fix(dingtalk): strip leaked internal source handles

WeKnora's system prompt hard-enforces 'ALWAYS respond in {{language}}',
fed by its Language middleware (WEKNORA_LANGUAGE env -> Accept-Language
header -> zh-CN fallback). The previous localizedQuery() prompt prefix
lost against that instruction, so a user-set 'en' preference still got
Chinese answers on English questions.

- AgentChatRequest.Locale is transmitted as the Accept-Language header
  (never in the JSON body); WeKnora maps it to the prompt language
- 'auto' detects the query script client-side (latin->en, Han->zh-CN,
  kana->ja, Hangul->ko); es is never auto-guessed
- unset/unknown locale sends no header, preserving prior server behavior
- drop localizedQuery prompt prefixes entirely

Dockerfile

@@ -2,6 +2,8 @@ FROM golang:1.26.5-bookworm AS build
 
 WORKDIR /src
 COPY go.mod go.sum ./
+ARG GOPROXY=https://proxy.golang.org,direct
+ENV GOPROXY=${GOPROXY}
 RUN go mod download
 COPY . ./
 

README.md

@@ -76,6 +76,35 @@ DobotAI 是 WeKnora 的企业外部渠道集成层，负责钉钉协议、身份
 
 目录职责规则：`cmd/`只装配进程，`internal/`承载业务模块，`internal/store/postgres/`只实现数据库持久化，`db/migrations/`只放Schema变更，`deploy/`只放容器运行资产。历史计划、备份、镜像归档和真实环境文件均不进入Git。
 
+## 部署方式
+
+| 方式 | 适用场景 | 数据库 | 入口 |
+| --- | --- | --- | --- |
+| 源码/原生二进制 | 本地开发、快速调试 | 手工配置阿里云RDS连接 | `go run ./cmd/dobotai` |
+| Docker | 测试、预发布、生产候选 | 既有阿里云RDS；Docker不运行数据库 | `sudo bash ./install-docker.sh` |
+
+### 源码部署
+
+```bash
+go run ./cmd/dobotai
+curl --noproxy '*' -fsS http://127.0.0.1:8090/healthz
+```
+
+源码方式不自动安装Docker、不创建目录、不检查RDS表，也不适合作为长期渠道消费者。
+
+### Docker + 阿里云RDS部署
+
+克隆仓库后在根目录执行：
+
+```bash
+sudo bash ./install-docker.sh
+sudo dobotai-dingtalk-configure
+```
+
+第一条命令自动安装Docker/Compose（如缺失）、构建应用镜像、准备目录和配置模板；第二条命令安全录入RDS、WeKnora与钉钉配置，然后检查RDS表：空库初始化`000001`至`000021`，完整表不写入，异常/半成品表拒绝启动。Docker只运行`dobotai-dingtalk`，不创建`dobotai-postgres`、本地数据卷或本地数据库。
+
+完整安装、RDS检查、升级和回滚见 [Docker部署手册](deploy/dobotai-dingtalk/README.md)。
+
 ## 钉钉 Stream
 
 使用官方 `dingtalk-stream-sdk-go`，不暴露公网回调入口。

cmd/dobotai/main.go

@@ -79,10 +79,22 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
+	defaultMode := reasoningmode.ModeQuick
+	if raw := strings.TrimSpace(os.Getenv("DOBOTAI_DEFAULT_MODE")); raw != "" {
+		switch raw {
+		case "reasoning":
+			defaultMode = reasoningmode.ModeReasoning
+		case "quick":
+			defaultMode = reasoningmode.ModeQuick
+		default:
+			log.Fatal("DOBOTAI_DEFAULT_MODE must be quick or reasoning")
+		}
+	}
 	reasoningService, err := reasoningmode.NewService(
 		store,
 		os.Getenv("DOBOTAI_QUICK_AGENT_ID"),
 		os.Getenv("DOBOTAI_REASONING_AGENT_ID"),
+		reasoningmode.WithDefaultMode(defaultMode),
 	)
 	if err != nil {
 		log.Fatal(err)

db/migrations/000022_reasoning_default_mode.down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE reasoning_mode_states
+    DROP COLUMN user_selected;

db/migrations/000022_reasoning_default_mode.up.sql

@@ -0,0 +1,6 @@
+-- 000022_reasoning_default_mode: support an operator-configurable default
+-- mode for the /think reasoning router. The new column records whether a
+-- user has explicitly chosen a mode (/think on|off); users who never have
+-- will follow DOBOTAI_DEFAULT_MODE instead of the hardcoded quick answer.
+ALTER TABLE reasoning_mode_states
+    ADD COLUMN user_selected BOOLEAN NOT NULL DEFAULT FALSE;

db/migrations/000022_reasoning_default_mode_contract_test.go

@@ -0,0 +1,34 @@
+package migrations_test
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestUp022AddsReasoningUserSelectedColumn(t *testing.T) {
+	data, err := os.ReadFile("000022_reasoning_default_mode.up.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	source := strings.ToUpper(string(data))
+	for _, required := range []string{
+		"ALTER TABLE REASONING_MODE_STATES",
+		"ADD COLUMN USER_SELECTED BOOLEAN NOT NULL DEFAULT FALSE",
+	} {
+		if !strings.Contains(source, required) {
+			t.Errorf("up migration missing %q", required)
+		}
+	}
+}
+
+func TestDown022DropsUserSelectedColumn(t *testing.T) {
+	data, err := os.ReadFile("000022_reasoning_default_mode.down.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	source := strings.ToUpper(string(data))
+	if !strings.Contains(source, "DROP COLUMN USER_SELECTED") {
+		t.Errorf("down migration missing %q", "DROP COLUMN USER_SELECTED")
+	}
+}

deploy/dobotai-dingtalk/README.md

@@ -1,280 +1,157 @@
-# DobotAI DingTalk 容器部署手册
+# DobotAI Docker部署（阿里云RDS）
 
-> 适用范围：DobotAI 测试环境的容器化运行。容器和 Compose 服务名固定为 `dobotai-dingtalk`。
-> 本文不授权生产部署；生产必须使用已验收的同一镜像、独立备份和独立变更审批。
+## 定位
 
-## 1. 定位
-
-DobotAI 是钉钉渠道的对话编排与交付层，不是知识库或文档解析平台。
-
-它负责：
-
-- 接收钉钉 Stream 消息、富文本和图片；
-- 将请求路由到 WeKnora Agent，并维护渠道会话；
-- 通过钉钉 AI 卡片或 Markdown 流式交付回答；
-- 处理 `/think`、`/setting` 等渠道命令；
-- 保存 Turn、会话映射、覆盖判定、Support Case、反馈和审计数据；
-- 对“真实检索过但没有引用”的回答创建未覆盖提醒；
-- 将 `resource://` 图片按私有 OSS 规则安全外发。
-
-它不负责：
-
-- WeKnora 文档、Chunk、向量、图谱、解析或模型运行；
-- WeKnora Agent 的知识检索策略；
-- 直接暴露 PostgreSQL、WeKnora 或对象存储到公网；
-- 替代钉钉应用、机器人或群权限配置。
-
-## 2. 架构
+DobotAI是钉钉渠道编排与交付服务。Docker只运行应用容器`dobotai-dingtalk`；数据库唯一使用已有的阿里云RDS PostgreSQL。
 
 ```text
-钉钉用户 / 群
-      │  DingTalk Stream
-      ▼
-┌──────────────────────────────────────┐
-│ dobotai-dingtalk 容器                │
-│  - 消息解析、会话编排、卡片流式交付 │
-│  - /think、/setting、首位管理员绑定 │
-│  - 覆盖判定、Support Case、审计      │
-└───────┬──────────────────┬───────────┘
-        │                  │
-        │ HTTP Agent Chat  │ PostgreSQL
-        ▼                  ▼
-   WeKnora 服务        DobotAI 独立数据库
-   - Agent/检索        - Turn / 会话 / 覆盖判定
-   - 文档/Chunk        - Support Case / 反馈 / 设置
-   - 模型与解析
+钉钉 Stream
+   ↓
+dobotai-dingtalk 容器
+   ├─ 阿里云RDS PostgreSQL：Turn、会话、反馈、管理员、覆盖判定
+   └─ 既有WeKnora：Agent、检索、知识、模型
 ```
 
-### 2.1 容器边界
-
-| 资源 | 归属 | 是否由本容器创建/删除 |
-| --- | --- | --- |
-| `dobotai-dingtalk` | DobotAI应用进程 | 是，容器可重建 |
-| DobotAI PostgreSQL | 独立数据服务 | 否，保留现有数据卷 |
-| WeKnora | 独立知识服务 | 否 |
-| `/var/lib/dobotai-test/secrets` | 宿主机密钥目录 | 仅挂载读写，不迁移、不输出 |
-| `/etc/dobotai-test/dobotai.env` | 受保护运行配置 | Docker读取，脚本原子更新 |
-
-测试环境的 PostgreSQL、WeKnora 已通过宿主机回环地址提供服务，因此 Compose 使用 `network_mode: host`。这不是新开公网端口：DobotAI仍按 `DOBOTAI_LISTEN_ADDR` 监听，默认是 `127.0.0.1:8090`。
-
-### 2.2 容器安全属性
-
-Compose 固定启用：
+禁止创建或使用：
 
 ```text
-容器名：dobotai-dingtalk
-网络：host（仅兼容现有测试宿主机回环依赖）
-运行身份：与原 dobotai-test 服务用户相同的 UID:GID
-根文件系统：只读
-临时写入：仅 /tmp tmpfs
-额外权限：no-new-privileges
-重启策略：unless-stopped
+dobotai-postgres 容器
+dobotai-postgres-data 数据卷
+本地PostgreSQL作为DobotAI目标数据库
 ```
 
-对应的关键 Compose 配置如下；不要为避免端口冲突额外添加 `ports:` 映射：
-
-```yaml
-services:
-  dobotai-dingtalk:
-    container_name: dobotai-dingtalk
-    network_mode: host
-    read_only: true
-    restart: unless-stopped
-```
-
-## 3. 安装前检查
-
-安装操作人员需要具备测试服务器的 `sudo` 和 Docker 权限。开始前确认：
+## 架构与目录
 
 ```text
-1. 已构建或导入经审查的 DobotAI 镜像；
-2. 现有 /etc/dobotai-test/dobotai.env 存在且权限为 0600；
-3. 现有密钥目录 /var/lib/dobotai-test/secrets 存在；
-4. DobotAI PostgreSQL 与 WeKnora 已健康；
-5. 已记录当前原生服务二进制SHA和运行状态；
-6. 如本版本包含 SQL 迁移，已先完成逻辑备份与迁移演练。
+宿主机
+├── dobotai-dingtalk                 唯一应用容器，host网络
+├── /opt/dobotai/container/          Compose、RDS检查器、SQL迁移、启动脚本
+├── /opt/dobotai/config/dobotai.env  0600，RDS/WeKnora/钉钉配置
+├── /opt/dobotai/secrets/            0700，DobotAI SecretStore
+└── /opt/dobotai/backups/            发布前RDS备份记录，不保存Docker数据库卷
+
+阿里云RDS
+└── DobotAI专用PostgreSQL数据库
 ```
 
-不要执行：
+应用使用`network_mode: host`，因此通过RDS私网地址访问云数据库、通过`127.0.0.1:8080`访问宿主机现有WeKnora。不会开放新的数据库端口；应用HTTP仍由`DOBOTAI_LISTEN_ADDR=127.0.0.1:8090`约束。
 
-```text
-docker compose down -v
-docker volume rm / prune
-删除 PostgreSQL / WeKnora 数据卷
-将密钥、数据库连接串或 API Key 写入命令行、日志或 Git
-```
+## 安装
 
-## 4. 构建和导入镜像
-
-在已审查且工作树干净的源码目录构建。示例中的值均为占位符：
+克隆完整仓库后，只执行：
 
 ```bash
-docker build \
-  --build-arg VERSION=test-<commit-short> \
-  --build-arg COMMIT_SHA=<完整提交SHA> \
-  --build-arg BUILD_TIME=<UTC时间> \
-  -t dobotai-dingtalk:test-<commit-short> .
+sudo bash ./install-docker.sh
 ```
 
-跨主机传输时先保存镜像归档并记录 SHA-256；测试服务器导入后必须复核归档哈希和镜像标签。生产不得在目标机重新编译，应使用已测试的同一镜像归档或不可变镜像摘要。
-
-## 5. 安装容器资产（不切换服务）
-
-将本目录、候选镜像和已核验的归档放到测试服务器的受控发布目录。确认镜像已经 `docker load` 后执行：
-
-```bash
-sudo DOBOTAI_IMAGE=dobotai-dingtalk:test-<commit-short> \
-  bash ./install-test.sh
-```
-
-该脚本会：
+根脚本自动：
 
 ```text
-1. 检查候选镜像、现有 env 与密钥目录；
-2. 备份原生 DobotAI 二进制和 systemd Unit，并写入 SHA-256；
-3. 安装 Compose、配置器、启动器和绑定脚本；
-4. 生成权限 0600 的 /opt/dobotai-test/container/runtime.env；
-5. 保持原生 dobotai-test.service 继续运行。
+检查或安装Docker Engine和Docker Compose v2（APT系统）
+以当前Git提交构建 dobotai-dingtalk:local-<Git短SHA>
+创建 /opt/dobotai/{container,config,secrets,backups}
+复制应用Compose、RDS检查器和21个SQL迁移
+生成权限0600的应用环境模板
+安装三条短命令
 ```
 
-它不会读取或打印环境变量值、不会修改数据库、不会启动容器。
+它不会连接、创建或修改RDS，也不会启动未配置的钉钉应用。
 
-## 6. 配置并启动
+## 配置、RDS检查与启动
 
-日常只需要执行：
+安装后执行：
 
 ```bash
 sudo dobotai-dingtalk-configure
 ```
 
-该命令交互更新 `/etc/dobotai-test/dobotai.env`。每项都会显示用途和脱敏格式示例；已配置的值永不回显，直接回车表示保留。
+配置器分字段录入阿里云RDS（主机、端口、数据库名、账号、密码），自动组装连接串；WeKnora和钉钉凭证密钥不回显，环境文件原子写入且权限0600。
 
