@xdxer/dingtalk-agent 0.1.5-beta.7 → 0.1.5-beta.9

package/skills/core/dta-people-group-memory/SKILL.md

@@ -3,7 +3,7 @@ name: dta-people-group-memory
 description: 让办公 Agent 认识「人」和「会话（群/单聊）」并记住交互。需要判断某位同事是谁、在做什么、怎么和他协作、我们之前聊过什么，或需要判断某个群是干什么的、在推什么、谁说了算、这事在哪讨论过、我该不该在这儿说话时使用；用户要求「记住这个人／沉淀一下这次聊天／以后记得我的偏好」时也使用。未绑定存储前完全惰性，不写任何东西。
 compatibility: Storage-agnostic. Ships with a DingTalk-document adapter and a local-Markdown adapter; the model and ingest layers never touch a specific medium. Binding happens on demand under the runtime identity.
 metadata:
-  version: "0.3.0"
+  version: "0.3.1"
 ---
 
 # 认识人 · 认识会话 · 记住交互
@@ -23,7 +23,7 @@ metadata:
   └ adapters.md        介质特有的坑全部收在适配器里
 ```
 
-**存储是双介质、按 section 种类分流**（`model.md` §三）：叙事类正文（identity/chronicle/digest…）走**钉钉文档**（读整页、人打开看）；注册表类（索引/水位/count/tombstone/roster）走 **AI 表格**（按 key 查、真分页、不撞截断墙）。同一套模型层操作，registry 换成结构化介质就把一半病理关掉——这是端口解耦的现场兑现。
+**存储是双介质、按 section 种类分流**（`model.md` §三）：叙事类正文（identity/chronicle/digest…）走**钉钉文档**（读整页、人打开看）；注册表类（索引/水位/count/tombstone/roster）走 **AI 表格**（**按 key / recordId 有界查**，不撞文档字符墙）。同一套模型层操作，registry 换成结构化介质就把一半病理关掉——这是端口解耦的现场兑现。**但 AI 表格的全量枚举仍会静默截断**（见四条不变式③）：只有按 key/recordId 的有界查询能当存在性证据，别把它当"随便分页扫都安全"。
 
 **解耦的检验标准**：如果这世界上只有本地 Markdown 文件这一种存储，模型层会长成同样的样子吗？会，才算解耦。凡是“因为钉钉文档会截断，所以本体要按月分页”这类推理，都必须改写成“适配器声明读取上限，通用算法据此分片”。
 
@@ -54,8 +54,8 @@ metadata:
 ## 四条不变式（模型层保证，不下放给适配器）
 
 1. **原始层只增不删，派生层可重建。** 纠错用 `supersedes` 并列新增，不改写原件。
-2. **写后必回读，`success` 不算数。** 没有回读证据不许声称已记。
-3. **读失败 ≠ 不存在。** 读取失败、分页未完、授权缺失一律记欠账并跳过本轮，绝不写成“没有”，也绝不据此新建重复实体。
+2. **写后必回读，且按 recordId 回读那一行，`success` 不算数。** 回读若靠全表扫或按键再查，会被截断骗到别的行或读空——只有拿写入拿到的 recordId 精确回读才作数。
+3. **读不完整 ≠ 不存在。** 不只是"读报错了"：AI 表格分页会**静默截断**——成功返回一个偏小的前缀却报 hasMore=false，没有任何完整性凭据。所以全量枚举一律当"未证明完整"，绝不据此写"没有"、也绝不据此新建重复实体。要判"某人/某群不存在"，用有界的按键查（命中 0 行），不要用全表扫。
 4. **先写事实、后推水位。** 任一失败即本批作废、水位不动——水位虚高会让这批源事件永远不再被消化。
 
 ## 两个实体，一句话说清区别

package/skills/core/dta-people-group-memory/references/model.md

@@ -145,4 +145,4 @@ watermark: { subject: <key>, channel: im|todo|doc, value: <绝对时间> }
 4. 交叉归属三铁律。
 5. 先写事实、后推水位。
 6. 会话隐私档位白名单默认拒绝。
-7. **"读失败 ≠ 不存在"**：任何读取失败、分页未完、授权缺失，一律记欠账并跳过本轮，**绝不写成"没有"**，也绝不据此新建重复实体。
+7. **"读不完整 ≠ 不存在"**：不只是读报错——AI 表格分页会**静默截断**（成功返回偏小前缀却报 hasMore=false，无完整性凭据）。读失败、分页未完、授权缺失、以及**任何全量枚举**，一律当"未证明完整"，记欠账、跳过本轮，**绝不写成"没有"**，也绝不据此新建重复实体。判"不存在"只能用有界的按键查（命中 0 行）。

package/skills/platforms/multica-dingtalk/PLATFORM.md

@@ -34,7 +34,7 @@ Multica 是钉钉 FDE fork 的托管 Agent 平台：把一个 dingtalk-agent 数
 - **run 幂等按 `(trigger, 计划时刻)`；漏掉的 fire 会塌缩成最近一次，迟到超过 5 分钟直接跳过。** 所以定点 cron 只用来开窗，不能用来保证「某时刻必须发生」——完成判据必须逾期后持续为真。
 - **多条节律不要落在同一分钟。** 外发类的留痕写在动作之后、没有锁，并发唤醒会把同一条消息发两遍给第三方。
 
-`autopilot-create` 的 stdout **带一行非 JSON 前缀**（`scheduled: <cron> ..., next run ...`）。直接 `json.load(stdout)` 会抛异常，让人误判「没建成」而**重复创建**——重复的节律就是重复的外发。建完一律用 `autopilot-list` / `autopilot-get` 独立回读条数、cron、时区、提示词、启用状态和 `next_run_at`，不要相信创建响应。
+`autopilot-create` 的 stdout 是**纯 JSON**（`scheduled: ...` 进度提示走 stderr，`json.load(stdout)` 不会炸）。真正的坑是 **create 非幂等**：重复创建就是重复的节律、重复的外发。建完一律用 `autopilot-list` / `autopilot-get` 独立回读条数、cron、时区、提示词、启用状态和 `next_run_at`，不要相信创建响应。
 
 `multica_ext.py` **没有** `autopilot-delete`；误建的先 `autopilot-set-status --status paused` 止血，再按需 `DELETE /api/autopilots/{id}`（需带 `X-Workspace-Id` 头，否则 400）。
 
@@ -48,7 +48,7 @@ Multica 是钉钉 FDE fork 的托管 Agent 平台：把一个 dingtalk-agent 数
 
 1. **dws 自动路径（首选）**：`dws dev app list` 选已有应用或经用户确认 `dws dev app robot submit` 新建 →（异步，`robot result` 轮询到 SUCCESS）→ `dws dev app credentials get --unified-app-id <id>` 取 AppKey/AppSecret → `dingtalk-bind --agent <id> --client-id <AppKey> --client-secret-stdin`。
    - 机器人 desc 只允许中英文数字和特定标点（冒号/括号会触发 67010 失败）。
-   - 想让未绑定账号的用户也能直接对话（快速验收/对客服务），绑定时加 `--allow-unbound`（connect-to-customers 模式：以安装者身份服务未绑定发送者）；否则未绑定发送者只会收到账号绑定引导。
+   - **不加 `--allow-unbound` 的默认行为是拦截**：任何未把钉钉账号绑定到 Multica 的发送者（包括机器人 owner 本人）@ 机器人只会收到账号绑定引导，不产生任何 Run——验收第一句话就会撞上。想让未绑定账号的用户直接对话（快速验收/对客服务），绑定时加 `--allow-unbound`（connect-to-customers 模式：以安装者身份服务未绑定发送者），或先走 `dingtalk-account-begin --binding-mode message` 完成绑定。
