@bolloon/bolloon-agent 0.1.34 → 0.1.36

package/dist/agents/pi-sdk.js

@@ -20,6 +20,17 @@ import { DiscoveredAgentsManager, createSocialHeartbeat } from '../social/heartb
 import { getGlobalSharedContext } from '../social/global-shared-context.js';
 import { Session, SkillRegistry, saveSession, loadSession } from '@bolloon/constraint-runtime';
 import { loadSkillsFromPaths, defaultSkillPaths, describeSkill } from './skill-loader.js';
+// Judgment 注入门 (P0): 在主对话 LLM 调起前自动拼入 Top 3 判断力
+// 失败静默, 不阻塞主对话
+import { injectJudgmentGate, recordJudgmentUsage } from '../pi-ecosystem-judgment/injection-gate.js';
+// 持续监控门 (P3): AI 回复后审计是否违反原则
+import { monitorAfterReply } from '../pi-ecosystem-judgment/monitor-gate.js';
+// Bootstrap 生命周期 hook (SessionStart / Stop / PreToolUse)
+import { onSessionStart, onStop, onPreToolUse } from '../pi-ecosystem-judgment/human-value-pipeline.js';
+import { onPostToolUse } from '../bootstrap/lifecycle-hooks.js';
+import { budgetReduce, snip, microcompact } from '../context-compaction/index.js';
+// React Harness: 8-gate + 4-guard (防越权 / 防 prompt 注入)
+import { ReactHarness } from '../security/react-harness.js';
 const SHARED_SESSION_PATH = path.join(process.env.HOME || '/tmp', '.bolloon', 'sessions');
 const PERSONA_PATH = path.join(process.env.HOME || '/tmp', '.bolloon', 'persona.json');
 export class PiSessionManager {
@@ -334,15 +345,86 @@ class PiAgentSession {
     messageHistory = [];
     tools = new Map();
     skillRegistry = new SkillRegistry();
-    MAX_REACT_ITERATIONS = 100;
+    // 2026-06-16 修: 父要求把 ReAct loop 上限放大到 "几乎无限", 靠自动压缩上下文 + fail-safe 兜底
+    // 默认 10000 — 正常任务永远跑不到, 但作为防 LLM 死循环 / 防 OOM 的最后一道闸
+    // 旧默认 100 写死导致中等复杂度任务 (10-50 个 tool call + 多步反思) 会被误杀
+    MAX_REACT_ITERATIONS = 10_000;
     MAX_REFINE_ATTEMPTS = 3;
     QUALITY_THRESHOLD = 0.6;
+    /** P1: 上下文溢出阈值 (单轮估算 token 数, 超过则强制终止防止 prompt-too-long) */
+    MAX_OUTPUT_TOKEN_ESCALATION_THRESHOLD = 60_000; // 60K tokens 上限
+    /** 2026-06-16 新增: 累计错误总数兜底 (不管是否同工具, 累计 N 次就强制退出)
+     *  防 LLM 轮换工具名绕开 MAX_SAME_TOOL_FAILURES 的死循环攻击 */
+    MAX_TOTAL_ERRORS = 20;
+    /** 2026-06-16 新增: loop 内自动压缩触发阈值 (相对 60K 阈值的比例) */
+    LOOP_COMPACT_RATIO = 0.8;
+    /** P1: max output token 升级重试 (LLM 截断时重试, 最多 3 次) */
+    MAX_OUTPUT_TOKEN_ESCALATION_RETRIES = 3;
     thinkingEngine = new DeepThinkingEngine(3);
     coordinator = new AgentCoordinator(3);
     harness = null;
     harnessEnabled = false;
+    /** 8-gate + 4-guard 集中调度 (防越权 / 防 prompt 注入) */
+    reactHarness = new ReactHarness();
     usePivotLoop = false;
     pivotLoopConfig;
+    /** P2: 当前会话的 permission mode (每次 promptStream 入口解析) */
+    currentPermissionMode = 'default';
+    /** P1.2: Context Collapse 读时投影结果 (feature flag 开启时由 maybeAutoCompact 写入, buildContext 优先用) */
+    projectedHistory = null;
+    /**
+     * Judgment 注入门临时结果: 在 prompt / promptStream / promptWithPivotLoop 入口算一次, 拼到本轮 systemPrompt 末尾
+     * 每次调用都会重置 (避免上一轮遗留)
+     */
+    judgmentGateAddition = '';
+    judgmentGateUsedIds = [];
+    /**
+     * 当前 onStream 引用 + abort signal (computeJudgmentGate 需要 onStream 广播 phase)
+     * 每次 prompt / promptStream / promptWithPivotLoop 入口设置, 用完即清
+     */
+    currentOnStream = null;
+    currentSignal = null;
+    /** Bootstrap SessionStart 拼的 system prompt 片段 (用完即清) */
+    bootstrapAddition = '';
+    /** 当前 prompt 开始时间 (供 Stop hook 计算 durationMs) */
+    promptStartTime = 0;
+    /** 当前 channel id (由 getAgentForChannel / prompt 4 参注入, 供 hook / log 使用) */
+    currentChannelId = '';
+    /**
+     * 算 judgment 注入门: 失败静默, 不阻塞主对话
+     * 期间通过 currentOnStream 广播 phase 事件, 前端可显示 "正在检索判断力..." 状态
+     * 调用方负责用完即清 (judgmentGateAddition='')
+     */
+    async computeJudgmentGate(input) {
+        const safePhase = (phase, extra = {}) => {
+            try {
+                if (this.currentOnStream) {
+                    this.currentOnStream({ type: 'phase', phase, ...extra, content: '' });
+                }
+            }
+            catch { /* 静默 */ }
+        };
+        safePhase('gate_compute', { detail: '正在检索相关判断力...' });
+        try {
+            // P-Action 4 (2026-06-15) 路径 1 整合: 透传 maxChars=1500 (≈ 375 tokens 硬上限)
+            // 路径 2/3 检测由 injection-gate 内部 alreadyInjectedSources 处理 (目前 assembleSystemPrompt 还没注入 value-store 标记, 所以这里不传)
+            const gate = await injectJudgmentGate(input, {}, { maxChars: 1500 });
+            this.judgmentGateAddition = gate.systemAddition;
+            this.judgmentGateUsedIds = gate.usedIds;
+            if (gate.usedIds.length > 0) {
+                safePhase('gate_done', { usedCount: gate.usedIds.length, didInject: gate.didInject, skipReason: gate.skipReason });
+            }
+        }
+        catch (err) {
+            console.warn('[PiAgent] judgment gate failed (non-fatal):', err);
+            this.judgmentGateAddition = '';
+            this.judgmentGateUsedIds = [];
+        }
+    }
+    clearJudgmentGate() {
+        this.judgmentGateAddition = '';
+        this.judgmentGateUsedIds = [];
+    }
     constructor(config) {
         this.cwd = config.cwd;
         this.peerId = config.peerId || 'local';
@@ -428,17 +510,21 @@ class PiAgentSession {
             const { createBollharnessIntegration } = await import('../bollharness-integration/index.js');
             this.harness = createBollharnessIntegration();
             this.harnessEnabled = true;
+            // ReactHarness 已用 bollharness, 这里也记一份以供 archive 调用
+            this.reactHarness = new ReactHarness({ harnessEnabled: true, gateEnabled: true });
         }
         catch (e) {
