@xdxer/dingtalk-agent 0.1.5-beta.8 → 0.1.5-beta.9

package/dist/src/agent-audit.js

@@ -133,16 +133,37 @@ export function auditAgent(root, options = {}) {
     let currentHostVersion = '';
     let loadReportError = '';
     let sideEffect = false;
+    const loadAttempts = [];
     if (options.verifyLoad) {
         if (!options.yes)
             throw new Error('agent audit --verify-load 会调用 OpenCode；必须同时传 --yes');
         if (staticPrerequisitesReady) {
-            const execution = executeLoadAudit(rootReal, options, loadTargetHash, definitionInstruction, basicInstruction, effectiveModel, () => currentLoadTargetHash(rootReal, options, requiredSkills, effectiveModel));
-            loadReport = execution.report;
-            loadReportPath = execution.evidencePath;
-            verifiedReportPath = execution.reportPath;
-            currentHostVersion = execution.currentHostVersion;
-            sideEffect = 'local-opencode-eval';
+            // 门禁语义不变：ready 断言「当前 hash 组合下 Host 必然加载」这个确定性属性，而
+            // 单次 LLM 抽样失败混入了噪声维度（实测 3 个同构 Agent 首轮 1 pass/2 fail、零改动
+            // 重跑全过）。仅对探针执行类失败做一次全新 Session 的二次确认；attempt 之间
+            // targetHash/Host 漂移仍会中止整条命令。每次 attempt 都记进 verification.attempts
+            // ——flaky 不是被吞掉，而是从不可归因变成有账可查。--out 模式禁用重试（第二次
+            // attempt 会拒绝覆盖用户指定的输出路径）。
+            const maxAttempts = options.strictSingleRun || options.out ? 1 : 2;
+            for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+                const execution = executeLoadAudit(rootReal, options, loadTargetHash, definitionInstruction, basicInstruction, effectiveModel, () => currentLoadTargetHash(rootReal, options, requiredSkills, effectiveModel));
+                loadReport = execution.report;
+                loadReportPath = execution.evidencePath;
+                verifiedReportPath = execution.reportPath;
+                currentHostVersion = execution.currentHostVersion;
+                sideEffect = 'local-opencode-eval';
+                const verdict = verifyLoadReport(rootReal, verifiedReportPath, loadReport, basic, definitionInstruction, effectiveModel, currentHostVersion);
+                const summary = Array.isArray(verdict.evidence.failureSummary)
+                    ? verdict.evidence.failureSummary : [];
+                loadAttempts.push({
+                    attempt,
+                    passed: verdict.passed,
+                    evidencePath: relative(rootReal, execution.evidencePath),
+                    failureSummary: summary,
+                });
+                if (verdict.passed || !shouldRetryLoadAudit(summary))
+                    break;
+            }
         }
     }
     else if (options.loadReport) {
@@ -167,9 +188,19 @@ export function auditAgent(root, options = {}) {
                 ? 'missing-report' : 'static-prerequisites-failed'),
         },
     };
+    const loadFailureHighlights = Array.isArray(load.evidence.failureSummary)
+        ? load.evidence.failureSummary.slice(0, 2) : [];
     add('host.load-probe', 'load', load.passed ? 'pass' : 'fail', true, load.passed ? 'Agent Definition 原生 rule canary、Basic load probe 与 Session directory 均通过'
-        : '尚未取得与当前 Definition、Basic 全树 hash 绑定的 Host load 证据', { report: loadReportPath ? relative(rootReal, loadReportPath) : '',
-        targetHash: loadTargetHash, ...load.evidence });
+        : '尚未取得与当前 Definition、Basic 全树 hash 绑定的 Host load 证据' +
+            (loadFailureHighlights.length ? `（${loadFailureHighlights.join('；')}）` : ''), { report: loadReportPath ? relative(rootReal, loadReportPath) : '',
+        targetHash: loadTargetHash, ...load.evidence,
+        ...(loadAttempts.length ? {
+            verification: {
+                attempts: loadAttempts,
+                passedOnAttempt: (loadAttempts.find((item) => item.passed) || { attempt: 0 }).attempt,
+                strictSingleRun: Boolean(options.strictSingleRun),
+            },
+        } : {}) });
     let remoteReportPath = '';
     if (remote) {
         let loaded = null;
@@ -966,6 +997,20 @@ function readLoadEvidence(root, input, expectedTargetHash) {
     }
     return { path: loaded.path, reportPath: report.path, report: report.value };
 }
+/**
+ * 只有「探针执行类」失败值得一次全新 Session 的二次确认——模型抖动、超时、回显不精确、
+ * session 导出缺失都是瞬时面。静态类失败（schema/hash/绑定/host 漂移）重跑必然复现，
+ * 直接判死，不浪费第二次探针。
+ */
+export function shouldRetryLoadAudit(failureSummary) {
+    if (!Array.isArray(failureSummary) || !failureSummary.length)
+        return false;
+    const staticPrefixes = [
