@xdxer/dingtalk-agent 0.1.5-beta.2 → 0.1.5-beta.4

package/dist/src/agent-audit.js

@@ -12,6 +12,7 @@ import { resolvePackageRoot } from './package-root.js';
 import { bundledSkillPath } from './skill-manager.js';
 import { createIsolatedOpenCodeHost } from './opencode-isolation.js';
 const COMPOSE_TEMPLATE_MARKER = /<(?:Agent 名称|岗位\/角色|人群、团队或工作场域|长期目标|主动负责的事项|可观察的交付物|明确不做或必须升级确认的事项|岗位稳定的输入、判断、交付与验收范式|何时自行推进、何时交给谁|本体级常见错误 [12]|纠偏动作 [12]|Role Skill names|role-skill-name|Role Skill 名称|岗位职责或工作流|领域判断、输入与交付物|相邻职责或明确交接边界|岗位特有的禁区或必须升级条件|领域输入|领域方法\/SOP|领域常见错误|领域纠偏动作|可观察结果 [12]|route)>/u;
+const BASIC = 'dingtalk-basic-behavior';
 const BASIC_INSTRUCTION = '.agents/skills/dingtalk-basic-behavior/SKILL.md';
 const DEFINITION_PROBE_PROMPT = '这是 Agent Definition 继承探针。只依据已强制加载的角色宪法末尾注释回答；' +
     '严格输出纯文本 dta-definition-probe=<值>，若看不到则输出纯文本 ' +
@@ -77,28 +78,33 @@ export function auditAgent(root, options = {}) {
         }
     }
     const basic = readCanonicalBasicSkill();
-    const basicExposurePath = join(rootReal, '.agents', 'skills', 'dingtalk-basic-behavior', 'SKILL.md');
+    const packagedBasic = definition.skills.find((item) => item.name === BASIC);
+    const basicExposurePath = packagedBasic?.path || join(rootReal, '.agents', 'skills', BASIC, 'SKILL.md');
     const basicExposure = inspectSkill(basicExposurePath);
     const basicExposureTree = inspectSkillTree(basicExposurePath);
     add('host.basic-exposure', 'host', basicExposure.exists && basicExposure.name === basic.name &&
         basicExposure.version === basic.version && basicExposure.hash === basic.hash &&
         basicExposureTree.hash === basic.treeHash ? 'pass' : 'fail', true, basicExposure.exists && basicExposure.hash === basic.hash &&
         basicExposureTree.hash === basic.treeHash
-        ? 'OpenCode Basic Skill 全树 exposure 与 canonical source 一致'
-        : 'OpenCode Basic Skill 入口、references 或 assets 缺失或发生漂移', { expected: basic, actual: { ...basicExposure, treeHash: basicExposureTree.hash,
+        ? 'Agent package 的 Basic Skill 全树与 canonical source 一致'
+        : 'Agent package 的 Basic Skill 入口、references 或 assets 缺失或发生漂移', { expected: basic, actual: { ...basicExposure, treeHash: basicExposureTree.hash,
             files: basicExposureTree.files, error: basicExposureTree.error } });
     const config = inspectOpenCodeConfig(rootReal);
     const definitionInstruction = definition.body?.path
         ? relative(rootReal, definition.body.path).split('\\').join('/') : '';
     const definitionInstructionCount = countInstructionsForPath(rootReal, config.instructions, definitionInstruction);
-    const definitionRuleReady = !config.error && definitionInstruction === 'AGENTS.md' &&
-        definitionInstructionCount === 0;
+    const definitionInstructionExpected = definitionInstruction === 'AGENTS.md' ? 0 : 1;
+    const definitionRuleReady = !config.error && Boolean(definitionInstruction) &&
+        definitionInstructionCount === definitionInstructionExpected;
     add('host.definition-rule', 'host', definitionRuleReady
         ? 'pass' : 'fail', true, definitionRuleReady
-        ? 'OpenCode 使用项目根 AGENTS.md 原生 rule，且未重复声明 custom instruction'
-        : 'Agent Definition 必须是项目根 AGENTS.md，且不能重复加入 opencode instructions', { path: config.path, error: config.error, instruction: definitionInstruction,
+        ? definitionInstruction === 'AGENTS.md'
+            ? 'OpenCode 使用项目根开发兼容模式的原生 Agent Definition'
+            : 'OpenCode 以唯一 custom instruction 加载独立 Agent Definition'
+        : 'Agent Definition 未形成唯一加载路径', { path: config.path, error: config.error, instruction: definitionInstruction,
         instructionCount: definitionInstructionCount });