             console.warn('[PiAgentSession] Harness initialization failed:', e);
             this.harnessEnabled = false;
+            // 失败 fallback: 走纯 8-gate (不带 bollharness 的 8-gate 工作流)
+            this.reactHarness = new ReactHarness({ harnessEnabled: false, gateEnabled: true });
         }
     }
     registerTools() {
         this.tools.set('read_document', {
             name: 'read_document',
             description: '读取文档内容，支持 .txt, .md, .pdf, .docx 格式',
-            parameters: { path: '文件路径' },
+            parameters: { path: 'string' },
             execute: async (args) => {
                 try {
                     const content = await documentReader.read(args.path);
@@ -455,7 +541,7 @@ class PiAgentSession {
         this.tools.set('summarize_document', {
             name: 'summarize_document',
             description: '总结文档内容，分析并生成摘要',
-            parameters: { path: '文件路径', context: '可选上下文信息' },
+            parameters: { path: 'string', context: 'string' },
             execute: async (args) => {
                 try {
                     if (!this.minimaxAvailable) {
@@ -475,7 +561,7 @@ class PiAgentSession {
         this.tools.set('improve_document', {
             name: 'improve_document',
             description: '根据要求改进文档内容',
-            parameters: { path: '文件路径', requirements: '改进要求' },
+            parameters: { path: 'string', requirements: 'string' },
             execute: async (args) => {
                 try {
                     if (!this.minimaxAvailable) {
@@ -767,8 +853,9 @@ class PiAgentSession {
             return false;
         }
     }
-    async prompt(input) {
+    async prompt(input, options) {
         this.minimaxAvailable = this.checkMinimax();
+        this.currentChannelId = options?.channelId ?? this.currentChannelId;
         this.messageHistory.push({
             role: 'user',
             content: input
@@ -778,10 +865,36 @@ class PiAgentSession {
             this.messageHistory.push({ role: 'assistant', content: response });
             return response;
         }
-        return this.runReActLoop();
+        // P0 注入门
+        this.currentSignal = options?.signal ?? null;
+        this.currentOnStream = options?.onStream ?? null;
+        await this.computeJudgmentGate(input);
+        // P2: 解析当前 permission mode
+        try {
+            const { resolvePermissionMode } = await import('./permission-mode.js');
+            this.currentPermissionMode = resolvePermissionMode();
+        }
+        catch (err) {
+            console.warn('[PiAgent] resolvePermissionMode failed (non-fatal):', err);
+            this.currentPermissionMode = 'default';
+        }
+        try {
+            // 2026-06-16: runReActLoop 现在返回 { reply, aiFailed, aiFailureReason } — 这里只需 reply 字符串
+            const loopResult = await this.runReActLoop(undefined, options?.signal);
+            return loopResult.reply;
+        }
+        finally {
+            if (this.judgmentGateUsedIds.length > 0) {
+                recordJudgmentUsage(this.judgmentGateUsedIds, { userInput: input }).catch((err) => console.warn('[PiAgent] recordJudgmentUsage failed:', err));
+            }
+            this.clearJudgmentGate();
+            this.currentSignal = null;
+            this.currentOnStream = null;
+        }
     }
-    async promptStream(input, onStream) {
+    async promptStream(input, onStream, signal, channelId) {
         this.minimaxAvailable = this.checkMinimax();
+        this.currentChannelId = channelId ?? this.currentChannelId;
         this.messageHistory.push({
             role: 'user',
             content: input
@@ -793,11 +906,129 @@ class PiAgentSession {
             onStream({ type: 'done', content: '' });
             return response;
         }
-        const result = await this.runReActLoop(onStream);
+        // P0 注入门: 缓存 onStream + signal, computeJudgmentGate 用 currentOnStream 广播 phase
+        this.currentOnStream = onStream;
+        this.currentSignal = signal ?? null;
+        await this.computeJudgmentGate(input);
+        // P1.1: 异步跑 Auto-Compact (LLM 摘要, 仅在 budget 超限时触发, 失败静默)
+        // 复用 computeJudgmentGate 的 onStream 广播 phase, 跟 judgment 注入门风格一致
+        try {
+            await this.maybeAutoCompact(onStream, signal);
+        }
+        catch (err) {
+            console.warn('[PiAgent] maybeAutoCompact failed (non-fatal):', err);
+        }
+        // Bootstrap SessionStart: 收集项目 Context, 拼到 systemAddition 头部
+        // (失败静默, 5s 限流防止循环)
+        let bootstrapAddition = '';
+        try {
+            const ss = await onSessionStart({ channelId: this.currentChannelId || undefined });
+            bootstrapAddition = ss.systemAddition || '';
+        }
+        catch (err) {
+            console.warn('[PiAgent] onSessionStart failed (non-fatal):', err);
+        }
+        this.bootstrapAddition = bootstrapAddition;
+        // P2: 解析当前 permission mode (BootstrapOptions > env BOLLOON_PERM_MODE > default)
+        try {
+            const { resolvePermissionMode } = await import('./permission-mode.js');
+            this.currentPermissionMode = resolvePermissionMode();
+        }
+        catch (err) {
+            console.warn('[PiAgent] resolvePermissionMode failed (non-fatal, using default):', err);
+            this.currentPermissionMode = 'default';
+        }
+        this.promptStartTime = Date.now();
+        // 2026-06-16: loop 自动重试 — runReActLoop 内部遇到 [AI 服务调用失败] sentinel 时,
+        //   会设 aiFailed=true 并提前 break. 这里在外层重跑整个 loop (不是单次 LLM 调用),
+        //   临时网络抖动 / 配额瞬时超限可自愈. 最多 3 次, 指数退避 1s/2s/4s.
+        //   用户看到 status bar 显示 "自动重试中 X/N" — 不暴露按钮.
