@bolloon/bolloon-agent 0.3.22 → 0.3.24

package/dist/agents/deny-pipeline.js

@@ -0,0 +1,116 @@
+/**
+ * deny-pipeline.ts — Unified Deny-First Pipeline (2026-07-29)
+ *
+ * 将分散在 system 各处的拒绝逻辑统一到一条管道:
+ *   1. deny-list  (Tool pre-filter — pi-sdk.ts _deniedToolNames)
+ *   2. hooks      (HooksEngine.checkToolUse — shell/LLM)
+ *   3. permission (permission-mode.ts — static mode)
+ *   4. judgment   (injectNegativeGuard — 负向判断力)
+ *
+ * 设计: deny-first
+ *   - 任何一层拒绝, 整个工具被阻塞
+ *   - 第一层拒绝后不再检查后续 (fail-fast)
+ *
+ * Claude Code 论文 7 层防御的简化实现:
+ *   第 1 层 = deny-list  (硬拒绝, 最便宜)
+ *   第 2 层 = permission (静态规则)
+ *   第 3 层 = hooks      (可编程策略, 中等成本)
+ *   第 4 层 = judgment   (LLM 评估, 最贵)
+ */
+/**
+ * Unified Deny Pipeline.
+ *
+ * 按顺序注册 checker, 每个 checker 返回 {denied} 表示是否拒绝该工具.
+ * 任何 checker 返回 denied=true 即中断, 不再执行后续.
+ */
+export class DenyPipeline {
+    checkers = [];
+    constructor() {
+        // 默认注册: 从 null 开始, 调用方按需 addChecker
+    }
+    /** 添加一个检查器 (按添加顺序执行) */
+    addChecker(checker) {
+        this.checkers.push(checker);
+    }
+    /** 清空所有检查器 (调试/测试用) */
+    clear() {
+        this.checkers = [];
+    }
+    /**
+     * 对工具执行完整 deny 检查.
+     * 返回第一个拒绝结果, 或 {denied: false} (全部通过).
+     */
+    async check(ctx) {
+        for (const checker of this.checkers) {
+            try {
+                const result = await checker(ctx);
+                if (result.denied) {
+                    return result;
+                }
+                // 如果 check 返回了 systemAddition, 累积
+                if (result.systemAddition) {
+                    // 当前 check 通过, 但携带了注入文本
+                }
+            }
+            catch (e) {
+                // checker 异常: 按 deny-first 原则, 异常视为拒绝 (安全侧)
+                return {
+                    denied: true,
+                    reason: `Deny check 异常: ${String(e)}`,
+                    source: `checker:${this.checkers.indexOf(checker)}`,
+                };
+            }
+        }
+        return { denied: false, reason: '', source: '' };
+    }
+    // ============== 工厂方法 ==============
+    /**
+     * 构建 deny-list checker.
+     * 检查工具名是否在 deny set 中.
+     */
+    static denyListChecker(deniedNames) {
+        return (ctx) => ({
+            denied: deniedNames.has(ctx.toolName),
+            reason: deniedNames.has(ctx.toolName)
+                ? `工具 ${ctx.toolName} 在拒绝列表中, 不允许调用`
+                : '',
+            source: 'deny-list',
+        });
+    }
+    /**
+     * 构建 permission-mode checker.