 2. **复用已有安装**：`dingtalk-list` 查看现有机器人安装换绑。
 3. **扫码兜底**：`dingtalk-begin` 产出扫码链接交用户完成（不要用 `--wait` 阻塞会话）。
 

package/skills/platforms/multica-dingtalk/dta-deploy-multica/SKILL.md

@@ -3,7 +3,7 @@ name: dta-deploy-multica
 description: 当开发者要把 dingtalk-agent Agent Project 部署、更新、检查、恢复或 retire 到 Multica Workspace，或把通过指定 Eval gate 的本地版本晋级、把脱敏反馈转成待评审 Eval candidate 时使用。只编排 dta 的稳定 deploy/promote/observe CLI，不直接调用 Multica 写命令，不创建 Trigger，不热改 Agent 本体或 Skill，也不替用户登录或持有凭据。
 compatibility: Requires dingtalk-agent and an authenticated Multica CLI profile for live apply/status readback.
 metadata:
-  version: "0.4.0"
+  version: "0.5.0"
 ---
 
 # 部署 dingtalk-agent 到 Multica
@@ -13,11 +13,12 @@ metadata:
 ## 工作顺序
 
 1. 先运行 `dta workspace doctor <name> --json` 和 `dta workspace inspect <name> --execute --yes --json`。登录、profile 默认 Workspace、显式 Workspace、Runtime、Agent ID 链或 Skill 唯一性不一致时停止；不要用 `--yes` 越过。
-2. 运行 `dta deploy --workspace <name> --dry-run --json`，向用户展示 `planId`、本体/Skill hash、forward/rollback 写预算、将读取和写入的资源类型、删除/retire 范围以及不包含 Trigger。
+2. 运行 `dta deploy --workspace <name> --dry-run --json`，向用户展示 `planId`、本体/Skill hash、forward/rollback 写预算、将读取和写入的资源类型、删除/retire 范围以及不包含 Trigger。plan 对中间状态敏感：dry-run 之后、apply 之前不要插入 `workspace inspect` 等操作，否则 planId 作废，重跑 dry-run 后立即 apply。
 3. 只有用户明确确认这份 plan 后，才运行 `dta deploy --workspace <name> --plan-id <id> --yes --json`。旧 planId、当前选择的 Workspace 或显示名都不能代替稳定 ID。
-4. 返回 pending、超时或本地 Receipt 写入失败时，不重复 apply。load-smoke Issue 已创建但没有任何 task 时，CLI 会且只会按稳定 Agent ID 在同一 Issue 留下一条受控 `@` 评论恢复首次入队；已有 queued/running/terminal task 时绝不重复触发。随后运行 `dta deploy --workspace <name> --status --operation-id <id> --execute --yes --json` 做独立回读和 reconcile。
-5. 只有远端 Agent/Runtime/Skill tree/assignment 回读一致，System Prompt 与本地人类可读 Definition 原文一致，并且 Basic、Role 的随机 load smoke 轨迹通过，Workspace 才能进入 `ready`。
-6. 退役先 dry-run，再用冻结 plan 执行 `--retire`；只 archive 精确 Agent，保留 Skill、Issue、语义存储和 Artifact，不把 retire 当成删除。
+4. 返回 pending、超时或本地 Receipt 写入失败时，不重复 apply。load-smoke Issue 已创建但没有任何 task 时，CLI 会且只会按稳定 Agent ID 在同一 Issue 留下一条受控 `@` 评论恢复首次入队；已有 queued/running/terminal task 时绝不重复触发。随后运行 `dta deploy --workspace <name> --status --operation-id <id> --execute --yes --json` 做独立回读和 reconcile。注意不带 `--execute` 的 `--status` 返回的是 apply 时刻的**冻结回执**（首次部署 smoke 字段常是空的 pending 快照，输出会标 `receiptFrozen` 并给出刷新命令）；smoke 失败若分类为 `skills-not-visible`（冷沙箱尚未物化 Skill），状态收敛为 `verifying` 而非 `failed`，用带 `--execute --yes` 的 status 重试即可。
+5. 换 runtime 只有两条正路：显式迁移用 `dta deploy --rebind-runtime`（先 dry-run，planId 绑定迁移前后 runtime，Receipt 记录 from/to）；退役用 `--retire`（不受 `agent.runtime-drift` 阻挡）。不要原地改 env 里的 runtime id 硬顶普通 apply——那会被 fail-closed 挡下。
+6. 只有远端 Agent/Runtime/Skill tree/assignment 回读一致，System Prompt 与本地人类可读 Definition 原文一致，并且 Basic、Role 的随机 load smoke 轨迹通过，Workspace 才能进入 `ready`。
+7. 退役先 dry-run，再用冻结 plan 执行 `--retire`；只 archive 精确 Agent，保留 Skill、Issue、语义存储和 Artifact，不把 retire 当成删除。
 
 完整命令、状态机与失败恢复见 [multica-deployment-contract.md](references/multica-deployment-contract.md)。
 

package/skills/platforms/multica-dingtalk/dta-deploy-multica/references/multica-deployment-contract.md

@@ -23,6 +23,10 @@ dta workspace run multica-dev --prompt-file readonly-question.md --execute --yes
 # 只 archive 精确 Agent；不删除 Skill、Storage、Issue 或 Trigger
 dta deploy --workspace multica-dev --retire --dry-run --json
 dta deploy --workspace multica-dev --retire --plan-id <planId> --yes --json
+
+# 显式把 Agent 迁到 env 当前指向的 runtime（planId 绑定迁移前后 runtime，Receipt 记 from/to）
+dta deploy --workspace multica-dev --dry-run --rebind-runtime --json
+dta deploy --workspace multica-dev --rebind-runtime --plan-id <planId> --yes --json
 ```
 
 ## 状态机
@@ -33,7 +37,10 @@ planned → applying → verifying → ready
 ready → retired
 ```
 
-- 每次 apply 前重新读取 W3 的 profile/auth/Workspace/Runtime/Agent/Skill ID 链；与 plan 不一致时在任何写入前失败。
+- 每次 apply 前重新读取 W3 的 profile/auth/Workspace/Runtime/Agent/Skill ID 链；与 plan 不一致时在任何写入前失败。scope 类失败带结构化 `failureDetails`（expected/actual/hint）；provider CLI 自身失败时其 stderr 原文透传到终端，证据文件仍只存 hash。
