@xdxer/dingtalk-agent 0.1.5-beta.7 → 0.1.5-beta.9

package/dist/src/multica-deploy.js

@@ -5,7 +5,8 @@ import { tmpdir } from 'node:os';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { WORKSPACE_STATE_ROOT, inspectAgentProject, projectSkillRef, showDevelopmentWorkspace, } from './development-workspace.js';
 import { digest, stableStringify } from './events.js';
-import { MULTICA_EVIDENCE_ROOT, inspectMulticaWorkspace, planMulticaWorkspace, statusMulticaWorkspace, } from './multica-provider.js';
+import { MULTICA_EVIDENCE_ROOT, emitProviderDiagnostic, inspectMulticaWorkspace, planMulticaWorkspace, sanitizeProviderEnv, statusMulticaWorkspace, } from './multica-provider.js';
+import { allRuntimeVocabularies, commandInvokesDws, forbiddenSmokeTool, skillsLoadedInContent, vocabulariesForRuntimeProvider, } from './multica-runtime-vocabulary.js';
 export const MULTICA_DEPLOYMENT_SCHEMA = 'dingtalk-agent/multica-deployment-receipt@1';
 const MAX_DEPLOY_SKILLS = 32;
 const MAX_SKILL_SUPPORTING_FILES = 128;
@@ -13,10 +14,12 @@ const deploymentWriteBudgets = new WeakMap();
 class DeploymentFailure extends Error {
     category;
     ambiguous;
-    constructor(category, ambiguous = false) {
+    detail;
+    constructor(category, ambiguous = false, detail) {
         super(category);
         this.category = category;
         this.ambiguous = ambiguous;
+        this.detail = detail;
     }
 }
 export function runMulticaWorkspaceIssue(start, name, prompt, options = {}) {
@@ -80,6 +83,7 @@ export function runMulticaWorkspaceIssue(start, name, prompt, options = {}) {
     if (!inspection.passed || inspection.resources.workspace?.id !== plan.workspaceId ||
         inspection.resources.runtime?.id !== plan.runtimeId ||
         inspection.resources.agent?.id !== plan.agentId ||
+        inspection.diff.includes('agent.runtime-drift') ||
         stableStringify(assignedSkills) !== stableStringify(expectedSkills)) {
         throw new Error('Multica workspace run scope 或 Skill assignment 与 Project 不一致；未创建 Issue');
     }
@@ -92,6 +96,7 @@ export function runMulticaWorkspaceIssue(start, name, prompt, options = {}) {
     const issueId = resourceId(issue.id, 'workspace run issue.id');
     return readbackWorkspaceRun({
         root: info.root, name, plan, issueId, runId, command, env, timeoutMs, calls, out: options.out,
+        runtimeProvider: inspection.resources.runtime?.provider || '',
     });
 }
 /**
@@ -131,13 +136,43 @@ function readbackWorkspaceRun(ctx) {
     }
     const toolUses = messages.filter((item) => optionalString(item.type) === 'tool_use');
     const toolNames = toolUses.map((item) => optionalString(item.tool)).filter(Boolean);
-    const loadedSkills = toolUses.filter((item) => optionalString(item.tool) === 'skill')
-        .map((item) => optionalString(smokeToolInput(item).name)).filter(Boolean);
+    // Skill 装载与文件写入按 runtime 词汇解读（并集），并叠加 tool_result 的
+    // `**Skill loaded**` 正向证据 —— 与 smoke 判定同一套词汇，不再假定工具名叫 skill。
+    const vocabularies = ctx.runtimeProvider
+        ? vocabulariesForRuntimeProvider(ctx.runtimeProvider) : [];
+    const active = vocabularies.length
+        ? vocabularies : allRuntimeVocabularies();
+    const loadedSet = new Set();
+    const runBannerTools = new Set(active.flatMap((item) => [...item.skillResultTools]));
+    for (const item of messages) {
+        const type = optionalString(item.type);
+        const tool = optionalString(item.tool);
+        if (type === 'tool_use') {
+            const message = { tool, input: smokeToolInput(item) };
+            for (const vocabulary of active) {
+                const name = vocabulary.skillLoadFromToolUse(message);
+                if (name)
+                    loadedSet.add(name);
+            }
+        }
+        else if (type === 'tool_result' && runBannerTools.has(tool)) {
+            for (const name of skillsLoadedInContent(optionalString(item.content)))
+                loadedSet.add(name);
+        }
+    }
+    const loadedSkills = [...loadedSet].sort();
     const texts = messages.filter((item) => optionalString(item.type) === 'text')
         .map((item) => optionalString(item.content)).filter(Boolean);
-    const replyWrites = toolUses.filter((item) => optionalString(item.tool) === 'write')
-        .map((item) => smokeToolInput(item)).filter((input) => optionalString(input.filePath).endsWith('/reply.md'))
-        .map((input) => optionalString(input.content)).filter(Boolean);
+    const replyWrites = toolUses.flatMap((item) => {
+        const message = {
+            tool: optionalString(item.tool), input: smokeToolInput(item),
+        };
+        return active.map((vocabulary) => vocabulary.writeEvidence(message))
+            .filter((write) => Boolean(write))
+            // 裸文件名与 ./、绝对路径等价（平台常见写法，与 smoke 白名单同一课）。
+            .filter((write) => write.path === 'reply.md' || write.path.endsWith('/reply.md'))
+            .map((write) => write.content);
+    }).filter(Boolean);
     const answer = safeRemoteOutput(replyWrites.at(-1) || texts.at(-1) || '', 64 * 1024);
     const issueReadback = jsonObject(runProvider(command, scopedArgs({ profile: plan.profile, expected: { workspaceId: plan.workspaceId } }, [
         'issue', 'get', issueId, '--output', 'json',
@@ -265,6 +300,7 @@ export function statusMulticaWorkspaceRun(start, name, options = {}) {
 }
 export function planMulticaDeployment(start, name, options = {}) {
     const action = options.action || 'apply';
+    const rebindRuntime = Boolean(options.rebindRuntime) && action === 'apply';
     const env = options.env || process.env;
     const cliVersion = options.cliVersion || '';
     const info = inspectAgentProject(start, cliVersion);