-| 环境变量 | 用途 | 格式示例 |
+`DOBOTAI_TENANT_KEY`不是WeKnora Agent租户键。它是DobotAI内部数据隔离键，首次安装时自动生成并固定保存；配置器不会要求填写或改动它。WeKnora侧只需要填写实际的两个Agent ID。
+
+配置器会要求两个不同的WeKnora Agent ID，并自动生成`DOBOTAI_AGENT_BINDINGS={"dingtalk:*":"快速问答Agent ID"}`。`DOBOTAI_INGRESS_TOKEN`是保护本机`POST /v1/qa`内部接口的Bearer Token，不用于钉钉或WeKnora；同样由安装器自动生成。
+
+| 配置 | 示例 | 作用 |
 | --- | --- | --- |
-| `DATABASE_URL` | DobotAI独立PostgreSQL连接串，不得填写WeKnora数据库 | `postgres://USER:<数据库密码>@127.0.0.1:55432/dobotai_test?sslmode=disable` |
-| `WEKNORA_BASE_URL` | 测试WeKnora地址 | `http://127.0.0.1:8080` |
-| `WEKNORA_API_KEY` | DobotAI使用的WeKnora API密钥 | `<你的WeKnora API Key>` |
-| `DOBOTAI_INGRESS_TOKEN` | `/v1/qa`调用令牌 | `<随机长字符串>` |
-| `DOBOTAI_TENANT_KEY` | 与既有DobotAI数据一致的租户键 | `dobotai-test` |
-| `DOBOTAI_AGENT_BINDINGS` | 钉钉会话到WeKnora Agent的映射 | `{"dingtalk:*":"你的Agent ID"}` |
-| `DINGTALK_CLIENT_ID` | 钉钉应用Client ID/AppKey | `dingxxxxxxxx` |
-| `DINGTALK_CLIENT_SECRET` | 钉钉应用Client Secret/AppSecret | `<你的钉钉 AppSecret>` |
+| `DATABASE_URL` | `postgres://USER:***@rds-endpoint:5432/dobotai?sslmode=require` | DobotAI专用阿里云RDS PostgreSQL |
+| `WEKNORA_BASE_URL` | `http://127.0.0.1:8080` | 宿主机既有WeKnora |
+| `WEKNORA_API_KEY` | `<你的WeKnora API Key>` | DobotAI专用Key |
+| `DOBOTAI_QUICK_AGENT_ID` | `<快速问答Agent ID>` | 默认快速问答实际调用的Agent |
+| `DOBOTAI_REASONING_AGENT_ID` | `<智能推理Agent ID>` | `/think`和持续智能推理实际调用的Agent |
+| `DINGTALK_CLIENT_ID` | `dingxxxxxxxx` | 钉钉AppKey |
+| `DINGTALK_CLIENT_SECRET` | `<你的钉钉 AppSecret>` | 钉钉AppSecret |
 
-保存成功后，配置器自动调用启动器：
+回答图片外发OSS同为分字段录入的可选整组（紧随RDS之后、WeKnora/钉钉凭证之前）：
+
+| 配置 | 示例 | 作用 |
+| --- | --- | --- |
+| `DOBOTAI_OUTBOUND_IMAGE_OSS_ENDPOINT` | `https://oss-cn-shenzhen.aliyuncs.com` | 私有Bucket接入地址 |
+| `DOBOTAI_OUTBOUND_IMAGE_OSS_REGION` | `cn-shenzhen` | Bucket所在地域 |
+| `DOBOTAI_OUTBOUND_IMAGE_OSS_BUCKET` | `dobot-xxx` | 外发图片专用私有Bucket |
+| `DOBOTAI_OUTBOUND_IMAGE_OSS_ACCESS_KEY_ID` | `<AK ID>` | 仅授权该Bucket的AK |
+| `DOBOTAI_OUTBOUND_IMAGE_OSS_ACCESS_KEY_SECRET` | `<AK Secret>` | 仅授权该Bucket的SK（不回显） |
+| `DOBOTAI_OUTBOUND_IMAGE_PUBLIC_BASE_URL` | `https://host/dingtalk/i` | 钉钉可见的稳定HTTPS入口，不含凭据 |
+
+OSS规则：六项全部留空即整组禁用图片外发（答案含`resource://`图片时按无图降级）；填写任一项则六项必填，缺项拒绝保存。运行时仅改写WeKnora `resource://`引用为短签HTTPS，私有Bucket由稳定基础地址代理，`<img>`外链与`data:`剥除。禁止把OSS凭据写入Git或命令行。
+
+保存后脚本自动执行以下RDS门禁：
 
 ```text
-停止原生 dobotai-test.service
-→ 启动 dobotai-dingtalk
-→ 检查 http://127.0.0.1:8090/healthz
-→ 健康成功后禁用原生服务
+1. 使用RDS连接串执行 pg_isready
+2. 检查DobotAI核心表
+3. 数据库没有任何public表：按000001~000021初始化
+4. 所有核心表存在：判定正常，不执行任何DDL
+5. 部分表、缺表或非空异常库：拒绝初始化和启动
+6. RDS通过后才启动 dobotai-dingtalk 并检查 /healthz
 ```
 
-首次容器启动失败会恢复原生服务；容器版本升级失败会恢复上一容器镜像。
+这保证不会把已有RDS表误当成空库重建，也不会把半成品或错误库静默升级。
 
-## 7. 首位管理员绑定
+## 日常命令
 
-仅当该租户不存在有效管理员时执行：
+```bash
+# 重新检查RDS并启动/升级应用
+sudo dobotai-dingtalk-start
+
+# 交互更新RDS、WeKnora、钉钉配置后启动
+sudo dobotai-dingtalk-configure
+
+# 仅首位管理员且无有效管理员时使用
+sudo dobotai-dingtalk-bind-admin
+
+# 健康与版本
+curl --noproxy '*' -fsS http://127.0.0.1:8090/healthz
+curl --noproxy '*' -fsS http://127.0.0.1:8090/version
+```
+
+## 升级与回滚
+
+应用升级仅替换`dobotai-dingtalk`镜像。启动前再次检查RDS；健康失败时恢复上一应用镜像（如存在）。RDS不是容器资产，不能被`docker compose down`、镜像替换或本机卷操作影响。
+
+RDS有实际数据时，数据库备份、SQL变更与恢复应在阿里云RDS发布流程中完成并验证；不要把应用镜像回滚误当成数据库回滚。
+
+## 首位管理员
+
+应用和钉钉Stream运行后：
 
 ```bash
 sudo dobotai-dingtalk-bind-admin
 ```
 
-终端会显示一个10分钟有效的随机六码。候选管理员必须私聊钉钉机器人发送：
+终端会显示10分钟有效的六码；候选管理员私聊机器人：
 
 ```text
 /setting <六码绑定码>
 ```
 
-验证成功后，终端自动写入 `super_admin/active` 并退出。已有有效管理员时命令拒绝执行，防止借由该入口追加管理员或意外提权。
+已有有效管理员时绑定命令会拒绝，避免提权。
 
-## 8. 覆盖判定与未覆盖提醒
-
-覆盖判定基于真实的 `knowledge_searched` 工具事件和结构化引用，不按关键词猜测。
-
-| 场景 | 覆盖结果 | 是否创建 Support Case |
-| --- | --- | --- |
-| 有引用 | `covered_has_references` | 否 |
-| 实际检索过但无引用 | `uncovered_no_references` | 是 |
-| 明确无权威知识/无答案 | `uncovered_explicit_no_answer` | 是 |
-| 图片未检索、纯视觉识别 | `covered_visual_recognition` | 否 |
-| 文本未检索、闲聊或普通非知识响应 | `covered_non_knowledge_response` | 否 |
-
-因此“在吗”“你好”“谢谢”等未触发知识检索的文本不会产生未覆盖提醒；真正检索过但没有权威引用的问题仍会进入人工支持流程。
-
-## 9. 数据库迁移门禁
-
-DobotAI进程只连接数据库，**不会自动发现或执行 SQL 迁移**。包含新迁移的版本必须在容器替换前由发布流程显式完成：
+## 不执行的操作
 
 ```text
-1. 对 DobotAI PostgreSQL 做逻辑备份；
-2. 使用 pg_restore --list 验证备份非空；
-3. 在事务中执行已审查的 .up.sql；
-4. 向 dobotai_schema_migrations 写入对应 version/name/applied_at；
-5. 查询约束、列或索引确认生效；
-6. 再替换容器镜像并进行健康与业务验收。
+不创建本地PostgreSQL容器或数据卷
+不迁移、删除或覆盖现有本地 dobotai-test-postgres
+不创建、删除或重置阿里云RDS数据库
+不把RDS连接串、Token、钉钉凭据写入Git、命令行或日志
+不重建WeKnora、Neo4j、Redis、Elasticsearch
 ```
-
-`000021_coverage_non_knowledge_response_reason` 是一个示例：它只扩展 `coverage_decisions.reason_code` 的 CHECK 约束，不回写历史Turn、覆盖判定或Support Case。
-
-## 10. 日常检查
-
-```bash
-# 健康检查
-curl --noproxy '*' -fsS http://127.0.0.1:8090/healthz
-
-# 运行版本
-curl --noproxy '*' -fsS http://127.0.0.1:8090/version
-
-# 容器状态与重启次数
-sudo docker inspect -f '{{.Config.Image}}|{{.State.Running}}|{{.RestartCount}}' dobotai-dingtalk
-
-# 最近日志（不要复制含敏感内容的原始上下文）
-sudo docker logs --since 10m dobotai-dingtalk
-```
-
-验收至少应同时满足：
-
-```text
-容器 running，重启次数为0；
-/healthz 返回 ok；
-/version 的 commit_sha 与发布记录一致；
-钉钉 Stream 仅启动一个消费者；
-旧 dobotai-test.service 为 inactive + disabled；
-目标业务路径已由真实钉钉消息验证。
-```
-
-## 11. 升级与回滚
-
-### 升级
-
-```text
-构建/导入经审查的新镜像
-→ 备份DobotAI PostgreSQL
-→ 应用并记录必要迁移
-→ 将 runtime.env 中的 DOBOTAI_IMAGE 更新为新标签
-→ 执行 sudo dobotai-dingtalk-start
-→ 健康、版本、日志、钉钉真实消息验收
-```
-
-注意拼写：数据库和应用名称是 `DobotAI`；上述流程中的镜像名为 `dobotai-dingtalk`。
-
-### 自动回滚
-
-启动器会保存替换前的容器镜像：
-
-```text
-首次容器化失败：停止候选容器，恢复原生服务；
-后续容器升级失败：停止候选容器，恢复上一容器镜像。
-```
-
-数据库迁移不能仅靠容器回滚撤销。只有经过审查且已验证的 `.down.sql` 才可用于数据库回滚；任何数据恢复都必须先确认备份可用。
-
-## 12. 明确非目标
-
-```text
-不容器化或重建 WeKnora；
-不容器化或删除 DobotAI PostgreSQL；
-不重新启用已删除的网页管理面；
-不在生产环境复用测试凭据、测试镜像或未验收的迁移；
-不把密钥、Token、连接串、钉钉凭据写入 Git、命令行或日志。
-```

deploy/dobotai-dingtalk/configure_env.py

@@ -1,83 +1,121 @@
 #!/usr/bin/env python3
 import argparse
 import getpass
+import json
 import os
 from pathlib import Path
+from urllib.parse import quote, unquote, urlsplit
+import subprocess
 import sys
 
 FIELDS = (
-    ("DATABASE_URL", "DobotAI PostgreSQL 连接串", "DobotAI独立数据库，不得填写WeKnora数据库。", "postgres://USER:<数据库密码>@127.0.0.1:55432/dobotai_test?sslmode=disable", True),
-    ("WEKNORA_BASE_URL", "WeKnora 地址", "容器通过宿主网络访问测试WeKnora。", "http://127.0.0.1:8080", False),
-    ("WEKNORA_API_KEY", "WeKnora API Key", "在WeKnora中为DobotAI创建的API密钥。", "<你的WeKnora API Key>", True),
-    ("DOBOTAI_INGRESS_TOKEN", "DobotAI Ingress Token", "调用 /v1/qa 时使用的独立长随机令牌。", "<随机长字符串>", True),
-    ("DOBOTAI_TENANT_KEY", "DobotAI 租户键", "必须与现有DobotAI数据和Agent绑定使用同一个租户键。", "dobotai-test", False),
-    ("DOBOTAI_AGENT_BINDINGS", "DobotAI Agent Bindings JSON", "钉钉会话匹配到WeKnora Agent的映射。", '{"dingtalk:*":"你的Agent ID"}', False),
-    ("DINGTALK_CLIENT_ID", "钉钉 Client ID", "钉钉应用的Client ID/AppKey。", "dingxxxxxxxx", False),
-    ("DINGTALK_CLIENT_SECRET", "钉钉 Client Secret", "钉钉应用的Client Secret/AppSecret。", "<你的钉钉 AppSecret>", True),
+    ("WEKNORA_BASE_URL", "WeKnora 地址", "应用容器通过宿主机网络访问既有WeKnora。", "http://127.0.0.1:8080", False),
+    ("WEKNORA_API_KEY", "WeKnora API Key", "DobotAI专用WeKnora API Key。", "<你的WeKnora API Key>", True),
+    ("DOBOTAI_QUICK_AGENT_ID", "快速问答Agent ID", "默认问答实际调用的WeKnora Agent。", "<快速问答Agent ID>", False),
+    ("DOBOTAI_REASONING_AGENT_ID", "智能推理Agent ID", "/think和持续智能推理实际调用的WeKnora Agent。", "<智能推理Agent ID>", False),
+    ("DINGTALK_CLIENT_ID", "钉钉 Client ID", "钉钉应用Client ID/AppKey。", "dingxxxxxxxx", False),
+    ("DINGTALK_CLIENT_SECRET", "钉钉 Client Secret", "钉钉应用Client Secret/AppSecret。", "<你的钉钉 AppSecret>", True),
 )
 
+def prompt_rds(values):
+    """分字段录入阿里云RDS并组装DATABASE_URL；已有值作为默认。"""
+    existing = values.get("DATABASE_URL", "").strip()
+    host = port = database = user = password = ""
+    if existing:
+        u = urlsplit(existing)
+        host = u.hostname or ""
+        port = str(u.port or "") if u.port else ""
+        database = u.path.lstrip("/")
+        user = unquote(u.username or "")
+        password = unquote(u.password or "")
 