+- 目标 runtime 的 provider 必须在受支持词汇表内（当前 `opencode`）；hermes 等不受支持 provider 在任何远端写入前 fail closed（`scope.runtime-provider-unsupported`）——那类 runtime 上 workspace skill 一律加载不到，部署"成功"也是死局。
+- Agent 的 runtime 归属漂移（`agent.runtime-drift`）只挡普通 apply：显式迁移用 `--rebind-runtime`，退役用 `--retire`，都不被漂移锁死。
+- dta 调用 multica CLI 前会从子进程环境剔除保留变量 `MULTICA_AGENT_ID`（切 Agent 身份鉴权、误报未登录）、`MULTICA_SERVER_URL` 与 `MULTICA_TOKEN`（把 endpoint/身份从具名 profile 脚下换走——shell 里残留的预发 URL 绝不能重定向生产部署）；剔除记录在 inspection 的 `envSanitized`。
 - plan 同时冻结 forward/rollback 最大写预算；最多 32 个受管 Skill、每个最多 128 个 supporting files，CLI 在每个 Provider mutation 前检查预算。
 - Provider 调用超时属于结果未知：先保存 `reconciling` operation，再只读 status；不盲目重放 create/update。
 - load-smoke Issue 创建成功但 `issue runs` 为空时，说明 Issue 已持久化而首次入队未落地；apply 只允许按计划中稳定 Agent ID 在同一 Issue 留下一条受控 `mention://agent/<id>` 评论恢复一次。只要已有 task（包括 queued/running/terminal），就不得触发第二次运行。
@@ -48,10 +55,13 @@ ready → retired
 3. Basic、Role Skill 的完整文件树 hash 一致；
 4. assignment 精确等于部署计划，不包含隐式平台启动 Skill；
 5. smoke task completed；
-6. 轨迹中 Basic、每个 Role 都有 Host 原生 Skill load 证据；
-7. 最终 marker/loaded 清单与计划一致；
-8. operation 与 Receipt hash 完整，Workspace state 绑定当前 desired/deployment hash。
+6. 轨迹中 Basic、每个 Role 都有装载证据——按目标 runtime 的 trace 词汇解读：Host `skill` 工具调用（工具本身就是装载机制），或云 runtime `read_file` **结果**中的 `**Skill loaded**` banner。装载「尝试」（`Loading skill 'X'` 的 tool_use，失败时同样会出现）与模型自述文本都不算证据，banner 也只认可信工具（read_file/skill）的 tool_result——terminal/bash 的输出是模型指定的，echo 伪造不算数；
+7. 精确 JSON 回执可回读——优先从 Issue comment 本身取证（平台回读，与工具词汇无关），其次是回复文本 / 受限收口文件；
+8. 轨迹不含 dws（工具名或 shell 命令）；
+9. operation 与 Receipt hash 完整，Workspace state 绑定当前 desired/deployment hash。
 
 任一门禁失败都保持 `verifying` 或进入 `failed`，不能用本地 OpenCode 通过、旧 smoke、目录存在或模型自述覆盖。
 
+**ready 证明什么、不证明什么**：ready 证明每个必需 Skill 有装载证据、精确回执已落盘、无 dws 调用；**不再**证明「轨迹里每个工具都在白名单内」——无害的额外工具/命令不判死（旧的负向白名单在健康云 runtime 上造成过结构性假阴性），词汇表不认识的工具名记录在 `smoke.unrecognizedTools` 供诊断。smoke 失败若分类为 `skills-not-visible`（任务终态但轨迹显示 Skill not found，冷沙箱推送物化竞态），状态收敛为 `verifying`：apply 在预算内做有限次受控 mention 重试，`--status --execute --yes` 也可补一次（该情形如实上报 `remoteWrite`）。重试以「最新 run 的 taskId 变化」为新 run 出现的判据——mention 触发的 run 在平台上异步创建，等不到新 run 只会停手，不会重复 mention；重试评论本身的写入抖动只终止重试并保持 `verifying`，绝不触发对已验证部署的回滚。
+
 `workspace run` 在创建 Issue 前重新核对精确 Workspace、Runtime、Agent 与 assignment。报告记录 Issue/task 状态、实际 Skill trace、回答、轮询次数和脱敏调用；同一状态的重复轮询只保留一条证据。超时后仍没有关联 task 时返回 `task.not-created`，并把 Issue 状态写进 `taskDiagnostic`，不能把 Issue 创建成功算成 Agent 已运行。

package/skills/platforms/multica-dingtalk/dta-ops-multica/SKILL.md

@@ -2,7 +2,7 @@
 name: dta-ops-multica
 description: External Python wrapper defining the full developer chain for delivering an agent on the Multica (DingTalk-FDE fork) platform — workspace bootstrap, runtime/agent provisioning, skill assembly (push/pull), DingTalk robot & account binding, execution-trace observability, cron scheduling (autopilot), and health checks. Use when provisioning, operating, debugging, or observing a Multica-managed agent from the command line with only an endpoint and a token.
 metadata:
-  version: "0.2.0"
+  version: "0.3.0"
 ---
 
 # Multica FDE External Skill
@@ -60,8 +60,13 @@ python3 $PY agent-create --workspace fde-team --name "FDE 教练" \
 merge, never clobber; repo registration needs owner/admin. Slugs:
 `^[a-z0-9]+(-[a-z0-9]+)*$`, reserved list enforced. An agent needs a runtime:
 FC-E2B cloud (`runtime-create-fc`, requires server-side FC-E2B enablement) or
-a local daemon. `runtime-templates` lists templates; when `--template-id` is
-omitted and exactly one exists it is auto-picked.
+a local daemon. `runtime-create-fc` injects `--provider opencode` by default —
+the SERVER default is hermes, where workspace skills structurally never load
+(agents answer "Skill not found" with zero warning); only pass
+`--provider hermes` if that is explicitly what you want. `runtime-templates`
+lists templates; when `--template-id` is omitted the sole READY template is
+auto-picked (waiting templates are excluded; several ready ones → the error
+lists candidates sorted by `created_at`, pick the newest).