@@ -273,12 +309,21 @@ export function planMulticaDeployment(start, name, options = {}) {
     const readPlan = planMulticaWorkspace(info.root, name, { env, cliVersion });
     const blocking = [...readPlan.blocking];
     let inspectionId = '';
+    let previousRuntimeId = '';
     try {
         const status = statusMulticaWorkspace(info.root, name, cliVersion);
         inspectionId = status.inspectionId;
         if (!status.readyForApply || !status.evidenceIntegrity || !status.stateMatched) {
             blocking.push(...status.failures.map((item) => `inspection.${item}`));
         }
+        // Runtime 归属漂移只挡「普通 apply」：没有显式 --rebind-runtime 时不允许悄悄把
+        // Agent 搬到新 runtime。retire 是收敛动作，不受漂移阻挡（否则 deploy 与 retire
+        // 会被同一把锁一起锁死）。
+        if (status.diff.includes('agent.runtime-drift')) {
+            previousRuntimeId = status.observedAgentRuntimeId || '';
+            if (action === 'apply' && !rebindRuntime)
+                blocking.push('agent.runtime-drift');
+        }
     }
     catch {
         blocking.push('inspection.invalid');
@@ -287,26 +332,30 @@ export function planMulticaDeployment(start, name, options = {}) {
         blocking.push('inspection.missing');
     if (action === 'retire' && !readPlan.expected.agentId)
         blocking.push('agent-id.missing');
+    if (rebindRuntime && !readPlan.expected.agentId)
+        blocking.push('rebind.agent-id-missing');
     const expectedSkills = source.skills.map((skill) => ({
         name: skill.name, hash: skill.hash, files: skill.files.length + 1,
     }));
     const operations = action === 'retire'
         ? ['scope.reinspect', 'agent.archive', 'agent.readback', 'receipt.persist']
         : [
-            'scope.reinspect', 'skills.readback', 'skills.reconcile', 'agent.reconcile',
+            'scope.reinspect', 'skills.readback', 'skills.reconcile',
+            ...(rebindRuntime ? ['agent.rebind-runtime'] : []), 'agent.reconcile',
             'skills.assign-exact', 'provider.readback', 'load-smoke.create',
             'load-smoke.recover-if-unstarted', 'load-smoke.readback', 'receipt.persist',
         ];
     const writeBudget = action === 'retire'
         ? { forward: 1, rollback: 0 }
         : {
-            forward: source.skills.length * (1 + MAX_SKILL_SUPPORTING_FILES * 2) + 5,
+            // +3 on top of the base 5: bounded skills-not-visible smoke retries (cold sandbox).
+            forward: source.skills.length * (1 + MAX_SKILL_SUPPORTING_FILES * 2) + 8,
             rollback: source.skills.length * (1 + MAX_SKILL_SUPPORTING_FILES * 2) + 3,
         };
     const planId = `multica_deploy_plan_${digest(stableStringify({
         action, workspace: name, profile: readPlan.profile, inspectionId,
         desiredHash: workspace.desiredHash, deploymentHash: source.deploymentHash,
-        expected: readPlan.expected, operations, writeBudget,
+        expected: readPlan.expected, operations, writeBudget, rebindRuntime, previousRuntimeId,
         blocking: [...new Set(blocking)].sort(),
     })).slice(0, 24)}`;
     return {
@@ -327,7 +376,9 @@ export function planMulticaDeployment(start, name, options = {}) {
             skills: expectedSkills,
             definitionHash: source.definitionHash,
             instructionsHash: source.instructionsHash,
+            ...(rebindRuntime ? { previousRuntimeId } : {}),
         },
+        rebindRuntime,
         operations,
         writeBudget,
         blocking: [...new Set(blocking)].sort(),
@@ -348,9 +399,12 @@ export function applyMulticaDeployment(start, name, options = {}, action = 'appl
         throw new Error('dta deploy 必须传 dry-run 返回的 --plan-id');
     const env = options.env || process.env;
     const cliVersion = options.cliVersion || '';
-    const plan = planMulticaDeployment(start, name, { action, env, cliVersion });
+    const rebindRuntime = Boolean(options.rebindRuntime) && action === 'apply';
+    const plan = planMulticaDeployment(start, name, { action, env, cliVersion, rebindRuntime });
     if (options.planId !== plan.planId) {
-        throw new Error(`deploy plan 已失效；期望当前 planId ${plan.planId}`);
+        throw new Error(`deploy plan 已失效；期望当前 planId ${plan.planId}。` +
+            'plan 对中间状态敏感：dry-run 之后、apply 之前不要插入 workspace inspect 等操作；' +
+            '重跑 --dry-run 取新 planId 后立即 apply');
     }
     if (plan.blocking.length)
         throw new Error(`deploy 前置条件不完整: ${plan.blocking.join(', ')}`);
@@ -368,7 +422,12 @@ export function applyMulticaDeployment(start, name, options = {}, action = 'appl
         preflight.profile !== plan.profile ||
         preflight.expected.workspaceId !== plan.expected.workspaceId ||
         preflight.expected.runtimeId !== plan.expected.runtimeId) {
-        throw new Error('deploy scope/readback 与冻结 plan 不一致；未执行任何远端写入');
+        throw new Error('deploy scope/readback 与冻结 plan 不一致；未执行任何远端写入' +
+            '（dry-run 与 apply 之间若插入过 inspect 或远端有变化，重跑 --dry-run 后立即 apply）');
+    }
+    if (action === 'apply' && !rebindRuntime && preflight.diff.includes('agent.runtime-drift')) {
+        throw new Error('deploy 前置条件不完整: agent.runtime-drift' +
+            '（Agent 当前绑定在其他 runtime；显式迁移用 --rebind-runtime，退役用 --retire）');
     }
     appendInspectionCalls(preflight, 'preflight', calls);
     const operationId = `multica_operation_${Date.now()}_${randomUUID().slice(0, 12)}`;
@@ -401,7 +460,7 @@ export function applyMulticaDeployment(start, name, options = {}, action = 'appl
         operation.calls = calls;
         operation.failures = [failure.category, ...rollbackReport.failures];
         operation.updatedAt = new Date().toISOString();
