@yeaft/webchat-agent 1.0.513 → 1.0.515

package/yeaft/sub-agent/execution-control.js

@@ -2,6 +2,22 @@
 import { createHash } from 'node:crypto';
 import { ToolRegistry, isToolErrorOutput } from '../tools/registry.js';
 
+export const BUDGET_FIELDS = ['max_tokens', 'max_turns', 'max_tool_calls', 'max_llm_calls', 'wall_time_ms'];
+
+/** Validate a partial budget. Updates use absolute lifetime ceilings, never reset usage. */
+export function validateBudget(budget) {
+  if (!budget || typeof budget !== 'object' || Array.isArray(budget)) return 'budget must be an object';
+  for (const key of Object.keys(budget)) {
+    if (!BUDGET_FIELDS.includes(key)) return `unknown budget field: ${key}`;
+    const value = budget[key];
+    if (!Number.isFinite(value) || value <= 0
+        || (key !== 'max_tokens' && !Number.isSafeInteger(value))) {
+      return `budget.${key} must be finite and positive (counts and milliseconds must be integers)`;
+    }
+  }
+  return null;
+}
+
 /** Defaults are safety ceilings, not targets; explicit positive limits override each field. */
 export function resolveSubAgentBudget(budget, persona) {
   return {
@@ -25,11 +41,10 @@ function fingerprint(value) {
  * Parent Active Tool Set checks remain independent and must not be bypassed.
  */
 export class SubAgentToolRegistry extends ToolRegistry {
-  constructor({ allows = () => true, agent = null, stopBudget = null } = {}) {
+  constructor({ allows = () => true, agent = null } = {}) {
     super();
     this.allows = allows;
     this.agent = agent;
-    this.stopBudget = stopBudget;
     this.recentFingerprints = [];
   }
 
@@ -38,9 +53,53 @@ export class SubAgentToolRegistry extends ToolRegistry {
     return this;
   }
 
+  /** Provider-boundary guidance: leave the original tool results untouched. */
+  prepareProviderRequest() {
+    const agent = this.agent;
+    if (!agent) return null;
+    const stats = agent.execution || createExecutionStats();
+    const limit = agent.budget?.max_tool_calls;
+    const llmLimit = agent.budget?.max_llm_calls;
+    const llmCalls = agent.usage?.llmCalls || 0;
+    const reason = limit && stats.toolCalls >= limit ? `max_tool_calls (${limit}) reached`
+      : llmLimit && llmCalls >= llmLimit ? `max_llm_calls (${llmLimit}) reached` : null;
+    if (reason) {
+      agent.executionBudgetReason ||= reason;
+      agent.budgetReportStarted = true;
+      return {
+        finalize: true,
+        maxOutputTokens: 4096,
+        prompt: `[Sub-agent execution limit] ${reason}; ${stats.toolCalls} tools and ${llmCalls} LLM requests used. No more tools are available. Use the evidence already in this conversation to return your final handoff now: conclusion, supported findings, actual verification, and any unexamined scope or blockers. Do not claim a complete review if checks remain unfinished. This is the single reserved reporting response; do not plan further work.`,
+      };
+    }
+    const nearLimit = (limit && stats.toolCalls >= Math.ceil(limit * 0.75))
+      || (llmLimit && llmCalls >= Math.ceil(llmLimit * 0.75));
+    const elapsedMs = Date.now() - (agent.usage?.startedAt || Date.now());
+    const nearTime = agent.budget?.wall_time_ms && elapsedMs >= agent.budget.wall_time_ms * 0.75;
+    const updated = agent.controlRevision ? `[Parent control revision ${agent.controlRevision}] Current lifetime ceilings replace the initial preamble: ${JSON.stringify(agent.budget)}. Extra tool grants: ${JSON.stringify(agent.allowTools || [])}. Use DiscoverTools if an allowed tool is not yet visible.\n` : '';
+    return nearLimit || nearTime || updated ? {
+      prompt: `${updated}[Sub-agent execution budget] ${stats.toolCalls}/${limit ?? 'unset'} tools, ${llmCalls}/${llmLimit ?? 'unset'} LLM requests used; ${Math.max(0, (agent.budget?.wall_time_ms || 0) - elapsedMs)}ms remaining. Finish the assigned result using existing evidence where possible. Investigate only essential remaining unknowns, then return a conclusion.`,
+    } : null;
+  }
+
+  /** Reserve at actual Engine dispatch (including retries), not UI turn_start. */
+  reserveProviderRequest({ reporting = false } = {}) {
+    const agent = this.agent;
+    if (!agent) return;
+    if (agent.abortController?.signal.aborted) throw new Error('Sub-agent aborted');
+    const usage = agent.usage ||= { tokens: 0, turns: 0, startedAt: Date.now() };
+    if (reporting) {
+      if (usage.reportingLlmCalls) throw new Error('Sub-agent reporting request already used');
+      usage.reportingLlmCalls = 1;
+    } else if (agent.budget?.max_llm_calls && (usage.llmCalls || 0) >= agent.budget.max_llm_calls) {
+      throw new Error(`max_llm_calls (${agent.budget.max_llm_calls}) reached before dispatch`);
+    }
+    usage.llmCalls = (usage.llmCalls || 0) + 1;
+  }
+
   async execute(name, input, ctx = {}) {
     const tool = this.get(name);
-    if (!tool) throw new Error(`Unknown or disallowed child tool: ${name}`);
+    if (!tool || !this.allows(tool)) throw new Error(`Unknown or disallowed child tool: ${name}`);
     const agent = this.agent;
     if (!agent) return super.execute(name, input, ctx);
     // Serial dispatch can resume after a tool_start yield; never start a write
@@ -50,9 +109,10 @@ export class SubAgentToolRegistry extends ToolRegistry {
     const stats = agent.execution || (agent.execution = createExecutionStats());
     const limit = agent.budget?.max_tool_calls;
     if (limit !== undefined && stats.toolCalls >= limit) {
-      const reason = `max_tool_calls (${limit}) reached; return partial evidence to the parent before extending scope`;
-      this.stopBudget?.(reason);
-      throw new Error(reason);
+      // Fence dispatch without aborting already reserved parallel calls. The
+      // next provider boundary gets one tool-free response with their evidence.
+      agent.toolBudgetReason ||= `max_tool_calls (${limit}) reached`;
+      throw new Error(`${agent.toolBudgetReason}; no further tools may execute. Return findings from the available evidence.`);
     }
     stats.toolCalls += 1;
     agent.usage ||= { tokens: 0, turns: 0, startedAt: Date.now() };