 
 ### 2 — Define & assemble: where the agent comes from, what skills it has
 
@@ -94,10 +99,19 @@ python3 $PY dingtalk-bind --agent <uuid> --client-id <AppKey> --client-secret-st
 python3 $PY dingtalk-begin --agent <uuid> --wait
 python3 $PY dingtalk-list ; python3 $PY dingtalk-revoke --installation <uuid>
 # Personal-account binding family (dingtalk_account):
-python3 $PY dingtalk-account-begin --agent <uuid>   # prints QR URL
-python3 $PY dingtalk-account-list ; python3 $PY dingtalk-account-unbind --installation <uuid>
+python3 $PY dingtalk-account-begin --agent <uuid> --binding-mode message   # prints QR URL
+python3 $PY dingtalk-account-list
+python3 $PY dingtalk-account-unbind --installation <uuid> --binding-mode message
 ```
 
+`binding_mode` is server-enforced (400 `invalid_binding_mode` without it) and
+its wire contract is asymmetric: `begin` takes it in the JSON body, `unbind`
+in the query string. `message` maps the sender's identity for conversation
+routing only; `identity` grants the agent a persistent delegated DingTalk
+identity — never choose it silently on the user's behalf. Without
+`--allow-unbound` on the robot install, senders not account-bound to Multica
+(the robot owner included) only receive a binding prompt.
+
 Bind and unbind always come in pairs: robot `dingtalk-bind`/`dingtalk-begin`
 ↔ `dingtalk-revoke`; account `dingtalk-account-begin` ↔
 `dingtalk-account-unbind`. `dingtalk-account-begin` returns the binding link
@@ -142,6 +156,10 @@ that desired state against live:
 
 ```bash
 dta schedule plan --workspace <name> --json     # desired state, provider-mapped
+# EXIT 2 = do NOT reconcile. The manifest has schedules that collide at the same
+# instant, that can't be proven not to (cross-timezone / cron extension syntax), or
+# that lack a data-derived completion. Deploying anyway creates one autopilot per
+# entry → the same message goes out twice. Fix the manifest, don't override.
 python3 $PY autopilot-list                       # live; match declared↔live by title
 # create only missing, update drifted, delete extra — autopilot-create is NOT
 # idempotent, so ALWAYS list first; blind-creating duplicates → duplicate外发.
@@ -175,8 +193,16 @@ python3 $PY agent-check --agent <uuid>
 Composite JSON report: agent status/archived, runtime health (online /
 unstable = offline but seen <5 min ago / offline / missing), active tasks +
 last outcome (with `failure_reason`), recent failure count, DingTalk robot +
-account binding state, plus a `checks[]` verdict list; `healthy` = no `fail`
-(warns don't fail the check).
+account binding state, plus a `checks[]` verdict list. **BREAKING (0.3.0)**:
+the single `healthy` boolean is removed — it reported green while users could
+not reach the agent at all (no robot / account unbound are only warns).
+Consume the split verdict instead: `infrastructureHealthy` (agent/runtime/
+tasks have no fail) and `userReady` (infrastructure healthy AND robot bound
+AND `dws_identity` bound), with `reasons[]` naming every gap and `nextAction`
+carrying the single next command. `userReadyCaveat` records the one upstream
+blind spot: installations don't read back effective `allow_unbound`, so a
+robot bound with that flag serves unbound senders even when
+`userReady=false`.
 
 ### 7 — Basics: issues, comments, chat, members, tokens
 

package/skills/platforms/multica-dingtalk/dta-ops-multica/scripts/multica_ext.py

@@ -313,15 +313,33 @@ def cmd_runtime_create_fc(ctx: Ctx, args: argparse.Namespace) -> None:
         # The server resolves template_id against id, template, or name;
         # id is best-effort and may be absent.
         ref = lambda t: t.get("id") or t.get("template") or t.get("name")  # noqa: E731
-        if len(templates) > 1:
+        status_of = lambda t: str(t.get("status") or "").lower()  # noqa: E731
+        # waiting 等未就绪状态选了也建不起来；status 字段缺失时保守放行（Observed 字段）。
+        usable = [t for t in templates if not status_of(t) or status_of(t) == "ready"]
+        if not usable:
             fail(
-                "multiple templates available, pass --template-id: "
-                + ", ".join(f"{ref(t)} ({t.get('name') or t.get('template')})" for t in templates)
+                "no ready FC-E2B templates (all "
+                + ", ".join(f"{ref(t)}={status_of(t) or 'unknown'}" for t in templates)
+                + ")"
             )
-        template_id = ref(templates[0])
+        if len(usable) > 1:
+            newest = max(usable, key=lambda t: str(t.get("created_at") or ""))
+            fail(
+                "multiple ready templates, pass --template-id: "
+                + ", ".join(
+                    f"{ref(t)} ({t.get('name') or t.get('template')}, "
+                    f"{status_of(t) or 'unknown'}, created {t.get('created_at') or '?'})"
+                    for t in sorted(usable, key=lambda t: str(t.get("created_at") or ""), reverse=True)
+                )
+                + f"; component_versions 通常完全相同，选最新 ready 即可（推荐 {ref(newest)}）"
+            )
+        template_id = ref(usable[0])
         if not template_id:
             fail("template list entry has no usable identifier")
-        note(f"using template {template_id} ({templates[0].get('name') or templates[0].get('template')})")
+        note(
+            f"using template {template_id} ({usable[0].get('name') or usable[0].get('template')}, "
+            f"{status_of(usable[0]) or 'unknown'})"
+        )
     body: Dict[str, Any] = {"template_id": template_id}
     for flag in ("name", "provider", "visibility"):
         value = getattr(args, flag, None)
@@ -397,7 +415,15 @@ def cmd_dingtalk_bind(ctx: Ctx, args: argparse.Namespace) -> None:
         "robot_code": args.robot_code or args.client_id,
         "allow_unbound": args.allow_unbound,
     }
-    out(api(ctx, "POST", f"/api/workspaces/{ws_id}/dingtalk/install/manual", body=body))
+    res = api(ctx, "POST", f"/api/workspaces/{ws_id}/dingtalk/install/manual", body=body)
+    if not args.allow_unbound:
+        note(
+            "allow_unbound=false: senders whose DingTalk account is NOT bound to Multica "
+            "(including the robot owner) only get a binding prompt when they @ the robot. "
+            "For acceptance/customer-facing use, either run dingtalk-account-begin first or "
+            "re-bind with --allow-unbound (upsert; installation id unchanged)."