+        const MAX_LOOP_RETRIES = 3;
+        let attempt = 0;
+        let result = '';
+        let lastAiFailureReason = '';
+        while (attempt <= MAX_LOOP_RETRIES) {
+            try {
+                const loopResult = await this.runReActLoop(onStream, signal);
+                result = loopResult.reply;
+                if (!loopResult.aiFailed)
+                    break; // 正常完成, 退出 retry 循环
+                lastAiFailureReason = loopResult.aiFailureReason || 'AI 调用失败';
+            }
+            catch (err) {
+                // abort 失败: 视作"已中断", 抛错让上层用 partial 兜底
+                this.currentOnStream = null;
+                this.currentSignal = null;
+                throw err;
+            }
+            attempt++;
+            if (attempt > MAX_LOOP_RETRIES) {
+                console.warn(`[PiAgent] loop 自动重试 ${MAX_LOOP_RETRIES} 次后仍失败, 终止`);
+                if (onStream) {
+                    onStream({ type: 'status', content: `⛔ loop 自动重试 ${MAX_LOOP_RETRIES} 次后仍失败: ${lastAiFailureReason}`, tool: 'system' });
+                }
+                result = lastAiFailureReason || 'AI 服务调用失败, 自动重试后仍不可用';
+                break;
+            }
+            const backoffMs = 1000 * Math.pow(2, attempt - 1); // 1s, 2s, 4s
+            console.log(`[PiAgent] loop 自动重试 ${attempt}/${MAX_LOOP_RETRIES}, 等待 ${backoffMs}ms`);
+            if (onStream) {
+                onStream({ type: 'status', content: `↻ 自动重试 loop ${attempt}/${MAX_LOOP_RETRIES} (${(backoffMs / 1000).toFixed(0)}s 后)`, tool: 'system' });
+            }
+            // 中途 abort 也要响应
+            await new Promise((resolve, reject) => {
+                const t = setTimeout(() => {
+                    signal?.removeEventListener?.('abort', onAbort);
+                    resolve();
+                }, backoffMs);
+                const onAbort = () => {
+                    clearTimeout(t);
+                    reject(new Error('aborted during retry backoff'));
+                };
+                if (signal?.aborted) {
+                    clearTimeout(t);
+                    reject(new Error('aborted during retry backoff'));
+                    return;
+                }
+                signal?.addEventListener?.('abort', onAbort, { once: true });
+            });
+            // 重试时要把这条 user message 从 history 里移除 (避免下一次 runReActLoop 又重复加入),
+            // 因为 messageHistory.push({role:'user'}) 在 promptStream 顶部已经做过, 重跑 runReActLoop 不会重复 push,
+            // 但 assistant 失败那条也别留 (留了会污染下一轮 LLM context).
+            // 简化: 重试前 pop 一次 assistant (如果最后一条是 assistant)
+            if (this.messageHistory.length > 0 && this.messageHistory[this.messageHistory.length - 1].role === 'assistant') {
+                this.messageHistory.pop();
+            }
+        }
         onStream({ type: 'done', content: '' });
+        // 回溯: 异步记录 usage (不等)
+        if (this.judgmentGateUsedIds.length > 0) {
+            recordJudgmentUsage(this.judgmentGateUsedIds, { userInput: input }).catch((err) => console.warn('[PiAgent] recordJudgmentUsage failed:', err));
+            // P0.5: 把 usedIds 通过 stream 事件回传给调用方 (server.ts 写到 session message)
+            try {
+                onStream({ type: 'used_judgments', usedIds: this.judgmentGateUsedIds, content: '' });
+            }
+            catch { }
+        }
+        // P3 监控门: fire-and-forget 审计 AI 回复是否违反原则
+        monitorAfterReply(input, result);
+        // Bootstrap Stop hook: fire-and-forget 写本次 session 摘要
+        const stopStartTime = this.promptStartTime || Date.now();
+        onStop({
+            channelId: this.currentChannelId || 'unknown',
+            durationMs: Date.now() - stopStartTime,
+            usedJudgmentIds: [...this.judgmentGateUsedIds],
+        }).catch((err) => console.warn('[PiAgent] onStop failed:', err));
+        // 用完即清, 避免污染下一轮
+        this.clearJudgmentGate();
+        this.currentOnStream = null;
+        this.currentSignal = null;
+        this.bootstrapAddition = '';
+        this.promptStartTime = 0;
         return result;
     }
-    async promptWithPivotLoop(input, config) {
+    async promptWithPivotLoop(input, config, channelId) {
+        this.currentChannelId = channelId ?? this.currentChannelId;
         if (!this.minimaxAvailable) {
             const response = await this.handleFallback(input);
             return {
@@ -824,12 +1055,14 @@ class PiAgentSession {
         for (const tool of this.tools.values()) {
             loop.registerTool(tool);
         }
+        // P0 注入门: 在构造 systemPrompt 之前算一次, 拼到末尾
+        await this.computeJudgmentGate(input);
         const personaSection = this.persona ? `
 角色描述: ${this.persona.description || '无'}
 性格特点: ${this.persona.personality || '无'}
 问候语: ${this.persona.greeting || '无'}
 ` : '';
-        const systemPrompt = `你是 ${this.identity.name}，基于ReAct (Reasoning + Acting)模式工作。${personaSection}
+        const systemPrompt = `${this.bootstrapAddition}你是 ${this.identity.name}，基于ReAct (Reasoning + Acting)模式工作。${personaSection}
 当前工作目录: ${this.cwd}
 当前身份: ${this.identity.name} (${this.identity.did})
 
@@ -846,31 +1079,98 @@ ${this.getToolDefinitions()}
 - 每次只调用一个工具
 - 仔细分析工具返回结果
 - 当任务完成时，必须在回答末尾添加 <final gen> 标记表示结束
-- 如果需要更多信息，继续调用工具`;
-        const result = await loop.execute(input, llm, systemPrompt);
+- 如果需要更多信息，继续调用工具${this.judgmentGateAddition}`;
+        // 2026-06-15: 把 currentOnStream 传给 loop, 让 step-timeline 在 pivot 循环里也能 emit step_start/done
+        //   之前 loop.execute() 不接 streamCallback, 导致 step-timeline 只能看到老 runReActLoop 路径
+        //   promptWithPivotLoop 路径 0 step events — UI 显示 timeline 但永远是空
+        const result = await loop.execute(input, llm, systemPrompt, this.currentOnStream ?? undefined);
         this.messageHistory.push({ role: 'user', content: input });
         if (result.response) {
             this.messageHistory.push({ role: 'assistant', content: result.response });
         }
+        // 回溯 + 清场
+        if (this.judgmentGateUsedIds.length > 0) {
+            recordJudgmentUsage(this.judgmentGateUsedIds, { userInput: input }).catch((err) => console.warn('[PiAgent] recordJudgmentUsage failed:', err));
+        }
+        this.clearJudgmentGate();
         return result;
     }
-    async runReActLoop(onStream) {
+    async runReActLoop(onStream, signal) {
         const llm = getMinimax();
