@xdxer/dingtalk-agent 0.1.5-beta.11 → 0.1.5-beta.13

package/dist/src/multica-deploy.js

@@ -4,6 +4,8 @@ import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSyn
 import { tmpdir } from 'node:os';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { WORKSPACE_STATE_ROOT, inspectAgentProject, projectSkillRef, showDevelopmentWorkspace, } from './development-workspace.js';
+import { PREDICATE_REGISTRY_PATH, buildPredicateRegistry, predicateRegistryOwner, serializeRegistry, } from './predicate-registry.js';
+import { completionPredicateId } from './schedule-plan.js';
 import { digest, stableStringify } from './events.js';
 import { MULTICA_EVIDENCE_ROOT, emitProviderDiagnostic, inspectMulticaWorkspace, planMulticaWorkspace, sanitizeProviderEnv, statusMulticaWorkspace, } from './multica-provider.js';
 import { allRuntimeVocabularies, commandInvokesDws, forbiddenSmokeTool, skillsLoadedInContent, vocabulariesForRuntimeProvider, } from './multica-runtime-vocabulary.js';
@@ -368,6 +370,7 @@ export function planMulticaDeployment(start, name, options = {}) {
         inspectionId,
         desiredHash: workspace.desiredHash,
         deploymentHash: source.deploymentHash,
+        predicateRegistry: source.predicateRegistry,
         expected: {
             workspaceId: readPlan.expected.workspaceId,
             runtimeId: readPlan.expected.runtimeId,
@@ -565,6 +568,7 @@ function executeApply(root, workspace, source, plan, preflight, operation, comma
         inspectionEvidencePath: readback.evidencePath,
         desiredHash: workspace.desiredHash,
         deploymentHash: source.deploymentHash,
+        predicateRegistry: source.predicateRegistry,
         observedHash,
         agent: {
             id: finalSnapshot.agent?.id || agentId,
@@ -626,6 +630,7 @@ function retireDeployment(root, workspace, source, plan, preflight, operation, c
         inspectionEvidencePath: preflight.evidencePath,
         desiredHash: workspace.desiredHash,
         deploymentHash: source.deploymentHash,
+        predicateRegistry: source.predicateRegistry,
         observedHash,
         agent: {
             id: agent.id,
@@ -674,11 +679,61 @@ function loadDeploymentSource(root) {
     // second runtime protocol beside the Host's native Skill assignment.
     const instructions = definition;
     const instructionsHash = sha256(instructions);
+    // predicate registry 投影作为受管 supporting file 进入归属 Skill（issue #46）：
+    // 走既有 skill-push 链路交付，投影 hash 因此进 Skill tree hash → deployment hash →
+    // Receipt，回读用现有 skill hash 对账就能发现漂移。不引入第二条传输通道。
+    const predicateRegistry = attachPredicateRegistry(info, skills);
     const deploymentHash = digest(stableStringify({
         definitionHash, instructionsHash,
         skills: skills.map((item) => ({ name: item.name, hash: item.hash })),
+        predicateRegistryHash: predicateRegistry?.hash || '',
     }));
-    return { definitionHash, instructions, instructionsHash, skills, deploymentHash };
+    return { definitionHash, instructions, instructionsHash, skills, predicateRegistry, deploymentHash };
+}
+/**
+ * 把 manifest 的 predicates 注册表投影成归属 Skill 的受管 supporting file。
+ *
+ * 归属 Skill 必须真在受管集合里：注册表声明了、却没有任何一个部署的 Skill 承载它，
+ * 那么运行拍读不到判据——这时**拒绝部署**，而不是部署一个「声明说有判据、运行侧其实
+ * 拿不到」的 Agent。同路径已有作者手写文件时同样拒绝：受管 artifact 不覆盖人写的东西。
+ */
+function attachPredicateRegistry(info, skills) {
+    const projection = buildPredicateRegistry({
+        name: info.project.name,
+        predicates: info.project.predicates,
+        // completion 文法只有一个 parser（schedule-plan），投影这边不再自己解析一遍
+        scheduleRefs: info.project.schedules.map((schedule) => ({
+            name: schedule.name, predicate: completionPredicateId(schedule.completion),
+        })),
+    });
+    if (!projection)
+        return null;
+    const owner = predicateRegistryOwner(info.project.skills);
+    const bundle = skills.find((item) => item.name === owner);
+    if (!bundle) {
+        throw new Error(`Project 声明了 predicates 注册表，但受管 Skill 集合里没有承载它的 Skill（期望 ${owner || '-'}）——` +
+            '运行拍会读不到判据，先把该 Skill 加入 agent.skills 再部署');
+    }
+    if (bundle.files.some((item) => item.path === PREDICATE_REGISTRY_PATH)) {
+        throw new Error(`Skill ${owner} 已有 ${PREDICATE_REGISTRY_PATH}——受管 registry 投影不覆盖作者手写文件`);
+    }
+    const text = serializeRegistry(projection);