+        )
+    out(res)
 
 
 def cmd_dingtalk_begin(ctx: Ctx, args: argparse.Namespace) -> None:
@@ -450,7 +476,9 @@ def cmd_dingtalk_account_begin(ctx: Ctx, args: argparse.Namespace) -> None:
         ctx,
         "POST",
         f"/api/workspaces/{ws_id}/dingtalk/account-bindings/begin",
-        body={"agent_id": args.agent},
+        # Server enforces binding_mode (400 invalid_binding_mode without it): message-only
+        # identity mapping vs delegated identity. Wire contract: begin reads it from the BODY.
+        body={"agent_id": args.agent, "binding_mode": args.binding_mode},
     )
     note(f"scan to bind account: {res.get('qr_code_url')}")
     out(res)
@@ -463,7 +491,14 @@ def cmd_dingtalk_account_list(ctx: Ctx, args: argparse.Namespace) -> None:
 
 def cmd_dingtalk_account_unbind(ctx: Ctx, args: argparse.Namespace) -> None:
     ws_id = resolve_workspace_id(ctx)
-    api(ctx, "DELETE", f"/api/workspaces/{ws_id}/dingtalk/account-bindings/{args.installation}")
+    # Wire contract asymmetry (verified live): unbind reads binding_mode from the QUERY
+    # string; putting it in the DELETE body still returns 400 invalid_binding_mode.
+    api(
+        ctx,
+        "DELETE",
+        f"/api/workspaces/{ws_id}/dingtalk/account-bindings/{args.installation}"
+        f"?binding_mode={urllib.parse.quote(args.binding_mode)}",
+    )
     out({"unbound": True})
 
 
@@ -675,6 +710,38 @@ def cmd_agent_check(ctx: Ctx, args: argparse.Namespace) -> None:
         json.dumps(account.get("dws_identity"), ensure_ascii=False) if account else "no account binding",
     )
 
+    # 基础设施健康 ≠ 用户可用：机器人未绑/账号 unbound 时用户发消息只会收到绑定引导、
+    # 不产生任何 Run，但没有一项是 "fail"。旧的单布尔 `healthy` 正是把这两层混成一团、
+    # 让 operator 看着全绿而用户侧完全不工作的祸根——按验收证据（P-01/M-06）拆开并移除。
+    infra_checks = {"agent", "runtime", "last_task", "recent_tasks"}
+    infrastructure_healthy = all(
+        c["status"] != "fail" for c in checks if c["check"] in infra_checks
+    )
+    robot_ok = bool(robot)
+    account_bound = bool(account and (account.get("dws_identity") or {}).get("status") == "bound")
+    user_ready = infrastructure_healthy and robot_ok and account_bound
+    reasons = [
+        f"{c['check']}: {c['detail']}"
+        for c in checks
+        if (c["check"] in infra_checks and c["status"] == "fail")
+        or (c["check"] in ("dingtalk_robot", "dingtalk_account") and c["status"] != "ok")
+    ]
+    if agent.get("archived_at"):
+        next_action = "agent restore（或重新部署）后再检查"
+    elif runtime_health in ("missing", "offline"):
+        next_action = "runtime-list 核对；必要时 runtime-create-fc --provider opencode 重建并迁移"
+    elif not robot_ok:
+        next_action = (
+            f"python3 multica_ext.py dingtalk-bind --agent {args.agent} "
+            "--client-id <AppKey> --client-secret-stdin（或 dingtalk-begin 扫码）"
+        )
+    elif not account_bound:
+        next_action = (
+            f"python3 multica_ext.py dingtalk-account-begin --agent {args.agent} "
+            "--binding-mode message（或重绑机器人加 --allow-unbound）"
+        )
+    else:
+        next_action = ""
     out({
         "agent": {k: agent.get(k) for k in ("id", "name", "status", "model", "runtime_id", "archived_at")},
         "runtime": {
@@ -683,7 +750,14 @@ def cmd_agent_check(ctx: Ctx, args: argparse.Namespace) -> None:
         },
         "tasks": {"active": len(active), "last_outcome_status": (last_outcome or {}).get("status")},
         "checks": checks,
-        "healthy": all(c["status"] != "fail" for c in checks),
+        "infrastructureHealthy": infrastructure_healthy,
+        "userReady": user_ready,
+        "reasons": reasons,
+        "nextAction": next_action,
+        "userReadyCaveat": (
+            "安装回读不含 effective allow_unbound（上游缺口 MUL-005）：若绑定时开启过 "
+            "allow_unbound，未绑定账号的发送者实际也能对话"
+        ),
         "warnings": sum(1 for c in checks if c["status"] == "warn"),
     })
 
@@ -936,11 +1010,19 @@ def build_parser() -> argparse.ArgumentParser:
     p = cmd(
         "runtime-create-fc",
         cmd_runtime_create_fc,
-        "Create an FC-E2B cloud runtime; picks the sole available template when --template-id is omitted",
+        "Create an FC-E2B cloud runtime (provider defaults to opencode); "
+        "picks the sole READY template when --template-id is omitted",
     )
     p.add_argument("--template-id", dest="template_id")
     p.add_argument("--name")
-    p.add_argument("--provider")
+    p.add_argument(
+        "--provider",
+        default="opencode",
+        help="runtime provider; defaults to opencode — the only provider dta's skill-loading "
+        "contract supports. The SERVER default is hermes, where workspace skills never load "
+        "(agents report 'Skill not found' with zero warning); pass --provider hermes only if "
+        "you explicitly want that",
+    )
     p.add_argument("--visibility", choices=["private", "public"])
 
     p = cmd("agent-list", cmd_agent_list, "List agents in the workspace")
@@ -984,7 +1066,14 @@ def build_parser() -> argparse.ArgumentParser:
     p.add_argument("--client-secret", dest="client_secret", help="DingTalk AppSecret (prefer stdin/env)")
     p.add_argument("--client-secret-stdin", dest="client_secret_stdin", action="store_true")
     p.add_argument("--client-secret-env", dest="client_secret_env", metavar="VAR")
-    p.add_argument("--allow-unbound", dest="allow_unbound", action="store_true")
+    p.add_argument(
+        "--allow-unbound",
+        dest="allow_unbound",
+        action="store_true",
+        help="serve senders whose DingTalk account is not bound to Multica "
+        "(connect-to-customers). WITHOUT this flag such senders — the robot owner "
+        "included — only receive a binding prompt",
+    )
 
     p = cmd(
         "dingtalk-begin",
@@ -1000,6 +1089,15 @@ def build_parser() -> argparse.ArgumentParser:
 
     p = cmd("dingtalk-account-begin", cmd_dingtalk_account_begin, "Start binding a personal DingTalk account to an agent")
     p.add_argument("--agent", required=True, help="agent uuid")
+    p.add_argument(
+        "--binding-mode",
+        dest="binding_mode",
+        choices=("message", "identity"),
+        default="message",