+     * default 模式: 禁用 shell_exec / git_commit / git_push 等危险工具
+     * bypassPermissions: 放行所有
+     */
+    static permissionChecker() {
+        const DEFAULT_DENY_TOOLS = new Set([
+            'shell_exec', 'git_commit', 'git_push', 'git_branch',
+            'delete_file', 'write_file', 'edit_file',
+        ]);
+        return (ctx) => {
+            if (ctx.permissionMode === 'bypassPermissions') {
+                return { denied: false, reason: '', source: 'permission' };
+            }
+            if (ctx.permissionMode === 'acceptEdits') {
+                // acceptEdits: 允许写文件, 但禁止 shell 和 git 操作
+                if (ctx.toolName === 'shell_exec' || ctx.toolName === 'git_commit' || ctx.toolName === 'git_push') {
+                    return {
+                        denied: true,
+                        reason: `当前 permission mode 为 acceptEdits, 工具 ${ctx.toolName} 受限. 如需调用请切换到 bypassPermissions.`,
+                        source: 'permission',
+                    };
+                }
+                return { denied: false, reason: '', source: 'permission' };
+            }
+            // default: 危险工具全禁
+            if (DEFAULT_DENY_TOOLS.has(ctx.toolName)) {
+                return {
+                    denied: true,
+                    reason: `当前 permission mode 为 default, 工具 ${ctx.toolName} 不允许调用. 如需调用请切换到 acceptEdits 或 bypassPermissions.`,
+                    source: 'permission',
+                };
+            }
+            return { denied: false, reason: '', source: 'permission' };
+        };
+    }
+}

package/dist/agents/parse-tool-call.js

@@ -222,21 +222,43 @@ export function parseAllToolCalls(content, ctx) {
         }
         catch { /* skip */ }
     }
+    // 8. 自闭合 XML 标签: <toolName attr1="val1" attr2="val2" />
+    const selfCloseRe = /<(\w+)((?:\s+\w+\s*=\s*["'][^"']*["'])*)\s*\/\s*>/g;
+    let scm;
+    while ((scm = selfCloseRe.exec(stripped)) !== null) {
+        const name = scm[1];
+        const attrStr = scm[2] || '';
+        const resolved = ctx.tools.has(name) ? name : resolve(ctx, name);
+        if (!resolved)
+            continue;
+        const args = {};
+        const attrRe = /(\w+)\s*=\s*["']([^"']*)["']/g;
+        let am;
+        while ((am = attrRe.exec(attrStr)) !== null) {
+            args[am[1]] = am[2].trim();
+        }
+        autoSplitCommand(args);
+        const key = resolved + JSON.stringify(args);
+        if (!seen.has(key)) {
+            seen.add(key);
+            results.push({ name: resolved, args });
+        }
+    }
     return results;
 }
 /** 从 XML 子标签中提取 args */
 function parseXmlArgs(rawArgs) {
     const args = {};
-    // <parameter name="X">value</parameter>
-    const paramRe = /<parameter\s+name=["'](\w+)["']>([\s\S]*?)<\/parameter>/g;
+    // <parameter name="X" ...>value</parameter>  — 允许额外属性如 string="true"
+    const paramRe = /<parameter\s+name=["'](\w+)["'][^>]*>([\s\S]*?)<\/parameter>/g;
     let pm;
     while ((pm = paramRe.exec(rawArgs)) !== null) {
         args[pm[1]] = pm[2].trim();
     }
     if (Object.keys(args).length > 0)
         return args;
-    // <param name="X">value</param>
-    const pRe = /<param\s+name=["'](\w+)["']>([\s\S]*?)<\/param>/g;
+    // <param name="X" ...>value</param>
+    const pRe = /<param\s+name=["'](\w+)["'][^>]*>([\s\S]*?)<\/param>/g;
     while ((pm = pRe.exec(rawArgs)) !== null) {
         args[pm[1]] = pm[2].trim().replace(/^["']|["']$/g, '');
     }

package/dist/agents/pi-sdk.js

@@ -41,6 +41,8 @@ import { onPostToolUse } from '../bootstrap/lifecycle-hooks.js';
 import { budgetReduce, snip, microcompact } from '../context-compaction/index.js';
 // React Harness: 8-gate + 4-guard (防越权 / 防 prompt 注入)
 import { ReactHarness } from '../security/react-harness.js';
+import { HooksEngine } from '../hooks/hooks-engine.js';
+import { DenyPipeline } from './deny-pipeline.js';
 import { parseToolCall as parseToolCallImpl, parseAllToolCalls, isFinalResponse as isFinalResponseImpl, extractFinalAnswer as extractFinalAnswerImpl } from './parse-tool-call.js';
 import { buildObservation, buildReflection, formatObservationWithReflection } from './error-classifier.js';
 import { sessionStore as defaultSessionStore } from './session-store.js';
@@ -105,6 +107,47 @@ export class PiAgentSession {
     currentPermissionMode = 'default';
     /** P1.2: Context Collapse 读时投影结果 (feature flag 开启时由 maybeAutoCompact 写入, buildContext 优先用) */
     projectedHistory = null;
+    /**
+     * 2026-07-29 (Tool pre-filter): 拒绝工具列表 — 这些工具从模型视野完全删除
+     * 模型"看不到"这些工具 (name/description/params 不在 system prompt 列出,
+     * 也不出现在 native API tools 参数中).