-        receipt = failureReceipt(info.root, workspace, source, plan, preflight, operation, calls, rollbackReport, status, failure.category);
+        receipt = failureReceipt(info.root, workspace, source, plan, preflight, operation, calls, rollbackReport, status, failure.category, failure.detail);
     }
     finally {
         rmSync(temp, { recursive: true, force: true });
@@ -429,6 +488,7 @@ function executeApply(root, workspace, source, plan, preflight, operation, comma
             calls: [...calls],
             agent: { ...previous.agent, action: 'noop' },
             skills: previous.skills.map((skill) => ({ ...skill, action: 'noop' })),
+            failureDetails: Array.isArray(previous.failureDetails) ? previous.failureDetails : [],
             evidencePath: receiptRelativePath(workspace.name, receiptId),
             remoteWrite: false,
             sideEffect: 'multica-read',
@@ -477,9 +537,12 @@ function executeApply(root, workspace, source, plan, preflight, operation, comma
         throw new DeploymentFailure('readback.deployment-mismatch');
     }
     const observedHash = deploymentObservedHash(finalSnapshot, readback.inspectionId);
-    const smoke = createAndReadSmoke(root, plan, source, agentId, command, env, timeoutMs, smokeTimeoutMs, noWait, calls);
+    const smoke = createAndReadSmoke(root, plan, source, agentId, readback.resources.runtime?.provider || '', command, env, timeoutMs, smokeTimeoutMs, noWait, calls);
+    // skills-not-visible 是冷沙箱竞态（推送的 Skill 尚未物化），不是真实部署失败：落
+    // verifying 而非 failed，避免把一次正常部署误判成失败、把人推去改本体换模板。
     const status = smoke.status === 'passed'
-        ? 'ready' : smoke.status === 'pending' ? 'verifying' : 'failed';
+        ? 'ready' : smoke.status === 'pending' ? 'verifying'
+        : smoke.classification === 'skills-not-visible' ? 'verifying' : 'failed';
     const receiptId = `multica_receipt_${digest(stableStringify({
         operationId: operation.operationId, planId: plan.planId, observedHash,
         smoke: { markerHash: smoke.markerHash, issueId: smoke.issueId, taskId: smoke.taskId },
@@ -516,6 +579,13 @@ function executeApply(root, workspace, source, plan, preflight, operation, comma
         smoke,
         rollback: emptyRollback(false),
         failures: [...smoke.failures],
+        failureDetails: [...smoke.failureDetails],
+        ...(plan.rebindRuntime && plan.expected.previousRuntimeId ? {
+            rebind: {
+                fromRuntimeId: plan.expected.previousRuntimeId,
+                toRuntimeId: plan.expected.runtimeId,
+            },
+        } : {}),
         evidencePath: receiptRelativePath(workspace.name, receiptId),
         remoteRead: true,
         remoteWrite: calls.some((call) => call.kind === 'write'),
@@ -570,6 +640,7 @@ function retireDeployment(root, workspace, source, plan, preflight, operation, c
         smoke: emptySmoke('not-run', source.skills.map((item) => item.name)),
         rollback: emptyRollback(false),
         failures: [],
+        failureDetails: [],
         evidencePath: receiptRelativePath(workspace.name, receiptId),
         remoteRead: true,
         remoteWrite: calls.some((call) => call.kind === 'write'),
@@ -784,7 +855,7 @@ function upsertSkillFile(root, plan, skillId, path, contentFile, command, env, t
         '--content-file', contentFile, '--output', 'json',
     ]), `skill.file.upsert:${path}`, 'write', root, env, timeoutMs, calls);
 }
-function createAndReadSmoke(root, plan, source, agentId, command, env, timeoutMs, smokeTimeoutMs, noWait, calls) {
+function createAndReadSmoke(root, plan, source, agentId, runtimeProvider, command, env, timeoutMs, smokeTimeoutMs, noWait, calls) {
     const marker = `DTA-MULTICA-LOAD-${randomUUID()}`;
     const requiredSkills = source.skills.map((item) => item.name).sort();
     const expectedResponse = JSON.stringify({
@@ -796,14 +867,15 @@ function createAndReadSmoke(root, plan, source, agentId, command, env, timeoutMs
             'DTA_MULTICA_LOAD_SMOKE@1', `marker=${marker}`,
             `required_skills=${JSON.stringify(requiredSkills)}`,
             'This is a deployment control-plane verification task.',
-            'Use the Host native Skill tool exactly once for every required skill above, in the listed order.',
+            'Load every required skill above through the Host skill mechanism, in the listed order.',
             'Do not call DWS, network, or business tools. Only the Host Issue control-plane calls needed to read this Issue and persist the exact result are exempt.',
-            `Return exactly this JSON and nothing else: ${expectedResponse}`,
+            `Post exactly this JSON as an Issue comment (and nothing else): ${expectedResponse}`,
         ].join('\n'),
         '--assignee-id', agentId, '--output', 'json',
     ]), 'smoke.issue.create', 'write', root, env, timeoutMs, calls).stdout, 'smoke issue');
     const issueId = resourceId(issue.id, 'smoke issue.id');
-    let smoke = readSmoke(root, plan, marker, issueId, agentId, requiredSkills, command, env, timeoutMs, calls);
+    const read = () => readSmoke(root, plan, marker, issueId, agentId, requiredSkills, runtimeProvider, command, env, timeoutMs, calls);
+    let smoke = read();
     // Multica persists the Issue before attempting the initial agent enqueue. If
     // that enqueue loses a transient readiness race, the API still returns a
     // valid assigned todo Issue but issue runs remains empty forever. Recover
@@ -812,19 +884,65 @@ function createAndReadSmoke(root, plan, source, agentId, command, env, timeoutMs
     // duplicated. The mention route is used instead of issue rerun because it is
     // the platform's normal first-run trigger and does not require a prior task.