-def parse_env(path: Path):
-    lines = path.read_text(encoding="utf-8").splitlines()
-    values = {}
+    def ask(key, label, default, secret=False):
+        suffix = "（已配置，直接回车保留）" if default else "（必填）"
+        reader = getpass.getpass if secret else input
+        entered = reader(f"{label}{suffix}: ").strip()
+        return entered or default
+
+    print("\n阿里云RDS PostgreSQL（分字段填写）\n用途：DobotAI专用数据库；空库自动初始化，已有表只校验不改结构。")
+    host = ask("host", "RDS主机地址", host)
+    port = ask("port", "RDS端口", port or "5432")
+    database = ask("database", "数据库名", database)
+    user = ask("user", "数据库账号", user)
+    password = ask("password", "数据库密码", password, secret=True)
+    if not all((host, port, database, user, password)):
+        raise SystemExit("RDS字段不完整，未保存。")
+    if not database.startswith(("dobotai", "dobotai_")):
+        print("警告：数据库名不是DobotAI专用库，继续前请确认。")
+    values["DATABASE_URL"] = f"postgres://{quote(user, safe='')}:{quote(password, safe='')}@{host}:{port}/{database}"
+
+OSS_FIELDS = (
+    ("DOBOTAI_OUTBOUND_IMAGE_OSS_ENDPOINT", "OSS Endpoint", "私有Bucket的接入地址。", "https://oss-cn-shenzhen.aliyuncs.com", False),
+    ("DOBOTAI_OUTBOUND_IMAGE_OSS_REGION", "OSS Region", "Bucket所在地域。", "cn-shenzhen", False),
+    ("DOBOTAI_OUTBOUND_IMAGE_OSS_BUCKET", "OSS Bucket", "外发图片专用私有Bucket。", "dobot-xxx", False),
+    ("DOBOTAI_OUTBOUND_IMAGE_OSS_ACCESS_KEY_ID", "OSS AccessKey ID", "仅授权该Bucket的AK。", "<AK ID>", False),
+    ("DOBOTAI_OUTBOUND_IMAGE_OSS_ACCESS_KEY_SECRET", "OSS AccessKey Secret", "仅授权该Bucket的SK。", "<AK Secret>", True),
+    ("DOBOTAI_OUTBOUND_IMAGE_PUBLIC_BASE_URL", "图片稳定外发基础地址", "钉钉可见的稳定HTTPS入口，不含凭据。", "https://host/dingtalk/i", False),
+)
+
+def prompt_oss(values):
+    """OSS整组录入：全部留空即禁用；任一项填写则六项必填。"""
+    print("\n回答图片外发OSS（可选，OSS整组录入；直接回车表示整组禁用）")
+    entered = {}
+    for key, label, description, example, secret in OSS_FIELDS:
+        default = values.get(key, "").strip()
+        suffix = "（已配置，直接回车保留）" if default else ""
+        print(f"用途：{description} 格式示例：{example}")
+        reader = getpass.getpass if secret else input
+        value = reader(f"{label}{suffix}: ").strip()
+        entered[key] = value or default
+    if not any(entered.values()):
+        for key, *_ in OSS_FIELDS:
+            values.pop(key, None)
+        return
+    missing = [label for key, label, *_ in OSS_FIELDS if not entered[key]]
+    if missing:
+        raise SystemExit("OSS为整组可选能力，以下项未填写：" + "、".join(missing))
+    values.update(entered)
+
+
+
+def parse_env(path):
+    lines = path.read_text(encoding="utf-8").splitlines(); values = {}
     for line in lines:
         if line and not line.lstrip().startswith("#") and "=" in line:
-            key, value = line.split("=", 1)
-            values[key.strip()] = value
+            key, value = line.split("=", 1); values[key.strip()] = value
     return lines, values
 
-
-def prompt(label: str, description: str, example: str, secret: bool, configured: bool) -> str:
-    suffix = "（已配置，直接回车保留）" if configured else "（必填）"
-    print(f"\n{label}\n用途：{description}\n格式示例：{example}")
-    if secret:
-        return getpass.getpass(f"{label}{suffix}: ").strip()
-    return input(f"{label}{suffix}: ").strip()
-
-
-def write_env(path: Path, lines, values):
-    rendered = []
-    written = set()
+def write_env(path, lines, values):
+    rendered=[]; written=set()
     for line in lines:
         if line and not line.lstrip().startswith("#") and "=" in line:
-            key = line.split("=", 1)[0].strip()
-            if key in values:
-                rendered.append(f"{key}={values[key]}")
-                written.add(key)
-                continue
+            key=line.split("=",1)[0].strip()
+            if key in values: rendered.append(f"{key}={values[key]}"); written.add(key); continue
         rendered.append(line)
-    for key, value in values.items():
-        if key not in written:
-            rendered.append(f"{key}={value}")
-    temporary = path.with_name(path.name + ".new")
-    temporary.write_text("\n".join(rendered) + "\n", encoding="utf-8")
-    os.chmod(temporary,0o600)
-    os.replace(temporary, path)
-
+    rendered.extend(f"{key}={value}" for key,value in values.items() if key not in written)
+    temp=path.with_name(path.name+".new"); temp.write_text("\n".join(rendered)+"\n",encoding="utf-8"); os.chmod(temp,0o600); os.replace(temp,path)
 
 def main():
-    parser = argparse.ArgumentParser(description="配置 DobotAI 容器运行环境")
-    parser.add_argument("--env-file", required=True)
-    parser.add_argument("--start-script", required=True)
-    args = parser.parse_args()
-
-    env_file = Path(args.env_file)
-    if not env_file.is_file():
-        raise SystemExit("DobotAI 环境文件不存在，请先完成部署。")
-    lines, values = parse_env(env_file)
-    for key, label, description, example, secret in FIELDS:
-        entered = prompt(label, description, example, secret, bool(values.get(key, "").strip()))
-        if entered:
-            values[key] = entered
-    missing = [label for key, label, _, _, _ in FIELDS if not values.get(key, "").strip()]
-    if missing:
-        raise SystemExit("以下必填项未配置：" + "、".join(missing))
-    write_env(env_file, lines, values)
-    os.execv(args.start_script, [args.start_script])
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except KeyboardInterrupt:
-        sys.exit(130)
+    parser=argparse.ArgumentParser(description="配置DobotAI阿里云RDS和渠道凭证")
+    parser.add_argument("--env-file",required=True); parser.add_argument("--schema-script",required=True); parser.add_argument("--start-script",required=True)
+    args=parser.parse_args(); path=Path(args.env_file)
+    if not path.is_file(): raise SystemExit("DobotAI环境文件不存在，请先执行根目录install-docker.sh。")
+    lines,values=parse_env(path)
+    prompt_rds(values)
+    prompt_oss(values)
+    for key,label,description,example,secret in FIELDS:
+        suffix="（已配置，直接回车保留）" if values.get(key,"").strip() else "（必填）"
+        print(f"\n{label}\n用途：{description}\n格式示例：{example}")
+        entered=(getpass.getpass if secret else input)(f"{label}{suffix}: ").strip()
+        if entered: values[key]=entered
+    missing=[label for key,label,*_ in FIELDS if not values.get(key,"").strip()]
+    if missing: raise SystemExit("以下必填项未配置："+"、".join(missing))
+    if values["DOBOTAI_QUICK_AGENT_ID"] == values["DOBOTAI_REASONING_AGENT_ID"]:
+        raise SystemExit("快速问答Agent ID与智能推理Agent ID必须不同。")
+    values["DOBOTAI_AGENT_BINDINGS"] = json.dumps({"dingtalk:*": values["DOBOTAI_QUICK_AGENT_ID"]}, separators=(",", ":"))
+    write_env(path,lines,values)
+    subprocess.run([args.schema_script], check=True)
+    os.execv(args.start_script,[args.start_script])
+if __name__=="__main__":
+    try: main()
+    except KeyboardInterrupt: sys.exit(130)

deploy/dobotai-dingtalk/dobotai-dingtalk-bind-admin

@@ -1,10 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
-
-container="dobotai-dingtalk"
-if [[ "$(docker inspect --format '{{.State.Running}}' "$container" 2>/dev/null || true)" != "true" ]]; then
-  echo "DobotAI 容器未运行。请先执行：sudo dobotai-dingtalk-configure" >&2
-  exit 1
-fi
-
+home="${DOBOTAI_HOME:-/opt/dobotai}"
+container_dir="$home/container"
+if [[ "$(docker inspect --format '{{.State.Running}}' dobotai-dingtalk 2>/dev/null || true)" != "true" ]]; then echo "DobotAI容器未运行。请先执行：sudo dobotai-dingtalk-configure" >&2; exit 1; fi
 exec docker exec -it dobotai-dingtalk /usr/local/bin/dobotai bootstrap-admin

deploy/dobotai-dingtalk/dobotai-dingtalk-start

@@ -1,77 +1,23 @@
 #!/usr/bin/env bash
 set -euo pipefail
-
-container_dir="/opt/dobotai-test/container"
+home="${DOBOTAI_HOME:-/opt/dobotai}"
+container_dir="$home/container"
 compose_file="$container_dir/compose.yaml"
 runtime_env="$container_dir/runtime.env"
-legacy_service="dobotai-test.service"
 health_url="http://127.0.0.1:8090/healthz"
-
-if [[ ! -r "$compose_file" || ! -r "$runtime_env" ]]; then
-  echo "容器运行文件未安装。请先部署 dobotai-dingtalk。" >&2
-  exit 1
-fi
-
-legacy_was_active=false
-if systemctl is-active --quiet "$legacy_service"; then
-  legacy_was_active=true
-  systemctl stop "$legacy_service"
-fi
-
-previous_image="$(docker inspect --format '{{.Config.Image}}' dobotai-dingtalk 2>/dev/null || true)"
-
-set_runtime_image() {
-  local image="$1"
-  python3 - "$runtime_env" "$image" <<'PY'
-from pathlib import Path
-import os
-import sys
-
-path = Path(sys.argv[1])
-image = sys.argv[2]
-lines = path.read_text(encoding="utf-8").splitlines()
-updated = False
-rendered = []
-for line in lines:
-    if line.startswith("DOBOTAI_IMAGE="):
-        rendered.append("DOBOTAI_IMAGE=" + image)
-        updated = True
-    else:
-        rendered.append(line)
-if not updated:
-    rendered.append("DOBOTAI_IMAGE=" + image)
-temporary = path.with_name(path.name + ".new")
-temporary.write_text("\n".join(rendered) + "\n", encoding="utf-8")
-os.chmod(temporary, 0o600)
-os.replace(temporary, path)
-PY
-}
-
+[[ -r "$compose_file" && -r "$runtime_env" ]] || { echo "容器资产未安装。" >&2; exit 1; }
+"$container_dir/rds-schema-init.sh"
+compose=(docker compose --env-file "$runtime_env" -f "$compose_file")
+previous_image="$(docker inspect -f '{{.Config.Image}}' dobotai-dingtalk 2>/dev/null || true)"
 rollback() {
-  docker compose --env-file "$runtime_env" -f "$compose_file" down --remove-orphans >/dev/null 2>&1 || true
-  if [[ -n "$previous_image" ]]; then
-    set_runtime_image "$previous_image"
-    docker compose --env-file "$runtime_env" -f "$compose_file" up -d --no-build --force-recreate >/dev/null 2>&1 || true
-  elif [[ "$legacy_was_active" == "true" ]]; then
-    systemctl start "$legacy_service" || true
-  fi
+  "${compose[@]}" rm -sf dobotai-dingtalk >/dev/null 2>&1 || true
+  if [[ -n "$previous_image" ]]; then "${compose[@]}" up -d --no-build --force-recreate dobotai-dingtalk >/dev/null 2>&1 || true; fi
 }
 trap rollback ERR
-
-docker compose --env-file "$runtime_env" -f "$compose_file" up -d --no-build --force-recreate
+"${compose[@]}" up -d --no-build --force-recreate dobotai-dingtalk
 for _ in $(seq 1 30); do
-  if curl --noproxy '*' --fail --silent --max-time 2 "$health_url" >/dev/null; then
-    systemctl disable "$legacy_service" >/dev/null
-    trap - ERR
-    echo "DobotAI 容器已启动：dobotai-dingtalk"
-    exit 0
-  fi
+  if curl --noproxy '*' --fail --silent --max-time 2 "$health_url" >/dev/null; then trap - ERR; echo "DobotAI容器已启动：dobotai-dingtalk"; exit 0; fi
   sleep 1
 done
-
-if [[ -n "$previous_image" ]]; then
-  echo "DobotAI 容器健康检查失败，已回滚到上一容器镜像。" >&2
-else
-  echo "DobotAI 容器健康检查失败，已回滚到原生服务。" >&2
-fi
+echo "DobotAI健康检查失败，已恢复上一应用容器（如存在）。" >&2
 exit 1