-    const instructionCount = countInstructionsForPath(rootReal, config.instructions, '.agents/skills/dingtalk-basic-behavior/SKILL.md');
+    const basicInstruction = relative(rootReal, basicExposurePath).split('\\').join('/');
+    const instructionCount = countInstructionsForPath(rootReal, config.instructions, basicInstruction);
     add('host.basic-instruction', 'host', !config.error && instructionCount === 1 &&
         config.permissions['dingtalk-basic-behavior'] === 'allow' ? 'pass' : 'fail', true, !config.error && instructionCount === 1 &&
         config.permissions['dingtalk-basic-behavior'] === 'allow'
@@ -107,12 +113,10 @@ export function auditAgent(root, options = {}) {
         permission: config.permissions['dingtalk-basic-behavior'] || '' });
     for (const name of requiredSkills) {
         const source = roleSkills.get(name);
-        const exposure = inspectSkill(join(rootReal, '.agents', 'skills', name, 'SKILL.md'));
         const permission = config.permissions[name] || '';
-        const matched = Boolean(source?.hash && exposure.exists && exposure.name === name &&
-            exposure.hash === source.hash && permission === 'allow');
-        add(`host.role-exposure.${name}`, 'host', matched ? 'pass' : 'fail', true, matched ? `Role Skill ${name} exposure 与 Definition 一致`
-            : `Role Skill ${name} exposure、hash 或 permission 不一致`, { sourceHash: source?.hash || '', exposure, permission });
+        const matched = Boolean(source?.hash && source.path && permission === 'allow');
+        add(`host.role-exposure.${name}`, 'host', matched ? 'pass' : 'fail', true, matched ? `Role Skill ${name} 单一发布源与 Host permission 一致`
+            : `Role Skill ${name} 发布源或 permission 不一致`, { sourceHash: source?.hash || '', sourcePath: source?.path || '', permission });
     }
     const staticPrerequisitesReady = checks
         .filter((item) => item.blocking)
@@ -129,7 +133,7 @@ export function auditAgent(root, options = {}) {
         if (!options.yes)
             throw new Error('agent audit --verify-load 会调用 OpenCode；必须同时传 --yes');
         if (staticPrerequisitesReady) {
-            const execution = executeLoadAudit(rootReal, options, loadTargetHash, definitionInstruction, effectiveModel, () => currentLoadTargetHash(rootReal, options, requiredSkills, effectiveModel));
+            const execution = executeLoadAudit(rootReal, options, loadTargetHash, definitionInstruction, basicInstruction, effectiveModel, () => currentLoadTargetHash(rootReal, options, requiredSkills, effectiveModel));
             loadReport = execution.report;
             loadReportPath = execution.evidencePath;
             verifiedReportPath = execution.reportPath;
@@ -374,17 +378,14 @@ function currentLoadTargetHash(root, options, requiredSkills, model) {
     const hydrated = bootstrap(root, { ...(options.bootstrap || {}), deferRemote: true });
     const definition = hydrated.definition;
     const basic = readCanonicalBasicSkill();
-    const exposedPath = join(root, '.agents', 'skills', 'dingtalk-basic-behavior', 'SKILL.md');
+    const packagedBasic = definition.skills.find((item) => item.name === BASIC);
+    const exposedPath = packagedBasic?.path || join(root, '.agents', 'skills', BASIC, 'SKILL.md');
     const exposed = inspectSkill(exposedPath);
     const exposedTree = inspectSkillTree(exposedPath);
     const config = inspectOpenCodeConfig(root);
     const roleSkills = new Map(definition.skills
         .filter((item) => item.name !== 'dingtalk-basic-behavior')
         .map((item) => [item.name, item]));
-    const roleExposureHashes = Object.fromEntries(requiredSkills.map((name) => [