     if (smoke.status === 'pending' && !smoke.taskId) {
-        runProvider(command, scopedArgs(plan, [
-            'issue', 'comment', 'add', issueId,
-            '--content', `[@DTA load smoke](mention://agent/${agentId}) Execute the deployment verification exactly as specified in this Issue description.`,
-            '--output', 'json',
-        ]), 'smoke.issue.recover', 'write', root, env, timeoutMs, calls);
-        smoke = readSmoke(root, plan, marker, issueId, agentId, requiredSkills, command, env, timeoutMs, calls);
+        try {
+            runProvider(command, scopedArgs(plan, [
+                'issue', 'comment', 'add', issueId,
+                '--content', `[@DTA load smoke](mention://agent/${agentId}) Execute the deployment verification exactly as specified in this Issue description.`,
+                '--output', 'json',
+            ]), 'smoke.issue.recover', 'write', root, env, timeoutMs, calls);
+            smoke = read();
+        }
+        catch {
+            // 与重试 mention 同一不变量：部署本体已回读验证，一次评论写入的抖动只让 smoke
+            // 停在 pending（收敛为 verifying，由 --status 收口），不允许升级为回滚。
+        }
     }
     if (noWait)
         return smoke;
     const started = Date.now();
-    while (smoke.status === 'pending' && Date.now() - started < smokeTimeoutMs) {
-        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2_000);
-        smoke = readSmoke(root, plan, marker, issueId, agentId, requiredSkills, command, env, timeoutMs, calls);
+    const pollToTerminal = () => {
+        while (smoke.status === 'pending' && Date.now() - started < smokeTimeoutMs) {
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2_000);
+            smoke = read();
+        }
+    };
+    pollToTerminal();
+    // 冷沙箱竞态：推送的 Skill 要数分钟才对运行时可见，任务报 `Skill not found` 不是
+    // 真失败。在预算内用 mention 触发新 task（新沙箱有机会看到新 Skill），有限次重试。
+    // 默认 30s 预算下基本轮不到重试；--wait / --smoke-timeout 放宽后才生效。
+    const retryDelayMs = Math.min(20_000, Math.max(500, Math.floor(smokeTimeoutMs / 12)));
+    let retries = 0;
+    while (smoke.status === 'failed' && smoke.classification === 'skills-not-visible' &&
+        retries < 3 && Date.now() - started < smokeTimeoutMs) {
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, retryDelayMs);
+        try {
+            runProvider(command, scopedArgs(plan, [
+                'issue', 'comment', 'add', issueId,
+                '--content', `[@DTA load smoke](mention://agent/${agentId}) Skills were not yet visible in the sandbox; re-run the deployment verification exactly as specified in this Issue description.`,
+                '--output', 'json',
+            ]), 'smoke.issue.retry', 'write', root, env, timeoutMs, calls);
+        }
+        catch {
+            // 一次评论写入的抖动不允许升级为对已验证部署的回滚：失败已记入 calls，
+            // 停止重试并保持当前 smoke 判定（skills-not-visible → verifying）。
+            break;
+        }
+        retries += 1;
+        // mention 触发的新 run 在平台上是异步创建的：只有当最新 run 的 taskId 变化后
+        // 才重新判定；等不到新 run 就停手——绝不因为还读到旧终态 run 而重复 mention。
+        const staleTaskId = smoke.taskId;
+        let sawNewRun = false;
+        while (Date.now() - started < smokeTimeoutMs) {
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2_000);
+            smoke = read();
+            if (smoke.taskId && smoke.taskId !== staleTaskId) {
+                sawNewRun = true;
+                break;
+            }
+        }
+        if (!sawNewRun)
+            break;
+        pollToTerminal();
     }
     if (smoke.status === 'pending' && !smoke.taskDiagnostic) {
         const detail = smoke.taskId
@@ -834,55 +952,180 @@ function createAndReadSmoke(root, plan, source, agentId, command, env, timeoutMs
     }
     return smoke;
 }
-function readSmoke(root, plan, marker, issueId, agentId, requiredSkills, command, env, timeoutMs, calls) {
+/**
+ * Judge a smoke run from positive evidence instead of a tool-name whitelist. The old judge
+ * required every tool_use to match hardcoded `skill`/`write`/`bash` shapes, so a healthy
+ * cloud runtime emitting `read_file`/`terminal` could never reach ready — and one extra
+ * harmless tool failed the whole trace. Now: each required skill needs load evidence
+ * (vocabulary tool_use or host-generated `**Skill loaded**` tool_result), the response is
+ * taken from the Issue comments themselves first (platform readback, vocabulary-independent),
+ * and only the explicit dws denylist is fatal. Unknown tool names are recorded, not judged.