         let iteration = 0;
         let finalResponse = '';
         let lastQualityScore = 0;
         let refineAttempts = 0;
         let consecutiveErrors = 0;
+        // 2026-06-16 新增: 累计错误数 (跨工具, 兜底防 LLM 轮换工具名死循环)
+        let totalErrors = 0;
         let lastFailedTool = ''; // 跟踪最近一次失败的 tool name
         let lastFailedToolCount = 0; // 最近失败工具的连续失败次数
+        // 2026-06-16: AI sentinel 标志 — runReActLoop 返回 aiFailed=true,
+        //   promptStream 据此自动重跑整个 loop 最多 N 次 (不是单次 LLM 重试)
+        let aiFailed = false;
+        let aiFailureReason = '';
         const MAX_CONSECUTIVE_ERRORS = 3;
         const MAX_SAME_TOOL_FAILURES = 3; // 同一工具连续失败 3 次, 强制让 LLM 给出最终答案
         // 发送循环开始的事件
         if (onStream) {
             onStream({ type: 'status', content: '🔄 开始 ReAct 循环...', tool: 'system' });
         }
+        // React Harness: 循环开始 (重置 turn 计数 + 触发 harness sessionStart)
+        // 失败静默 (fail-open), 不阻塞主循环
+        try {
+            await this.reactHarness.onSessionStart(this.currentChannelId || undefined);
+        }
+        catch (err) {
+            console.warn('[PiAgent] reactHarness.onSessionStart failed (non-fatal):', err);
+        }
         while (iteration < this.MAX_REACT_ITERATIONS) {
             iteration++;
+            // 停止条件 1: max turns (fail-safe 10000, 正常任务永远跑不到)
+            if (iteration >= this.MAX_REACT_ITERATIONS) {
+                console.warn(`[PiAgent] 达到最大循环数 ${this.MAX_REACT_ITERATIONS}, 强制终止 (fail-safe)`);
+                onStream?.({ type: 'error', content: `⏹️ 达到最大循环数 (${this.MAX_REACT_ITERATIONS}, fail-safe)`, tool: 'loop' });
+                finalResponse = finalResponse || '(本轮 ReAct 循环达到最大步数, 强制结束)';
+                break;
+            }
+            // 停止条件 2: signal.aborted (显式 abort / 用户中断)
+            if (signal?.aborted) {
+                console.warn('[PiAgent] runReActLoop aborted by signal');
+                onStream?.({ type: 'error', content: '⏹️ 用户中断', tool: 'loop' });
+                finalResponse = finalResponse || '(用户中断)';
+                break;
+            }
+            // 2026-06-16 新增: 累计错误兜底 — 跨工具, 防 LLM 轮换工具名绕过 MAX_SAME_TOOL_FAILURES
+            if (totalErrors >= this.MAX_TOTAL_ERRORS) {
+                console.warn(`[PiAgent] 累计错误 ${totalErrors} >= ${this.MAX_TOTAL_ERRORS}, 强制终止 (防死循环)`);
+                onStream?.({ type: 'error', content: `⛔ 累计 ${totalErrors} 次错误, 强制终止 (防止 LLM 死循环)`, tool: 'loop' });
+                finalResponse = finalResponse || `(本轮 ReAct 循环累计 ${totalErrors} 次错误, 强制结束。请换个思路或简化任务重试。)`;
+                break;
+            }
+            // 2026-06-16 新增: loop 内自动压缩 — token 超 80% 阈值时跑一次
+            // compact 失败走 C 路径: 不强行 break, 让现有 60K 阈值兜底 (后面有检查)
+            const compactThreshold = this.MAX_OUTPUT_TOKEN_ESCALATION_THRESHOLD * this.LOOP_COMPACT_RATIO;
+            const estimatedTokensBefore = this.estimateHistoryTokens();
+            if (estimatedTokensBefore > compactThreshold) {
+                const tokensBeforeCompact = estimatedTokensBefore;
+                console.log(`[PiAgent] loop 入口 token ${tokensBeforeCompact} > ${compactThreshold}, 触发自动压缩`);
+                onStream?.({ type: 'status', content: `🗜️ loop 自动压缩 (token ${tokensBeforeCompact} > ${compactThreshold})`, tool: 'compactor' });
+                try {
+                    await this.maybeAutoCompact(onStream, signal);
+                }
+                catch (compactErr) {
+                    // C 路径: compact 失败不 break, 让 token 阈值检查兜底
+                    console.warn(`[PiAgent] loop 内 maybeAutoCompact 失败 (non-fatal, 继续走 token 阈值):`, compactErr);
+                }
+            }
+            // 停止条件 3: context overflow (compact 后还超, 强制终止)
+            const estimatedTokens = this.estimateHistoryTokens();
+            if (estimatedTokens > this.MAX_OUTPUT_TOKEN_ESCALATION_THRESHOLD) {
+                console.warn(`[PiAgent] context overflow (${estimatedTokens} tokens > ${this.MAX_OUTPUT_TOKEN_ESCALATION_THRESHOLD})`);
+                onStream?.({ type: 'error', content: `⏹️ 上下文溢出 (${estimatedTokens} tokens, 阈值 ${this.MAX_OUTPUT_TOKEN_ESCALATION_THRESHOLD})`, tool: 'loop' });
+                finalResponse = finalResponse || '(本轮 ReAct 循环因上下文溢出终止)';
+                break;
+            }
             // 调试日志：显示每次循环开始
             console.log(`[PiAgent] 循环 ${iteration}/${this.MAX_REACT_ITERATIONS} 开始`);
             if (onStream) {
@@ -892,7 +1192,7 @@ ${this.getToolDefinitions()}
 性格特点: ${this.persona.personality || '无'}
 问候语: ${this.persona.greeting || '无'}
 ` : '';
-            const systemPrompt = `你是 ${this.identity.name}，基于ReAct (Reasoning + Acting)模式工作。${personaSection}
+            const systemPrompt = `${this.bootstrapAddition}你是 ${this.identity.name}，基于ReAct (Reasoning + Acting)模式工作。${personaSection}
 当前工作目录: ${this.cwd}
 当前身份: ${this.identity.name} (${this.identity.did})
 ${refineContext}
@@ -910,9 +1210,27 @@ ${toolDefs}
 - 每次只调用一个工具
 - 仔细分析工具返回结果
 - 当任务完成时，必须在回答末尾添加 <final gen> 标记表示结束
-- 如果需要更多信息，继续调用工具`;
-            const response = await llm.chat(context, systemPrompt);
-            const reply = response.reply.trim();
+- 如果需要更多信息，继续调用工具${this.judgmentGateAddition}`;
+            // 3 个恢复机制 (Claude Code 论文 9-step pipeline 内部):
+            //   1. max output token 升级 (最多 3 次, 每次 maxOutputTokens 翻倍)
+            //   2. reactive compaction (prompt 估算超阈值, 跑压缩)
+            //   3. prompt-too-long (LLM 报错 4xxx token 错误, 跑 reactive compaction 再试 1 次)
+            // 失败静默: 全部重试失败 → 空 reply (上层用 no tool_use 终止)
+            const response = await this.callLlmWithRecovery(llm, context, systemPrompt, signal, onStream);
+            const reply = (response.reply || '').trim();
+            // 2026-06-16: 看到 [AI 服务调用失败] sentinel → 不再立即 break,
+            // 而是设 aiFailed=true, 让外层 promptStream 自动重跑整个 loop 最多 N 次
+            // (LLM API 401 / 网络错 / 配额满时, pi-ai 返回这个 prefix;
+            //  自动 retry 兜底: 临时网络抖动可自愈, 真挂 N 次后才报失败)
+            if (reply.startsWith('[AI 服务调用失败]')) {
+                console.log(`[PiAgent] 收到 AI 错误 sentinel, 标记 aiFailed, 外层会自动重试整个 loop`);
+                aiFailed = true;
+                aiFailureReason = reply.length > 200 ? reply.substring(0, 200) : reply;
+                if (onStream) {
+                    onStream({ type: 'status', content: `⚠️ AI 调用失败, 将自动重试整个 loop`, tool: 'system' });
+                }
+                break;