-        name,
-        inspectSkill(join(root, '.agents', 'skills', name, 'SKILL.md')).hash || '',
-    ]));
     const roleSourceHashes = Object.fromEntries(requiredSkills.map((name) => [
         name, roleSkills.get(name)?.hash || '',
     ]));
@@ -402,11 +403,10 @@ function currentLoadTargetHash(root, options, requiredSkills, model) {
         opencodeConfigHash: config.hash,
         requiredSkills,
         roleSourceHashes,
-        roleExposureHashes,
         model,
     }));
 }
-function executeLoadAudit(root, options, targetHash, definitionInstruction, model, revalidate) {
+function executeLoadAudit(root, options, targetHash, definitionInstruction, basicInstruction, model, revalidate) {
     const runId = `agent_audit_${Date.now()}_${randomUUID().slice(0, 8)}`;
     const outputInspection = inspectContainedPath(root, options.out || join('.dingtalk-agent', 'agent-audit', 'results', runId));
     const outputRoot = outputInspection.path;
@@ -424,8 +424,8 @@ function executeLoadAudit(root, options, targetHash, definitionInstruction, mode
     const host = createIsolatedOpenCodeHost(model.split('/')[0]);
     try {
         const command = process.env.DTA_OPENCODE_BIN || 'opencode';
-        const sourcePreflight = inspectSourceOpenCodeRuntime(command, root, host.environment, definitionInstruction);
-        materializeAuditProbeWorkspace(root, auditWorkspace, definitionInstruction);
+        const sourcePreflight = inspectSourceOpenCodeRuntime(command, root, host.environment, definitionInstruction, basicInstruction);
+        materializeAuditProbeWorkspace(root, auditWorkspace, definitionInstruction, basicInstruction);
         const suitePath = join(auditWorkspace, 'suite.json');
         writeAtomic(suitePath, JSON.stringify({
             $schema: 'dingtalk-agent/robot-eval-suite@1',
@@ -494,19 +494,19 @@ function executeLoadAudit(root, options, targetHash, definitionInstruction, mode
         rmSync(auditWorkspace, { recursive: true, force: true });
     }
 }
-function materializeAuditProbeWorkspace(sourceRoot, targetRoot, definitionInstruction) {
-    if (definitionInstruction !== 'AGENTS.md') {
-        throw new Error('OpenCode 原生 Definition 探针只接受项目根 AGENTS.md');
-    }
+function materializeAuditProbeWorkspace(sourceRoot, targetRoot, definitionInstruction, basicInstruction) {
     mkdirSync(targetRoot, { recursive: true });
-    writeAtomic(join(targetRoot, 'AGENTS.md'), readFileSync(join(sourceRoot, 'AGENTS.md'), 'utf8'));
-    const sourceBasic = join(sourceRoot, '.agents', 'skills', 'dingtalk-basic-behavior');
+    writeAtomic(join(targetRoot, definitionInstruction), readFileSync(join(sourceRoot, definitionInstruction), 'utf8'));
+    const sourceBasic = dirname(join(sourceRoot, basicInstruction));
     const targetBasic = join(targetRoot, '.agents', 'skills', 'dingtalk-basic-behavior');
     mkdirSync(dirname(targetBasic), { recursive: true });
     cpSync(sourceBasic, targetBasic, { recursive: true });
     const config = {
         $schema: 'https://opencode.ai/config.json',
-        instructions: [BASIC_INSTRUCTION],
+        instructions: [
+            ...(definitionInstruction === 'AGENTS.md' ? [] : [definitionInstruction]),
+            BASIC_INSTRUCTION,
+        ],
         permission: { skill: { 'dingtalk-basic-behavior': 'allow' } },
         plugin: [],
         mcp: {},
@@ -515,19 +515,21 @@ function materializeAuditProbeWorkspace(sourceRoot, targetRoot, definitionInstru
     };
     writeAtomic(join(targetRoot, 'opencode.json'), JSON.stringify(config, null, 2) + '\n');
 }
-function inspectSourceOpenCodeRuntime(command, root, environment, definitionInstruction) {