+ */
+function readSmoke(root, plan, marker, issueId, agentId, requiredSkills, runtimeProvider, command, env, timeoutMs, calls) {
+    const provider = runtimeProvider || '';
+    const registered = vocabulariesForRuntimeProvider(provider);
+    const active = registered.length
+        ? registered : allRuntimeVocabularies();
+    const vocabularyIds = active.map((item) => item.id);
+    const base = {
+        ...emptySmoke('pending', requiredSkills), marker, markerHash: sha256(marker), issueId,
+        runtimeProvider: provider, vocabularyIds,
+    };
     const runs = jsonArray(runProvider(command, scopedArgs(plan, ['issue', 'runs', issueId, '--full-id', '--output', 'json']), 'smoke.issue.runs', 'read', root, env, timeoutMs, calls).stdout, 'smoke runs');
     const candidates = runs.filter((item) => !optionalString(item.agent_id) ||
         optionalString(item.agent_id) === agentId);
     const run = candidates.sort((a, b) => optionalString(b.created_at).localeCompare(optionalString(a.created_at)))[0];
     if (!run)
-        return {
-            ...emptySmoke('pending', requiredSkills), marker, markerHash: sha256(marker), issueId,
-        };
+        return base;
     const taskId = resourceId(run.id, 'smoke task.id');
     const taskStatus = optionalString(run.status);
     if (!['completed', 'failed', 'cancelled'].includes(taskStatus))
         return {
-            ...emptySmoke('pending', requiredSkills), marker, markerHash: sha256(marker), issueId, taskId, taskStatus,
+            ...base, taskId, taskStatus,
         };
     const messages = jsonArray(runProvider(command, scopedArgs(plan, [
         'issue', 'run-messages', taskId, '--issue', issueId, '--output', 'json',
     ]), 'smoke.issue.messages', 'read', root, env, timeoutMs, calls).stdout, 'smoke messages');
     const toolUses = messages.filter((item) => optionalString(item.type) === 'tool_use');
-    const skillToolUses = toolUses.filter((item) => optionalString(item.tool) === 'skill');
-    const skillNames = skillToolUses.map((item) => smokeToolInput(item).name)
-        .filter((item) => typeof item === 'string' && Boolean(item)).sort();
-    const loadedSkills = requiredSkills.filter((name) => skillNames.includes(name)).sort();
+    const toolNames = [...new Set(toolUses.map((item) => optionalString(item.tool))
+            .filter(Boolean))].sort();
+    // Skill-load evidence: a native skill tool_use (the host mechanism itself), or the
+    // host-generated `**Skill loaded**` banner in a skill-capable tool's tool_result. Two
+    // things are deliberately NOT evidence: model text (a reply can claim anything), and
+    // load ATTEMPTS — a failed cold-sandbox load emits the same "Loading skill" tool_use
+    // before its error result, and a terminal/bash result echoes whatever the model printed.
+    const evidence = new Set();
+    const attempted = new Set();
+    const evidenceTools = new Set();
+    const bannerTools = new Set(active.flatMap((item) => [...item.skillResultTools]));
+    for (const item of messages) {
+        const type = optionalString(item.type);
+        const tool = optionalString(item.tool);
+        if (type === 'tool_use') {
+            const message = { tool, input: smokeToolInput(item) };
+            for (const vocabulary of active) {
+                const name = vocabulary.skillLoadFromToolUse(message);
+                if (name) {
+                    evidence.add(name);
+                    evidenceTools.add(tool);
+                }
+                const attempt = vocabulary.skillAttemptFromToolUse(message);
+                if (attempt) {
+                    attempted.add(attempt);
+                    evidenceTools.add(tool);
+                }
+            }
+        }
+        else if (type === 'tool_result' && bannerTools.has(tool)) {
+            for (const name of skillsLoadedInContent(optionalString(item.content))) {
+                evidence.add(name);
+                evidenceTools.add(tool);
+            }
+        }
+    }
+    const loadedSkills = requiredSkills.filter((name) => evidence.has(name)).sort();
+    const skillEvidencePassed = loadedSkills.length === requiredSkills.length;
+    // dws is the DingTalk side-effect boundary: as a named tool or shelled out in a command.
+    const commandTexts = toolUses.flatMap((item) => {
+        const message = {
+            tool: optionalString(item.tool), input: smokeToolInput(item),
+        };
+        return active.map((vocabulary) => vocabulary.commandText(message)).filter(Boolean);
+    });
+    const forbiddenTools = toolNames.filter((name) => forbiddenSmokeTool(name));
+    const forbiddenCommands = commandTexts.some((text) => commandInvokesDws(text));
+    const knownTools = new Set(active.flatMap((item) => [...item.tools]));
+    const unrecognizedTools = toolNames.filter((name) => !knownTools.has(name) && !evidenceTools.has(name) && !forbiddenSmokeTool(name));
+    // Response evidence, most stable source first: the Issue's own comments (platform
+    // readback — no tool vocabulary involved), then trace texts, writes and shell heredocs.