+        help="binding capability: message-only identity mapping (default), or delegated "
+        "DingTalk identity — identity grants a persistent execution identity, never pick "
+        "it silently for the user",
+    )
 
     cmd("dingtalk-account-list", cmd_dingtalk_account_list, "List personal DingTalk account bindings")
 
@@ -1009,6 +1107,14 @@ def build_parser() -> argparse.ArgumentParser:
         "Remove a personal DingTalk account binding (row kept as revoked for audit)",
     )
     p.add_argument("--installation", required=True, help="installation uuid")
+    p.add_argument(
+        "--binding-mode",
+        dest="binding_mode",
+        choices=("message", "identity"),
+        default="message",
+        help="binding capability to remove: message-only identity mapping (default) or "
+        "delegated DingTalk identity",
+    )
 
     p = cmd("agent-tasks", cmd_agent_tasks, "List an agent's task run history")
     p.add_argument("--agent", required=True, help="agent uuid")

package/dist/src/map.js

@@ -1,157 +0,0 @@
-// Managed Agents Platform（MAP）注册表与工作区归属解析。
-//
-// 一个 Agent 工作区归属于至多一个托管平台；归属解析顺序固定：
-//   DTA_MAP 环境变量 > dingtalk-agent.json#map > .dingtalk-agent/map.json > 按 Provider 声明推断。
-// 平台相关的方法学不写进 CLI——它们随对应平台的 Skill 包分发，只在用户选择该平台时安装。
-// 平台命令（如 deploy/promote/observe）必须先通过归属门禁；coming-soon 平台一律 fail-closed。
-import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { dirname, join, parse, resolve } from 'node:path';
-import { findAgentProjectRoot } from './development-workspace.js';
-import { installGlobalSkill } from './skill-manager.js';
-export const MANAGED_AGENT_PLATFORMS = [
-    {
-        name: 'multica-dingtalk',
-        label: 'Multica (DingTalk)',
-        status: 'supported',
-        description: '钉钉 Multica 托管平台：受控部署、晋级与观测回流。',
-        skills: ['dingtalk-agent-deploy', 'dingtalk-agent-boot-multica'],
-        commands: ['deploy', 'promote', 'observe'],
-    },
-    {
-        name: 'deap',
-        label: 'DEAP',
-        status: 'coming-soon',
-        description: '敬请期待。',
-        skills: [],
-        commands: [],
-    },
-];
-export const MAP_FILE = '.dingtalk-agent/map.json';
-const PROJECT_FILE = 'dingtalk-agent.json';
-export function mapDefinition(name) {
-    return MANAGED_AGENT_PLATFORMS.find((item) => item.name === name) || null;
-}
-export function resolveMap(start = process.cwd(), env = process.env) {
-    const fromEnv = String(env.DTA_MAP || '').trim();
-    if (fromEnv)
-        return resolution(fromEnv, 'env', '');
-    const projectRoot = findAgentProjectRoot(start);
-    if (projectRoot) {
-        const manifestPath = join(projectRoot, PROJECT_FILE);
-        if (existsSync(manifestPath) && !lstatSync(manifestPath).isSymbolicLink()) {
-            const manifest = readJsonOrNull(manifestPath);
-            const declared = typeof manifest?.map === 'string' ? manifest.map.trim() : '';
-            if (declared)
-                return resolution(declared, 'project-manifest', manifestPath);
-        }
-    }
-    const mapPath = findUp(start, MAP_FILE);
-    if (mapPath) {
-        const stored = readJsonOrNull(mapPath);
-        const declared = typeof stored?.map === 'string' ? stored.map.trim() : '';
-        if (declared)
-            return resolution(declared, 'map-file', mapPath);
-    }
-    if (projectRoot) {
-        const manifest = readJsonOrNull(join(projectRoot, PROJECT_FILE));
-        const providers = Object.values(manifest?.workspaces || {})
-            .map((workspace) => workspace?.provider?.kind);
-        if (providers.includes('multica')) {
-            return resolution('multica-dingtalk', 'inferred', join(projectRoot, PROJECT_FILE));
-        }
-    }
-    return resolution(null, 'none', '');
-}
-export function useMap(start, name, options) {
-    const definition = mapDefinition(name);
-    if (!definition) {
-        throw new Error(`未知 managed agents platform: ${name}\n` +
-            `可用: ${MANAGED_AGENT_PLATFORMS.map((item) => `${item.name}（${statusLabel(item.status)}）`).join('、')}`);
-    }
-    if (definition.status !== 'supported') {
-        throw new Error(`${definition.label} 敬请期待——当前版本尚未开放该平台。`);
-    }
-    const projectRoot = findAgentProjectRoot(start);
-    let written;
-    if (projectRoot && existsSync(join(projectRoot, PROJECT_FILE))) {
-        const manifestPath = join(projectRoot, PROJECT_FILE);
-        if (lstatSync(manifestPath).isSymbolicLink()) {
-            throw new Error(`${PROJECT_FILE} 不能是符号链接`);
-        }
-        const manifest = readJsonOrNull(manifestPath);
-        if (!manifest || typeof manifest !== 'object') {
-            throw new Error(`${PROJECT_FILE} 不是合法 JSON，无法写入 map 归属`);
-        }
-        manifest.map = definition.name;
-        writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
-        written = manifestPath;
-    }
-    else {
-        const target = join(resolve(start), MAP_FILE);
-        mkdirSync(dirname(target), { recursive: true });
-        writeFileSync(target, JSON.stringify({ $schema: 'dingtalk-agent/map@1', map: definition.name }, null, 2) + '\n');
-        written = target;
-    }
-    const skillInstalls = [];
-    if (options.installSkills !== false) {
-        for (const skill of definition.skills) {
-            skillInstalls.push(installGlobalSkill(options.packageRoot, {
-                name: skill, home: options.home, env: options.env,
-            }));
-        }
-    }
-    return { ...resolveMap(start, options.env || process.env), written, skillInstalls };
-}
-/** deploy/promote/observe 等平台命令的归属门禁：未归属、未知或 coming-soon 一律 fail-closed。 */
-export function requireSupportedMap(command, start = process.cwd(), env = process.env) {
-    const resolved = resolveMap(start, env);
-    if (!resolved.map) {
-        throw new Error(`当前工作区未声明 managed agents platform，无法执行 \`${command}\`。\n` +
-            '先运行 `dta map use multica-dingtalk`，或设置 DTA_MAP 环境变量。');
-    }
-    if (!resolved.definition) {
-        throw new Error(`工作区声明了未知 platform: ${resolved.map}（来源 ${resolved.source}）。\n` +
-            `可用: ${MANAGED_AGENT_PLATFORMS.map((item) => item.name).join('、')}`);
-    }
-    if (resolved.definition.status !== 'supported') {
-        throw new Error(`${resolved.definition.label} 敬请期待——\`${command}\` 尚未在该平台开放。`);