+function inspectSourceOpenCodeRuntime(command, root, environment, definitionInstruction, basicInstruction) {
     const parent = mkdtempSync(join(tmpdir(), 'dta-source-config-preflight-'));
     const workspace = join(parent, 'workspace');
     let stdout = '';
     try {
         mkdirSync(workspace, { recursive: true });
         cpSync(join(root, 'opencode.json'), join(workspace, 'opencode.json'));
-        if (existsSync(join(root, 'AGENTS.md'))) {
-            cpSync(join(root, 'AGENTS.md'), join(workspace, 'AGENTS.md'));
+        if (existsSync(join(root, definitionInstruction))) {
+            const target = join(workspace, definitionInstruction);
+            mkdirSync(dirname(target), { recursive: true });
+            cpSync(join(root, definitionInstruction), target);
         }
-        const basic = join(root, '.agents', 'skills', 'dingtalk-basic-behavior');
+        const basic = dirname(join(root, basicInstruction));
         if (existsSync(basic)) {
-            const target = join(workspace, '.agents', 'skills', 'dingtalk-basic-behavior');
+            const target = dirname(join(workspace, basicInstruction));
             mkdirSync(dirname(target), { recursive: true });
             cpSync(basic, target, {
                 recursive: true,
@@ -564,9 +566,10 @@ function inspectSourceOpenCodeRuntime(command, root, environment, definitionInst
         throw new Error('OpenCode 原项目 resolved instructions 不是 string array');
     }
     const definitionCount = countInstructionsForPath(root, instructions, definitionInstruction);
-    const basicCount = countInstructionsForPath(root, instructions, BASIC_INSTRUCTION);
-    if (definitionInstruction !== 'AGENTS.md' || definitionCount !== 0 || basicCount !== 1) {
-        throw new Error(`OpenCode 原项目 resolved config 未形成原生 AGENTS.md + 唯一 Basic: ` +
+    const basicCount = countInstructionsForPath(root, instructions, basicInstruction);
+    const expectedDefinitionCount = definitionInstruction === 'AGENTS.md' ? 0 : 1;
+    if (definitionCount !== expectedDefinitionCount || basicCount !== 1) {
+        throw new Error(`OpenCode 原项目 resolved config 未形成唯一 Agent Definition + Basic: ` +
             `definition=${definitionCount} basic=${basicCount}`);
     }
     if (value.agent?.['dta-eval'] !== undefined) {
@@ -625,7 +628,10 @@ function executeInheritanceProbe(sourceRoot, model, command, timeoutMs, reportEv
             !Array.isArray(sourceConfig.permission) ? sourceConfig.permission : {};
         const skill = permission.skill && typeof permission.skill === 'object' &&
             !Array.isArray(permission.skill) ? permission.skill : {};
-        sourceConfig.instructions = [BASIC_INSTRUCTION];
+        sourceConfig.instructions = [
+            ...(definitionInstruction === 'AGENTS.md' ? [] : [definitionInstruction]),
+            BASIC_INSTRUCTION,
+        ];
         delete sourceConfig.provider;
         sourceConfig.plugin = [];
         sourceConfig.mcp = {};
@@ -665,7 +671,7 @@ function executeInheritanceProbe(sourceRoot, model, command, timeoutMs, reportEv
         const definitionRaw = persistProbeExecution(reportEvidenceRoot, 'definition', definitionExecution);
         const referenceRaw = persistProbeExecution(reportEvidenceRoot, 'reference', referenceExecution);
         const result = {
-            passed: definitionInstruction === 'AGENTS.md' && basicResolvedCount === 1 &&
+            passed: Boolean(definitionInstruction) && basicResolvedCount === 1 &&
                 definitionPermissionPassed && referencePermissionPassed &&
                 definitionExecution.exitCode === 0 && definitionExecution.directoryMatched &&
                 definitionExecution.toolCalls === 0 &&
