@xdxer/dingtalk-agent 0.1.5-beta.8 → 0.1.5-beta.9

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to `@xdxer/dingtalk-agent` are documented here. The project follows semantic versioning; prerelease entries describe release candidates and do not imply that Live canaries or registry publication have completed.
 
+## 0.1.5-beta.9 - 2026-07-25
+
+Fixes for the blockers recorded across three real acceptance sessions (2026-07-23/24, the `~/xdx/blockers` corpus). The common shape: fail-closed held the line, but the judge read the wrong evidence, the error named the wrong cause, or the locked state had no clean way out. Ships on the `beta` dist-tag; `latest` stays at 0.1.4. Merged as PRs #21, #27, #29, #30, #31, #32.
+
+### Fixed
+
+- **The load-smoke judge could structurally never reach `ready` on a cloud runtime.** It hardcoded the tool names `skill`/`write`/`bash` and required *every* tool_use to match a whitelist, while Multica cloud runtimes surface skill loads as `read_file` ("Loading skill '<name>'") and commands as `terminal` — a smoke that actually succeeded on the platform (all skills loaded, exact JSON posted) was judged `failed` with `loadedSkills: []`. Trace reading now goes through per-runtime-provider vocabularies (`src/multica-runtime-vocabulary.ts`), skill loads are proven by positive evidence (the host-generated `**Skill loaded**` tool_result, or the vocabulary's skill tool_use — model text never counts), and the response is taken from the Issue's own comments first, which no tool rename can break. The `.every(whitelist)` negative gate is gone: one extra harmless tool no longer kills a healthy trace (that had already caused two production false negatives); only dws — as a tool name or shelled out in a command — stays fatal, with a named `smoke.forbidden-tool:dws` failure. Unknown tool names are recorded in `smoke.unrecognizedTools` instead of judged.
+- **Cold-sandbox deploys systematically failed their first smoke.** Pushed skills take minutes to materialize into a runtime sandbox, and deploy fired the smoke immediately, reporting `Skill not found` with no way to tell "not ready yet" from "really broken" — the exact wrong signal that sent one acceptance session off rewriting the agent and swapping templates. A terminal smoke whose trace shows skill-not-found wording is now classified `skills-not-visible`: the receipt converges to `verifying` (not `failed`), apply retries with a bounded, budgeted mention inside the smoke window, and `deploy --status --execute --yes` performs one controlled retry — honestly reported as `remoteWrite: true` / `sideEffect: multica-read-write`.
+- **Switching runtimes deadlocked deploy and retire together.** `scope.agent-binding-mismatch` blocked apply *and* the retire that would have resolved it; the only way out was editing the env back to the old runtime id by hand. Runtime drift is now an inspection diff (`agent.runtime-drift`), not a hard failure: plain apply is still refused (no silent agent migration), `--retire` proceeds (archiving is convergence, not a write to protect), and the new `deploy --rebind-runtime` migrates explicitly — plan-gated, with `previousRuntimeId` baked into the planId and `rebind: {from,to}` on the receipt.
+- **`MULTICA_AGENT_ID` in the environment made every dta call report "Not authenticated. Run 'multica login'".** The multica CLI treats that variable as an agent-identity switch; dta passed the whole process env through, so a manifest envRef with that natural-looking name deadlocked second deploys behind a message pointing at login (one session lost 20+ minutes to it). dta now strips the reserved variable from every provider subprocess (values still resolve from the raw env first), records the removal in `envSanitized`, and `workspace doctor` warns when a manifest ref collides with a reserved name. The fixture example is renamed off the reserved name.
+- **Deploying onto a hermes runtime "succeeded" and then every skill load failed with zero warning.** dta never checked the runtime's provider kind, and the server default for new FC runtimes is hermes — where workspace skills are never visible. Inspection now fails closed (`scope.runtime-provider-unsupported`, expected/actual in the detail) before any remote write when the target runtime's provider has no registered trace vocabulary.