-    }
-    if (!resolved.definition.commands.includes(command)) {
-        throw new Error(`${resolved.definition.label} 不承接命令 \`${command}\`。`);
-    }
-    return resolved;
-}
-export function statusLabel(status) {
-    return status === 'supported' ? '已支持' : '敬请期待';
-}
-function resolution(name, source, file) {
-    return {
-        $schema: 'dingtalk-agent/map-resolution@1',
-        map: name,
-        source,
-        file,
-        definition: name ? mapDefinition(name) : null,
-        platforms: MANAGED_AGENT_PLATFORMS,
-    };
-}
-function readJsonOrNull(path) {
-    try {
-        return JSON.parse(readFileSync(path, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-function findUp(start, relativePath) {
-    let dir = resolve(start);
-    while (true) {
-        const candidate = join(dir, relativePath);
-        if (existsSync(candidate) && !lstatSync(candidate).isSymbolicLink())
-            return candidate;
-        const parent = dirname(dir);
-        if (parent === dir || dir === parse(dir).root)
-            return null;
-        dir = parent;
-    }
-}
-//# sourceMappingURL=map.js.map

package/dist/src/map.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"map.js","sourceRoot":"","sources":["../../src/map.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,oCAAoC;AACpC,yFAAyF;AACzF,oDAAoD;AACpD,wEAAwE;AAExE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAA0B,MAAM,oBAAoB,CAAA;AAa/E,MAAM,CAAC,MAAM,uBAAuB,GAAoB;IACtD;QACE,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,WAAW;QACnB,WAAW,EAAE,+BAA+B;QAC5C,MAAM,EAAE,CAAC,uBAAuB,EAAE,6BAA6B,CAAC;QAChE,QAAQ,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,OAAO;QACpB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;KACb;CACF,CAAA;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,0BAA0B,CAAA;AAClD,MAAM,YAAY,GAAG,qBAAqB,CAAA;AAkB1C,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAyB,OAAO,CAAC,GAAG;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,OAAO;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;IAElD,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAC/C,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1E,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,OAAO,QAAQ,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YAC7E,IAAI,QAAQ;gBAAE,OAAO,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACvC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,IAAI,QAAQ;YAAE,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAChE,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAA;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC;aACxD,GAAG,CAAC,CAAC,SAAc,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;QACrD,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AACrC,CAAC;AASD,MAAM,UAAU,MAAM,CAAC,KAAa,EAAE,IAAY,EAAE,OAAsB;IACxE,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,IAAI;YACvC,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACtG,CAAA;IACH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,qBAAqB,CAAC,CAAA;IAC3D,CAAC;IAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;IAC/C,IAAI,OAAe,CAAA;IACnB,IAAI,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QACpD,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC,CAAA;QAC5C,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,CAAC,CAAA;QAC7C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,YAAY,wBAAwB,CAAC,CAAA;QAC1D,CAAC;QACD,QAAQ,CAAC,GAAG,GAAG,UAAU,CAAC,IAAI,CAAA;QAC9B,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;QACrE,OAAO,GAAG,YAAY,CAAA;IACxB,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAA;QAC7C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/C,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAClC,EAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CACnE,GAAG,IAAI,CAAC,CAAA;QACT,OAAO,GAAG,MAAM,CAAA;IAClB,CAAC;IAED,MAAM,aAAa,GAAwB,EAAE,CAAA;IAC7C,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtC,aAAa,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE;gBACzD,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG;aAClD,CAAC,CAAC,CAAA;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAA;AACrF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CACjC,OAAe,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,MAAyB,OAAO,CAAC,GAAG;IAE5E,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,2CAA2C,OAAO,OAAO;YACzD,sDAAsD,CACvD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,sBAAsB,QAAQ,CAAC,GAAG,OAAO,QAAQ,CAAC,MAAM,MAAM;YAC9D,OAAO,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACpE,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,YAAY,OAAO,cAAc,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,YAAY,OAAO,KAAK,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAiB;IAC3C,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,IAAmB,EAAE,MAAiB,EAAE,IAAY;IACtE,OAAO;QACL,OAAO,EAAE,iCAAiC;QAC1C,GAAG,EAAE,IAAI;QACT,MAAM;QACN,IAAI;QACJ,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAC7C,SAAS,EAAE,uBAAuB;KACnC,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AAC7E,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,YAAoB;IACjD,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IACxB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;QACzC,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE;YAAE,OAAO,SAAS,CAAA;QACrF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAC1D,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;AACH,CAAC","sourcesContent":["// Managed Agents Platform（MAP）注册表与工作区归属解析。\n//\n// 一个 Agent 工作区归属于至多一个托管平台；归属解析顺序固定：\n//   DTA_MAP 环境变量 > dingtalk-agent.json#map > .dingtalk-agent/map.json > 按 Provider 声明推断。\n// 平台相关的方法学不写进 CLI——它们随对应平台的 Skill 包分发，只在用户选择该平台时安装。\n// 平台命令（如 deploy/promote/observe）必须先通过归属门禁；coming-soon 平台一律 fail-closed。