+    const matchesResponse = (value) => smokeResponseMatches(value, marker, requiredSkills);
+    let commentContents = [];
+    try {
+        commentContents = jsonArray(runProvider(command, scopedArgs(plan, [
+            'issue', 'comment', 'list', issueId, '--recent', '20', '--output', 'json',
+        ]), 'smoke.issue.comments', 'read', root, env, timeoutMs, calls).stdout, 'smoke comments').map((item) => optionalString(item.content)).filter(Boolean);
+    }
+    catch {
+        commentContents = []; // 旧版 provider CLI 可能没有 comment list；回退 trace 内取证
+    }
     const texts = messages.filter((item) => optionalString(item.type) === 'text')
         .map((item) => optionalString(item.content)).filter(Boolean);
     const finalText = texts.at(-1) || '';
-    const matchesResponse = (value) => smokeResponseMatches(value, marker, requiredSkills);
-    const responseWrites = toolUses.filter((item) => optionalString(item.tool) === 'write')
-        .map((item) => smokeToolInput(item)).filter((input) => safeSmokeResponsePath(optionalString(input.filePath)))
-        .map((input) => optionalString(input.content)).filter(Boolean);
-    const responseShells = toolUses.filter((item) => optionalString(item.tool) === 'bash')
-        .map((item) => optionalString(smokeToolInput(item).command))
-        .filter((command) => safeCombinedSmokeResponse(command, issueId, marker, requiredSkills))
-        .map(() => JSON.stringify({ schema: 'dta-multica-load-smoke@1', marker, loaded: requiredSkills }));
-    const responseEvidence = [...texts, ...responseWrites, ...responseShells]
+    const responseWrites = [];
+    const responseShells = [];
+    for (const item of toolUses) {
+        const message = {
+            tool: optionalString(item.tool), input: smokeToolInput(item),
+        };
+        for (const vocabulary of active) {
+            const write = vocabulary.writeEvidence(message);
+            if (write && safeSmokeResponsePath(write.path))
+                responseWrites.push(write.content);
+            const text = vocabulary.commandText(message);
+            if (text && safeCombinedSmokeResponse(text, issueId, marker, requiredSkills)) {
+                responseShells.push(JSON.stringify({
+                    schema: 'dta-multica-load-smoke@1', marker, loaded: requiredSkills,
+                }));
+            }
+        }
+    }
+    const responseEvidence = [...commentContents, ...texts, ...responseWrites, ...responseShells]
         .find(matchesResponse) || '';
     const responsePassed = Boolean(responseEvidence);
-    const toolTracePassed = toolUses.every((item) => allowedSmokeToolUse(item, issueId, marker, requiredSkills)) && stableStringify(skillNames) === stableStringify(requiredSkills);
+    const toolTracePassed = skillEvidencePassed && !forbiddenTools.length && !forbiddenCommands;
     const failures = [];
+    const failureDetails = [];
     if (taskStatus !== 'completed')
         failures.push(`smoke.task.${taskStatus || 'unknown'}`);
-    if (!toolTracePassed)
-        failures.push('smoke.skill-tool-trace');
-    if (!responsePassed)
+    if (!skillEvidencePassed) {
+        failures.push('smoke.skill-load-evidence');
+        const attemptedMissing = requiredSkills.filter((name) => attempted.has(name) && !evidence.has(name));
+        failureDetails.push({
+            code: 'smoke.skill-load-evidence',
+            expected: requiredSkills,
+            actual: loadedSkills,
+            hint: attemptedMissing.length
+                ? `有装载尝试但无成功证据（tool_result 缺 **Skill loaded**）: ${attemptedMissing.join(', ')}；` +
+                    '尝试不算装载成功'
+                : unrecognizedTools.length
+                    ? `轨迹里有词汇表不认识的工具名: ${unrecognizedTools.join(', ')}；` +
+                        '若属新 runtime 词汇，需要在 multica-runtime-vocabulary 注册'
+                    : '轨迹中没有这些 Skill 的装载证据（tool_result 的 **Skill loaded** 或 Skill 工具调用）',
+        });
+    }
+    for (const tool of forbiddenTools)
+        failures.push(`smoke.forbidden-tool:${tool}`);
+    if (forbiddenCommands)
+        failures.push('smoke.forbidden-command:dws');
+    if (!responsePassed) {
         failures.push('smoke.response');
+        failureDetails.push({
+            code: 'smoke.response',
+            actual: `comments=${commentContents.length} texts=${texts.length} writes=${responseWrites.length}`,
+            hint: '未在 Issue comment、回复文本或落盘文件中找到精确的 dta-multica-load-smoke@1 JSON',
+        });
+    }
+    // 分类冷沙箱竞态：任务终态且缺装载证据，轨迹里出现 skill not found 类措辞 → 可重试，
+    // 与「配置/模板真错了」区分开（B7 的两个误导方向都来自不区分这两态）。
+    let classification = '';
+    if (!skillEvidencePassed) {
+        const searchable = messages.map((item) => optionalString(item.content)).join('\n');
+        if (/skill[^\n]{0,80}?not\s+found|not\s+found[^\n]{0,60}?skill|skill\s+view\s+failed/i.test(searchable)) {
+            classification = 'skills-not-visible';
+            failures.unshift('smoke.skills-not-visible');
+            failureDetails.unshift({
+                code: 'smoke.skills-not-visible',
+                hint: '推送的 Skill 尚未物化进沙箱（冷启动竞态，通常数分钟内自愈）；' +
+                    '用 deploy --status --execute --yes 重试，或部署时用 --wait 放宽预算',
+            });
+        }
+    }
     return {
         status: failures.length ? 'failed' : 'passed', marker, markerHash: sha256(marker),
         issueId, taskId, taskStatus, taskDiagnostic: remoteTaskDiagnostic(run), requiredSkills, loadedSkills,
         toolTracePassed, responsePassed, responseHash: sha256(responseEvidence || finalText), failures,
+        runtimeProvider: provider, vocabularyIds, toolNames, unrecognizedTools, classification,