+- **Failures named the enum and hid the facts.** `scope.profile-workspace-mismatch` didn't say which workspace the profile pointed at; provider CLI stderr was hashed and discarded, so "calls all passed yet not authenticated" was undiagnosable without reading source. Scope/auth/binding failures now carry structured `failureDetails` (`code`/`expected`/`actual`/`hint` — IDs and enums only, the redaction contract is untouched), renderers print them, and a failing provider call's stderr is streamed to dta's own stderr in the moment while evidence files keep storing only hashes. Plan-invalidation errors explain the actual rule: don't run `inspect` between dry-run and apply.
+- **`deploy --status` without `--execute` looked like the smoke fields were all null.** It returns the receipt frozen at apply time — for a `verifying` deploy that's the pending snapshot. The report now says so (`receiptFrozen`, `smokeStale`) and hands over the exact refresh command in `nextAction`; the human renderer prints the smoke block and the hint instead of leaving the fields to be misread as a broken readback.
+
+### Added
+
+- Contract coverage for all of the above in #53/#54: cloud-vocabulary smoke with noise commands, hermes fail-closed, reserved-env sanitization on both the inspect and deploy write paths (the fake multica replicates the Go CLI's identity-switch semantics), skills-not-visible retry/convergence/recovery, frozen-status fields, rebind end-to-end (including stale-plan smuggling refusal) and retire-under-drift. The fake provider gained deterministic increasing run timestamps, an issue-comment store with `issue comment list`, cloud and cloud-spoof trace vocabulary modes, a bounded skill-not-found mode, and an async-run-creation mode (`DTA_FAKE_MULTICA_RUN_DELAY_READS`).
+- **ops skill (`dta-ops-multica` 0.3.0, BREAKING)**: `runtime-create-fc` now injects `--provider opencode` by default — the server default is hermes, where workspace skills structurally never load; template auto-pick filters `waiting` and, with several ready candidates, fails closed listing them by `created_at`. `agent-check` **removes the single `healthy` boolean** (it reported green while users could not reach the agent at all) in favor of `infrastructureHealthy` + `userReady` with `reasons[]`, a single `nextAction`, and a `userReadyCaveat` naming the upstream blind spot (installations don't read back effective `allow_unbound`). `dingtalk-account-begin`/`-unbind` carry the server-enforced `binding_mode` (body vs query — the asymmetric wire contract is pinned in comments); `dingtalk-bind` without `--allow-unbound` now says on stderr that unbound senders (the owner included) will only get a binding prompt. PLATFORM.md's false claim that `autopilot-create` stdout carries a non-JSON prefix is corrected (it is pure JSON; the real hazard — non-idempotent create — stays). `multica_ext.py` gains its first automated regression: a fake HTTP server that records every request (#70).
+- **scaffold / schedule**: `workspace create` now atomically creates the declared artifacts directory (with `.gitkeep`), so a fresh project's first `workspace doctor` passes instead of failing on the scaffold's own omission; output states explicitly that only the local manifest was written — no remote Multica resources. Schedule planning shares deploy's exact agent-binding fallback (`multicaAgentIdSource`): a declared `agentIdFrom` env ref wins, otherwise the agent ID saved to workspace state by the first deploy is used verbatim — the golden path no longer demands hand-wiring (#71 pins deploy/schedule consistency). First agent creation prints how the ID will be reused; `agent.unbound-name-candidates` renders the candidate IDs it always had in JSON.
+- **gates**: `agent audit --verify-load` failures now carry a `failureSummary` (probe exitCode/durationMs/answer-match per failing surface) surfaced into the check summary and human output, and probe-execution-class failures get one fresh-session re-confirmation — recorded in `verification.attempts` with `passedOnAttempt`, so a flaky pass is visible instead of unexplainable (`--strict-single-run` opts out; static failures never retry). `check-skill-versions` closes the `git mv` blind spot: rename detection re-attaches the new directory to its old baseline (pure renames require a bump too — the directory name is the flat-namespace interface), with a frontmatter-name fallback for low-similarity rewrites (#72).