+     * 在 registerTools() 之后立即应用, 也可运行时通过 denyTool/allowTool 动态调整.
+     * 首次 getToolDefinitions() 调用时会缓存带过滤的结果.
+     */
+    _deniedToolNames = new Set();
+    /** 2026-07-29: Hook 引擎 */
+    _hooks = new HooksEngine();
+    /** 2026-07-29: Unified Deny-First Pipeline */
+    _denyPipeline = new DenyPipeline();
+    /** 2026-07-29: Snip + Context Collapse 启用标志 (默认启用) */
+    _enableSnipCollapse = true;
+    /** 注册一个或多个工具到拒绝列表 */
+    denyTool(...names) {
+        for (const name of names)
+            this._deniedToolNames.add(name);
+        // 拒绝列表变了, 清除缓存让下次 getToolDefinitions 重新生成
+        this.cachedToolDefinitions = '';
+    }
+    /** 从拒绝列表移除一个或多个工具 */
+    allowTool(...names) {
+        for (const name of names)
+            this._deniedToolNames.delete(name);
+        this.cachedToolDefinitions = '';
+    }
+    /** 获取当前拒绝列表 (快照) */
+    getDeniedTools() {
+        return Array.from(this._deniedToolNames);
+    }
+    /** 返回已过滤（剔除拒绝工具）的工具迭代器 */
+    allowedTools() {
+        const self = this;
+        return (function* () {
+            for (const [name, tool] of self.tools) {
+                if (!self._deniedToolNames.has(name))
+                    yield tool;
+            }
+        })();
+    }
     /**
      * Judgment 注入门临时结果: 在 prompt / promptStream / promptWithPivotLoop 入口算一次, 拼到本轮 systemPrompt 末尾
      * 每次调用都会重置 (避免上一轮遗留)
@@ -201,6 +244,54 @@ export class PiAgentSession {
         this.initSession();
         initDocumentReceiver();
         this.registerTools();
+        // 2026-07-29: 从环境变量加载默认拒绝工具列表 (逗号分隔)
+        //   BOLLOON_DENIED_TOOLS=shell_exec,git_commit 会在启动时拒绝高危险工具
+        try {
+            const envDenied = process.env.BOLLOON_DENIED_TOOLS;
+            if (envDenied && envDenied.trim()) {
+                const names = envDenied.split(',').map(n => n.trim()).filter(Boolean);
+                if (names.length > 0)
+                    this.denyTool(...names);
+            }
+        }
+        catch { /* env 读失败静默 */ }
+        // 2026-07-29: 从环境变量控制 Snip/Collapse
+        try {
+            if (process.env.BOLLOON_SNIP_COLLAPSE === '0')
+                this._enableSnipCollapse = false;
+        }
+        catch { /* 静默 */ }
+        // 2026-07-29: 从 ~/.bolloon/hooks.yaml 加载 hook 配置
+        //   失败静默 (无 hook 配置也正常)
+        try {
+            // fire-and-forget, 不阻塞构造
+            this._hooks.loadFromConfig().catch(() => { });
+        }
+        catch { /* 静默 */ }
+        // 2026-07-29: 初始化 DenyPipeline — 注册所有检查器
+        //   顺序: deny-list (最快) → permission → hooks → judgment
+        this._denyPipeline.addChecker(DenyPipeline.denyListChecker(this._deniedToolNames));
+        this._denyPipeline.addChecker(DenyPipeline.permissionChecker());
+        // 仅当启用了 hook 时注册 hooks 检查器
+        //   (hook 可能走到 LLM, 是最贵的, 放在最后)
+        this._denyPipeline.addChecker(async (ctx) => {
+            try {
+                const hookResult = await this._hooks.checkToolUse(ctx.toolName, ctx.toolArgs);
+                if (hookResult?.deny) {
+                    return {
+                        denied: true,
+                        reason: hookResult.reason || 'Hook 拒绝',
+                        source: 'hooks',
+                        systemAddition: hookResult.systemAddition,
+                    };
+                }
+                if (hookResult?.systemAddition) {
+                    this.contextHintAddition += '\n' + hookResult.systemAddition;
+                }
+            }
+            catch { /* hook 失败不阻塞 */ }
+            return { denied: false, reason: '', source: 'hooks' };
+        });
         this.loadSkills(config.skillsPaths);
         this.initHarness();
         // M2.3 (2026-06-17): 重启后 LLM 恢复记忆 — 从 session JSON 加载历史到 messageHistory