deploy/dobotai-dingtalk/install-docker.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source_root="${DOBOTAI_SOURCE_ROOT:-$(cd "$script_dir/../.." && pwd)}"
+home="${DOBOTAI_HOME:-/opt/dobotai}"
+container_dir="$home/container"
+config_dir="$home/config"
+secret_dir="$home/secrets"
+backup_dir="$home/backups"
+app_env="$config_dir/dobotai.env"
+runtime_env="$container_dir/runtime.env"
+image="${DOBOTAI_IMAGE:?root install-docker.sh must provide the local image}"
+bin_dir="${DOBOTAI_BIN_DIR:-/usr/local/sbin}"
+
+[[ ${EUID} -eq 0 ]] || { echo "请使用sudo执行安装脚本。" >&2; exit 1; }
+docker image inspect "$image" >/dev/null 2>&1 || { echo "应用镜像不存在。" >&2; exit 1; }
+install -d -m 0750 "$home" "$container_dir" "$config_dir" "$backup_dir" "$container_dir/migrations"
+install -d -m 0700 -o 10001 -g 10001 "$secret_dir"
+install -m 0644 "$script_dir/compose.yaml" "$container_dir/compose.yaml"
+install -m 0700 "$script_dir/configure_env.py" "$container_dir/configure_env.py"
+install -m 0750 "$script_dir/rds-schema-init.sh" "$container_dir/rds-schema-init.sh"
+install -m 0750 "$script_dir/dobotai-dingtalk-start" "$container_dir/dobotai-dingtalk-start"
+install -m 0750 "$script_dir/dobotai-dingtalk-bind-admin" "$container_dir/dobotai-dingtalk-bind-admin"
+install -m 0644 "$source_root"/db/migrations/*.up.sql "$container_dir/migrations/"
+
+if [[ ! -f "$app_env" ]]; then
+  umask 077
+  read -r tenant_suffix ingress_token < <(python3 -c 'import secrets; print(secrets.token_hex(12), secrets.token_urlsafe(32))')
+  cat > "$app_env" <<'EOF'
+DOBOTAI_LISTEN_ADDR=127.0.0.1:8090
+DATABASE_URL=
+WEKNORA_BASE_URL=http://127.0.0.1:8080
+WEKNORA_API_KEY=
+DOBOTAI_ADMIN_TOKEN=
+DOBOTAI_AGENT_BINDINGS=
+DOBOTAI_QUICK_AGENT_ID=
+DOBOTAI_REASONING_AGENT_ID=
+DINGTALK_CLIENT_ID=
+DINGTALK_CLIENT_SECRET=
+EOF
+  printf 'DOBOTAI_TENANT_KEY=dobotai-%s\n' "$tenant_suffix" >> "$app_env"
+  printf 'DOBOTAI_INGRESS_TOKEN=%s\n' "$ingress_token" >> "$app_env"
+  chmod 0600 "$app_env"
+fi
+umask 077
+cat > "$runtime_env" <<EOF
+DOBOTAI_IMAGE=$image
+DOBOTAI_RUNTIME_UID=10001
+DOBOTAI_RUNTIME_GID=10001
+DOBOTAI_ENV_FILE=$app_env
+DOBOTAI_SECRET_DIR_HOST=$secret_dir
+EOF
+chmod 0600 "$runtime_env"
+install -d -m 0755 "$bin_dir"
+for command in configure start bind-admin; do
+  target="$bin_dir/dobotai-dingtalk-$command"
+  cat > "$target" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+export DOBOTAI_HOME='$home'
+exec '$container_dir/dobotai-dingtalk-$command'
+EOF
+  chmod 0750 "$target"
+done
+# configure is a Python entrypoint rather than a shell asset.
+cat > "$bin_dir/dobotai-dingtalk-configure" <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+export DOBOTAI_HOME='$home'
+exec python3 '$container_dir/configure_env.py' --env-file '$app_env' --schema-script '$container_dir/rds-schema-init.sh' --start-script '$bin_dir/dobotai-dingtalk-start'
+EOF
+chmod 0750 "$bin_dir/dobotai-dingtalk-configure"
+
+echo "应用容器资产已安装；尚未连接或修改阿里云RDS。"
+echo "下一步执行：sudo dobotai-dingtalk-configure"

deploy/dobotai-dingtalk/rds-schema-init.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+home="${DOBOTAI_HOME:-/opt/dobotai}"
+app_env="$home/config/dobotai.env"
+migrations_dir="$home/container/migrations"
+[[ -r "$app_env" && -d "$migrations_dir" ]] || { echo "RDS检查资产未安装。" >&2; exit 1; }
+temp_env="$(mktemp)"; trap 'rm -f "$temp_env"' EXIT
+python3 - "$app_env" "$temp_env" <<'PY'
+from pathlib import Path
+import os,sys
+values={}
+for line in Path(sys.argv[1]).read_text(encoding='utf-8').splitlines():
+ if line and not line.startswith('#') and '=' in line:
+  key,value=line.split('=',1); values[key]=value
+url=values.get('DATABASE_URL','').strip()
+if not (url.startswith('postgres://') or url.startswith('postgresql://')): raise SystemExit('DATABASE_URL必须是阿里云RDS PostgreSQL连接串。')
+Path(sys.argv[2]).write_text('DATABASE_URL='+url+'\n',encoding='utf-8'); os.chmod(sys.argv[2],0o600)
+PY
+rds_shell() { docker run --rm -i --network host --env-file "$temp_env" postgres:16-alpine sh -ec "$1"; }
+rds_shell 'pg_isready -d "$DATABASE_URL" >/dev/null' || true
+if ! probe_error="$(rds_shell 'exec psql -At -v ON_ERROR_STOP=1 "$DATABASE_URL" -c "SELECT 1"' 2>&1)"; then
+  case "$probe_error" in
+    *"does not exist"*|*"不存在"*)
+      echo "阿里云RDS目标数据库不存在；请RDS管理员创建DobotAI专用数据库并授予应用账号连接和建表权限。" >&2
+      ;;
+    *)
+      echo "无法连接阿里云RDS目标数据库；请管理员检查网络、白名单、TLS、账号权限和连接串。" >&2
+      ;;
+  esac
+  exit 1
+fi
+sql() { rds_shell 'exec psql -v ON_ERROR_STOP=1 "$DATABASE_URL"'; }
+sql_at() { rds_shell 'exec psql -At -v ON_ERROR_STOP=1 "$DATABASE_URL"'; }
+state=$(printf "%s\n" "WITH expected(name) AS (VALUES ('turns'),('session_mappings'),('messages'),('coverage_decisions'),('support_cases'),('system_config_revisions'),('administrators'),('setting_sessions'),('user_preferences'),('reasoning_mode_states'),('reasoning_mode_turns')) SELECT CASE WHEN to_regclass('public.turns') IS NULL AND (SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='public')=0 THEN 'empty' WHEN (SELECT COUNT(*) FROM expected e JOIN information_schema.tables t ON t.table_schema='public' AND t.table_name=e.name)=11 THEN 'normal' ELSE 'inconsistent' END;" | sql_at)
+case "$state" in
+ normal) echo "阿里云RDS表结构检查通过；不执行初始化。"; exit 0;;
+ inconsistent) echo "阿里云RDS表结构不完整或不是空库，拒绝初始化和启动。" >&2; exit 1;;
+ empty) echo "阿里云RDS为空，开始初始化DobotAI表。";;
+ *) echo "无法判定阿里云RDS表状态。" >&2; exit 1;;
+esac
+for migration in "$migrations_dir"/*.up.sql; do printf 'BEGIN;\n'; cat "$migration"; printf '\nCOMMIT;\n'; done | sql
+echo "阿里云RDS初始化完成。"

install-docker.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ ${EUID} -ne 0 ]]; then
+  echo "请在仓库根目录执行：sudo bash ./install-docker.sh" >&2
+  exit 1
+fi
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$repo_root"
+[[ -f Dockerfile && -f deploy/dobotai-dingtalk/install-docker.sh ]] || { echo "必须从完整DobotAI源码仓库根目录运行。" >&2; exit 1; }
+command -v git >/dev/null || { echo "未找到git。" >&2; exit 1; }
+git rev-parse --is-inside-work-tree >/dev/null || { echo "请从git clone得到的仓库中执行。" >&2; exit 1; }
+
+install_docker_if_missing() {
+  if command -v docker >/dev/null && docker compose version >/dev/null 2>&1; then return; fi
+  command -v apt-get >/dev/null || { echo "请先安装Docker Engine和Docker Compose v2。" >&2; exit 1; }
+  export DEBIAN_FRONTEND=noninteractive
+  apt-get update
+  if apt-cache show docker-compose-v2 >/dev/null 2>&1; then
+    apt-get install -y docker.io docker-compose-v2
+  elif apt-cache show docker-compose-plugin >/dev/null 2>&1; then
+    apt-get install -y docker.io docker-compose-plugin
+  else
+    echo "APT源缺少Docker Compose v2插件。" >&2; exit 1
+  fi
+  systemctl enable --now docker
+}
+install_docker_if_missing
+docker compose version >/dev/null
+
+commit_sha="$(git rev-parse HEAD)"
+commit_short="$(git rev-parse --short=12 HEAD)"
+image="dobotai-dingtalk:local-${commit_short}"
+echo "[1/2] 构建DobotAI应用镜像：$image"
+docker build --build-arg "GOPROXY=https://goproxy.cn,direct" --build-arg "VERSION=local-${commit_short}" --build-arg "COMMIT_SHA=${commit_sha}" --build-arg "BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)" --label "org.opencontainers.image.revision=${commit_sha}" --tag "$image" "$repo_root"
+
+echo "[2/2] 安装应用容器资产；阿里云RDS将在配置后检查或初始化"
+export DOBOTAI_IMAGE="$image"
+export DOBOTAI_SOURCE_ROOT="$repo_root"
+exec bash "$repo_root/deploy/dobotai-dingtalk/install-docker.sh"

internal/channels/dingtalk/display_sanitizer.go

@@ -8,7 +8,11 @@ import (
 const displayReferenceMarkerPattern = `\[\[ref[\t ]+id[\t ]*=[\t ]*["']c[0-9]+["'][\t ]*\]\]`
 
 var (
-	displayReferenceMarkerRE      = regexp.MustCompile(displayReferenceMarkerPattern)
+	displayReferenceMarkerRE = regexp.MustCompile(displayReferenceMarkerPattern)
+	// bareInternalSourceHandleRE matches WeKnora request-local source aliases
+	// leaked by a model (for example [d21], [c12], or [w3]). It intentionally
+	// does not match ordinary Markdown links or arbitrary bracketed content.
+	bareInternalSourceHandleRE    = regexp.MustCompile(`(?i)\[(?:[dcw][0-9]+)(?:[	 ]*[,，][	 ]*(?:[dcw][0-9]+))*\]`)
 	leadingReferenceGroupColonRE  = regexp.MustCompile(`(?m)^[	 ]*(?:` + displayReferenceMarkerPattern + `[	 ]*)+[：:][	 ]*`)
 	spacedReferenceGroupRE        = regexp.MustCompile(`[	 ]+(?:` + displayReferenceMarkerPattern + `[	 ]*)+`)
 	spaceBeforeDisplayPunctuation = regexp.MustCompile(`[	 ]+([，。；：！？、,.;:!?])`)
@@ -19,12 +23,13 @@ func sanitizeDisplayAnswer(content string) string {
 	if index := strings.LastIndex(content, "[[ref"); index >= 0 && !strings.Contains(content[index:], "]]") {
 		content = content[:index]
 	}
-	if !displayReferenceMarkerRE.MatchString(content) {
+	if !displayReferenceMarkerRE.MatchString(content) && !bareInternalSourceHandleRE.MatchString(content) {
 		return content
 	}
 	content = leadingReferenceGroupColonRE.ReplaceAllString(content, "")
 	content = spacedReferenceGroupRE.ReplaceAllString(content, " ")
 	content = displayReferenceMarkerRE.ReplaceAllString(content, "")
+	content = bareInternalSourceHandleRE.ReplaceAllString(content, "")
 	content = spaceBeforeDisplayPunctuation.ReplaceAllString(content, "$1")
 	content = spaceAfterDisplayColon.ReplaceAllString(content, "$1")
 	return content

internal/channels/dingtalk/display_sanitizer_test.go

@@ -34,10 +34,20 @@ func TestSanitizeDisplayAnswerRemovesInternalReferenceMarkers(t *testing.T) {
 			want:  "Feature A remains supported.",
 		},
 		{
-			name:  "unrelated double bracket syntax is preserved",
+			name:  "unrelated double bracket syntax and ordinary link are preserved",
 			input: "请保留 [[wiki|页面名称]] 和 [普通链接](https://example.com)。",
 			want:  "请保留 [[wiki|页面名称]] 和 [普通链接](https://example.com)。",
 		},
+		{
+			name:  "bare internal source handles",
+			input: "Nova支持虚拟控制器离线仿真[d21]，并可搭配VX500[w3]。",
+			want:  "Nova支持虚拟控制器离线仿真，并可搭配VX500。",
+		},
+		{
+			name:  "grouped bare internal source handles",
+			input: "该结论由多个资料支持 [d21, c12，w3]。",
+			want:  "该结论由多个资料支持。",
+		},
 		{
 			name:  "content without references remains byte for byte unchanged",
 			input: "Protocol: value ; keep  spacing\n  indented",

internal/channels/dingtalk/handler.go

@@ -629,7 +629,7 @@ func (h *Handler) finalizeCardOrMarkdown(ctx context.Context, webhookURL string,
 
 func (h *Handler) rewriteOutboundContent(ctx context.Context, content string) string {
 	if h.outboundRewriter == nil {
-		return sanitizeDisplayAnswer(content)
+		return normalizeWideMarkdownTables(sanitizeDisplayAnswer(content))
 	}
 	timeout := h.finalDeliveryTimeout
 	if timeout <= 0 {
@@ -637,7 +637,7 @@ func (h *Handler) rewriteOutboundContent(ctx context.Context, content string) st
 	}
 	rewriteCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), timeout)
 	defer cancel()
-	return sanitizeDisplayAnswer(h.outboundRewriter.Rewrite(rewriteCtx, content))
+	return normalizeWideMarkdownTables(sanitizeDisplayAnswer(h.outboundRewriter.Rewrite(rewriteCtx, content)))
 }
 