package/yeaft/sub-agent/liveness.js

@@ -135,7 +135,15 @@ export function diagnoseAgentLiveness(agent, opts = {}) {
       ...agent.execution,
       recentCalls: agent.execution.recentCalls.map(call => ({ ...call })),
       remainingToolCalls: Math.max(0, (agent.budget?.max_tool_calls || 0) - agent.execution.toolCalls),
-      limits: agent.budget,
+      limits: { ...agent.budget },
+      llmCalls: agent.usage?.llmCalls || 0,
+      reportingLlmCalls: agent.usage?.reportingLlmCalls || 0,
+      remainingLlmCalls: agent.budget?.max_llm_calls === undefined ? null
+        : Math.max(0, agent.budget.max_llm_calls - (agent.usage?.llmCalls || 0)),
+      remainingWallTimeMs: agent.budget?.wall_time_ms === undefined ? null
+        : Math.max(0, agent.budget.wall_time_ms - (now - (agent.usage?.startedAt || now))),
+      allowTools: [...(agent.allowTools || [])],
+      controlRevision: agent.controlRevision || 0,
       progressNote: 'Execution counts and repeated results are diagnostics, not proof of semantic progress or stalling.',
     } : null,
     msSinceLastEvent: liveness.msSinceLastEvent ?? msSinceActivity,

package/yeaft/sub-agent/runner.js

@@ -39,6 +39,7 @@ import { Engine } from '../engine.js';
 import { snapshotEffortDecision } from '../effort.js';
 import { SubAgentToolRegistry, resolveSubAgentBudget, createExecutionStats } from './execution-control.js';
 import { getPersona } from '../personas.js';
+import { RESTRICTED_TOOLS, createChildToolPolicy } from './tool-access.js';
 import { buildSpawnedPreamble } from './spawned-prompt.js';
 import { STATUS, isTerminalAgentStatus } from './status.js';
 import { createOutputLog } from './output-log.js';
@@ -59,19 +60,6 @@ async function loadTickAgent() {
   return _tickAgent;
 }
 