@@ -830,7 +836,7 @@ function validRandomProbe(value, name) {
     const count = name === 'dta-reference-probe' ? 2 : 1;
     return new RegExp(`^${name}=${uuid}${count === 2 ? `:${uuid}` : ''}$`).test(value);
 }
-function verifyLoadProbeSet(root, reportPath, report, primaryName, comparisonName, basic, expectedRuns) {
+function verifyLoadProbeSet(root, reportPath, report, primaryName, comparisonName, basic, definitionInstruction, expectedRuns) {
     const all = Array.isArray(report.loadProbes) ? report.loadProbes : [];
     const declaredRuns = Number(report.summary?.runsPerConfiguration);
     const primary = all.filter((item) => item.configuration === primaryName);
@@ -841,7 +847,12 @@ function verifyLoadProbeSet(root, reportPath, report, primaryName, comparisonNam
         items.every((item) => Number.isInteger(item.runNumber) &&
             item.runNumber >= 1 && item.runNumber <= expectedRuns);
     const common = (item) => {
-        const expectedInstructions = item.expectsLoad === true ? [BASIC_INSTRUCTION] : [];
+        const expectedInstructions = item.expectsLoad === true
+            ? [
+                BASIC_INSTRUCTION,
+                ...(definitionInstruction === 'AGENTS.md' ? [] : [definitionInstruction]),
+            ].sort()
+            : [];
         return loadProbeCorePassed(item, version) &&
             stableStringify(item.resolvedInstructions) === stableStringify(expectedInstructions) &&
             verifyLoadProbeRaw(root, reportPath, item, String(report.engine?.model || ''));
@@ -954,7 +965,7 @@ function readLoadEvidence(root, input, expectedTargetHash) {
 function verifyLoadReport(root, reportPath, report, basic, definitionInstruction, model, currentHostVersion) {
     const configuration = 'with_skill';
     const comparison = 'without_skill';
-    const probeSet = verifyLoadProbeSet(root, reportPath, report, configuration, comparison, basic, 1);
+    const probeSet = verifyLoadProbeSet(root, reportPath, report, configuration, comparison, basic, definitionInstruction, 1);
     const probes = probeSet.primary;
     const source = report.skills?.[configuration];
     const gate = report.summary?.configurationLoadGates?.[configuration];
@@ -966,7 +977,7 @@ function verifyLoadReport(root, reportPath, report, basic, definitionInstruction
         Array.isArray(definition.toolNames) && definition.toolNames.length === 0 &&
         Array.isArray(definition.toolPaths) && definition.toolPaths.length === 0 &&
         Array.isArray(definition.toolTrace) && definition.toolTrace.length === 0 &&
-        definition.nativeRule === 'AGENTS.md' && definitionInstruction === 'AGENTS.md' &&
+        definition.nativeRule === definitionInstruction && Boolean(definitionInstruction) &&
         definition.permissionPassed === true &&
         zeroToolPermission(definition.evalAgent || {});
     const referenceTrace = Array.isArray(reference.toolTrace) ? reference.toolTrace : [];
@@ -1017,7 +1028,7 @@ function verifyLoadReport(root, reportPath, report, basic, definitionInstruction
             baselineAntiGuessProbes: probeSet.passedComparison,
             expectedRunsPerConfiguration: probeSet.expectedRuns,
             definitionInstruction,
-            definitionNativeRule: definition.nativeRule === 'AGENTS.md',
+            definitionNativeRule: definition.nativeRule === definitionInstruction,
             totalProbes: probes.length,
             definitionProbePassed: definitionPassed,
             referenceProbePassed: referencePassed,
@@ -1037,8 +1048,11 @@ function verifySourceConfigEvidence(root, reportPath, summary, evidence) {
         return false;