@@ -429,10 +520,12 @@ export class PiAgentSession {
     }
     getToolDefinitions() {
         // M2.4 (2026-06-17): 缓存 tool 定义 — registerTools() 在构造时调一次, 此后不变
+        // 2026-07-29: 拒绝列表变化时清空缓存, 重新生成
         if (this.cachedToolDefinitions)
             return this.cachedToolDefinitions;
         const defs = ['可用工具 (name(params) - 简介):'];
-        for (const tool of this.tools.values()) {
+        // 2026-07-29: 使用 allowedTools() 过滤掉拒绝列表中的工具
+        for (const tool of this.allowedTools()) {
             // 2026-06-19: 压缩 tool 定义 — 只显示参数名 (不显示描述, 减少 60% 长度)
             //   完整 description 在 history 第一轮注入 (getToolDefinitionsFull 调用), 后续轮只看简短
             //   避免 system prompt 太大导致 minimax 撞 max_tokens 输出空
@@ -521,7 +614,7 @@ export class PiAgentSession {
         }
         try {
             // 2026-06-16: runReActLoop 现在返回 { reply, aiFailed, aiFailureReason } — 这里只需 reply 字符串
-            const loopResult = await this.runReActLoop(undefined, options?.signal);
+            const loopResult = await this.runReActLoop(this.currentOnStream ?? undefined, options?.signal);
             return loopResult.reply;
         }
         finally {
@@ -925,6 +1018,11 @@ ${this.getToolDefinitions()}
         let aiFailureReason = '';
         const MAX_CONSECUTIVE_ERRORS = 3;
         const MAX_SAME_TOOL_FAILURES = 3; // 同一工具连续失败 3 次, 强制让 LLM 给出最终答案
+        // 2026-07-29: Hermes 风格硬限制 — 防死循环 (不再靠 soft hint)
+        const MAX_IDEMPOTENT_TOOL = 5; // 同工具成功调 5 次 → 注入 hint 强制 final gen
+        const MAX_TOOL_CALLS_PER_LOOP = 25; // 单轮循环总工具调用上限 → 注入 hint
+        let totalToolCallsThisLoop = 0;
+        const lastNTools = []; // 最近 MAX_IDEMPOTENT_TOOL 次工具名, 检测重复
         // 发送循环开始的事件
         if (onStream) {
             onStream({ type: 'status', content: '🔄 开始 ReAct 循环...', tool: 'system' });
@@ -937,6 +1035,11 @@ ${this.getToolDefinitions()}
         catch (err) {
             console.warn('[PiAgent] reactHarness.onSessionStart failed (non-fatal):', err);
         }
+        // 2026-07-29: Hook onLoopStart
+        try {
+            await this._hooks.fire('onLoopStart', { event: 'onLoopStart', channelId: this.currentChannelId, agentId: this.currentAgentId });
+        }
+        catch { /* hook 失败静默 */ }
         while (iteration < this.MAX_REACT_ITERATIONS) {
             iteration++;
             // 停止条件 1: max turns (fail-safe 10000, 正常任务永远跑不到)
@@ -955,6 +1058,21 @@ ${this.getToolDefinitions()}
                 finalResponse = finalResponse || '(用户中断)';
                 break;
             }
+            // 2026-07-29: Hermes 风格硬限制 (idempotent tool / total call cap)
+            if (totalToolCallsThisLoop >= MAX_TOOL_CALLS_PER_LOOP) {
+                console.warn(`[PiAgent] 单轮工具调用已达 ${MAX_TOOL_CALLS_PER_LOOP}, 注入 hint 让 LLM 总结`);
+                onStream?.({ type: 'error', content: `⏹️ 工具调用已达上限 (${MAX_TOOL_CALLS_PER_LOOP}), 请基于已有结果回答`, tool: 'loop' });
+                this.messageHistory.push({ role: 'system', content: `[注意] 你已连续调用 ${MAX_TOOL_CALLS_PER_LOOP} 次工具。请基于已有结果直接回答用户, 不要再次调用任何工具。在回答末尾加 <final gen> 标记结束。` });
+                totalToolCallsThisLoop = 0; // 重置计数器, 只防连续死循环
+            }
+            if (lastNTools.length >= MAX_IDEMPOTENT_TOOL && new Set(lastNTools).size === 1) {
+                const repeatedTool = lastNTools[0];
+                console.warn(`[PiAgent] 同工具 ${repeatedTool} 连续成功调 ${MAX_IDEMPOTENT_TOOL} 次, 注入 hint 让 LLM 总结`);
+                onStream?.({ type: 'error', content: `⏹️ 工具 ${repeatedTool} 重复调用 ${MAX_IDEMPOTENT_TOOL} 次, 请基于已有结果回答`, tool: 'loop' });
+                this.messageHistory.push({ role: 'system', content: `[注意] 你已连续 ${MAX_IDEMPOTENT_TOOL} 次调用 ${repeatedTool}。请基于已有结果直接回答用户, 不要再次调用任何工具。在回答末尾加 <final gen> 标记结束。` });