-const RESTRICTED_TOOLS = new Set([
-  'SpawnAgent',
-  'Agent',          // legacy alias
-  'PromptAgent',
-  'SendMessage',    // legacy alias
-  'WaitAgent',
-  'CloseAgent',
-  'ListAgents',
-  'RouteForward',
-  'AskUser',
-  'CreateWorkItem',
-]);
-
 /** How long an idle sub-agent may wait for a follow-up before the watchdog reaps it. */
 const IDLE_ABANDON_MS = 5 * 60 * 1000; // 5 minutes
 
@@ -85,24 +73,11 @@ const LAST_RESULT_MAX_CHARS = 8 * 1024;
  * @param {ToolRegistry|null} parentRegistry
  * @returns {ToolRegistry}
  */
-export function buildChildToolRegistry(parentRegistry, { agent = null, stopBudget = null } = {}) {
-  const preset = agent?.personaData || getPersona(agent?.persona);
-  // Implementers retain work tools; read-only roles are a structural allowlist.
-  // Resolve legacy template names (Read) to canonical FileRead before filtering.
-  const allowed = preset && preset.id !== 'implementer'
-    ? new Set([...preset.tools.map(name => parentRegistry?.get(name)?.name || (name === 'Read' ? 'FileRead' : name)), 'DiscoverTools'])
-    : null;
-  const child = new SubAgentToolRegistry({
-    agent, stopBudget,
-    allows: tool => !RESTRICTED_TOOLS.has(tool.name) && (!allowed || allowed.has(tool.name)),
-  });
-  if (!parentRegistry || typeof parentRegistry.getAllTools !== 'function') {
-    return child;
-  }
-  for (const t of parentRegistry.getAllTools()) {
-    if (RESTRICTED_TOOLS.has(t.name)) continue;
-    child.register(t);
-  }
+export function buildChildToolRegistry(parentRegistry, { agent = null } = {}) {
+  const policy = createChildToolPolicy(parentRegistry, agent);
+  const child = new SubAgentToolRegistry({ agent, allows: policy.allows });
+  policy.refresh(child);
+  if (agent) agent.refreshToolPolicy = () => policy.refresh(child);
   return child;
 }
 
@@ -164,10 +139,7 @@ export function startSubAgent(agent, deps = {}) {
     // sub-agent (matches parent VP persona memory).
     agent.budget = resolveSubAgentBudget(agent.budget, agent.persona);
     agent.execution = agent.execution || createExecutionStats();
-    const childRegistry = buildChildToolRegistry(deps.parentToolRegistry, {
-      agent,
-      stopBudget: reason => stopForBudget(agent, reason),
-    });
+    const childRegistry = buildChildToolRegistry(deps.parentToolRegistry, { agent });
     subEngine = new Engine({
       adapter: deps.adapter,
       trace: deps.trace,
@@ -214,6 +186,7 @@ export function startSubAgent(agent, deps = {}) {
       expectedOutput: agent.expected_output,
       presetPrompt: (agent.personaData || getPersona(agent.persona))?.systemPrompt,
       budget: agent.budget,
+      allowTools: agent.allowTools || [],
       language: deps.language ?? deps.config?.language ?? 'en',
     });
 
@@ -262,6 +235,7 @@ export function startSubAgent(agent, deps = {}) {
     agent.outputFile = null;
     agent.subEngine = null;
     agent.subVpPersona = null;
+    agent.refreshToolPolicy = null;
     agent.__driverStarted = false;
     throw err;
   }
@@ -307,7 +281,13 @@ function armWallTimeWatchdog(agent, deps) {
   const remainingMs = Math.max(0, startedAt + wallTimeMs - Date.now());
   const timer = setTimeout(() => {
     if (isTerminalAgentStatus(agent.status)) return;
-    const reason = `wall_time_ms (${wallTimeMs}) exceeded`;
+    // Node timers above 2^31-1 overflow to 1ms. Large explicit ceilings are
+    // chunked without changing the original deadline.
+    if (Date.now() < startedAt + agent.budget.wall_time_ms) {
+      agent.rearmWallTimeWatchdog?.();
+      return;
+    }
+    const reason = `wall_time_ms (${agent.budget.wall_time_ms}) exceeded`;
     agent.result = buildWallTimeBudgetResult(agent, reason);
     agent.partial_output = agent.result.partial_output || '';
     if (agent.abortController && !agent.abortController.signal.aborted) {
@@ -318,14 +298,19 @@ function armWallTimeWatchdog(agent, deps) {
       diagnostic: 'wall_time_watchdog',
       deps,
     });
-  }, remainingMs);
+  }, Math.min(remainingMs, 2 ** 31 - 1));
   timer.unref?.();
   return timer;
 }
 