+        failureDetails,
     };
 }
 function smokeToolInput(item) {
@@ -900,46 +1143,6 @@ function smokeResponseMatches(value, marker, requiredSkills) {
         return false;
     }
 }
-function allowedSmokeToolUse(item, issueId, marker, requiredSkills) {
-    const tool = optionalString(item.tool);
-    if (tool === 'skill')
-        return true;
-    const input = smokeToolInput(item);
-    if (tool === 'write') {
-        return safeSmokeResponsePath(optionalString(input.filePath)) &&
-            smokeResponseMatches(optionalString(input.content), marker, requiredSkills);
-    }
-    if (tool !== 'bash')
-        return false;
-    const command = optionalString(input.command);
-    if (new Set([
-        `multica issue get ${issueId} --output json`,
-        `multica issue metadata list ${issueId} --output json`,
-        `multica issue comment list ${issueId} --recent 10 --output json`,
-        `multica issue status ${issueId} in_progress`,
-        `multica issue status ${issueId} in_review`,
-    ]).has(command))
-        return true;
-    const commentPrefix = `multica issue comment add ${issueId} --content-file `;
-    if (command.startsWith(commentPrefix)) {
-        return safeSmokeResponsePath(command.slice(commentPrefix.length));
-    }
-    const cleanupFirstPrefix = 'rm ';
-    const cleanupFirstSuffix = ` && multica issue status ${issueId} in_review`;
-    if (command.startsWith(cleanupFirstPrefix) && command.endsWith(cleanupFirstSuffix)) {
-        return safeSmokeCleanup(command.slice(cleanupFirstPrefix.length, command.length - cleanupFirstSuffix.length));
-    }
-    const statusFirstPrefix = `multica issue status ${issueId} in_review && rm `;
-    if (command.startsWith(statusFirstPrefix)) {
-        return safeSmokeCleanup(command.slice(statusFirstPrefix.length));
-    }
-    if (command.startsWith(cleanupFirstPrefix)) {
-        return safeSmokeCleanup(command.slice(cleanupFirstPrefix.length));
-    }
-    if (safeCombinedSmokeResponse(command, issueId, marker, requiredSkills))
-        return true;
-    return false;
-}
 function safeCombinedSmokeResponse(command, issueId, marker, requiredSkills) {
     const response = JSON.stringify({ schema: 'dta-multica-load-smoke@1', marker, loaded: requiredSkills });
     return command === [
@@ -963,9 +1166,6 @@ function safeSmokeResponsePath(value) {
     return value.split('/').every((part) => !part ||
         (part !== '.' && part !== '..' && /^[A-Za-z0-9._-]+$/.test(part)));
 }
-function safeSmokeCleanup(value) {
-    return safeSmokeResponsePath(value.startsWith('-f ') ? value.slice(3) : value);
-}
 function rollbackConfirmed(root, plan, command, env, timeoutMs, calls, rollback, temp) {
     const report = emptyRollback(true);
     const attempt = (id, argv) => {
@@ -1079,7 +1279,7 @@ function verifyRollback(root, plan, command, env, timeoutMs, calls, rollback, re
         });
     }
 }
-function failureReceipt(root, workspace, source, plan, preflight, operation, calls, rollback, status, failure) {
+function failureReceipt(root, workspace, source, plan, preflight, operation, calls, rollback, status, failure, failureDetail) {
     const receiptId = `multica_receipt_${digest(stableStringify({
         operationId: operation.operationId, status, failure,
     })).slice(0, 24)}`;
@@ -1117,6 +1317,7 @@ function failureReceipt(root, workspace, source, plan, preflight, operation, cal
         smoke: emptySmoke('not-run', source.skills.map((item) => item.name)),
         rollback,
         failures: [failure, ...rollback.failures],
+        failureDetails: failureDetail ? [failureDetail] : [],
         evidencePath: receiptRelativePath(workspace.name, receiptId),
         remoteRead: true,
         remoteWrite: calls.some((call) => call.kind === 'write' || call.kind === 'rollback'),
@@ -1136,6 +1337,7 @@ export function statusMulticaDeployment(start, name, options = {}) {
             workspace: name, provider: 'multica', available: false, operationId: '', receiptId: '',
             status: 'missing', passed: false, providerReady: false,
             operationIntegrity: false, receiptIntegrity: false, reconciled: false,
+            receiptFrozen: false, smokeStale: false, nextAction: '',
             failures: ['deployment.missing'], receipt: null,
             remoteRead: false, remoteWrite: false, triggerWrite: false,
             sideEffect: false, dingtalkSideEffect: false,
@@ -1143,6 +1345,7 @@ export function statusMulticaDeployment(start, name, options = {}) {
     let { operation, receipt } = loaded;
     let reconciled = false;
     let remoteRead = false;
+    let remoteWrite = false;
     if (options.execute) {
         if (!options.yes)
             throw new Error('deploy --status 远端 reconcile 必须同时传 --execute --yes');
@@ -1151,12 +1354,41 @@ export function statusMulticaDeployment(start, name, options = {}) {
         const timeoutMs = positiveTimeout(options.timeoutMs, 30_000, 300_000);
         if (receipt.status === 'verifying' && receipt.smoke.issueId) {
             remoteRead = true;
-            const smokeReadback = readSmokeFromReceipt(info.root, receipt, command, env, timeoutMs);
-            const smoke = smokeReadback.smoke;
-            receipt = { ...receipt, calls: smokeReadback.calls, smoke, status: smoke.status === 'passed' ? 'ready'
-                    : smoke.status === 'pending' ? 'verifying' : 'failed',
+            let smokeReadback = readSmokeFromReceipt(info.root, receipt, command, env, timeoutMs);
+            let smoke = smokeReadback.smoke;
+            let calls = smokeReadback.calls;
+            // 冷沙箱竞态的收口入口：终态失败但分类为 skills-not-visible 时，补一次 mention