+                lastNTools.length = 0; // 重置计数器
+                // 不 break — 让 LLM 在下一轮用已有信息回答
+            }
             // 2026-06-16 新增: 累计错误兜底 — 跨工具, 防 LLM 轮换工具名绕过 MAX_SAME_TOOL_FAILURES
             if (totalErrors >= this.MAX_TOTAL_ERRORS) {
                 console.warn(`[PiAgent] 累计错误 ${totalErrors} >= ${this.MAX_TOTAL_ERRORS}, 强制终止 (防死循环)`);
@@ -963,7 +1081,7 @@ ${this.getToolDefinitions()}
                 if (this.successfulToolResults.length > 0) {
                     finalResponse = `✅ 之前步骤成功执行了 ${this.successfulToolResults.length} 个工具 (但 LLM 后续 ${totalErrors} 次调用失败):\n` +
                         this.successfulToolResults.map((r, i) => `  ${i + 1}. ${r.tool}: ${r.outputPreview}`).join('\n') +
-                        `\n\n⚠️ (LLM 连续失败, 可能是 minimax 上游限流/网络问题, 工具已成功执行但 LLM 没能继续总结)`;
+                        `\n\n⚠️ (LLM 连续失败, 可能是上游限流/网络问题, 工具已成功执行但 LLM 没能继续总结)`;
                 }
                 else {
                     finalResponse = finalResponse || `(本轮 ReAct 循环累计 ${totalErrors} 次错误, 强制结束。请换个思路或简化任务重试。)`;
@@ -1051,9 +1169,31 @@ ${toolDefs}
             //   2. reactive compaction (prompt 估算超阈值, 跑压缩)
             //   3. prompt-too-long (LLM 报错 4xxx token 错误, 跑 reactive compaction 再试 1 次)
             // 失败静默: 全部重试失败 → 空 reply (上层用 no tool_use 终止)
-            // Bug 5: pass tool IDs for native OpenAI tool calling
-            const toolIds = Array.from(this.tools.keys());
-            const response = await this.callLlmWithRecovery(llm, messages, systemPrompt, signal, onStream, toolIds);
+            // Bug 5: pass tool IDs for native OpenAI tool calling — 2026-07-29: 过滤拒绝工具
+            const toolIds = Array.from(this.tools.keys()).filter(n => !this._deniedToolNames.has(n));
+            // 2026-07-29: 从 this.tools Map 生成 OpenAI 原生 tools 格式 (含参数 schema)
+            const openaiFormattedTools = [];
+            for (const [name, tool] of this.tools) {
+                if (this._deniedToolNames.has(name))
+                    continue;
+                const params = tool.parameters || {};
+                const properties = {};
+                const required = [];
+                for (const [pName, pDesc] of Object.entries(params)) {
+                    properties[pName] = { type: 'string', description: String(pDesc) };
+                    if (String(pDesc).includes('必填'))
+                        required.push(pName);
+                }
+                openaiFormattedTools.push({
+                    type: 'function',
+                    function: {
+                        name,
+                        description: tool.description || name,
+                        parameters: { type: 'object', properties, required },
+                    },
+                });
+            }
+            const response = await this.callLlmWithRecovery(llm, messages, systemPrompt, signal, onStream, openaiFormattedTools);
             const reply = (response.reply || '').trim();
             // 2026-06-30: OpenAI 协议 native tool_calls (LLM 真产了 tool_call 时, minimax/M3 会返回 id)
             const nativeToolCalls = response.toolCalls;
@@ -1106,7 +1246,7 @@ ${toolDefs}
                 if (onStream) {
                     onStream({ type: 'status', content: `⚠️ AI 调用失败 ${totalErrors}/${this.MAX_TOTAL_ERRORS}, 已 push 错误到 history 让 LLM 反思`, tool: 'system' });
                 }
-                // 退避 2s 后继续 — 临时 minimax 限流避开, 不让 loop 终止
+                // 退避 2s 后继续 — 临时上游限流避开, 不让 loop 终止
                 await new Promise(resolve => setTimeout(resolve, 2000));
                 // 关键: 不设 aiFailed=true, 让外层不重试整个 loop (重置 history), 继续内层循环
                 continue;
@@ -1184,6 +1324,29 @@ ${toolDefs}