     const value = summary;
     const manifest = evidence;
-    if (value.passed !== true || value.definitionInstruction !== 'AGENTS.md' ||
-        value.definitionInstructionCount !== 0 || value.basicInstructionCount !== 1 ||
+    const expectedDefinitionCount = value.definitionInstruction === 'AGENTS.md' ? 0 : 1;
+    if (value.passed !== true || typeof value.definitionInstruction !== 'string' ||
+        !value.definitionInstruction ||
+        value.definitionInstructionCount !== expectedDefinitionCount ||
+        value.basicInstructionCount !== 1 ||
         typeof value.rawHash !== 'string' || !value.rawHash ||
         manifest.rawHash !== value.rawHash)
         return false;
@@ -1227,12 +1241,12 @@ function repairFor(id) {
     if (id === 'definition.semantic-contract')
         return {
             id, why: '结构化模板不能替代真实的本体定义、岗位底线、做事范式和常犯错误。',
-            actions: ['评审并替换 AGENTS.md 中所有 <...> 占位符，再复跑 audit。'],
+            actions: ['评审并替换 manifest 中 agent.definition 指向文件的所有 <...> 占位符，再复跑 audit。'],
         };
     if (id === 'definition.body')
         return {
             id, why: 'Agent 必须有长期定义、岗位底线、做事范式和常犯错误。',
-            actions: ['从 compose Skill 的 AGENTS.template.md 创建 AGENTS.md，再复跑 audit。'],
+            actions: ['从 compose Skill 的 AGENTS.template.md 创建 agent/AGENTS.md，并由 manifest 的 agent.definition 指向它，再复跑 audit。'],
         };
     if (id === 'storage.memory')
         return {
@@ -1257,22 +1271,22 @@ function repairFor(id) {
     if (id.startsWith('skill.role.') && id.endsWith('.semantic'))
         return {
             id, why: 'Role Skill 必须包含真实的领域输入、方法、产物和验收，而不是模板提示。',
-            actions: [`评审并替换 skills/${id.slice('skill.role.'.length, -'.semantic'.length)}/SKILL.md 中所有 <...> 占位符。`],
+            actions: [`评审并替换 agent.skillsRoot 下 ${id.slice('skill.role.'.length, -'.semantic'.length)}/SKILL.md 中所有 <...> 占位符。`],
         };
     if (id.startsWith('skill.role.'))
         return {
             id, why: '领域职责需要独立 Role Skill，不能写回 Basic Behavior。',
-            actions: [`创建 skills/${id.slice('skill.role.'.length)}/SKILL.md，并确保目录名等于 frontmatter name。`],
+            actions: [`在 manifest 声明的 agent.skillsRoot 下创建 ${id.slice('skill.role.'.length)}/SKILL.md，并确保目录名等于 frontmatter name。`],
         };
     if (id === 'host.basic-exposure')
         return {
             id, why: 'OpenCode 只能从项目 exposure 完整继承本次装配的 Basic Skill 入口、references 与 assets。',
-            actions: ['把 canonical dingtalk-basic-behavior 全树物化到 .agents/skills/dingtalk-basic-behavior。'],
+            actions: ['把 canonical dingtalk-basic-behavior 全树放入 agent.skillsRoot；由 dta 在隔离 Host 工作区临时物化 exposure。'],
         };
     if (id === 'host.definition-rule')
         return {
-            id, why: 'OpenCode 只会把项目根 AGENTS.md 作为本地原生 rule；重复 custom instruction 会形成冗余通道。',
-            actions: ['把项目本体统一为根目录 AGENTS.md，并从 opencode.json#instructions 删除其等价路径。'],
+            id, why: 'Agent Definition 与仓库开发约束必须分离，重复 custom instruction 会形成冗余通道。',
+            actions: ['让 managed Host 只加载一次 manifest 的 agent.definition；仓库根 AGENTS.md 仅保留 Coding Agent 开发约束。'],
         };
     if (id === 'host.basic-instruction')
         return {
@@ -1282,7 +1296,7 @@ function repairFor(id) {
     if (id.startsWith('host.role-exposure.'))
         return {
             id, why: 'Role Skill 的发布源、Host exposure 与权限必须指向同一版本。',
-            actions: [`物化 .agents/skills/${id.slice('host.role-exposure.'.length)}，校验 hash 并设置 permission=allow。`],
+            actions: [`修复 agent.skillsRoot 下 ${id.slice('host.role-exposure.'.length)} 的唯一发布源；由 dta 临时物化 Host exposure、校验 hash 并设置 permission=allow。`],
         };
     if (id === 'host.load-probe')
         return {