Aska
7e39153a69
#1 工具布尔标记生效(agent-106, 安全红线): loop toolSchemas/runToolCalls 加 allow-set 安全门 restrictSchemas/applyToolSecurityGate——群聊/陌生人只暴露允许工具(默认关), 被拒not_allowed软提示+AuditEvent, owner全工具不变; 身份靠 ActorEnv(非提示词) #2 checkpoint 恢复(agent-109): run.go LoadLatest + resumableStopReason门控(只恢复in-flight工具循环,不出答案不续跑), 幂等不重放副作用, 新会话不误恢复; resume_test 4用例 #3 tool_result(agent-108, 协议层): Anthropic 原生tool_result块(tool_use_id/is_error)非user纯文本 + OpenAI tool消息补tool_call_id; Content加ToolCallID/IsError等; (loop接线层2处留待,见备注) #6 capacity_awaken推送(agent-107): onCapacity从只Debug改推WS hub(BroadcastCapacityAwaken, sessionId定向+payload对齐前端AwakenPayload) 管理面板移动端(agent-110): AdminApp 汉堡菜单+抽屉侧栏+标题truncate防换行, RBAC守卫不受影响 全仓 build/vet/test绿 + 前端build绿; 前端无涉差异已对齐 备注: #3 loop接线层2处(assistant工具轮append历史 + Message.ToolCallID/IsError)留给后续; #4代审/#5子代理触发/#7拆文件后置(主人说后三不急)
87 lines
3.4 KiB
Go
87 lines
3.4 KiB
Go
package loop
|
|
|
|
import (
|
|
"context"
|
|
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/agent"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/tool"
|
|
)
|
|
|
|
// auditToolRejectNotAllowed is the audit "what" for a tool call denied by the
|
|
// design/11 §3 security gate in a group/stranger environment.
|
|
const auditToolRejectNotAllowed = "tool.reject.not_allowed"
|
|
|
|
// AuditEvent reports a security-gated tool rejection to the audit sink
|
|
// (design/11 §3 §8). The loop emits one when it denies a tool call in a
|
|
// restricted (group/stranger) environment, so the rejection is auditable and the
|
|
// frontend can render the small "xx 工具在群聊被拒" note. It is wired to the
|
|
// gateway audit trail via Options.OnAudit.
|
|
type AuditEvent struct {
|
|
// Who is the acting actor environment label ("group_member"/"stranger").
|
|
Who string
|
|
// What is the operation, e.g. "tool.reject.not_allowed".
|
|
What string
|
|
// Result is the outcome detail — the not_allowed hint naming the denied tool.
|
|
Result string
|
|
}
|
|
|
|
// restrictSchemas returns only the tool schemas the session env on ctx may
|
|
// invoke, per the design/11 §3 security gate: a group/stranger session may
|
|
// invoke only tools whose editable marker allows that environment (default
|
|
// closed), while the owner environment keeps the full set. It is the final word
|
|
// over the capacity allowed-set view — a security red line, not a convenience
|
|
// hint — so it runs last and can only shrink the surface.
|
|
func (l *Loop) restrictSchemas(ctx context.Context, d *tool.Dispatcher, schemas []model.ToolSpec) []model.ToolSpec {
|
|
policy := d.PolicyEngine(sessionEnvFrom(ctx).ActorEnv)
|
|
kept := make([]model.ToolSpec, 0, len(schemas))
|
|
for _, s := range schemas {
|
|
if policy.Allow(s.Name) {
|
|
kept = append(kept, s)
|
|
}
|
|
}
|
|
return kept
|
|
}
|
|
|
|
// applyToolSecurityGate blocks every call whose tool is not allowed in the
|
|
// session env on ctx (design/11 §3). It mutates actions in place, overriding
|
|
// each runnable call to a skip carrying the not_allowed hint and emitting an
|
|
// AuditEvent for the rejection. A nil receiver or nil dispatcher is a no-op.
|
|
func (l *Loop) applyToolSecurityGate(ctx context.Context, d *tool.Dispatcher, calls []agent.ToolCall, actions []toolCallAction) {
|
|
env := sessionEnvFrom(ctx)
|
|
policy := d.PolicyEngine(env.ActorEnv)
|
|
for i := range calls {
|
|
if !actions[i].run {
|
|
continue
|
|
}
|
|
if policy.Allow(calls[i].Name) {
|
|
continue
|
|
}
|
|
reason := notAllowedReason(calls[i].Name)
|
|
actions[i] = toolCallAction{run: false, reason: reason}
|
|
l.emitAudit(AuditEvent{
|
|
Who: string(env.ActorEnv),
|
|
What: auditToolRejectNotAllowed,
|
|
Result: reason,
|
|
})
|
|
}
|
|
}
|
|
|
|
// notAllowedReason is the soft hint fed back to the model when a restricted
|
|
// (group/stranger) session invokes a tool whose editable marker denies that
|
|
// environment (design/11 §3). It is a soft result — injected into the
|
|
// conversation, never a panic or hard crash — so the model can reassess.
|
|
func notAllowedReason(name string) string {
|
|
return "not_allowed: tool " + name + " is not allowed in a group/stranger conversation"
|
|
}
|
|
|
|
// emitAudit forwards an AuditEvent to the configured OnAudit sink. It is a no-op
|
|
// when no sink is wired, so the security gate still works (soft not_allowed
|
|
// result) in leaf tests that do not attach an audit sink.
|
|
func (l *Loop) emitAudit(ev AuditEvent) {
|
|
if l.onAudit == nil {
|
|
return
|
|
}
|
|
l.onAudit(ev)
|
|
}
|