+            }
             console.log(`[PiAgent] LLM 回复长度: ${reply.length}, 内容预览: "${reply.substring(0, 80)}..."`);
             console.log(`[PiAgent] LLM 完整回复:\n${reply}`);
             // 通知前端：收到 LLM 回复
@@ -944,19 +1262,160 @@ ${toolDefs}
                     if (toolCall.args && Object.keys(toolCall.args).length > 0) {
                         onStream({ type: 'status', content: `📋 参数: ${JSON.stringify(toolCall.args)}`, tool: toolCall.name });
                     }
+                    // 2026-06-15: step-timeline 状态机 — 开新节点
+                    onStream({
+                        type: 'step_start',
+                        content: `调用 ${toolCall.name}`,
+                        tool: toolCall.name,
+                        args: toolCall.args || {},
+                    });
                 }
                 const tool = this.tools.get(toolCall.name);
                 if (!tool) {
                     consecutiveErrors++;
+                    // 2026-06-16 新增: 未知工具也要累计 (LLM 幻觉高频场景)
+                    totalErrors++;
                     const errorResult = { success: false, error: `未知工具: ${toolCall.name}` };
                     this.messageHistory.push({ role: 'tool', content: JSON.stringify(errorResult), toolResult: errorResult });
                     this.logToHarness(toolCall.name, toolCall.args, errorResult);
-                    console.warn(`[PiAgent] 未知工具: ${toolCall.name}，跳过并继续`);
+                    console.warn(`[PiAgent] 未知工具: ${toolCall.name} (累计 ${totalErrors}/${this.MAX_TOTAL_ERRORS})，跳过并继续`);
                     continue;
                 }
+                // Bootstrap PreToolUse hook: 调工具前校验 (危险命令拦截)
+                // 失败静默 — hook 自身挂掉 = 放行
+                // P2: 透传 permissionMode (从 BootstrapOptions / env BOLLOON_PERM_MODE 解析)
+                let toolToExecute = tool;
+                try {
+                    const pre = await onPreToolUse({
+                        tool: toolCall.name,
+                        args: toolCall.args || {},
+                        permissionMode: this.currentPermissionMode,
+                    });
+                    if (!pre.allowed) {
+                        const deniedResult = {
+                            success: false,
+                            error: `PreToolUse 拒绝: ${pre.reason || '未通过安全校验'}`,
+                        };
+                        this.messageHistory.push({
+                            role: 'tool',
+                            content: JSON.stringify(deniedResult),
+                            toolResult: deniedResult,
+                        });
+                        this.logToHarness(toolCall.name, toolCall.args, deniedResult);
+                        if (onStream) {
+                            onStream({
+                                type: 'error',
+                                content: `🛡️ PreToolUse 拒绝 ${toolCall.name}: ${pre.reason || '安全校验失败'}`,
+                                tool: toolCall.name,
+                            });
+                            // 2026-06-15: step-timeline — 拦在 PreToolUse, 标 step_error
+                            onStream({
+                                type: 'step_error',
+                                content: `PreToolUse 拒绝 ${toolCall.name}`,
+                                tool: toolCall.name,
+                                error: pre.reason || '安全校验失败',
+                            });
+                        }
+                        console.warn(`[PiAgent] PreToolUse denied ${toolCall.name}: ${pre.reason}`);
+                        // 不调 tool.execute, 也不计 consecutiveErrors (这是用户级拒绝, 不是工具错)
+                        continue;
+                    }
+                }
+                catch (err) {
+                    console.warn('[PiAgent] onPreToolUse failed (non-fatal, allowing):', err);
+                }
+                // React Harness: 8-gate + builtin-guards 校验 (在 PreToolUse 之后, 串接双层)
+                // 失败静默, 拒绝时不调 tool.execute
                 try {
-                    const result = await tool.execute(toolCall.args);
-                    console.log(`[PiAgent] 工具 ${toolCall.name} 执行完成: success=${result.success}`);
+                    const pre = await this.reactHarness.preToolCall(toolCall.name, toolCall.args || {}, this.currentChannelId || undefined);
+                    if (!pre.allowed) {
+                        const deniedResult = {
+                            success: false,
+                            error: `Harness gate 拒绝 (${pre.details.rejectedBy}): ${pre.reason || '未通过安全校验'}`,
+                        };
+                        this.messageHistory.push({
+                            role: 'tool',
+                            content: JSON.stringify(deniedResult),
+                            toolResult: deniedResult,
+                        });
+                        this.logToHarness(toolCall.name, toolCall.args, deniedResult);
+                        if (onStream) {
+                            onStream({
+                                type: 'error',
+                                content: `🛡️ Harness ${pre.details.rejectedBy} 拒绝 ${toolCall.name}: ${pre.reason || '安全校验失败'}`,
+                                tool: toolCall.name,
+                            });
+                            // 2026-06-15: step-timeline — Harness gate 拒绝, 标 step_error
+                            onStream({
+                                type: 'step_error',
+                                content: `Harness 拒绝 ${toolCall.name}`,
+                                tool: toolCall.name,
+                                error: pre.reason || '安全校验失败',
+                            });
+                        }
+                        console.warn(`[PiAgent] Harness denied ${toolCall.name} (${pre.details.rejectedBy}): ${pre.reason}`);
+                        continue;
+                    }
+                }
+                catch (err) {
+                    console.warn('[PiAgent] reactHarness.preToolCall failed (non-fatal, allowing):', err);
+                }
+                try {
+                    const toolStart = Date.now();
+                    let result = await tool.execute(toolCall.args);
+                    const toolDurationMs = Date.now() - toolStart;
+                    console.log(`[PiAgent] 工具 ${toolCall.name} 执行完成: success=${result.success} (${toolDurationMs}ms)`);