                             args: toolCall.args || {},
                         });
                     }
+                    // 2026-07-29: Unified Deny-First Pipeline — 统合所有拒绝检查
+                    let denyResult = { denied: false, reason: '', source: '' };
+                    try {
+                        denyResult = await this._denyPipeline.check({
+                            toolName: toolCall.name,
+                            toolArgs: toolCall.args || {},
+                            permissionMode: this.currentPermissionMode,
+                            channelId: this.currentChannelId,
+                            agentId: this.currentAgentId,
+                        });
+                    }
+                    catch { /* pipeline 失败不阻塞工具调用 */ }
+                    if (denyResult.denied) {
+                        consecutiveErrors++;
+                        totalErrors++;
+                        const denyResultMsg = { success: false, error: `拒绝: [${denyResult.source}] ${denyResult.reason}` };
+                        this.messageHistory.push({ role: 'tool', content: JSON.stringify(denyResultMsg), toolResult: denyResultMsg });
+                        this.logToHarness(toolCall.name, toolCall.args, denyResultMsg);
+                        continue;
+                    }
+                    if (denyResult.systemAddition) {
+                        this.contextHintAddition += '\n' + denyResult.systemAddition;
+                    }
                     const tool = this.tools.get(toolCall.name);
                     if (!tool) {
                         consecutiveErrors++;
@@ -1222,6 +1385,26 @@ ${toolDefs}
                                 onStream({ type: 'step_error', content: `PreToolUse 拒绝 ${toolCall.name}`, tool: toolCall.name, error: pre.reason || '安全校验失败' });
                             }
                             console.warn(`[PiAgent] PreToolUse denied ${toolCall.name}: ${pre.reason}`);
+                            // 拒绝也算错误, 让错误恢复机制触发
+                            consecutiveErrors++;
+                            totalErrors++;
+                            if (toolCall.name === lastFailedTool) {
+                                lastFailedToolCount++;
+                            }
+                            else {
+                                lastFailedTool = toolCall.name;
+                                lastFailedToolCount = 1;
+                            }
+                            if (lastFailedToolCount >= MAX_SAME_TOOL_FAILURES) {
+                                this.messageHistory.push({ role: 'system', content: `[注意] 工具 ${toolCall.name} 被系统拒绝 (连续 ${MAX_SAME_TOOL_FAILURES} 次). 请不要再次尝试, 直接用已有信息回答用户, 末尾加 <final gen>.` });
+                                lastFailedTool = '';
+                                lastFailedToolCount = 0;
+                                consecutiveErrors = 0;
+                            }
+                            else if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+                                this.messageHistory.push({ role: 'system', content: `[注意] 连续 ${consecutiveErrors} 次工具调用被系统拒绝. 请换其他工具或直接回答用户, 末尾加 <final gen>.` });
+                                consecutiveErrors = 0;
+                            }
                             continue;
                         }
                     }
@@ -1240,6 +1423,25 @@ ${toolDefs}
                                 onStream({ type: 'step_error', content: `Harness 拒绝 ${toolCall.name}`, tool: toolCall.name, error: pre.reason || '安全校验失败' });
                             }
                             console.warn(`[PiAgent] Harness denied ${toolCall.name} (${pre.details.rejectedBy}): ${pre.reason}`);