+- **docs**: `docs/UPSTREAM-REQUIREMENTS.md` — the ledger of the 14 gaps this repo cannot fix (MUL-001..009 / DWS-001..005) with per-item evidence grades, workarounds and fixed-upstream criteria; the compose skill's drive-and-schedules reference gains the capability-vs-delivery-policy boundary (delivery targets and recipients live in the schedule wake prompt, never in `SKILL.md`).
+
+An adversarial review pass on the first cut of this change confirmed and fixed six defects before release: load *attempts* counted as load *evidence* (a failed cold-sandbox load emits the same "Loading skill" tool_use as a successful one — attempts now only feed race classification, and the `**Skill loaded**` banner is only trusted from skill-capable tools' results, so a `terminal` echo cannot forge it); the mention retry loop judged the stale terminal run and could fire duplicate mentions (a new run now counts as arrived only when the latest taskId changes, and the loop stops rather than re-mentions when none appears); a transient failure of the retry *or* first-enqueue-recovery comment escalated into a full rollback of an already-verified deployment (both now just end the attempt and leave the receipt at `verifying`); the dws command scan missed `/usr/bin/dws`, quoted and backticked forms (now tokenized with basename matching, and the tool-name denylist is case-insensitive and segment-based so `mcp__dws__send` counts); and the reserved-env strip list gains `MULTICA_SERVER_URL` and `MULTICA_TOKEN` — a stray pre-prod URL or token in the shell must never retarget a named-profile deploy.
+
 ## 0.1.5-beta.8 - 2026-07-23
 
 Follow-up to the beta.7 rename, from watching a real machine take the upgrade: the four core skills migrated cleanly, the two platform skills sat untouched and unannounced. The three defects below are the same shape — "clean up" was not carried through to the end. Ships on the `beta` dist-tag; `latest` stays at 0.1.4.

package/README.en.md

@@ -180,6 +180,7 @@ Prepared Runs expose four message atoms: `ack`, `reply`, `ask`, and `silence`. A
 |---|---|
 | Understand the Agent architecture and how the repo is divided | [Architecture](docs/ARCHITECTURE.md) |
 | Install, upgrade, or troubleshoot | [Installation](docs/INSTALLATION.md) |
+| Take over an agent already running in production (runtime view) | [Agent in Production](docs/AGENT-IN-PRODUCTION.md) |
 | Understand evaluation and evidence levels | [Self-test](docs/SELF-TEST.md) |
 | Create or audit an Agent | [Compose Skill](skills/core/dta-agent-compose/SKILL.md) |
 | Test or debug a delivered Agent | [Eval Skill](skills/core/dta-agent-eval/SKILL.md) |

package/README.md

@@ -179,6 +179,7 @@ Prepared Run 只开放 `ack`、`reply`、`ask`、`silence` 四个消息原子动
 |---|---|
 | 理解 Agent 架构与仓库分工 | [Architecture](docs/ARCHITECTURE.md) |
 | 安装、升级与排障 | [Installation](docs/INSTALLATION.md) |
+| 接手一个已经在跑的 Agent（运行视角） | [Agent in Production](docs/AGENT-IN-PRODUCTION.md) |
 | 理解评测与证据分层 | [Self-test](docs/SELF-TEST.md) |
 | 创建或审计 Agent | [Compose Skill](skills/core/dta-agent-compose/SKILL.md) |
 | 测试或调试已交付的 Agent | [Eval Skill](skills/core/dta-agent-eval/SKILL.md) |

package/dist/bin/dingtalk-agent.js

@@ -33,7 +33,7 @@ import { runStorageEvaluation } from '../src/storage-evals.js';
 import { runPersonalEventEvaluation } from '../src/personal-event-evals.js';
 import { CHECK_LABELS, doctor } from '../src/doctor.js';
 import { doctorDevelopmentWorkspace, inspectAgentProject, showDevelopmentWorkspace, } from '../src/development-workspace.js';