+            // 触发新 task（唯一的写；如实上报 remoteWrite/sideEffect）。新 run 是异步创建的：
+            // 以 taskId 变化为「新 run 出现」的判据再判定，等不到就按旧判定收场（仍 verifying），
+            // 不再重复 mention。
+            if (smoke.status === 'failed' && smoke.classification === 'skills-not-visible' &&
+                receipt.agent.id) {
+                const planLike = {
+                    profile: receipt.profile, expected: { workspaceId: operation.workspaceId },
+                };
+                const staleTaskId = smoke.taskId;
+                runProvider(command, scopedArgs(planLike, [
+                    'issue', 'comment', 'add', receipt.smoke.issueId,
+                    '--content', `[@DTA load smoke](mention://agent/${receipt.agent.id}) Skills were not yet visible in the sandbox; re-run the deployment verification exactly as specified in this Issue description.`,
+                    '--output', 'json',
+                ]), 'smoke.issue.retry', 'write', info.root, env, timeoutMs, calls);
+                remoteWrite = true;
+                const deadline = Date.now() + timeoutMs;
+                do {
+                    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2_000);
+                    smokeReadback = readSmokeFromReceipt(info.root, { ...receipt, calls }, command, env, timeoutMs);
+                    smoke = smokeReadback.smoke;
+                    calls = smokeReadback.calls;
+                } while ((smoke.status === 'pending' ||
+                    (Boolean(staleTaskId) && smoke.taskId === staleTaskId)) && Date.now() < deadline);
+            }
+            const nextStatus = smoke.status === 'passed' ? 'ready'
+                : smoke.status === 'pending' ? 'verifying'
+                    : smoke.classification === 'skills-not-visible' ? 'verifying' : 'failed';
+            receipt = { ...receipt, calls, smoke, status: nextStatus,
                 passed: smoke.status === 'passed', providerReady: smoke.status === 'passed',
-                failures: [...smoke.failures] };
+                failures: [...smoke.failures],
+                failureDetails: [...smoke.failureDetails] };
             reconciled = true;
             persistReceiptAndState(info.root, showDevelopmentWorkspace(info.root, name), operation, receipt);
         }
@@ -1190,6 +1422,7 @@ export function statusMulticaDeployment(start, name, options = {}) {
         }
         operation = loadOperationAndReceipt(info.root, name, operation.operationId)?.operation || operation;
     }
+    const receiptFrozen = !options.execute;
     return {
         $schema: 'dingtalk-agent/multica-deployment-status@1',
         workspace: name,
@@ -1203,12 +1436,17 @@ export function statusMulticaDeployment(start, name, options = {}) {
         operationIntegrity: true,
         receiptIntegrity: true,
         reconciled,
+        receiptFrozen,
+        smokeStale: receiptFrozen && receipt.status === 'verifying',
+        nextAction: ['verifying', 'reconciling'].includes(receipt.status)
+            ? `dta deploy --workspace ${name} --status --operation-id ${operation.operationId} --execute --yes`
+            : '',
         failures: [...receipt.failures],
         receipt,
         remoteRead,
-        remoteWrite: false,
+        remoteWrite,
         triggerWrite: false,
-        sideEffect: remoteRead ? 'multica-read' : false,
+        sideEffect: remoteWrite ? 'multica-read-write' : remoteRead ? 'multica-read' : false,
         dingtalkSideEffect: false,
     };
 }
@@ -1334,7 +1572,7 @@ function readSmokeFromReceipt(root, receipt, command, env, timeoutMs) {
                 failures: ['smoke.marker-not-recoverable'],
             } };
     }
-    const smoke = readSmoke(root, plan, markerValue, receipt.smoke.issueId, receipt.agent.id, receipt.smoke.requiredSkills, command, env, timeoutMs, calls);
+    const smoke = readSmoke(root, plan, markerValue, receipt.smoke.issueId, receipt.agent.id, receipt.smoke.requiredSkills, receipt.smoke.runtimeProvider || '', command, env, timeoutMs, calls);
     return { smoke, calls };
 }
 function persistReceiptAndState(root, workspace, operation, receipt) {
@@ -1504,7 +1742,7 @@ function runProvider(command, argv, id, kind, cwd, env, timeoutMs, calls) {
         throw new DeploymentFailure('budget.rollback-exhausted');
     }
     const run = spawnSync(command, argv, {
-        cwd, env, encoding: 'utf8', timeout: timeoutMs,
+        cwd, env: sanitizeProviderEnv(env).env, encoding: 'utf8', timeout: timeoutMs,
         maxBuffer: 32 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'],
     });
     const stdout = String(run.stdout || '');
@@ -1516,8 +1754,10 @@ function runProvider(command, argv, id, kind, cwd, env, timeoutMs, calls) {
         id, kind, argv: redactArgv(argv), exitCode,
         stdoutHash: sha256(stdout), stderrHash: sha256(stderr), passed, ambiguous,
     });
-    if (!passed)
+    if (!passed) {
+        emitProviderDiagnostic(id, exitCode, stderr || stdout);
         throw new DeploymentFailure(`command.${id}`, ambiguous);
+    }
     return { stdout, stderr };
 }
 function scopedArgs(plan, args) {
@@ -1638,6 +1878,8 @@ function emptySmoke(status, requiredSkills) {
         status, marker: '', markerHash: '', issueId: '', taskId: '', taskStatus: '', taskDiagnostic: '',
         requiredSkills: [...requiredSkills].sort(), loadedSkills: [],
         toolTracePassed: false, responsePassed: false, responseHash: '', failures: [],
+        runtimeProvider: '', vocabularyIds: [], toolNames: [], unrecognizedTools: [],
+        classification: '', failureDetails: [],
     };
 }
 function emptyRollback(attempted) {