+                            consecutiveErrors++;
+                            totalErrors++;
+                            if (toolCall.name === lastFailedTool) {
+                                lastFailedToolCount++;
+                            }
+                            else {
+                                lastFailedTool = toolCall.name;
+                                lastFailedToolCount = 1;
+                            }
+                            if (lastFailedToolCount >= MAX_SAME_TOOL_FAILURES) {
+                                this.messageHistory.push({ role: 'system', content: `[注意] 工具 ${toolCall.name} 被 Harness 拒绝 (连续 ${MAX_SAME_TOOL_FAILURES} 次). 请不要再次尝试, 末尾加 <final gen>.` });
+                                lastFailedTool = '';
+                                lastFailedToolCount = 0;
+                                consecutiveErrors = 0;
+                            }
+                            else if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+                                this.messageHistory.push({ role: 'system', content: `[注意] 连续 ${consecutiveErrors} 次工具调用被 Harness 拒绝. 请换其他工具或直接回答.` });
+                                consecutiveErrors = 0;
+                            }
                             continue;
                         }
                     }
@@ -1292,6 +1494,11 @@ ${toolDefs}
                         }
                         if (result.success) {
                             consecutiveErrors = 0;
+                            // 2026-07-29: Hermes 风格硬限制计数
+                            totalToolCallsThisLoop++;
+                            lastNTools.push(toolCall.name);
+                            if (lastNTools.length > MAX_IDEMPOTENT_TOOL)
+                                lastNTools.shift();
                             if (result.output) {
                                 this.successfulToolResults.push({ tool: toolCall.name, outputPreview: result.output.substring(0, 200) + (result.output.length > 200 ? '...' : '') });
                             }
@@ -1390,6 +1597,13 @@ ${toolDefs}
                         continue;
                     }
                     lastQualityScore = this.estimateResponseQuality(reply);
+                    // 2026-07-29: 质量门 — 即使 LLM 声称完成, 质量太低也继续
+                    if (lastQualityScore < this.QUALITY_THRESHOLD && refineAttempts < this.MAX_REFINE_ATTEMPTS) {
+                        console.log(`[PiAgent] final gen 质量 ${lastQualityScore.toFixed(2)} < ${this.QUALITY_THRESHOLD}, 注入 refine hint`);
+                        this.messageHistory.push({ role: 'system', content: `[质量检查] 你的回答质量评分为 ${(lastQualityScore * 10).toFixed(1)}/10, 低于 ${(this.QUALITY_THRESHOLD * 10).toFixed(1)}/10 阈值。请提供更完整、详细的回答, 包含工具调用获取到的具体信息, 末尾加 <final gen>。` });
+                        refineAttempts++;
+                        continue;
+                    }
                     finalResponse = this.extractFinalAnswer(reply);
                     break;
                 }
@@ -1521,55 +1735,24 @@ ${toolDefs}
      */
     buildMessages() {
         try {
-            const recentMessages = this.compressHistorySync(this.messageHistory).slice(-15);
+            // 直接取 history 最后 15 条, tool 结果转 user role, 避免 tool_calls 配对
+            const slice = this.messageHistory.slice(-15);
             const out = [];
-            for (const m of recentMessages) {
-                const role = m.role;
-                let content = m.content;
-                // 2026-06-30 修: OpenAI 协议 tool role 必须带 tool_call_id, 否则 minimax (OpenAI-compatible) 报 400
-                //   bolloon 之前把所有 tool result 包成 "[工具结果] ..." 当 user/assistant role 发, minimax 严格校验失败
-                //   现在: 保留 role='tool' + 加 tool_call_id 字段 (用 messageHistory 里自己生成的 id)