+                    // PostToolUse 审计 hook: 写 audit log, 默认 continue
+                    try {
+                        await onPostToolUse({
+                            tool: toolCall.name,
+                            args: toolCall.args || {},
+                            result: {
+                                success: result.success,
+                                output: result.output?.substring(0, 500),
+                                error: result.error,
+                            },
+                            durationMs: toolDurationMs,
+                        });
+                    }
+                    catch (postErr) {
+                        console.warn('[PiAgent] onPostToolUse failed (non-fatal):', postErr);
+                    }
+                    // Context router: 拿最近一次 preToolCall 算的 hint, 拼到 tool result messageHistory
+                    // (LLM 下次看到 tool result 时, 能"记得"这次调用的安全约束)
+                    const routeHint = this.reactHarness.getLastRouteHint();
+                    if (routeHint && routeHint.systemAddition) {
+                        this.messageHistory.push({
+                            role: 'system',
+                            content: `[Harness Router Hint: ${routeHint.reason}]\n${routeHint.systemAddition}`,
+                        });
+                        this.reactHarness.clearRouteHint();
+                    }
+                    // React Harness: post-tool call (output 审计: secret leak 等)
+                    // 拒绝时 result.output 含敏感 → 替换为 generic message, 不污染 messageHistory
+                    try {
+                        const post = await this.reactHarness.postToolCall(toolCall.name, String(result.output || ''), this.currentChannelId || undefined);
+                        if (!post.allowed) {
+                            if (onStream) {
+                                onStream({
+                                    type: 'error',
+                                    content: `🛡️ Harness output 拒绝 ${toolCall.name}: ${post.reason || '输出含敏感信息'}`,
+                                    tool: toolCall.name,
+                                });
+                            }
+                            console.warn(`[PiAgent] Harness output denied ${toolCall.name}: ${post.reason}`);
+                            // 替换 result: success 仍保留 (tool 本身没错), 但 output 改成 generic
+                            // 这样 LLM 下轮看 output 不会拿到秘密, 但 success 标志让它知道 "工具执行了"
+                            result = {
+                                ...result,
+                                output: `[harness output gate: output 含敏感内容, 已屏蔽. 原因: ${post.reason || 'unknown'}]`,
+                                _harnessDenied: true,
+                            };
+                        }
+                    }
+                    catch (err) {
+                        console.warn('[PiAgent] reactHarness.postToolCall failed (non-fatal, allowing):', err);
+                    }
                     this.messageHistory.push({ role: 'tool', content: JSON.stringify(result), toolResult: result });
                     this.logToHarness(toolCall.name, toolCall.args, result);
                     // 通知前端工具执行结果
@@ -967,9 +1426,24 @@ ${toolDefs}
                                 const outputPreview = result.output.substring(0, 200);
                                 onStream({ type: 'tool', content: `📤 结果: ${outputPreview}${result.output.length > 200 ? '...' : ''}`, tool: toolCall.name });
                             }
+                            // 2026-06-15: step-timeline 状态机 — 关闭当前节点 (成功)
+                            onStream({
+                                type: 'step_done',
+                                content: `${toolCall.name} 执行成功`,
+                                tool: toolCall.name,
+                                success: true,
+                                output: result.output,
+                            });
                         }
                         else {
                             onStream({ type: 'error', content: `❌ ${toolCall.name} 执行失败: ${result.error}`, tool: toolCall.name });
+                            // 2026-06-15: step-timeline 状态机 — 关闭当前节点 (失败)
+                            onStream({
+                                type: 'step_error',
+                                content: `${toolCall.name} 执行失败`,
+                                tool: toolCall.name,
+                                error: result.error,
+                            });
                         }
                     }
                     if (result.success) {
@@ -991,6 +1465,8 @@ ${toolDefs}
                     }
                     else {
                         consecutiveErrors++;
+                        // 2026-06-16 新增: 累计错误 (跨工具, 兜底防 LLM 轮换工具名死循环)
+                        totalErrors++;
                         // 跟踪同一工具连续失败次数
                         if (toolCall.name === lastFailedTool) {
                             lastFailedToolCount++;
@@ -999,7 +1475,7 @@ ${toolDefs}
                             lastFailedTool = toolCall.name;
                             lastFailedToolCount = 1;
                         }
-                        console.warn(`[PiAgent] 工具 ${toolCall.name} 执行失败 (${lastFailedToolCount}/${MAX_SAME_TOOL_FAILURES}): ${result.error}`);
+                        console.warn(`[PiAgent] 工具 ${toolCall.name} 执行失败 (${lastFailedToolCount}/${MAX_SAME_TOOL_FAILURES}, 累计 ${totalErrors}/${this.MAX_TOTAL_ERRORS}): ${result.error}`);
                         // 同一工具连续失败达到上限, 不再重试, 强制 LLM 给出最终答案
                         if (lastFailedToolCount >= MAX_SAME_TOOL_FAILURES) {
                             console.log(`[PiAgent] 工具 ${toolCall.name} 连续 ${MAX_SAME_TOOL_FAILURES} 次失败, 放弃并要求直接回答`);
@@ -1025,10 +1501,12 @@ ${toolDefs}
                 }
                 catch (execError) {
                     consecutiveErrors++;
+                    // 2026-06-16 新增: 异常分支也要累计
+                    totalErrors++;
                     const errorResult = { success: false, error: String(execError) };
                     this.messageHistory.push({ role: 'tool', content: JSON.stringify(errorResult), toolResult: errorResult });
                     this.logToHarness(toolCall.name, toolCall.args, errorResult);