 func (h *Handler) sanitizeOutboundPartial(content string) string {

internal/channels/dingtalk/table_normalize.go

@@ -0,0 +1,218 @@
+package dingtalk
+
+import (
+	"strings"
+	"unicode"
+)
+
+// maxTableCellVisualWidth is the DingTalk-safe cell budget. CJK counts as 2
+// display columns; a cell wider than this tends to collapse the column layout
+// (one character per line) in the streaming card renderer.
+const maxTableCellVisualWidth = 32
+
+// normalizeWideMarkdownTables makes final answers render reliably on DingTalk
+// cards without changing the knowledge itself. It (1) replaces <br> inside
+// table cells with a full-width separator, and (2) rewrites any table that
+// still contains an over-wide cell into a grouped list — a bold row heading
+// followed by one "- header：value" line per column. Compact tables pass
+// through unchanged. Tables inside code fences are never touched.
+func normalizeWideMarkdownTables(content string) string {
+	if !strings.Contains(content, "|") {
+		return content
+	}
+	lines := splitMarkdownStreamLines(content)
+	out := make([]string, 0, len(lines))
+	for i := 0; i < len(lines); {
+		line := lines[i]
+		if line.inFence {
+			out = append(out, line.text)
+			i++
+			continue
+		}
+		if isTableHeaderCandidate(line.text) && i+1 < len(lines) &&
+			isCompleteTableDelimiter(lines[i+1].text) {
+			end := i + 1
+			for end+1 < len(lines) && !lines[end+1].inFence &&
+				strings.HasPrefix(strings.TrimSpace(lines[end+1].text), "|") {
+				end++
+			}
+			out = append(out, normalizeTableBlock(lines[i:end+1])...)
+			i = end + 1
+			continue
+		}
+		out = append(out, line.text)
+		i++
+	}
+	return strings.Join(out, "\n")
+}
+
+func normalizeTableBlock(rows []markdownStreamLine) []string {
+	cells := make([][]string, 0, len(rows))
+	for idx, row := range rows {
+		if idx == 1 { // delimiter row
+			continue
+		}
+		cells = append(cells, splitTableRow(row.text))
+	}
+	maxWidth := 0
+	for _, row := range cells {
+		for _, cell := range row {
+			if w := visualWidth(cell); w > maxWidth {
+				maxWidth = w
+			}
+		}
+	}
+	header := cells[0]
+	if maxWidth <= maxTableCellVisualWidth {
+		// Compact tables keep their exact original bytes unless a cell carries
+		// <br>, which the card renderer mishandles inside cells.
+		if !blockHasBreak(rows) {
+			rebuilt := make([]string, len(rows))
+			for i, row := range rows {
+				rebuilt[i] = row.text
+			}
+			return rebuilt
+		}
+		var rebuilt []string
+		for idx, row := range cells {
+			joined := "| " + strings.Join(row, " | ") + " |"
+			if idx == 0 {
+				rebuilt = append(rebuilt, joined)
+				delims := make([]string, len(row))
+				for c := range row {
+					delims[c] = "---"
+				}
+				rebuilt = append(rebuilt, "| "+strings.Join(delims, " | ")+" |")
+			} else {
+				rebuilt = append(rebuilt, joined)
+			}
+		}
+		return rebuilt
+	}
+
+	var out []string
+	for gi, row := range cells[1:] {
+		if gi > 0 {
+			out = append(out, "")
+		}
+		var title string
+		var rest []string
+		for c, cell := range row {
+			if c == 0 {
+				title = cell
+				continue
+			}
+			label := strings.TrimSpace(header[min(c, len(header)-1)])
+			if label == "" {
+				label = "第" + itoa(c+1) + "项"
+			}
+			if cell == "" {
+				continue
+			}
+			rest = append(rest, "- "+label+"："+cell)
+		}
+		if title == "" {
+			title = label2(row[0])
+		}
+		out = append(out, "**"+strings.Trim(title, "* ")+"**")
+		out = append(out, rest...)
+	}
+	return out
+}
+
+func blockHasBreak(rows []markdownStreamLine) bool {
+	for _, row := range rows {
+		lower := strings.ToLower(row.text)
+		if strings.Contains(lower, "<br") {
+			return true
+		}
+	}
+	return false
+}
+
+func splitTableRow(line string) []string {
+	trimmed := strings.TrimSpace(line)
+	trimmed = strings.TrimPrefix(trimmed, "|")
+	trimmed = strings.TrimSuffix(trimmed, "|")
+	parts := splitEscaped(trimmed)
+	for i := range parts {
+		cell := strings.TrimSpace(parts[i])
+		cell = strings.ReplaceAll(cell, "<br>", "；")
+		cell = strings.ReplaceAll(cell, "<br/>", "；")
+		cell = strings.ReplaceAll(cell, "<br />", "；")
+		cell = strings.ReplaceAll(cell, "\\|", "|")
+		parts[i] = strings.TrimSpace(cell)
+	}
+	return parts
+}
+
+// splitEscaped splits on unescaped pipe separators.
+func splitEscaped(s string) []string {
+	var parts []string
+	var b strings.Builder
+	for i := 0; i < len(s); i++ {
+		switch s[i] {
+		case '\\':
+			if i+1 < len(s) && s[i+1] == '|' {
+				b.WriteString("\\|")
+				i++
+				continue
+			}
+			b.WriteByte(s[i])
+		case '|':
+			parts = append(parts, b.String())
+			b.Reset()
+		default:
+			b.WriteByte(s[i])
+		}
+	}
+	parts = append(parts, b.String())
+	return parts
+}
+
+func label2(cell string) string { return strings.Trim(cell, "* ") }
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
+
+func itoa(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	var d []byte
+	for n > 0 {
+		d = append([]byte{byte('0' + n%10)}, d...)
+		n /= 10
+	}
+	return string(d)
+}
+
+func visualWidth(s string) int {
+	w := 0
+	for _, r := range s {
+		if r == '\n' {
+			if w > 0 {
+				w++ // separator counted conservatively
+			}
+			continue
+		}
+		if unicode.Is(unicode.Han, r) || unicode.Is(unicode.Katakana, r) ||
+			unicode.Is(unicode.Hiragana, r) || fullwidthPunct(r) {
+			w += 2
+			continue
+		}
+		w++
+	}
+	return w
+}
+
+func fullwidthPunct(r rune) bool {
+	switch r {
+	case '，', '。', '：', '；', '（', '）', '、', '【', '】', '《', '》', '“', '”', '‘', '’', '　':
+		return true
+	}
+	return false
+}

internal/channels/dingtalk/table_normalize_test.go

@@ -0,0 +1,72 @@
+package dingtalk
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestNormalizeKeepsCompactTableUnchanged(t *testing.T) {
+	content := "重量如下：\n\n| 产品型号 | 净重 (本体重量) | 毛重 (含包装) |\n| :--- | :--- | :--- |\n| CR3A | 16.5 kg / 17.5 kg | 28.5 kg |\n| CR5A | 25 kg | 37 kg |\n\n结束"
+	got := normalizeWideMarkdownTables(content)
+	if got != content {
+		t.Fatalf("compact table must pass through untouched, got %q", got)
+	}
+}
+
+func TestNormalizeConvertsWideTableToGroupedList(t *testing.T) {
+	longCell := "J1: 180°/s (CR3A/5A/7A), 150°/s (CR10A/12A/16A)<br>J2: 180°/s (CR3A/5A/7A)"
+	content := "差异如下：\n\n| 对比项 | CR 系列 | CRA 系列 |\n| :--- | :--- | :--- |\n| **关节最大速度** | " + longCell + " | J1: 180°/s (CR3A/5A/7A), 150°/s (CR10A/12A/16A)<br>J2: 更多参数说明 |\n| 控制柜 | CC162 | CC262 |\n\n结论"
+	got := normalizeWideMarkdownTables(content)
+
+	if strings.Contains(got, "| 对比项") || strings.Contains(got, "<br>") {
+		t.Fatalf("wide table must be converted and <br> removed, got %q", got)
+	}
+	if !strings.HasPrefix(got, "差异如下：\n\n") || !strings.HasSuffix(got, "\n\n结论") {
+		t.Fatalf("surrounding text must be preserved, got %q", got)
+	}
+	// compact row (控制柜) from the same table is now a list entry too
+	if !strings.Contains(got, "**关节最大速度**\n- CR 系列：") || !strings.Contains(got, "- CRA 系列：") {
+		t.Fatalf("row key must become bold heading with header-labelled values, got %q", got)
+	}
+	if !strings.Contains(got, "**控制柜**\n- CR 系列：CC162\n- CRA 系列：CC262") {
+		t.Fatalf("every row must become a group, got %q", got)
+	}
+	if strings.Contains(got, "J1: 180°/s") == false {
+		t.Fatalf("cell content must be preserved, got %q", got)
+	}
+}
+
+func TestNormalizeReplacesBrKeepsTableWhenCellsShort(t *testing.T) {
+	content := "| A | B |\n| --- | --- |\n| 短 | 行一<br>行二 |"
+	got := normalizeWideMarkdownTables(content)
+	if strings.Contains(got, "<br>") {
+		t.Fatalf("<br> must be replaced, got %q", got)
+	}
+	if !strings.Contains(got, "| A | B |") || !strings.Contains(got, "行一；行二") {
+		t.Fatalf("short table must stay a table with ; separator, got %q", got)
+	}
+}
+
+func TestNormalizeSkipsFencedTables(t *testing.T) {
+	long := strings.Repeat("长", 30)
+	content := "```\n| 对比 | " + long + " |\n| --- | --- |\n| a | b |\n```\n正文"
+	got := normalizeWideMarkdownTables(content)
+	if got != content {
+		t.Fatalf("fenced content must never be rewritten, got %q", got)
+	}
+}
+
+func TestNormalizeHandlesEscapedPipesAndEmptyHeaders(t *testing.T) {
+	long := strings.Repeat("x", 40)
+	content := "| 项 |  | \n| --- | --- |\n| a\\|b | " + long + " |"
+	got := normalizeWideMarkdownTables(content)
+	if strings.Contains(got, "| a\\|b") {
+		t.Fatalf("escaped pipe cell should be converted out of table form, got %q", got)
+	}
+	if !strings.Contains(got, "a|b") {
+		t.Fatalf("escaped pipe must be restored as literal, got %q", got)
+	}
+	if !strings.Contains(got, "第2项：") {
+		t.Fatalf("missing header should fall back to ordinal label, got %q", got)
+	}
+}

internal/coverage/evaluator.go

@@ -6,36 +6,11 @@ import (
 	"gitea.zheromiku.top/Weknora/dobotai-platform/internal/core"
 )
 
-// noAnswerPhrases lists explicit "no answer" phrases that the knowledge base
-// returns when it cannot find relevant information. These are matched as
-// substrings after trimming whitespace.
-var noAnswerPhrases = []string{
-	"未找到",
-	"没有找到",
-	"无法确定",
-	"暂无相关",
-	"暂无已发布的权威知识",
-	"知识库中没有",
-	"产品不存在于资料中",
-}
-
-// retrievalGapPhrases are only considered a no-answer signal when the answer
-// also directs the user to a human channel. Requiring both signals avoids
-// misclassifying valid negative results such as "未查询到异常记录".
-var retrievalGapPhrases = []string{
-	"未查询到",
-	"未检索到",
-	"未能查询到",
-	"未能检索到",
-}
-
-var humanEscalationPhrases = []string{
-	"建议您联系",
-	"建议联系",
-	"请联系",
-	"联系技术支持",
-	"联系官方销售",
-}
+// canonicalNoAnswer is the only response that carries the explicit-no-answer
+// machine contract. It must be the complete answer, never a substring match:
+// an otherwise supported answer may legitimately say that one specific detail
+// was not found.
+const canonicalNoAnswer = "当前暂无已发布的权威知识，暂不建议操作。"
 
 // Evaluator classifies a successful turn into a coverage verdict.
 type Evaluator struct{}
@@ -53,20 +28,20 @@ func (e *Evaluator) Version() string {
 // Evaluate classifies a turn. It rejects non-succeeded turns. The evaluation
 // rules (in priority order):
 //  1. Failed/processing turns → ErrTurnNotSucceeded
-//  2. Answer contains an explicit "no answer" phrase → uncovered_explicit_no_answer
-//  3. Image turns (image media present) are classified by whether the question
+//  2. Has references → covered_has_references (references are the coverage
+//     evidence; wording in a supported answer never overrides them)
+//  3. Complete canonical no-answer response with no references
+//     → uncovered_explicit_no_answer
+//  4. Image turns (image media present) are classified by whether the question
 //     actually triggered a knowledge-base search:
-//     - has references → covered_has_references
 //     - no references + knowledge searched → uncovered_no_references
 //     - no references + no knowledge search → covered_visual_recognition
-//     (pure visual recognition is not a coverage miss)
-//  4. Text turns with zero references are classified by whether the question
+//  5. Text turns with zero references are classified by whether the question
 //     actually triggered a knowledge-base search:
 //     - knowledge searched → uncovered_no_references
 //     - no knowledge search → covered_non_knowledge_response
-//  5. Has references → covered_has_references
 //
-// v1 never uses a score threshold. TopScore captures the highest reference score
+// v5 never uses a score threshold. TopScore captures the highest reference score
 // (0 if no references).
 func (e *Evaluator) Evaluate(turn core.Turn) (Decision, error) {
 	if turn.Status != "succeeded" {
@@ -76,9 +51,25 @@ func (e *Evaluator) Evaluate(turn core.Turn) (Decision, error) {
 	// Normalize answer for no-answer phrase detection.
 	trimmed := strings.TrimSpace(turn.Answer)
 
-	// Check for explicit no-answer phrases first — this takes priority
-	// over reference presence.
-	if isNoAnswer(trimmed) {
+	// References are the durable coverage evidence. A supported answer may
+	// correctly note that one sub-detail is absent, so its wording cannot turn
+	// the entire turn into a knowledge gap.
+	if len(turn.References) > 0 {
+		return Decision{
+			TurnID:           turn.ID,
+			TenantKey:        turn.TenantKey,
+			Channel:          turn.Channel,
+			EvaluatorVersion: EvaluatorVersion,
+			Verdict:          VerdictCovered,
+			ReasonCode:       ReasonCoveredHasReferences,
+			ReferenceCount:   len(turn.References),
+			TopScore:         maxScore(turn.References),
+		}, nil
+	}
+
+	// An explicit abstention is a stable machine contract only when it is the
+	// complete answer. Do not use broad natural-language substring matching.
+	if isCanonicalNoAnswer(trimmed) {
 		return Decision{
 			TurnID:           turn.ID,
 			TenantKey:        turn.TenantKey,
@@ -86,8 +77,8 @@ func (e *Evaluator) Evaluate(turn core.Turn) (Decision, error) {
 			EvaluatorVersion: EvaluatorVersion,
 			Verdict:          VerdictUncovered,
 			ReasonCode:       ReasonUncoveredExplicitNoAnswer,
-			ReferenceCount:   len(turn.References),
-			TopScore:         maxScore(turn.References),
+			ReferenceCount:   0,
+			TopScore:         0,
 		}, nil
 	}
 
@@ -180,23 +171,8 @@ func hasImageMedia(media []core.MediaAudit) bool {
 	return false
 }
 