-import { buildScheduleShow, buildSchedulePlan } from '../src/schedule-plan.js';
+import { buildScheduleShow, buildSchedulePlan, scheduleBlockers } from '../src/schedule-plan.js';
 import { applyOpenCodeWorkspace, evalOpenCodeWorkspace, planOpenCodeWorkspace, runOpenCodeWorkspace, useOpenCodeWorkspace, } from '../src/opencode-provider.js';
 import { inspectMulticaWorkspace, listMulticaWorkspaceResources, planMulticaWorkspace, scaffoldMulticaWorkspace, statusMulticaWorkspace, } from '../src/multica-provider.js';
 import { applyMulticaDeployment, listMulticaDeployments, planMulticaDeployment, runMulticaWorkspaceIssue, statusMulticaDeployment, statusMulticaWorkspaceRun, } from '../src/multica-deploy.js';
@@ -342,7 +342,7 @@ async function main() {
                 status: { type: 'boolean' }, list: { type: 'boolean' },
                 execute: { type: 'boolean' }, 'operation-id': { type: 'string' },
                 timeout: { type: 'string' }, 'smoke-timeout': { type: 'string' },
-                retire: { type: 'boolean' },
+                retire: { type: 'boolean' }, 'rebind-runtime': { type: 'boolean' },
             },
         });
         if (positionals.length)
@@ -361,16 +361,19 @@ async function main() {
         let out;
         if (o.wait && o['no-wait'])
             fail('deploy --wait 与 --no-wait 互斥');
+        if (o['rebind-runtime'] && o.retire)
+            fail('deploy --rebind-runtime 与 --retire 互斥');
         if (o.list) {
             if (o.execute || o['operation-id'] || o.retire || o['plan-id'] || o['no-wait'] || o.wait ||
-                o.timeout || o['smoke-timeout']) {
+                o.timeout || o['smoke-timeout'] || o['rebind-runtime']) {
                 fail('deploy --list 只接受 --workspace 和 --json');
             }
             out = listMulticaDeployments(PROJECT_START, o.workspace, PACKAGE_JSON.version);
         }
         else if (o.status) {
-            if (o.retire || o['plan-id'] || o['no-wait'] || o.wait || o['dry-run'] || o['smoke-timeout']) {
-                fail('deploy --status 不接受 retire/plan-id/no-wait/wait/dry-run/smoke-timeout');
+            if (o.retire || o['plan-id'] || o['no-wait'] || o.wait || o['dry-run'] || o['smoke-timeout'] ||
+                o['rebind-runtime']) {
+                fail('deploy --status 不接受 retire/plan-id/no-wait/wait/dry-run/smoke-timeout/rebind-runtime');
             }
             if (Boolean(o.execute) !== Boolean(o.yes)) {
                 fail('deploy --status 远端 reconcile 必须同时传 --execute --yes');
@@ -387,6 +390,7 @@ async function main() {
             }
             out = planMulticaDeployment(PROJECT_START, o.workspace, {
                 action: o.retire ? 'retire' : 'apply', cliVersion: PACKAGE_JSON.version,
+                rebindRuntime: o['rebind-runtime'],
             });
         }
         else {
@@ -403,6 +407,7 @@ async function main() {
             out = applyMulticaDeployment(PROJECT_START, o.workspace, {
                 yes: o.yes, planId: o['plan-id'], noWait: o['no-wait'],
                 timeoutMs, smokeTimeoutMs: effectiveSmokeTimeoutMs, cliVersion: PACKAGE_JSON.version,
+                rebindRuntime: o['rebind-runtime'],
             }, o.retire ? 'retire' : 'apply');
         }
         if (o.json)
@@ -521,6 +526,10 @@ async function main() {
         });
         if (sub === 'show') {
             const out = buildScheduleShow(PROJECT_START, PACKAGE_JSON.version);
+            // 有阻断问题 = 非 0 退出，json 和人类两条路都设，否则自动化用 --json 拿到 exit 0 照样部署 → fail-open。
