: string\n  state: string\n  dwsProfile: string\n  expectedUserId: string\n  origins: Record<string, Origin>\n}\n\nexport function buildBootstrapDefinition(\n  mounts: BootstrapMount[],\n  config: DefinitionConfig,\n  workspace: WorkspaceSpec | null = null,\n): AgentDefinition {\n  const bodyMount = mounts.find((item) => item.slot === 'body') ||\n    mounts.find((item) => item.slot === 'profile') ||\n    mounts.find((item) => item.slot === 'workspace') || null\n  const discoveredSkills = mounts\n    .filter((item) => item.slot.startsWith('skill:'))\n    .map((item) => {\n      const metadata = readSkillMetadata(item.path)\n      return {\n        name: metadata.name || item.slot.slice('skill:'.length),\n        version: metadata.version, source: item.source,\n        path: item.path, hash: item.hash,\n      }\n    })\n  const configuredSkills = discoveredSkills.length\n    ? discoveredSkills\n    : (workspace?.skills || []).map((name) => ({\n      name, version: '', source: `workspace:${name}`, path: '', hash: '',\n    }))\n  const skills = configuredSkills.some((item) => item.name === 'dingtalk-basic-behavior')\n    ? configuredSkills\n    : [{\n      name: 'dingtalk-basic-behavior', version: '',\n      source: 'bundled:dingtalk-basic-behavior', path: '', hash: '',\n    }, ...configuredSkills]\n  const sourcePath = config.sourcePath ? resolve(config.sourcePath) : ''\n  const gitRevision = sourcePath ? readGitRevision(sourcePath) : ''\n  const sourceKind: AgentDefinition['source']['kind'] = workspace\n    ? 'workspace'\n    : config.source.startsWith('dingtalk-doc:')\n      ? 'dingtalk-doc'\n      : gitRevision ? 'git-checkout' : 'local-folder'\n  const id = cleanId(workspace?.id || (sourcePath ? basename(sourcePath) : config.source))\n  return finalize({\n    $schema: 'dingtalk-agent/agent-definition@1',\n    id,\n    source: { kind: sourceKind, uri: config.source, revision: gitRevision },\n    body: bodyMount ? { path: bodyMount.path, hash: bodyMount.hash } : null,\n    skills,\n    storage: {\n      memory: config.memory, knowledge: config.knowledge,\n      artifacts: config.artifacts, state: config.state,\n    },\n    authority: {\n      dwsProfile: config.dwsProfile,\n      expectedUserId: config.expectedUserId,\n    },\n    configuration: config.origins,\n  })\n}\n\n/**\n * Definition 与 Skill 一样按 Session 冻结。新 Run 只复制已验证的 Session 快照，\n * 因而在线修改 WORKSPACE.md、DWS profile 或启用 Skill 不会改变同一件事的身份。\n */\nexport function snapshotPreparedDefinition(\n  runPath: string,\n  sessionPath: string,\n  workspace: WorkspaceSpec,\n  mounts: MountSnapshot[],\n  skillManifest: SkillManifest,\n): AgentDefinition {\n  const sessionRoot = join(sessionPath, 'definition')\n  const definitionPath = join(sessionRoot, 'definition.json')\n  let definition: AgentDefinition\n  if (existsSync(definitionPath)) {\n    definition = verifyDefinition(sessionRoot)\n  } else {\n    mkdirSync(sessionRoot, { recursive: true })\n    const profile = mounts.find((item) => item.slot === 'profile')\n    let body: AgentDefinition['body'] = null\n    if (profile?.snapshotPath) {\n      const source = join(runPath, profile.snapshotPath)\n      const destination = join(sessionRoot, 'body.md')\n      copyFileSync(source, destination)\n      const markdown = readFileSync(destination, 'utf8')\n      body = { path: 'body.md', hash: digest(markdown) }\n    }\n    definition = finalize({\n      $schema: 'dingtalk-agent/agent-definition@1',\n      id: cleanId(workspace.id),\n      source: {\n        kind: 'workspace', uri: `workspace:${workspace.id}`,\n        revision: digest(stableStringify(workspace)),\n      },\n      body,\n      skills: skillManifest.entries.map((entry) => ({\n        name: entry.name, version: entry.version, source: entry.sourcePath,\n        path: entry.snapshotPath, hash: entry.hash,\n      })),\n      storage: {\n        memory: workspace.mounts.memory,\n        knowledge: workspace.mounts.knowledge,\n        artifacts: 'session:artifacts',\n        state: 'session:control-state',\n      },\n      authority: {\n        dwsProfile: workspace.dws.profile,\n        expectedUserId: workspace.dws.expectedUserId,\n      },\n      configuration: {\n        agent: 'workspace', skills: 'workspace', memory: 'workspace',\n        knowledge: 'workspace', artifacts: 'convention', state: 'convention',\n        dwsProfile: 'workspace', expectedUserId: 'workspace',\n      },\n    })\n    writeAtomic(definitionPath, JSON.stringify(definition, null, 2) + '\\n')\n  }\n\n  const destination = join(runPath, 'context', 'agent-definition')\n  rmSync(destination, { recursive: true, force: true })\n  cpSync(sessionRoot, destination, { recursive: true })\n  return definition\n}\n\nexport function verifyPreparedDefinition(runPath: string, expectedHash = ''): AgentDefinition {\n  return verifyDefinition(join(runPath, 'context', 'agent-definition'), expectedHash)\n}\n\nfunction finalize(\n  input: Omit<AgentDefinition, 'status' | 'missing' | 'hash'>,\n): AgentDefinition {\n  const missing: string[] = []\n  if (!input.body) missing.push('body')\n  if (!input.skills.length) missing.push('skills')\n  if (!input.storage.memory) missing.push('storage.memory')\n  if (!input.storage.knowledge) missing.push('storage.knowledge')\n  const unsigned = {\n    ...input,\n    status: missing.length ? 'partial' as const : 'ready' as const,\n    missing,\n  }\n  return { ...unsigned, hash: digest(stableStringify(unsigned)) }\n}\n\nfunction verifyDefinition(root: string, expectedHash = ''): AgentDefinition {\n  const path = join(root, 'definition.json')\n  if (!existsSync(path)) throw new Error('Agent Definition snapshot 缺少 definition.json')\n  const value = JSON.parse(readFileSync(path, 'utf8')) as AgentDefinition\n  const { hash, ...unsigned } = value\n  if (!hash || digest(stableStringify(unsigned)) !== hash || (expectedHash && hash !== expectedHash)) {\n    throw new Error('Agent Definition snapshot hash 不一致')\n  }\n  if (value.body) {\n    const rootPath = resolve(root)\n    const bodyPath = resolve(rootPath, value.body.path)\n    const rel = relative(rootPath, bodyPath)\n    if (rel === '..' || rel.startsWith(`..${process.platform === 'win32' ? '\\\\' : '/'}`)) {\n      throw new Error('Agent Definition body 必须位于 snapshot 内')\n    }\n    const body = readFileSync(bodyPath, 'utf8')\n    if (digest(body) !== value.body.hash) throw new Error('Agent Definition body 内容漂移')\n  }\n  return value\n}\n\nfunction readGitRevision(path: string): string {\n  const run = spawnSync('git', ['-C', path, 'rev-parse', '--show-toplevel', 'HEAD'], {\n    encoding: 'utf8', timeout: 2_000,\n  })\n  if (run.status !== 0) return ''\n  const lines = String(run.stdout || '').trim().split(/\\r?\\n/)\n  return lines.length >= 2 ? lines[1] : ''\n}\n\nfunction readSkillMetadata(path: string): { name: string; version: string } {\n  if (!path || !existsSync(path)) return { name: '', version: '' }\n  const text = readFileSync(path, 'utf8')\n  const block = text.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---/)?.[1] || ''\n  const scalar = (name: string) =>\n    block.match(new RegExp(`^${name}:\\\\s*['\"]?([^'\"\\\\r\\\\n]+)['\"]?\\\\s*$`, 'm'))?.[1]?.trim() || ''\n  const nestedVersion = block.match(\n    /^metadata:\\s*\\r?\\n(?:[ \\t]+.*\\r?\\n)*?[ \\t]+version:\\s*['\"]?([^'\"\\r\\n]+)['\"]?\\s*$/m,\n  )?.[1]?.trim() || ''\n  return { name: scalar('name'), version: nestedVersion || scalar('version') }\n}\n\nfunction writeAtomic(path: string, value: string): void {\n  mkdirSync(dirname(path), { recursive: true })\n  const temp = `${path}.${process.pid}.${Date.now()}.tmp`\n  writeFileSync(temp, value, { flag: 'wx' })\n  renameSync(temp, path)\n}\n\nfunction cleanId(value: string): string {\n  return value.replace(/^[a-z-]+:/, '').replace(/[^a-zA-Z0-9._-]+/g, '-')\n    .replace(/^-+|-+$/g, '') || 'agent'\n}\n"]}