-func isNoAnswer(answer string) bool {
-	lower := strings.ToLower(answer)
-	for _, phrase := range noAnswerPhrases {
-		if strings.Contains(lower, strings.ToLower(phrase)) {
-			return true
-		}
-	}
-	return containsAny(lower, retrievalGapPhrases) && containsAny(lower, humanEscalationPhrases)
-}
-
-func containsAny(value string, phrases []string) bool {
-	for _, phrase := range phrases {
-		if strings.Contains(value, strings.ToLower(phrase)) {
-			return true
-		}
-	}
-	return false
+func isCanonicalNoAnswer(answer string) bool {
+	return strings.TrimSpace(answer) == canonicalNoAnswer
 }
 
 func maxScore(refs []core.Reference) float64 {

internal/coverage/evaluator_test.go

@@ -8,8 +8,8 @@ import (
 
 func TestEvaluatorVersion(t *testing.T) {
 	e := NewEvaluator()
-	if e.Version() != "v4" {
-		t.Errorf("Evaluator version = %q, want v4", e.Version())
+	if e.Version() != "v5" {
+		t.Errorf("Evaluator version = %q, want v5", e.Version())
 	}
 }
 
@@ -30,55 +30,40 @@ func TestEvaluator_RejectsProcessingTurn(t *testing.T) {
 	}
 }
 
-func TestEvaluator_UncoveredExplicitNoAnswer(t *testing.T) {
-	e := NewEvaluator()
-	noAnswerPhrases := []string{
-		"未找到相关结果",
-		"没有找到你需要的信息",
-		"无法确定该问题的答案",
-		"暂无相关信息",
-		"知识库中没有找到相关内容",
-		"这个问题知识库中没有可用的信息",
-	}
-	for _, answer := range noAnswerPhrases {
-		turn := core.Turn{
-			ID:     "test-turn",
-			Status: "succeeded",
-			Answer: answer,
-			References: []core.Reference{
-				{ID: "r1", Score: 0.9},
-			},
-		}
-		d, err := e.Evaluate(turn)
-		if err != nil {
-			t.Fatalf("unexpected error for answer %q: %v", answer, err)
-		}
-		if d.Verdict != VerdictUncovered {
-			t.Errorf("answer %q: verdict = %s, want uncovered", answer, d.Verdict)
-		}
-		if d.ReasonCode != ReasonUncoveredExplicitNoAnswer {
-			t.Errorf("answer %q: reason_code = %s, want %s", answer, d.ReasonCode, ReasonUncoveredExplicitNoAnswer)
-		}
-	}
-}
-
-func TestEvaluator_ProductionMissingProductPhraseTrumpsReferences(t *testing.T) {
+func TestEvaluator_UncoveredCanonicalNoAnswerWithoutReferences(t *testing.T) {
 	e := NewEvaluator()
 	turn := core.Turn{
-		ID:     "missing-product-turn",
-		Status: "succeeded",
-		Answer: "根据提供的检索信息，无法提供对应手册。原因：产品不存在于资料中；检索资料未提及该产品。建议联系技术支持部门。",
-		References: []core.Reference{
-			{ID: "unrelated-1", Score: 0.395940},
-			{ID: "unrelated-2", Score: 0.311595},
-		},
+		ID:                "test-turn",
+		Status:            "succeeded",
+		Answer:            canonicalNoAnswer,
+		KnowledgeSearched: true,
 	}
 	d, err := e.Evaluate(turn)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if d.Verdict != VerdictUncovered || d.ReasonCode != ReasonUncoveredExplicitNoAnswer {
-		t.Fatalf("verdict=%s reason=%s", d.Verdict, d.ReasonCode)
+		t.Fatalf("verdict/reason = %s/%s, want %s/%s", d.Verdict, d.ReasonCode, VerdictUncovered, ReasonUncoveredExplicitNoAnswer)
+	}
+}
+
+func TestEvaluator_NovaPartialNotFoundWithSevenReferencesIsCovered(t *testing.T) {
+	e := NewEvaluator()
+	turn := core.Turn{
+		ID:     "nova-partial-turn",
+		Status: "succeeded",
+		Answer: "已找到Nova系列的相关资料；未找到VX500 2.5D视觉一体方案的明确说明。",
+		References: []core.Reference{
+			{ID: "r1"}, {ID: "r2"}, {ID: "r3"}, {ID: "r4"},
+			{ID: "r5"}, {ID: "r6"}, {ID: "r7"},
+		},
+	}
+	d, err := e.Evaluate(turn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if d.Verdict != VerdictCovered || d.ReasonCode != ReasonCoveredHasReferences || d.ReferenceCount != 7 {
+		t.Fatalf("verdict/reason/references = %s/%s/%d, want %s/%s/7", d.Verdict, d.ReasonCode, d.ReferenceCount, VerdictCovered, ReasonCoveredHasReferences)
 	}
 }
 
@@ -205,9 +190,9 @@ func TestEvaluator_TopScoreZeroWhenNoReferences(t *testing.T) {
 	}
 }
 
-func TestEvaluator_NoAnswerTrumpsReferences(t *testing.T) {
-	// When answer contains explicit "no answer" phrase, it should be uncovered
-	// even if references exist. No-answer detection takes priority.
+func TestEvaluator_ReferencesTrumpNaturalLanguageNoAnswer(t *testing.T) {
+	// References are durable coverage evidence; a natural-language phrase must
+	// not override them.
 	e := NewEvaluator()
 	turn := core.Turn{
 		ID:     "test-turn",
@@ -222,11 +207,11 @@ func TestEvaluator_NoAnswerTrumpsReferences(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if d.Verdict != VerdictUncovered {
-		t.Errorf("no-answer with references: verdict = %s, want uncovered", d.Verdict)
+	if d.Verdict != VerdictCovered {
+		t.Errorf("answer with references: verdict = %s, want covered", d.Verdict)
 	}
-	if d.ReasonCode != ReasonUncoveredExplicitNoAnswer {
-		t.Errorf("no-answer with references: reason_code = %s, want %s", d.ReasonCode, ReasonUncoveredExplicitNoAnswer)
+	if d.ReasonCode != ReasonCoveredHasReferences {
+		t.Errorf("answer with references: reason_code = %s, want %s", d.ReasonCode, ReasonCoveredHasReferences)
 	}
 }
 
@@ -245,12 +230,12 @@ func TestEvaluator_NoAnswerPhraseMatchesInsideAnswer(t *testing.T) {
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if d.ReasonCode != ReasonUncoveredExplicitNoAnswer {
-		t.Fatalf("reason_code = %s, want %s", d.ReasonCode, ReasonUncoveredExplicitNoAnswer)
+	if d.ReasonCode != ReasonCoveredHasReferences {
+		t.Fatalf("reason_code = %s, want %s", d.ReasonCode, ReasonCoveredHasReferences)
 	}
 }
 
-func TestEvaluator_ProductionUnavailableAuthorityPhraseTrumpsReferences(t *testing.T) {
+func TestEvaluator_ProductionUnavailableAuthorityPhraseWithReferencesIsCovered(t *testing.T) {
 	e := NewEvaluator()
 	turn := core.Turn{
 		ID:     "cra-price-turn",
@@ -265,11 +250,11 @@ func TestEvaluator_ProductionUnavailableAuthorityPhraseTrumpsReferences(t *testi
 	if err != nil {
 		t.Fatalf("Evaluate: %v", err)
 	}
-	if d.Verdict != VerdictUncovered {
-		t.Fatalf("verdict = %s, want %s", d.Verdict, VerdictUncovered)
+	if d.Verdict != VerdictCovered {
+		t.Fatalf("verdict = %s, want %s", d.Verdict, VerdictCovered)
 	}
-	if d.ReasonCode != ReasonUncoveredExplicitNoAnswer {
-		t.Fatalf("reason_code = %s, want %s", d.ReasonCode, ReasonUncoveredExplicitNoAnswer)
+	if d.ReasonCode != ReasonCoveredHasReferences {
+		t.Fatalf("reason_code = %s, want %s", d.ReasonCode, ReasonCoveredHasReferences)
 	}
 }
 
@@ -282,10 +267,10 @@ func TestEvaluator_RetrievalGapRequiresHumanEscalation(t *testing.T) {
 		reason  string
 	}{
 		{
-			name:    "production NOVA price answer",
+			name:    "retrieval wording with evidence remains covered",
 			answer:  "当前暂未查询到Nova系列机器人的公开销售价格信息。\n\n如需获取报价，建议您联系越疆科技官方销售渠道或对应区域的销售工程师咨询具体价格方案。",
-			verdict: VerdictUncovered,
-			reason:  ReasonUncoveredExplicitNoAnswer,
+			verdict: VerdictCovered,
+			reason:  ReasonCoveredHasReferences,
 		},
 		{
 			name:    "retrieval gap without escalation is a valid negative result",

internal/coverage/service_test.go

@@ -104,14 +104,12 @@ func TestService_EvaluateAndPersist_UncoveredExplicitNoAnswer(t *testing.T) {
 	s, _ := NewService(repo)
 
 	turn := core.Turn{
-		ID:        "turn-3",
-		TenantKey: "t1",
-		Channel:   "dingtalk",
-		Status:    "succeeded",
-		Answer:    "未找到相关结果",
-		References: []core.Reference{
-			{ID: "r1", Score: 0.5},
-		},
+		ID:                "turn-3",
+		TenantKey:         "t1",
+		Channel:           "dingtalk",
+		Status:            "succeeded",
+		Answer:            canonicalNoAnswer,
+		KnowledgeSearched: true,
 	}
 
 	d, err := s.EvaluateAndPersist(context.Background(), turn)

internal/coverage/types.go

@@ -33,7 +33,7 @@ const (
 )
 
 // EvaluatorVersion is the current version of the evaluator.
-const EvaluatorVersion = "v4"
+const EvaluatorVersion = "v5"
 
 var (
 	ErrTurnNotSucceeded = errors.New("coverage evaluator: turn status must be succeeded")

internal/qa/language_test.go

@@ -1,20 +0,0 @@
-package qa
-
-import "testing"
-
-func TestLocalizedQueryPreservesOriginalWhenAuto(t *testing.T) {
-	if got := localizedQuery("原始问题", "auto"); got != "原始问题" {
-		t.Fatalf("got %q", got)
-	}
-}
-
-func TestLocalizedQueryAddsRequestedLanguageWithoutChangingInput(t *testing.T) {
-	original := "机械臂怎么复位？"
-	got := localizedQuery(original, "ja")
-	if got != "日本語で回答してください。\n\n"+original {
-		t.Fatalf("got %q", got)
-	}
-	if original != "机械臂怎么复位？" {
-		t.Fatal("original query changed")
-	}
-}

internal/qa/service.go

@@ -227,7 +227,7 @@ func (s *Service) ask(ctx context.Context, request core.QARequest, answerObserve
 		return s.weknora.UpdateSessionTitle(updateCtx, existingSessionID, title, "Managed by DobotAI; business state remains outside WeKnora")
 	})
 
-	query := localizedQuery(request.Query, request.ResponseLocale)
+	query := request.Query
 	if request.ConversationType == core.ConversationGroup && strings.TrimSpace(request.SenderName) != "" {
 		query = request.SenderName + ": " + query
 	}
@@ -238,6 +238,11 @@ func (s *Service) ask(ctx context.Context, request core.QARequest, answerObserve
 	chatRequest := weknora.AgentChatRequest{
 		Query: query, AgentID: executionAgentID, AgentEnabled: true, Channel: "im", EnableMemory: true,
 		Images: images,
+		// The language preference travels as an Accept-Language request
+		// header (see weknora.resolveLocale), never as prompt text: WeKnora's
+		// system prompt enforces "ALWAYS respond in {{language}}" which is
+		// fed by that header, so a prompt-prefix instruction loses to it.
+		Locale: strings.TrimSpace(request.ResponseLocale),
 	}
 	// Track whether this turn actually triggered a knowledge-base search by
 	// observing knowledge_search tool-call events. The flag feeds coverage
@@ -373,24 +378,6 @@ func isKnowledgeTool(toolName string) bool {
 	}
 }
 
-func localizedQuery(query, locale string) string {
-	query = strings.TrimSpace(query)
-	switch strings.TrimSpace(locale) {
-	case "zh-CN":
-		return "请使用简体中文回答。\n\n" + query
-	case "en":
-		return "Answer in English.\n\n" + query
-	case "ja":
-		return "日本語で回答してください。\n\n" + query
-	case "ko":
-		return "한국어로 답변해 주세요.\n\n" + query
-	case "es":
-		return "Responde en español.\n\n" + query
-	default:
-		return query
-	}
-}
-
 func normalizeRequestIdentity(request core.QARequest) core.QARequest {
 	request.TenantKey = strings.TrimSpace(request.TenantKey)
 	request.Channel = strings.TrimSpace(request.Channel)

internal/reasoningmode/service.go

@@ -49,11 +49,28 @@ type Service struct {
 	repo             Repository
 	quickAgentID     string
 	reasoningAgentID string
+	defaultMode      Mode
 	now              func() time.Time
 	idleTimeout      time.Duration
 }
 