+            // 判据来自 scheduleBlockers（含 unverified），不在这手写，避免和 plan 那边分叉。
+            if (scheduleBlockers(out).length)
+                process.exitCode = 2;
             if (o.json) {
                 console.log(JSON.stringify(out, null, 2));
                 return;
@@ -529,20 +538,26 @@ async function main() {
                 console.log(muted('本 Project 未声明任何常驻节律（schedules）。'));
                 return;
             }
-            console.log(`${strong('声明的常驻节律（internalized cron）')} · ${out.count} 条`);
+            console.log(`${strong('声明的常驻节律（本地 manifest 声明，非线上实态）')} · ${out.count} 条`);
             for (const s of out.schedules) {
-                console.log(`\n  ${noun(s.name)}  ${s.cron}  ${s.timezone}  ${muted(`[${s.mode}]`)}`);
+                const metered = s.mode === 'work-item' ? '记账' : '不记账';
+                console.log(`\n  ${noun(s.name)}  ${s.cron}  ${s.timezone}  ${muted(`[${s.mode}·${metered}]`)}`);
                 if (s.wake)
                     console.log(muted(`    唤醒 ${s.wake}`));
                 if (s.completion)
                     console.log(muted(`    ②判据 ${s.completion}`));
             }
-            if (!out.minutesDistinct) {
-                console.log(`\n${mark('warn', `⚠️ 分钟位冲突: ${out.collidingMinutes.join(', ')} —— 外发类同分钟并发会重复送，请错开`)}`);
-                process.exitCode = 2;
+            if (out.collidingPairs.length) {
+                console.log(`\n${mark('fail', `✗ 同刻并发: ${out.collidingPairs.join('、')} —— 外发拍同一时刻 fire 会重复送第三方，请错开`)}`);
             }
-            else {
-                console.log(`\n${mark('pass', '✓ 各节律分钟位互不相同（外发防重复的静态前提满足）')}`);
+            if (out.missingCompletion.length) {
+                console.log(`${mark('fail', `✗ 缺完成判据: ${out.missingCompletion.join('、')} —— 没有数据派生的 completion，只能靠"跑没跑"判完成，漏拍就永久丢一期`)}`);
+            }
+            if (out.unverifiedPairs.length) {
+                console.log(`${mark('fail', `✗ 证不出是否同刻: ${out.unverifiedPairs.join('、')} —— 跨时区或 cron 扩展语法本地读不懂，一律当撞车挡住（0 9 * * * @Asia/Shanghai 和 0 1 * * * @UTC 就是同一时刻）；把两条写成同一个 timezone，或换掉扩展语法`)}`);
+            }
+            if (!out.collidingPairs.length && !out.missingCompletion.length && !out.unverifiedPairs.length) {
+                console.log(`\n${mark('pass', '✓ 各节律不同刻 fire、且都有数据派生的完成判据')}`);
             }
             return;
         }
@@ -552,6 +567,10 @@ async function main() {
                 fail('schedule plan 需要 --workspace <name>');
             const info = inspectAgentProject(PROJECT_START, PACKAGE_JSON.version);
             const plan = buildSchedulePlan(info, workspaceName);
+            // fail closed（json 和人类两条路都设）：plan 是 operator 真正照着部署的路径，
+            // 撞车不在这拦，两条会各建一个 autopilot → 重复外发。判据同 show，见 scheduleBlockers。
+            if (scheduleBlockers(plan).length)
+                process.exitCode = 2;
             if (o.json) {
                 console.log(JSON.stringify(plan, null, 2));
                 return;
@@ -564,8 +583,18 @@ async function main() {
                 return;
             }
             console.log(`  ${plan.count} 条声明 → provider ops:\n`);
-            for (const s of plan.schedules)
-                console.log(`  ${muted(`# ${s.name}`)}\n  ${noun(s.applyCommand)}\n`);
+            for (const s of plan.schedules) {
+                console.log(`  ${muted(`# ${s.name}  [${s.metered ? '记账' : '不记账·平台看不到成本'}]`)}\n  ${noun(s.applyCommand)}\n`);
+            }
+            if (plan.collidingPairs.length) {
+                console.log(`${mark('fail', `✗ 同刻并发: ${plan.collidingPairs.join('、')} —— 别照此部署，两条会各建一个 autopilot → 重复外发；先错开 fire 时刻`)}`);