-                    console.error(`[PiAgent] 工具执行异常: ${execError}`);
+                    console.error(`[PiAgent] 工具执行异常 (累计 ${totalErrors}/${this.MAX_TOTAL_ERRORS}): ${execError}`);
                 }
             }
             else {
@@ -1046,7 +1524,10 @@ ${toolDefs}
                 const containsToolCallIntent = reply.includes('调用工具') || reply.includes('tool(') ||
                     reply.includes('使用工具') || reply.includes('需要获取') || reply.includes('需要查看') ||
                     // 兼容 LLM 用对象字面量输出 tool call (上轮没解析成功时, 至少要继续)
-                    reply.includes('tool =>') || reply.includes('[TOOL_CALL]');
+                    reply.includes('tool =>') || reply.includes('[TOOL_CALL]') ||
+                    // 2026-06-15 修: 兼容 LLM 用 XML 标签输出 tool call (<shell_exec>...</shell_exec>)
+                    //   这时 parseToolCall 失败, 至少要让 loop 继续
+                    /<\w+>[\s\S]*?<\/\w+>/.test(reply);
                 const hasError = ['不存在', '找不到', '无法找到', 'not found', 'does not exist',
                     '错误', 'error', '失败', 'failed'].some(k => reply.includes(k));
                 const isTooShort = reply.length < 50 && reply.length > 0;
@@ -1092,7 +1573,15 @@ Workspace root folder: ${this.cwd}
 `;
         finalResponse = identityPrefix + finalResponse;
         this.messageHistory.push({ role: 'assistant', content: finalResponse });
-        return finalResponse;
+        // React Harness: 循环结束
+        try {
+            await this.reactHarness.onSessionEnd();
+        }
+        catch (err) {
+            console.warn('[PiAgent] reactHarness.onSessionEnd failed (non-fatal):', err);
+        }
+        // 2026-06-16: 暴露 aiFailed 标志 — promptStream 据此决定是否自动重试整个 loop
+        return { reply: finalResponse, aiFailed, aiFailureReason: aiFailureReason || undefined };
     }
     async deepThink(prompt) {
         const result = await this.thinkingEngine.think(prompt);
@@ -1138,7 +1627,13 @@ Workspace root folder: ${this.cwd}
         return { outputs, success: allSuccess };
     }
     buildContext() {
-        const recentMessages = this.messageHistory.slice(-10);
+        // P1 接入: 同步跑前 3 层压缩 (Budget Reduction / Snip / Microcompact)
+        // 异步层 (Context Collapse / Auto-Compact) 在 promptStream 入口处单独跑 (用 LLM)
+        // 失败静默: 任何 stage 抛错 → 走老 slice(-10) 逻辑
+        //
+        // P1.2: 如果 maybeAutoCompact 算过 Context Collapse 投影, 用 this.projectedHistory (读时投影, 非破坏)
+        const source = this.projectedHistory ?? this.messageHistory;
+        const recentMessages = this.compressHistorySync(source).slice(-10);
         return recentMessages.map(m => {
             if (m.role === 'user')
                 return `用户: ${m.content}`;
@@ -1151,6 +1646,154 @@ Workspace root folder: ${this.cwd}
             return m.content;
         }).join('\n');
     }
+    /**
+     * 估算 messageHistory 的 token 数 (4 字符 ≈ 1 token, 与 context-compaction 同步).
+     * 失败静默: 任何异常 → 0 (不阻塞)
+     */
+    estimateHistoryTokens() {
+        try {
+            const { estimateTokens } = require('../context-compaction/index.js');
+            return estimateTokens(this.messageHistory);
+        }
+        catch {
+            return 0;
+        }
+    }
+    /**
+     * 3 个恢复机制合一:
+     *   1. max output token 升级: 最多 3 次, 每次 maxOutputTokens 翻倍 (如果 llm.chat 支持)
+     *   2. reactive compaction: 估算 > 80% 阈值, 跑 sync compressHistorySync + 必要时 maybeAutoCompact
+     *   3. prompt-too-long: LLM 报错 4xxx token 错误, 跑 reactive compaction 再试 1 次
+     *
+     * 失败静默: 全部失败 → 返回空 reply, 让上层 no-tool_use 终止
+     */
+    async callLlmWithRecovery(llm, context, systemPrompt, signal, onStream) {
+        // Reactive compaction 预检: 估算 token 超 80% 阈值, 跑一次
+        const estimated = this.estimateHistoryTokens();
+        if (estimated > this.MAX_OUTPUT_TOKEN_ESCALATION_THRESHOLD * 0.8) {
+            console.warn(`[PiAgent] reactive compaction pre-check (${estimated} tokens > 80% threshold)`);
+            onStream?.({ type: 'status', content: '⚠️ reactive compaction 预检触发', tool: 'recovery' });
+            try {
+                const compacted = this.compressHistorySync(this.messageHistory);
+                this.messageHistory = compacted;
+                if (this.estimateHistoryTokens() > this.MAX_OUTPUT_TOKEN_ESCALATION_THRESHOLD * 0.8) {
+                    await this.maybeAutoCompact(onStream, signal);
+                }
+            }
+            catch (err) {
+                console.warn('[PiAgent] reactive compaction pre-check failed:', err);
+            }
+        }
+        // 主调用 + 3 个恢复路径
+        let lastErr = null;
+        for (let attempt = 0; attempt <= this.MAX_OUTPUT_TOKEN_ESCALATION_RETRIES; attempt++) {
+            try {
+                const response = await llm.chat(context, systemPrompt, signal);
+                return { reply: response.reply || '' };
+            }
+            catch (err) {
+                lastErr = err;
+                const errMsg = String(err?.message || err || '');
+                const isPromptTooLong = /token|too long|exceed|length|context|4000|413|429/i.test(errMsg);
+                if (isPromptTooLong) {
+                    console.warn(`[PiAgent] prompt-too-long 触发 (attempt ${attempt + 1}), 跑 reactive compaction`);
+                    onStream?.({ type: 'status', content: `⚠️ prompt-too-long 触发 (attempt ${attempt + 1}/${this.MAX_OUTPUT_TOKEN_ESCALATION_RETRIES + 1})`, tool: 'recovery' });
+                    try {
+                        await this.maybeAutoCompact(onStream, signal);
+                    }
+                    catch (compactionErr) {
+                        console.warn('[PiAgent] reactive compaction on prompt-too-long failed:', compactionErr);
+                    }
+                    // 重新生成 context (compressHistorySync + projected)
+                    context = this.buildContext();
+                }
+                else {
+                    // 非 prompt-too-long 错误, 1 次重试就放弃
+                    if (attempt === 0) {
+                        console.warn(`[PiAgent] LLM 调用失败 (non-prompt-too-long), 1 次重试:`, err);
+                        continue;
+                    }
+                    break;
+                }
+            }
+        }
+        console.warn('[PiAgent] callLlmWithRecovery 全失败 (silent):', lastErr);
+        return { reply: '' };
+    }
+    /**
+     * 同步压缩: 跑前 3 层 (Budget Reduction / Snip / Microcompact).