+        'report.schema', 'report.dingtalk-side-effect', 'basic.binding',
+        'inheritance.evidence', 'source-config.evidence', 'host.binding',
+    ];
+    return failureSummary.every((item) => typeof item === 'string' && !staticPrefixes.some((prefix) => item.startsWith(prefix)));
+}
 function verifyLoadReport(root, reportPath, report, basic, definitionInstruction, model, currentHostVersion) {
     const configuration = 'with_skill';
     const comparison = 'without_skill';
@@ -1023,9 +1068,60 @@ function verifyLoadReport(root, reportPath, report, basic, definitionInstruction
         report.summary?.loadGate === true && gate?.passed === true && probeSet.passed &&
         definitionPassed && referencePassed && inheritanceEvidenceValid &&
         sourceConfigEvidenceValid && hostMatched;
+    // 失败可归因：把每个失败面折成一行带关键数值的摘要。探针的 exitCode/durationMs 本来
+    // 就在 evidence 深处，缺的是提到人读得到的地方——此前失败只有一句通用的「尚未取得
+    // 证据」，没人能区分模型抖动、超时还是配置真错了（发布门禁 flaky 却无从归因）。
+    const failureSummary = [];
+    if (!passed) {
+        if (report.$schema !== 'dingtalk-agent/opencode-eval-report@1') {
+            failureSummary.push(`report.schema: ${String(report.$schema || '(missing)')}`);
+        }
+        if (report.passed !== true)
+            failureSummary.push('report.passed: false');
+        if (report.summary?.hardGate !== true)
+            failureSummary.push('report.hard-gate: false');
+        if (report.dingtalkSideEffect !== false)
+            failureSummary.push('report.dingtalk-side-effect: not false');
+        if (source?.name !== basic.name || source?.version !== basic.version ||
+            source?.hash !== basic.hash) {
+            failureSummary.push('basic.binding: got ' +
+                `${source?.name || '(none)'}@${source?.version || '?'} ` +
+                `hash=${String(source?.hash || '').slice(0, 12) || '?'}, expected ` +
+                `${basic.name}@${basic.version} hash=${basic.hash.slice(0, 12)}`);
+        }
+        if (report.summary?.loadGate !== true || gate?.passed !== true) {
+            failureSummary.push('load-gate: false');
+        }
+        if (!probeSet.passed) {
+            failureSummary.push(`load-probes: ${probeSet.passedPrimary}/${probes.length} primary ` +
+                `passed, anti-guess=${probeSet.passedComparison}`);
+        }
+        if (!definitionPassed) {
+            failureSummary.push('inheritance.definition: ' +
+                `answer=${definition.answer === definition.expected ? 'exact' : 'mismatch'} ` +
+                `exitCode=${definition.exitCode ?? '?'} durationMs=${definition.durationMs ?? '?'} ` +
+                `toolCalls=${definition.toolCalls ?? '?'}`);
+        }
+        if (!referencePassed) {
+            failureSummary.push('inheritance.reference: ' +
+                `answer=${reference.answer === reference.expected ? 'exact' : 'mismatch'} ` +
+                `exitCode=${reference.exitCode ?? '?'} durationMs=${reference.durationMs ?? '?'} ` +
+                `fullRead=${reference.fullRead === true}`);
+        }
+        if (!inheritanceEvidenceValid)
+            failureSummary.push('inheritance.evidence: hash/binding invalid');
+        if (!sourceConfigEvidenceValid)
+            failureSummary.push('source-config.evidence: invalid');
+        if (!hostMatched) {
+            failureSummary.push('host.binding: ' +
+                `report=${report.engine?.model || '?'}@${report.engine?.version || '?'} ` +
+                `current=@${currentHostVersion || '?'}`);
+        }
+    }
     return {
         passed,
         evidence: {
+            failureSummary,
             schema: report.$schema || '', configuration, sourceHash: source?.hash || '',
             expectedHash: basic.hash, loadGate: report.summary?.loadGate === true,
             passedProbes: probeSet.passedPrimary,
@@ -1305,7 +1401,10 @@ function repairFor(id) {
     if (id === 'host.load-probe')
         return {
             id, why: '静态目录和配置不能证明 Host 已解析 Agent Definition 并让模型读到 Basic 正文。',
-            actions: ['执行 dta agent audit --verify-load --yes --json，保留 resolved instructions、随机 probe 与 Session directory 证据。'],
+            actions: [
+                '执行 dta agent audit --verify-load --yes --json，保留 resolved instructions、随机 probe 与 Session directory 证据。',
+                '若探针已执行仍失败，先读 evidence 里的 failureSummary 与 verification.attempts 定位失败面（模型抖动/超时/hash 绑定），不要盲目改本体重跑。',
+            ],
         };
     if (id === 'authority.dws')
         return {