+            }
+            if (plan.missingCompletion.length) {
+                console.log(`${mark('fail', `✗ 缺完成判据: ${plan.missingCompletion.join('、')} —— 补上数据派生的 completion，别靠"跑没跑"判完成`)}`);
+            }
+            if (plan.unverifiedPairs.length) {
+                console.log(`${mark('fail', `✗ 证不出是否同刻: ${plan.unverifiedPairs.join('、')} —— 别照此部署。跨时区或扩展语法本地判不了，一律当撞车；把两条写成同一个 timezone 再 plan，判得出不撞就自动放行`)}`);
+            }
             console.log(`执行: ${noun(plan.reconcile)}`);
             return;
         }
@@ -1159,6 +1188,7 @@ async function main() {
                 'state-dir': { type: 'string' }, profile: { type: 'string' },
                 'expected-user-id': { type: 'string' }, 'require-skill': { type: 'string' },
                 'verify-load': { type: 'boolean' }, yes: { type: 'boolean' },
+                'strict-single-run': { type: 'boolean' },
                 model: { type: 'string' }, out: { type: 'string' },
                 'load-report': { type: 'string' }, 'remote-report': { type: 'string' },
                 json: { type: 'boolean' },
@@ -1175,6 +1205,7 @@ async function main() {
             bindings: loaded ? { path: loaded.path, hash: loaded.hash } : undefined,
             requiredSkills: o['require-skill']?.split(','),
             verifyLoad: o['verify-load'], yes: o.yes, model: o.model, out: o.out,
+            strictSingleRun: o['strict-single-run'],
             loadReport: o['load-report'], remoteReport: o['remote-report'],
         });
         if (o.json)
@@ -1747,6 +1778,22 @@ function printAgentAudit(out) {
     for (const check of out.checks) {
         const word = check.level === 'pass' ? 'PASS' : check.level === 'warn' ? 'WARN' : 'FAIL';
         console.log(`   ${mark(levelOf(check.level), word)} ${check.id}: ${check.summary}`);
+        const evidence = check.evidence;
+        // 失败可归因：把 failureSummary 的前几条与证据路径直接摆到失败行下面，
+        // 不再让人去 JSON 深处找「为什么」。flaky 通过（第二次 attempt 才过）也如实标注。
+        if (check.level !== 'pass' && check.blocking && Array.isArray(evidence?.failureSummary)) {
+            for (const line of evidence.failureSummary.slice(0, 3)) {
+                console.log(`      · ${line}`);
+            }
+            if (typeof evidence.report === 'string' && evidence.report) {
+                console.log(`      evidence: ${evidence.report}`);
+            }
+        }
+        const verification = evidence?.verification;
+        if (verification && Array.isArray(verification.attempts) && verification.attempts.length > 1) {
+            console.log(`      attempts: ${verification.attempts.length}` +
+                `（passedOnAttempt=${verification.passedOnAttempt || '-'}）`);
+        }
     }
     if (out.repairs.length) {
         console.log('\n修复建议:');
@@ -2015,10 +2062,39 @@ function printMulticaWorkspaceOperation(out) {
         console.log(`   blocking=${out.blocking.join(', ')}`);
     if (out.failures?.length)
         console.log(`   failures=${out.failures.join(', ')}`);
+    printFailureDetails(out.failureDetails, '   ');
+    // 同名候选就在 JSON 里，人类输出却只给一个枚举串——把出路直接摆出来（B10/C3）。
+    if (out.failures?.includes('agent.unbound-name-candidates') &&
+        Array.isArray(out.resources?.agentCandidates) && out.resources.agentCandidates.length) {
+        for (const candidate of out.resources.agentCandidates) {
+            console.log(`     candidate: ${candidate.id}  ${candidate.name}${candidate.archived ? '  (archived)' : ''}`);
+        }