-                if (role === 'tool') {
-                    const toolCallId = m.toolCallId || m.toolCall?.id || '';
-                    const result = m.toolResult;
-                    out.push({
-                        role: 'tool',
-                        content: result ? (typeof result === 'string' ? result : JSON.stringify(result)) : content,
-                        tool_call_id: toolCallId,
-                        name: m.toolCall?.name || '',
-                    });
+            for (const m of slice) {
+                const r = m.role;
+                if (r === 'tool') {
+                    out.push({ role: 'user', content: `[工具结果]\n${m.content || ''}` });
                     continue;
                 }
-                // system role (router hint 等) 直接保留
-                if (role === 'system') {
-                    out.push({ role: 'system', content });
+                if (r === 'assistant') {
+                    out.push({ role: 'assistant', content: m.content || '' });
                     continue;
                 }
-                // 2026-06-30 修: assistant 消息如果带 toolCall (bolloon 内部对象), emit OpenAI 协议的 tool_calls 数组
-                //   minimax 严格要求 assistant 消息含 tool_calls 字段, 后续 tool result 才能引用 tool_call_id
-                if (role === 'assistant') {
-                    const tc = m.toolCall;
-                    if (tc && tc.id) {
-                        out.push({
-                            role: 'assistant',
-                            content: content || '',
-                            tool_calls: [{
-                                    id: tc.id,
-                                    type: 'function',
-                                    function: {
-                                        name: tc.name,
-                                        arguments: JSON.stringify(tc.args || {}),
-                                    },
-                                }],
-                        });
-                    }
-                    else {
-                        out.push({ role, content });
-                    }
-                    continue;
+                if (r === 'user') {
+                    out.push({ role: 'user', content: m.content || '' });
                 }
-                if (role === 'user') {
-                    out.push({ role, content });
+                if (r === 'system') {
+                    out.push({ role: 'system', content: m.content || '' });
                 }
             }
             return out;
@@ -1688,6 +1871,20 @@ ${toolDefs}
                         contextOrMessages = this.buildContext();
                     }
                 }
+                else if (errMsg.includes('insufficient tool messages') || errMsg.includes('must be followed by tool messages')) {
+                    // 2026-07-29: 特殊的 400 错误 — tool_calls 配对异常, 降级为纯文本 context
+                    console.warn('[PiAgent] insufficient tool messages — 降级为 buildContext 文本');
+                    if (Array.isArray(contextOrMessages)) {
+                        contextOrMessages = this.buildContext();
+                        // 也清除最近一轮的 toolCalls, 防止再触发
+                        if (this.messageHistory.length > 1) {
+                            const last = this.messageHistory[this.messageHistory.length - 1];
+                            if (last.role === 'assistant' && last.toolCalls) {
+                                delete last.toolCalls;
+                            }
+                        }
+                    }
+                }
                 else {
                     // 指数退避
                     await new Promise((r) => setTimeout(r, backoffMs(attempt)));