+     * Context Collapse / Auto-Compact 是 async, 不在 buildContext 同步链里跑.
+     * 失败静默: 任何 stage 抛错 → 返回原 history.
+     */
+    compressHistorySync(history) {
+        try {
+            // context-compaction 的 Message 与 pi-sdk 的 Message 字段兼容
+            // 这里用 any cast 跳过 structural type 严格校验 (避免双向 import)
+            let h = history;
+            const r1 = budgetReduce(h);
+            h = r1.history;
+            const r2 = snip(h);
+            h = r2.history;
+            const r3 = microcompact(h);
+            h = r3.history;
+            return h;
+        }
+        catch (err) {
+            console.warn('[PiAgent] compressHistorySync failed (silent, using original):', err);
+            return history;
+        }
+    }
+    /**
+     * P1.1: 异步跑 Auto-Compact (LLM 摘要).
+     * 入口: promptStream 入口, 在 computeJudgmentGate 之后, onSessionStart 之前.
+     *
+     * 逻辑:
+     *   1. 跑完整 compactPipeline (5 层, 异步)
+     *   2. 第 5 层 (Auto-Compact) 需要 LLM, 通过 getMinimax().chat 注入
+     *   3. 如果 budgetGate 不超限, 5 层短路在前 3 层, 不会调 LLM → 零开销
+     *   4. 失败静默: 任何异常 → console.warn + 保留原 messageHistory
+     *
+     * onStream 广播: 跟 computeJudgmentGate 风格一致 (phase 事件供 UI timeline 显示)
+     */
+    async maybeAutoCompact(onStream, signal) {
+        if (this.messageHistory.length < 10)
+            return; // 历史太短, 不值得压
+        onStream?.({ type: 'status', content: '🗜️ 评估是否需要压缩上下文...', tool: 'compactor' });
+        // 注入 LLM (用 getMinimax().chat, 与 judgment 注入门 / ReAct 循环同一来源)
+        // 给 Context Collapse (虚拟投影) 和 Auto-Compact (摘要) 共用
+        const llm = getMinimax();
+        const llmChat = async (systemPrompt, userPrompt) => {
+            const r = await llm.chat(userPrompt, systemPrompt, signal);
+            return r.reply;
+        };
+        const { compactPipeline, isContextCollapseEnabled } = await import('../context-compaction/index.js');
+        const result = await compactPipeline(this.messageHistory, {
+            maxTokens: 8000,
+            llmChat,
+            collapseLlmChat: llmChat, // P1.2: Context Collapse 投影也用同一 LLM
+            cacheScope: this.currentChannelId || 'default',
+        });
+        if (result.compacted && result.history.length < this.messageHistory.length) {
+            const saved = this.messageHistory.length - result.history.length;
+            const stagesApplied = result.stages.filter((s) => s.applied).map((s) => s.stage).join(' → ');
+            onStream?.({
+                type: 'status',
+                content: `🗜️ 上下文压缩: ${stagesApplied || 'no-op'} | 节省 ${saved} 条 (剩余 ${result.history.length}, collapse=${isContextCollapseEnabled() ? 'on' : 'off'})`,
+                tool: 'compactor',
+            });
+            // 关键: 第 4 层 (Context Collapse) 是读时投影 (非破坏)
+            //       第 5 层 (Auto-Compact) 是破坏性折叠
+            //       这里用 if-else 区分: collapse on → 仅 buildContext 用; collapse off → 真更新
+            if (isContextCollapseEnabled()) {
+                this.projectedHistory = result.history; // buildContext 用
+                // messageHistory 不变 (非破坏)
+            }
+            else {
+                this.messageHistory = result.history; // 真破坏性更新
+                this.projectedHistory = null;
+            }
+        }
+    }
     isFinalResponse(content) {
         // 只有明确输出 <final gen> 才认为是最终回答
         return content.includes('<final gen>');
@@ -1190,6 +1833,9 @@ Workspace root folder: ${this.cwd}
             /\btool\s*=>\s*["'](\w+)["']/,
             // 兼容: [TOOL_CALL] 块内 JSON 形式 {"name": "x", "args": {...}}
             /\[TOOL_CALL\][\s\S]*?\{\s*"name"\s*:\s*"(\w+)"\s*,\s*"args"\s*:\s*(\{[\s\S]*?\})/i,
+            // 2026-06-15 修: 兼容 LLM 输出的 XML 格式 <tool_name>...<arg>value</arg>...</tool_name>
+            //   实际 LLM 习惯: <shell_exec>\n<command>ls</command>\n<args>["-la", "..."]</args>\n</shell_exec>
+            /<(\w+)>([\s\S]*?)<\/\1>/,
         ];
         for (const pattern of patterns) {
             const match = content.match(pattern);
@@ -1215,6 +1861,19 @@ Workspace root folder: ${this.cwd}
                         }
                     }
                 }
+                else if (rawArgs && /<\w+>[\s\S]*<\/\w+>/.test(rawArgs)) {
+                    // 2026-06-15 修: XML 格式, 解析内嵌子标签 <argname>value</argname>
+                    //   例: <command>ls</command>\n<args>["-la","~/.bolloon/skills"]</args>
+                    const xmlArgPattern = /<(\w+)>([\s\S]*?)<\/\1>/g;
+                    let xmlMatch;
+                    while ((xmlMatch = xmlArgPattern.exec(rawArgs)) !== null) {
+                        const argName = xmlMatch[1];
+                        const argValue = xmlMatch[2].trim();
+                        if (argName && argValue) {
+                            args[argName] = argValue;
+                        }
+                    }
+                }
                 else if (rawArgs) {
                     // 形参串, 形如 key: value, key2: value2
                     const argPairs = rawArgs.split(',').map(s => s.trim()).filter(Boolean);
@@ -1561,6 +2220,9 @@ ${this.extractOperationsFromRef(operationsRef)}
     updateIdentity(updates) {
         this.identity = { ...this.identity, ...updates };
     }
+    setCurrentChannelId(channelId) {
+        this.currentChannelId = channelId;
+    }
     getSessionState() {
         return this.sessionManager.getState();
     }