-func NewService(repo Repository, quickAgentID, reasoningAgentID string) (*Service, error) {
+// Option customises a reasoning mode Service.
+type Option func(*Service) error
+
+// WithDefaultMode sets the mode applied to users who never explicitly chose
+// one with /think. Passing ModeQuick (the default when unset) preserves the
+// historical behaviour of answering with the quick agent.
+func WithDefaultMode(mode Mode) Option {
+	return func(s *Service) error {
+		if mode != ModeQuick && mode != ModeReasoning {
+			return fmt.Errorf("invalid default reasoning mode %q", mode)
+		}
+		s.defaultMode = mode
+		return nil
+	}
+}
+
+func NewService(repo Repository, quickAgentID, reasoningAgentID string, opts ...Option) (*Service, error) {
 	quickAgentID = strings.TrimSpace(quickAgentID)
 	reasoningAgentID = strings.TrimSpace(reasoningAgentID)
 	if repo == nil {
@@ -65,13 +82,29 @@ func NewService(repo Repository, quickAgentID, reasoningAgentID string) (*Servic
 	if quickAgentID == reasoningAgentID {
 		return nil, errors.New("quick and reasoning agent IDs must differ")
 	}
-	return &Service{
+	service := &Service{
 		repo:             repo,
 		quickAgentID:     quickAgentID,
 		reasoningAgentID: reasoningAgentID,
+		defaultMode:      ModeQuick,
 		now:              time.Now,
 		idleTimeout:      defaultIdleTimeout,
-	}, nil
+	}
+	for _, opt := range opts {
+		if err := opt(service); err != nil {
+			return nil, err
+		}
+	}
+	return service, nil
+}
+
+// effectivelyReasoning reports whether a turn should be served by the
+// reasoning agent given the resolved state and the configured default mode.
+func (s *Service) effectivelyReasoning(state State) bool {
+	if state.Mode == ModeReasoning {
+		return true
+	}
+	return !state.UserSelected && s.defaultMode == ModeReasoning
 }
 
 func (s *Service) Prepare(ctx context.Context, scope Scope, text string) (Decision, error) {
@@ -95,10 +128,14 @@ func (s *Service) Prepare(ctx context.Context, scope Scope, text string) (Decisi
 				state.MaxRounds,
 			)}, nil
 		case CommandDisable:
-			_, wasReasoning, err := s.repo.Disable(ctx, scope, s.now())
+			previous, _, err := s.repo.ResolveState(ctx, scope, s.now())
 			if err != nil {
 				return Decision{}, err
 			}
+			wasReasoning := s.effectivelyReasoning(previous)
+			if _, _, err = s.repo.Disable(ctx, scope, s.now()); err != nil {
+				return Decision{}, err
+			}
 			if !wasReasoning {
 				return Decision{Handled: true, Reply: "当前未开启推理模式，默认是快速问答模式。"}, nil
 			}
@@ -106,7 +143,7 @@ func (s *Service) Prepare(ctx context.Context, scope Scope, text string) (Decisi
 		case CommandSingle:
 			return Decision{Query: command.Query, AgentID: s.reasoningAgentID, Execution: ExecutionReasoningSingle}, nil
 		case CommandHelp:
-			return Decision{Handled: true, Reply: helpReply()}, nil
+			return Decision{Handled: true, Reply: helpReply(s.defaultMode)}, nil
 		default:
 			return Decision{Handled: true, Reply: "用法：/think <问题>、/think on、/think off。"}, nil
 		}
@@ -119,13 +156,25 @@ func (s *Service) Prepare(ctx context.Context, scope Scope, text string) (Decisi
 	if state.Mode == ModeReasoning {
 		return Decision{Query: query, AgentID: s.reasoningAgentID, Execution: ExecutionReasoning}, nil
 	}
+	// The user never chose a mode explicitly: follow the operator default.
+	// Default-mode reasoning runs as a single reasoning turn so it never
+	// enters the rounds/idle-expiry machinery; the user can pin quick mode
+	// any time with /think off.
+	if s.effectivelyReasoning(state) {
+		return Decision{Query: query, AgentID: s.reasoningAgentID, Execution: ExecutionReasoningSingle}, nil
+	}
 	return Decision{Query: query, AgentID: s.quickAgentID, Execution: ExecutionQuick, Expired: expired}, nil
 }
 
-func helpReply() string {
+func helpReply(defaultMode Mode) string {
+	defaultLabel := "默认模式：快速问答模式，基于知识库快速准确作答，响应快、成本低，适合信息查询和事实确认。\n" +
+		"智能推理模式：支持多步思考与工具调用，计费标准更高，适合复杂分析和推导。\n"
+	if defaultMode == ModeReasoning {
+		defaultLabel = "默认模式：智能推理模式，支持多步思考与工具调用，效果更强、计费标准更高。\n" +
+			"快速问答模式：基于知识库快速准确作答，响应快、成本低，可用 /think off 切换并保持。\n"
+	}
 	return "一、模式说明\n" +
-		"默认模式：快速问答模式，基于知识库快速准确作答，响应快、成本低，适合信息查询和事实确认。\n" +
-		"智能推理模式：支持多步思考与工具调用，计费标准更高，适合复杂分析和推导。\n\n" +
+		defaultLabel + "\n" +
 		"二、模式切换指令\n" +
 		"/think + 你的问题：仅当前问题使用智能推理\n" +
 		"/think on：开启持续智能推理模式\n" +

internal/reasoningmode/service_test.go

@@ -23,6 +23,7 @@ func (f *fakeRepository) ResolveState(context.Context, Scope, time.Time) (State,
 func (f *fakeRepository) Enable(context.Context, Scope, time.Time, time.Duration) (State, error) {
 	f.enableCalls++
 	f.state.Mode = ModeReasoning
+	f.state.UserSelected = true
 	f.state.RoundsUsed = 0
 	return f.state, nil
 }
@@ -31,6 +32,7 @@ func (f *fakeRepository) Disable(context.Context, Scope, time.Time) (State, bool
 	f.disableCalls++
 	wasReasoning := f.state.Mode == ModeReasoning
 	f.state.Mode = ModeQuick
+	f.state.UserSelected = true
 	f.state.RoundsUsed = 0
 	return f.state, wasReasoning, nil
 }
@@ -177,3 +179,87 @@ func TestPrepareReturnsLocalHelpWithoutStateMutation(t *testing.T) {
 		t.Fatalf("help mutated mode: %+v", repo)
 	}
 }
+
+func newTestServiceWithDefault(t *testing.T, repo Repository, mode Mode) *Service {
+	t.Helper()
+	service, err := NewService(repo, "builtin-quick-answer", "builtin-smart-reasoning", WithDefaultMode(mode))
+	if err != nil {
+		t.Fatal(err)
+	}
+	service.now = func() time.Time { return time.Date(2026, 9, 15, 12, 0, 0, 0, time.UTC) }
+	return service
+}
+
+func TestNewServiceRejectsInvalidDefaultMode(t *testing.T) {
+	if _, err := NewService(&fakeRepository{}, "q", "r", WithDefaultMode("turbo")); err == nil {
+		t.Fatal("expected invalid default mode to fail")
+	}
+}
+
+func TestPrepareDefaultReasoningRoutesUnselectedUserToReasoningSingle(t *testing.T) {
+	repo := &fakeRepository{state: DefaultState()}
+	decision, err := newTestServiceWithDefault(t, repo, ModeReasoning).Prepare(context.Background(), testScope(), "普通问题")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if decision.AgentID != "builtin-smart-reasoning" || decision.Execution != ExecutionReasoningSingle {
+		t.Fatalf("decision=%+v", decision)
+	}
+}
+
+func TestPrepareDefaultReasoningHonoursUserQuickSelection(t *testing.T) {
+	state := DefaultState()
+	state.UserSelected = true
+	decision, err := newTestServiceWithDefault(t, &fakeRepository{state: state}, ModeReasoning).
+		Prepare(context.Background(), testScope(), "普通问题")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if decision.AgentID != "builtin-quick-answer" || decision.Execution != ExecutionQuick {
+		t.Fatalf("decision=%+v", decision)
+	}
+}
+
+func TestPrepareDefaultQuickKeepsLegacyBehaviour(t *testing.T) {
+	decision, err := newTestServiceWithDefault(t, &fakeRepository{state: DefaultState()}, ModeQuick).
+		Prepare(context.Background(), testScope(), "普通问题")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if decision.AgentID != "builtin-quick-answer" || decision.Execution != ExecutionQuick {
+		t.Fatalf("decision=%+v", decision)
+	}
+}
+
+func TestThinkOffPinsQuickModeUnderReasoningDefault(t *testing.T) {
+	repo := &fakeRepository{state: DefaultState()}
+	service := newTestServiceWithDefault(t, repo, ModeReasoning)
+	decision, err := service.Prepare(context.Background(), testScope(), "/think off")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !decision.Handled || !strings.Contains(decision.Reply, "切回") {
+		t.Fatalf("decision=%+v", decision)
+	}
+	if !repo.state.UserSelected || repo.state.Mode != ModeQuick {
+		t.Fatalf("state=%+v", repo.state)
+	}
+	followUp, err := service.Prepare(context.Background(), testScope(), "后续问题")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if followUp.AgentID != "builtin-quick-answer" {
+		t.Fatalf("follow-up escaped user quick selection: %+v", followUp)
+	}
+}
+
+func TestHelpReflectsReasoningDefaultMode(t *testing.T) {
+	decision, err := newTestServiceWithDefault(t, &fakeRepository{state: DefaultState()}, ModeReasoning).
+		Prepare(context.Background(), testScope(), "/help")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(decision.Reply, "默认模式：智能推理模式") {
+		t.Fatalf("help=%q", decision.Reply)
+	}
+}

internal/reasoningmode/state.go

@@ -22,6 +22,7 @@ var ErrInvalidState = errors.New("invalid reasoning mode state")
 
 type State struct {
 	Mode              Mode
+	UserSelected      bool
 	MaxRounds         int
 	RoundsUsed        int
 	HintEnabled       bool

internal/store/postgres/reasoning_mode.go

@@ -61,6 +61,7 @@ func (s *Store) Enable(ctx context.Context, scope reasoningmode.Scope, now time.
 		return reasoningmode.State{}, err
 	}
 	state.Mode = reasoningmode.ModeReasoning
+	state.UserSelected = true
 	state.RoundsUsed = 0
 	state.LastActivityAt = now
 	state.ExpiresAt = now.Add(idle)
@@ -92,6 +93,7 @@ func (s *Store) Disable(ctx context.Context, scope reasoningmode.Scope, now time
 	state, _ = reasoningmode.EffectiveState(state, now)
 	wasReasoning := state.Mode == reasoningmode.ModeReasoning
 	state.Mode = reasoningmode.ModeQuick
+	state.UserSelected = true
 	state.RoundsUsed = 0
 	state.ExpiresAt = time.Time{}
 	if err = updateReasoningState(ctx, tx, scope, state, now); err != nil {
@@ -256,14 +258,14 @@ func ensureReasoningState(ctx context.Context, tx pgx.Tx, scope reasoningmode.Sc
 }
 
 func selectReasoningStateForUpdate(ctx context.Context, tx pgx.Tx, scope reasoningmode.Scope) (reasoningmode.State, error) {
-	return scanReasoningState(tx.QueryRow(ctx, `SELECT mode,max_rounds,rounds_used,hint_enabled,last_activity_at,expires_at,onboarding_shown_at
+	return scanReasoningState(tx.QueryRow(ctx, `SELECT mode,user_selected,max_rounds,rounds_used,hint_enabled,last_activity_at,expires_at,onboarding_shown_at
 		FROM reasoning_mode_states
 		WHERE tenant_key=$1 AND channel=$2 AND external_actor_id=$3
 		FOR UPDATE`, scope.TenantKey, scope.Channel, scope.ExternalActorID))
 }
 
 func selectReasoningState(ctx context.Context, tx pgx.Tx, scope reasoningmode.Scope) (reasoningmode.State, error) {
-	return scanReasoningState(tx.QueryRow(ctx, `SELECT mode,max_rounds,rounds_used,hint_enabled,last_activity_at,expires_at,onboarding_shown_at
+	return scanReasoningState(tx.QueryRow(ctx, `SELECT mode,user_selected,max_rounds,rounds_used,hint_enabled,last_activity_at,expires_at,onboarding_shown_at
 		FROM reasoning_mode_states
 		WHERE tenant_key=$1 AND channel=$2 AND external_actor_id=$3`, scope.TenantKey, scope.Channel, scope.ExternalActorID))
 }
@@ -276,7 +278,7 @@ func scanReasoningState(row pgx.Row) (reasoningmode.State, error) {
 		expires    pgtype.Timestamptz
 		onboarding pgtype.Timestamptz
 	)
-	if err := row.Scan(&mode, &state.MaxRounds, &state.RoundsUsed, &state.HintEnabled, &last, &expires, &onboarding); err != nil {
+	if err := row.Scan(&mode, &state.UserSelected, &state.MaxRounds, &state.RoundsUsed, &state.HintEnabled, &last, &expires, &onboarding); err != nil {
 		return reasoningmode.State{}, fmt.Errorf("scan reasoning state: %w", err)
 	}
 	state.Mode = reasoningmode.Mode(mode)
@@ -295,11 +297,11 @@ func scanReasoningState(row pgx.Row) (reasoningmode.State, error) {
 
 func updateReasoningState(ctx context.Context, tx pgx.Tx, scope reasoningmode.Scope, state reasoningmode.State, now time.Time) error {
 	_, err := tx.Exec(ctx, `UPDATE reasoning_mode_states SET
-		mode=$4,max_rounds=$5,rounds_used=$6,hint_enabled=$7,
-		last_activity_at=$8,expires_at=$9,onboarding_shown_at=$10,updated_at=$11
+		mode=$4,user_selected=$5,max_rounds=$6,rounds_used=$7,hint_enabled=$8,
+		last_activity_at=$9,expires_at=$10,onboarding_shown_at=$11,updated_at=$12
 		WHERE tenant_key=$1 AND channel=$2 AND external_actor_id=$3`,
 		scope.TenantKey, scope.Channel, scope.ExternalActorID,
-		string(state.Mode), state.MaxRounds, state.RoundsUsed, state.HintEnabled,
+		string(state.Mode), state.UserSelected, state.MaxRounds, state.RoundsUsed, state.HintEnabled,
 		nullableTime(state.LastActivityAt), nullableTime(state.ExpiresAt), nullableTime(state.OnboardingShownAt), now,
 	)
 	if err != nil {

internal/weknora/client.go

@@ -54,6 +54,12 @@ type AgentChatRequest struct {
 	DisableTitle     bool     `json:"disable_title,omitempty"`
 	KnowledgeBaseIDs []string `json:"knowledge_base_ids,omitempty"`
 	Images           []Image  `json:"images,omitempty"`
+	// Locale is the response language preference ("zh-CN", "en", "ja", "ko",
+	// "es", or "auto"). It is transmitted as the Accept-Language request
+	// header — WeKnora's Language middleware turns it into the {{language}}
+	// prompt placeholder. "auto" and "" mean: detect from the query text.
+	// Not serialized in the JSON body.
+	Locale string `json:"-"`
 }
 
 type Image struct {
@@ -148,6 +154,9 @@ func (c *Client) agentChat(ctx context.Context, sessionID string, request AgentC
 	req.Header.Set("Content-Type", "application/json")
 	req.Header.Set("Accept", "text/event-stream")
 	req.Header.Set("X-API-Key", c.apiKey)
+	if locale := resolveLocale(request.Locale, request.Query); locale != "" {
+		req.Header.Set("Accept-Language", locale)
+	}
 	resp, err := c.http.Do(req)
 	if err != nil {
 		return ChatResult{}, fmt.Errorf("call weknora agent chat: %w", err)