\n\nimport { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { dirname, join, parse, resolve } from 'node:path'\n\nimport { findAgentProjectRoot } from './development-workspace.js'\nimport { installGlobalSkill, type GlobalSkillStatus } from './skill-manager.js'\n\nexport type MapStatus = 'supported' | 'coming-soon'\n\nexport interface MapDefinition {\n  name: string\n  label: string\n  status: MapStatus\n  description: string\n  skills: string[]\n  commands: string[]\n}\n\nexport const MANAGED_AGENT_PLATFORMS: MapDefinition[] = [\n  {\n    name: 'multica-dingtalk',\n    label: 'Multica (DingTalk)',\n    status: 'supported',\n    description: '钉钉 Multica 托管平台：受控部署、晋级与观测回流。',\n    skills: ['dingtalk-agent-deploy', 'dingtalk-agent-boot-multica'],\n    commands: ['deploy', 'promote', 'observe'],\n  },\n  {\n    name: 'deap',\n    label: 'DEAP',\n    status: 'coming-soon',\n    description: '敬请期待。',\n    skills: [],\n    commands: [],\n  },\n]\n\nexport const MAP_FILE = '.dingtalk-agent/map.json'\nconst PROJECT_FILE = 'dingtalk-agent.json'\n\nexport type MapSource = 'env' | 'project-manifest' | 'map-file' | 'inferred' | 'none'\n\nexport interface MapResolution {\n  $schema: 'dingtalk-agent/map-resolution@1'\n  map: string | null\n  source: MapSource\n  file: string\n  definition: MapDefinition | null\n  platforms: MapDefinition[]\n}\n\nexport interface MapUseResult extends MapResolution {\n  written: string\n  skillInstalls: GlobalSkillStatus[]\n}\n\nexport function mapDefinition(name: string): MapDefinition | null {\n  return MANAGED_AGENT_PLATFORMS.find((item) => item.name === name) || null\n}\n\nexport function resolveMap(start = process.cwd(), env: NodeJS.ProcessEnv = process.env): MapResolution {\n  const fromEnv = String(env.DTA_MAP || '').trim()\n  if (fromEnv) return resolution(fromEnv, 'env', '')\n\n  const projectRoot = findAgentProjectRoot(start)\n  if (projectRoot) {\n    const manifestPath = join(projectRoot, PROJECT_FILE)\n    if (existsSync(manifestPath) && !lstatSync(manifestPath).isSymbolicLink()) {\n      const manifest = readJsonOrNull(manifestPath)\n      const declared = typeof manifest?.map === 'string' ? manifest.map.trim() : ''\n      if (declared) return resolution(declared, 'project-manifest', manifestPath)\n    }\n  }\n\n  const mapPath = findUp(start, MAP_FILE)\n  if (mapPath) {\n    const stored = readJsonOrNull(mapPath)\n    const declared = typeof stored?.map === 'string' ? stored.map.trim() : ''\n    if (declared) return resolution(declared, 'map-file', mapPath)\n  }\n\n  if (projectRoot) {\n    const manifest = readJsonOrNull(join(projectRoot, PROJECT_FILE))\n    const providers = Object.values(manifest?.workspaces || {})\n      .map((workspace: any) => workspace?.provider?.kind)\n    if (providers.includes('multica')) {\n      return resolution('multica-dingtalk', 'inferred', join(projectRoot, PROJECT_FILE))\n    }\n  }\n\n  return resolution(null, 'none', '')\n}\n\nexport interface MapUseOptions {\n  packageRoot: string\n  home?: string\n  env?: NodeJS.ProcessEnv\n  installSkills?: boolean\n}\n\nexport function useMap(start: string, name: string, options: MapUseOptions): MapUseResult {\n  const definition = mapDefinition(name)\n  if (!definition) {\n    throw new Error(\n      `未知 managed agents platform: ${name}\\n` +\n      `可用: ${MANAGED_AGENT_PLATFORMS.map((item) => `${item.name}（${statusLabel(item.status)}）`).join('、')}`,\n    )\n  }\n  if (definition.status !== 'supported') {\n    throw new Error(`${definition.label} 敬请期待——当前版本尚未开放该平台。`)\n  }\n\n  const projectRoot = findAgentProjectRoot(start)\n  let written: string\n  if (projectRoot && existsSync(join(projectRoot, PROJECT_FILE))) {\n    const manifestPath = join(projectRoot, PROJECT_FILE)\n    if (lstatSync(manifestPath).isSymbolicLink()) {\n      throw new Error(`${PROJECT_FILE} 不能是符号链接`)\n    }\n    const manifest = readJsonOrNull(manifestPath)\n    if (!manifest || typeof manifest !== 'object') {\n      throw new Error(`${PROJECT_FILE} 不是合法 JSON，无法写入 map 归属`)\n    }\n    manifest.map = definition.name\n    writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\\n')\n    written = manifestPath\n  } else {\n    const target = join(resolve(start), MAP_FILE)\n    mkdirSync(dirname(target), { recursive: true })\n    writeFileSync(target, JSON.stringify(\n      { $schema: 'dingtalk-agent/map@1', map: definition.name }, null, 2,\n    ) + '\\n')\n    written = target\n  }\n\n  const skillInstalls: GlobalSkillStatus[] = []\n  if (options.installSkills !== false) {\n    for (const skill of definition.skills) {\n      skillInstalls.push(installGlobalSkill(options.packageRoot, {\n        name: skill, home: options.home, env: options.env,\n      }))\n    }\n  }\n\n  return { ...resolveMap(start, options.env || process.env), written, skillInstalls }\n}\n\n/** deploy/promote/observe 等平台命令的归属门禁：未归属、未知或 coming-soon 一律 fail-closed。 */\nexport function requireSupportedMap(\n  command: string, start = process.cwd(), env: NodeJS.ProcessEnv = process.env,\n): MapResolution {\n  const resolved = resolveMap(start, env)\n  if (!resolved.map) {\n    throw new Error(\n      `当前工作区未声明 managed agents platform，无法执行 \\`${command}\\`。\\n` +\n      '先运行 `dta map use multica-dingtalk`，或设置 DTA_MAP 环境变量。',\n    )\n  }\n  if (!resolved.definition) {\n    throw new Error(\n      `工作区声明了未知 platform: ${resolved.map}（来源 ${resolved.source}）。\\n` +\n      `可用: ${MANAGED_AGENT_PLATFORMS.map((item) => item.name).join('、')}`,\n    )\n  }\n  if (resolved.definition.status !== 'supported') {\n    throw new Error(`${resolved.definition.label} 敬请期待——\\`${command}\\` 尚未在该平台开放。`)\n  }\n  if (!resolved.definition.commands.includes(command)) {\n    throw new Error(`${resolved.definition.label} 不承接命令 \\`${command}\\`。`)\n  }\n  return resolved\n}\n\nexport function statusLabel(status: MapStatus): string {\n  return status === 'supported' ? '已支持' : '敬请期待'\n}\n\nfunction resolution(name: string | null, source: MapSource, file: string): MapResolution {\n  return {\n    $schema: 'dingtalk-agent/map-resolution@1',\n    map: name,\n    source,\n    file,\n    definition: name ? mapDefinition(name) : null,\n    platforms: MANAGED_AGENT_PLATFORMS,\n  }\n}\n\nfunction readJsonOrNull(path: string): any {\n  try { return JSON.parse(readFileSync(path, 'utf8')) } catch { return null }\n}\n\nfunction findUp(start: string, relativePath: string): string | null {\n  let dir = resolve(start)\n  while (true) {\n    const candidate = join(dir, relativePath)\n    if (existsSync(candidate) && !lstatSync(candidate).isSymbolicLink()) return candidate\n    const parent = dirname(dir)\n    if (parent === dir || dir === parse(dir).root) return null\n    dir = parent\n  }\n}\n"]}