+        console.log('     fix: 核对后在 manifest 声明 provider.agentIdFrom 指向正确 ID' +
+            '（或依赖首次 deploy 写入的 state.binding.agentId）；不要按名字猜绑定');
+    }
     if (out.evidencePath)
         console.log(`   evidence=${out.evidencePath}`);
     console.log(`   remoteWrite=${out.remoteWrite}  dingtalkSideEffect=${out.dingtalkSideEffect}`);
 }
+/** 期望 vs 实际 + 下一步：把 fail-closed 从「正确但沉默」升级为「正确且能自救」。 */
+function printFailureDetails(details, indent) {
+    if (!Array.isArray(details))
+        return;
+    for (const detail of details) {
+        if (!detail || typeof detail !== 'object')
+            continue;
+        const item = detail;
+        const format = (value) => Array.isArray(value) ? value.join(', ') : typeof value === 'string' ? value : '';
+        const expected = format(item.expected);
+        const actual = format(item.actual);
+        const parts = [
+            expected ? `expected=${expected}` : '', actual ? `actual=${actual}` : '',
+        ].filter(Boolean).join('  ');
+        console.log(`${indent}- ${item.code}${parts ? `: ${parts}` : ''}`);
+        if (typeof item.hint === 'string' && item.hint)
+            console.log(`${indent}  → ${item.hint}`);
+    }
+}
 function printMulticaDeployment(out) {
     console.log(`${strong('Multica deploy')}: ${noun(out.workspace || '<unknown>')}`);
     if (out.planId)
@@ -2033,12 +2109,37 @@ function printMulticaDeployment(out) {
         console.log(`  status: ${out.status}`);
     if (typeof out.providerReady === 'boolean')
         console.log(`  provider ready: ${out.providerReady}`);
+    // 首次创建 Agent 后把「二次部署怎么绑定」讲在当下（B10）：正常路径 ID 已存 state
+    // 自动复用；换机器/state 丢失才需要显式声明。
+    if (out.action === 'apply' && out.agent?.action === 'create' && out.agent?.id) {
+        console.log(`  agent created: ${out.agent.id}`);
+        console.log(`    ID 已写入 .dingtalk-agent/state/workspaces/${out.workspace}.json，二次部署与 schedule 自动复用`);
+        console.log('    换机器或 state 丢失时：在 manifest 声明 provider.agentIdFrom=env:<VAR> 并 export 该 ID');
+    }
+    if (out.rebind?.fromRuntimeId) {
+        console.log(`  rebind: ${out.rebind.fromRuntimeId} -> ${out.rebind.toRuntimeId}`);
+    }
+    const smoke = out.smoke || out.receipt?.smoke;
+    if (smoke && smoke.status && smoke.status !== 'not-run') {
+        const classified = smoke.classification ? ` (${smoke.classification})` : '';
+        console.log(`  smoke: ${smoke.status}${classified}  task=${smoke.taskId || '-'}${smoke.taskStatus ? ` (${smoke.taskStatus})` : ''}`);
+        console.log(`    loaded: ${smoke.loadedSkills?.length ?? 0}/${smoke.requiredSkills?.length ?? 0}  response: ${smoke.responsePassed === true}`);
+        if (Array.isArray(smoke.unrecognizedTools) && smoke.unrecognizedTools.length) {
+            console.log(`    unrecognized tools: ${smoke.unrecognizedTools.join(', ')}`);
+        }
+    }
     if (Array.isArray(out.blocking) && out.blocking.length) {
         console.log(`  blocking: ${out.blocking.join(', ')}`);
     }
     if (Array.isArray(out.failures) && out.failures.length) {
         console.log(`  failures: ${out.failures.join(', ')}`);
     }
+    printFailureDetails(out.failureDetails || out.receipt?.failureDetails, '  ');
+    if (Array.isArray(smoke?.failureDetails))
+        printFailureDetails(smoke.failureDetails, '  ');
+    if (out.receiptFrozen && out.nextAction) {
+        console.log(muted(`  smoke 字段为 apply 时刻的冻结值；刷新: ${out.nextAction}`));
+    }
     if (out.triggerWrite === false)
         console.log('  triggers: unchanged');
 }