internal/weknora/language.go

@@ -0,0 +1,67 @@
+package weknora
+
+import (
+	"strings"
+	"unicode"
+)
+
+// fixedLocales are the response languages the platform understands end-to-end
+// (settings command, preference storage, and WeKnora's LanguageLocaleName map).
+var fixedLocales = map[string]bool{
+	"zh-CN": true, "en": true, "ja": true, "ko": true, "es": true,
+}
+
+// resolveLocale maps a user preference + query text to an Accept-Language
+// value understood by WeKnora's Language middleware.
+//
+//   - ""     -> "" (send no header; WeKnora keeps its own fallback)
+//   - "auto" -> best-effort detection from the query script
+//   - a known fixed locale (e.g. "en", "ja") -> passed through verbatim
+//
+// WeKnora matches the first Accept-Language tag and maps it to a human
+// language name for its prompts, so the returned tag must be one it knows
+// ("zh-CN", "en", "ja", "ko", "es", ...). An "auto" query whose script
+// cannot be classified returns "" so the server behaves exactly as before.
+func resolveLocale(locale, query string) string {
+	locale = strings.TrimSpace(locale)
+	if fixedLocales[locale] {
+		return locale
+	}
+	if locale == "auto" {
+		return detectLocale(query)
+	}
+	return ""
+}
+
+// detectLocale classifies a query by the dominant non-ASCII script. Latin
+// text maps to "en"; CJK ideographs to "zh-CN"; kana to "ja"; hangul to "ko";
+// Spanish is not reliably script-detectable and is never auto-selected.
+// Pure punctuation/digits/empty text return "" (no guess).
+func detectLocale(query string) string {
+	var cjk, kana, hangul, latin int
+	for _, r := range query {
+		switch {
+		case unicode.Is(unicode.Hiragana, r) || unicode.Is(unicode.Katakana, r):
+			kana++
+		case unicode.Is(unicode.Han, r):
+			cjk++
+		case unicode.Is(unicode.Hangul, r):
+			hangul++
+		case r >= 'A' && r <= 'Z' || r >= 'a' && r <= 'z':
+			latin++
+		}
+	}
+	// Japanese mixes kanji in, so any kana presence wins over Han count.
+	switch {
+	case kana > 0:
+		return "ja"
+	case hangul > 0:
+		return "ko"
+	case cjk > 0:
+		return "zh-CN"
+	case latin > 0:
+		return "en"
+	default:
+		return ""
+	}
+}

internal/weknora/language_test.go

@@ -0,0 +1,96 @@
+package weknora
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestResolveLocaleFixedPrefersPreference(t *testing.T) {
+	// A fixed preference must win over the query's own script.
+	for _, locale := range []string{"zh-CN", "en", "ja", "ko", "es"} {
+		if got := resolveLocale(locale, "how many CR series do we have?"); got != locale {
+			t.Fatalf("resolveLocale(%q) = %q, want %q", locale, got, locale)
+		}
+	}
+}
+
+func TestResolveLocaleAutoDetectsFromQuery(t *testing.T) {
+	cases := []struct{ query, want string }{
+		{"how many serise do we have for CR?", "en"},
+		{"cr一共有几个系列", "zh-CN"},
+		{"ロボットのアームリセット方法", "ja"},
+		{"机器人复位怎么操作", "zh-CN"},
+		{"로봇 암 리셋 방법", "ko"},
+		{"5013", ""},   // no script evidence: no guess
+		{"!!! ??", ""}, // punctuation only: no guess
+	}
+	for _, tc := range cases {
+		if got := resolveLocale("auto", tc.query); got != tc.want {
+			t.Fatalf("resolveLocale(auto, %q) = %q, want %q", tc.query, got, tc.want)
+		}
+	}
+}
+
+func TestResolveLocaleUnknownPreferenceSendsNothing(t *testing.T) {
+	// Empty and unrecognized locales must not fabricate a header; WeKnora
+	// keeps its own fallback behaviour, exactly like before this feature.
+	if got := resolveLocale("", "hello"); got != "" {
+		t.Fatalf("empty locale = %q, want none", got)
+	}
+	if got := resolveLocale("fr-CA", "hello"); got != "" {
+		t.Fatalf("unknown locale = %q, want none", got)
+	}
+}
+
+func TestAgentChatSendsAcceptLanguageHeader(t *testing.T) {
+	var gotHeader string
+	body := "data: {\"response_type\":\"answer\",\"content\":\"ok\"}\n\ndata: {\"response_type\":\"complete\",\"done\":true}\n\n"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotHeader = r.Header.Get("Accept-Language")
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = w.Write([]byte(body))
+	}))
+	defer server.Close()
+	client, err := NewClient(server.URL, "test-key", 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := client.AgentChat(context.Background(), "s1", AgentChatRequest{
+		Query: "how many serise do we have for CR?", AgentID: "a1", Locale: "en",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if gotHeader != "en" {
+		t.Fatalf("Accept-Language = %q, want %q", gotHeader, "en")
+	}
+}
+
+func TestAgentChatOmitsAcceptLanguageWhenNoPreference(t *testing.T) {
+	var sent bool
+	body := "data: {\"response_type\":\"answer\",\"content\":\"ok\"}\n\ndata: {\"response_type\":\"complete\",\"done\":true}\n\n"
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, sent = r.Header["Accept-Language"]
+		w.Header().Set("Content-Type", "text/event-stream")
+		_, _ = w.Write([]byte(body))
+	}))
+	defer server.Close()
+	client, _ := NewClient(server.URL, "test-key", 0)
+	if _, err := client.AgentChat(context.Background(), "s1", AgentChatRequest{
+		Query: "cr有哪些系列", AgentID: "a1",
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if sent {
+		t.Fatal("Accept-Language header must be absent without a locale")
+	}
+}
+
+func TestAgentChatRequestLocaleIsNotSerialized(t *testing.T) {
+	// Locale rides on the header only; the JSON body contract is unchanged.
+	// (Guards against a future refactor accidentally adding it to the payload.)
+	if got := resolveLocale("auto", "How to reset the robot arm?"); got != "en" {
+		t.Fatalf("auto detection broken: %q", got)
+	}
+}

scripts/containerized_deployment_test.go

@@ -6,112 +6,96 @@ import (
 	"testing"
 )
 
-func TestDobotAIDingTalkContainerAssetsProvideSafeShortOperatorCommands(t *testing.T) {
+func TestDockerDeploymentContainsOnlyDobotAIApplication(t *testing.T) {
 	compose, err := os.ReadFile("../deploy/dobotai-dingtalk/compose.yaml")
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, required := range []string{
-		"dobotai-dingtalk:",
-		"container_name: dobotai-dingtalk",
-		"network_mode: host",
-		"env_file:",
-		"read_only: true",
-		"/var/lib/dobotai/secrets",
-	} {
-		if !strings.Contains(string(compose), required) {
+	source := string(compose)
+	for _, required := range []string{"dobotai-dingtalk:", "container_name: dobotai-dingtalk", "network_mode: host", "env_file:", "read_only: true"} {
+		if !strings.Contains(source, required) {
 			t.Errorf("compose missing %q", required)
 		}
 	}
-
-	configure, err := os.ReadFile("../deploy/dobotai-dingtalk/dobotai-dingtalk-configure")
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, required := range []string{
-		"configure_env.py",
-		"/etc/dobotai-test/dobotai.env",
-		"dobotai-dingtalk-start",
-	} {
-		if !strings.Contains(string(configure), required) {
-			t.Errorf("configure command missing %q", required)
-		}
-	}
-
-	bind, err := os.ReadFile("../deploy/dobotai-dingtalk/dobotai-dingtalk-bind-admin")
-	if err != nil {
-		t.Fatal(err)
-	}
-	for _, required := range []string{
-		"docker exec -it dobotai-dingtalk",
-		"/usr/local/bin/dobotai bootstrap-admin",
-	} {
-		if !strings.Contains(string(bind), required) {
-			t.Errorf("bind command missing %q", required)
+	for _, forbidden := range []string{"dobotai-postgres", "postgres-data", "name: dobotai-network"} {
+		if strings.Contains(source, forbidden) {
+			t.Errorf("compose must not manage a local database resource %q", forbidden)
 		}
 	}
 }
 
-func TestDobotAIDingTalkCredentialConfigurationNeverPassesSecretsOnCommandLine(t *testing.T) {
+func TestRootInstallerBuildsImageWithoutOperatorImageArgument(t *testing.T) {
+	data, err := os.ReadFile("../install-docker.sh")
+	if err != nil {
+		t.Fatal(err)
+	}
+	source := string(data)
+	for _, required := range []string{"docker build", "dobotai-dingtalk:local-", "install_docker_if_missing", "DOBOTAI_SOURCE_ROOT", "deploy/dobotai-dingtalk/install-docker.sh"} {
+		if !strings.Contains(source, required) {
+			t.Errorf("root installer missing %q", required)
+		}
+	}
+	if strings.Contains(source, "${DOBOTAI_IMAGE") {
+		t.Fatal("root installer must not require DOBOTAI_IMAGE")
+	}
+}
+
+func TestDockerfilePropagatesConfiguredGoProxyToModuleDownload(t *testing.T) {
+	data, err := os.ReadFile("../Dockerfile")
+	if err != nil {
+		t.Fatal(err)
+	}
+	source := string(data)
+	for _, required := range []string{"ARG GOPROXY=", "ENV GOPROXY=${GOPROXY}", "RUN go mod download"} {
+		if !strings.Contains(source, required) {
+			t.Errorf("Dockerfile missing %q", required)
+		}
+	}
+	if !(strings.Index(source, "ENV GOPROXY=${GOPROXY}") < strings.Index(source, "RUN go mod download")) {
+		t.Fatal("Dockerfile must set GOPROXY before downloading modules")
+	}
+}
+
+func TestRDSInitializerOnlyInitializesEmptySchemaAndRejectsInconsistentSchema(t *testing.T) {
+	data, err := os.ReadFile("../deploy/dobotai-dingtalk/rds-schema-init.sh")
+	if err != nil {
+		t.Fatal(err)
+	}
+	source := string(data)
+	for _, required := range []string{"pg_isready", "to_regclass('public.turns')", "empty", "normal", "inconsistent", "数据库不存在", "*.up.sql", "DATABASE_URL", "postgres:16-alpine"} {
+		if !strings.Contains(source, required) {
+			t.Errorf("RDS initializer missing %q", required)
+		}
+	}
+	for _, forbidden := range []string{"docker compose", "dobotai-postgres", "pg_dump -Fc", "DROP DATABASE", "DROP SCHEMA"} {
+		if strings.Contains(source, forbidden) {
+			t.Errorf("RDS initializer must not manage or destroy databases: %q", forbidden)
+		}
+	}
+}
+
+func TestRDSCredentialConfiguratorPromptsForExternalDatabase(t *testing.T) {
 	data, err := os.ReadFile("../deploy/dobotai-dingtalk/configure_env.py")
 	if err != nil {
 		t.Fatal(err)
 	}
 	source := string(data)
-	for _, required := range []string{"getpass.getpass", "os.replace", "0o600", "DINGTALK_CLIENT_SECRET"} {
+	for _, required := range []string{"DATABASE_URL", "阿里云RDS", "RDS主机地址", "RDS端口", "数据库名", "数据库账号", "数据库密码", "快速问答Agent ID", "智能推理Agent ID", "getpass.getpass", "os.replace", "0o600", "OSS整组录入", "DOBOTAI_OUTBOUND_IMAGE_OSS_ACCESS_KEY_SECRET"} {
 		if !strings.Contains(source, required) {
-			t.Errorf("credential configurator missing %q", required)
+			t.Errorf("RDS configurator missing %q", required)
 		}
 	}
-	for _, forbidden := range []string{"subprocess.run([", "-v", "DINGTALK_CLIENT_SECRET="} {
-		if strings.Contains(source, forbidden) {
-			t.Errorf("credential configurator must not expose secret through process arguments: %q", forbidden)
-		}
+	if strings.Contains(source, "RDS PostgreSQL连接串") {
+		t.Fatal("operator must not be asked to type a whole DATABASE_URL string")
 	}
-}
-
-func TestDobotAIDingTalkCredentialConfigurationExplainsEveryInputWithRedactedExamples(t *testing.T) {
-	configurator, err := os.ReadFile("../deploy/dobotai-dingtalk/configure_env.py")
+	if strings.Contains(source, "DobotAI租户键") || strings.Contains(source, "Agent Bindings JSON") || strings.Contains(source, "DobotAI Ingress Token") {
+		t.Fatal("operator must only be prompted for real RDS, WeKnora and DingTalk configuration")
+	}
+	installer, err := os.ReadFile("../deploy/dobotai-dingtalk/install-docker.sh")
 	if err != nil {
 		t.Fatal(err)
 	}
-	documentation, err := os.ReadFile("../deploy/dobotai-dingtalk/README.md")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(string(configurator), "格式示例：{example}") || !strings.Contains(string(documentation), "格式示例") {
-		t.Fatal("configuration guidance must label every example")
-	}
-	for _, example := range []string{
-		"postgres://USER:<数据库密码>@127.0.0.1:55432/dobotai_test?sslmode=disable",
-		"http://127.0.0.1:8080",
-		`{"dingtalk:*":"你的Agent ID"}`,
-		"DINGTALK_CLIENT_SECRET",
-	} {
-		if !strings.Contains(string(configurator), example) {
-			t.Errorf("configurator missing redacted example %q", example)
-		}
-		if !strings.Contains(string(documentation), example) {
-			t.Errorf("documentation missing redacted example %q", example)
-		}
-	}
-}
-
-func TestDobotAIDingTalkStartRollsBackToPreviousContainerImage(t *testing.T) {
-	data, err := os.ReadFile("../deploy/dobotai-dingtalk/dobotai-dingtalk-start")
-	if err != nil {
-		t.Fatal(err)
-	}
-	source := string(data)
-	for _, required := range []string{
-		"previous_image=",
-		"set_runtime_image",
-		"docker inspect --format",
-		"set_runtime_image \"$previous_image\"",
-		"docker compose --env-file \"$runtime_env\" -f \"$compose_file\" up -d --no-build --force-recreate",
-	} {
-		if !strings.Contains(source, required) {
-			t.Errorf("start script missing container upgrade rollback %q", required)
-		}
+	if !strings.Contains(string(installer), "secrets.token_hex") || !strings.Contains(string(installer), "secrets.token_urlsafe") || !strings.Contains(string(installer), "DOBOTAI_TENANT_KEY=dobotai-") {
+		t.Fatal("installer must generate and persist internal tenant and ingress tokens")
 	}
 }