+    const content = Buffer.from(text, 'utf8');
+    bundle.files = [...bundle.files, {
+            path: PREDICATE_REGISTRY_PATH, absolutePath: '', managedContent: text,
+            hash: sha256(content), bytes: content.length,
+        }].sort((a, b) => a.path.localeCompare(b.path));
+    if (bundle.files.length > MAX_SKILL_SUPPORTING_FILES) {
+        throw new Error(`Skill ${owner} 加上受管 registry 投影后 supporting files 超过 ${MAX_SKILL_SUPPORTING_FILES} 个`);
+    }
+    bundle.hash = skillTreeHash(bundle.content, bundle.files.map((item) => ({ path: item.path, hash: item.hash })));
+    return {
+        skill: owner,
+        path: PREDICATE_REGISTRY_PATH,
+        hash: projection.hash,
+        ids: Object.keys(projection.predicates),
+        schedules: projection.schedules.map((item) => item.name),
+    };
 }
 function loadSkillBundle(name, root) {
     const actual = realpathSync(root);
@@ -780,14 +835,14 @@ function reconcileSkill(root, plan, local, remote, command, env, timeoutMs, call
         rollback.createdSkillIds.push(id);
         action = 'create';
         for (const file of local.files)
-            upsertSkillFile(root, plan, id, file.path, file.absolutePath, command, env, timeoutMs, calls);
+            upsertSkillFile(root, plan, id, file.path, skillFileContentPath(file, temp), command, env, timeoutMs, calls);
     }
     else if (remote.hash !== local.hash) {
         rollback.updatedSkills.push(remote);
         runProvider(command, scopedArgs(plan, [
             'skill', 'update', id, '--content-file', local.mainPath, '--output', 'json',
         ]), `skill.update:${local.name}`, 'write', root, env, timeoutMs, calls);
-        syncSkillFiles(root, plan, id, local, remote, command, env, timeoutMs, calls);
+        syncSkillFiles(root, plan, id, local, remote, command, env, timeoutMs, calls, temp);
         action = 'update';
     }
     const readback = parseRemoteSkill(jsonObject(runProvider(command, scopedArgs(plan, ['skill', 'get', id, '--output', 'json']), `skill.get.readback:${local.name}`, 'read', root, env, timeoutMs, calls).stdout, `skill readback ${local.name}`));
@@ -835,7 +890,7 @@ function reconcileAgent(root, plan, source, remote, command, env, timeoutMs, cal
     }
     return { agent, action };
 }
-function syncSkillFiles(root, plan, skillId, local, remote, command, env, timeoutMs, calls) {
+function syncSkillFiles(root, plan, skillId, local, remote, command, env, timeoutMs, calls, temp) {
     const remoteByPath = new Map(remote.files.map((item) => [item.path, item]));
     const localPaths = new Set(local.files.map((item) => item.path));
     for (const file of remote.files) {
@@ -846,9 +901,25 @@ function syncSkillFiles(root, plan, skillId, local, remote, command, env, timeou
     for (const file of local.files) {
         if (remoteByPath.get(file.path)?.hash === file.hash)
             continue;
-        upsertSkillFile(root, plan, skillId, file.path, file.absolutePath, command, env, timeoutMs, calls);
+        upsertSkillFile(root, plan, skillId, file.path, skillFileContentPath(file, temp), command, env, timeoutMs, calls);
     }
 }
+/**
+ * 上传用的正文来源。磁盘文件直接给路径；受管 artifact（registry 投影）在这里才物化——
+ * plan 阶段只参与 hash，不落任何文件，dry-run 的「零副作用」保持为真。
+ */
+function skillFileContentPath(file, temp) {
+    if (file.absolutePath)
+        return file.absolutePath;
+    if (file.managedContent === undefined) {
+        throw new Error(`受管 Skill 文件缺正文: ${file.path}`);
+    }
+    const path = writeTemporaryContent(temp, `managed-${sha256(file.path).slice(0, 8)}`, file.managedContent);
+    if (sha256(readFileSync(path)) !== file.hash) {
+        throw new Error(`受管 Skill 文件物化后 hash 不一致: ${file.path}`);
+    }
+    return path;
+}
 function upsertSkillFile(root, plan, skillId, path, contentFile, command, env, timeoutMs, calls) {
     runProvider(command, scopedArgs(plan, [
         'skill', 'files', 'upsert', skillId, '--path', path,
@@ -1301,6 +1372,7 @@ function failureReceipt(root, workspace, source, plan, preflight, operation, cal
         inspectionEvidencePath: preflight.evidencePath,
         desiredHash: workspace.desiredHash,
         deploymentHash: source.deploymentHash,
+        predicateRegistry: source.predicateRegistry,
         observedHash: '',
         agent: {
             id: operation.agentId,