 async function driveSubAgent(agent, subEngine, vpPersona, deps) {
   const onEvent = typeof deps.onEvent === 'function' ? deps.onEvent : null;
-  const wallTimeWatchdog = armWallTimeWatchdog(agent, deps);
+  let wallTimeWatchdog = null;
+  agent.rearmWallTimeWatchdog = () => {
+    if (wallTimeWatchdog) clearTimeout(wallTimeWatchdog);
+    wallTimeWatchdog = armWallTimeWatchdog(agent, deps);
+  };
+  agent.rearmWallTimeWatchdog();
   const idleAbandonMs = typeof deps.idleAbandonMs === 'number' && deps.idleAbandonMs > 0
     ? deps.idleAbandonMs : IDLE_ABANDON_MS;
 
@@ -456,6 +441,7 @@ async function driveSubAgent(agent, subEngine, vpPersona, deps) {
       agent.lastResult = '';
       agent.result = '';
       let assistantText = '';
+      let budgetReportText = '';
       let endedNormally = false;
       let streamError = null;
       const turnTokenStart = agent.liveness?.tokenCount || 0;
@@ -501,6 +487,7 @@ async function driveSubAgent(agent, subEngine, vpPersona, deps) {
 
           if (evt && evt.type === 'text_delta' && typeof evt.text === 'string') {
             assistantText += evt.text;
+            if (agent.budgetReportStarted) budgetReportText += evt.text;
             // Mid-stream visibility: keep lastResult fresh so a parent
             // calling WaitAgent during a long generation sees what the
             // child is currently saying, not stale text from the prior
@@ -527,7 +514,8 @@ async function driveSubAgent(agent, subEngine, vpPersona, deps) {
           }
         }
       } catch (err) {
-        if (!agent.budgetStopReason) {
+        streamError = err && err.message ? err.message : String(err);
+        if (!agent.budgetStopReason && !agent.toolBudgetReason && !agent.executionBudgetReason) {
           transitionTerminal(agent, STATUS.FAILED, {
             error: err && err.message ? err.message : String(err),
             diagnostic: 'query_error',
@@ -545,6 +533,25 @@ async function driveSubAgent(agent, subEngine, vpPersona, deps) {
         return;
       }
 
+      if (isTerminalAgentStatus(agent.status)) return;
+
+      if (agent.executionBudgetReason || agent.toolBudgetReason) {
+        // A report is evidence, not proof that the assigned review completed.
+        // Prefer its complete text over the concatenated progress preview.
+        const partial = budgetReportText.trim() || assistantText.trim();
+        agent.partial_output = partial || 'No final report was produced before the tool limit. The investigation is incomplete; inspect the execution log before retrying.';
+        const reason = agent.executionBudgetReason || agent.toolBudgetReason;
+        agent.result = buildWallTimeBudgetResult(agent, reason);
+        agent.result.reporting = { attempted: !!agent.budgetReportStarted, received: !!budgetReportText.trim() };
+        if (streamError) agent.result.reporting.error = streamError;
+        agent.usage.turns += 1;
+        agent.result.usage = { ...agent.usage };
+        transitionTerminal(agent, STATUS.COMPLETED, {
+          error: reason, diagnostic: 'execution_budget_report', deps,
+        });
+        return;
+      }
+
       if (streamError) {
         transitionTerminal(agent, STATUS.FAILED, {
           error: streamError,
@@ -624,6 +631,8 @@ async function driveSubAgent(agent, subEngine, vpPersona, deps) {
     }
   } finally {
     if (wallTimeWatchdog) clearTimeout(wallTimeWatchdog);
+    agent.rearmWallTimeWatchdog = null;
+    agent.refreshToolPolicy = null;
     // Always clean up driver-owned resources. We intentionally do NOT
     // unset agent.result / agent.lastResult / agent.liveness / agent.
     // outputFile — those are observable by the parent after termination.

package/yeaft/sub-agent/spawned-prompt.js

@@ -25,7 +25,7 @@
  * @param {'en'|'zh'} [args.language='en']
  * @returns {string} preamble block (already ## headed, ready to concat)
  */
-export function buildSpawnedPreamble({ parentName, parentVpId, agentName, mission, expectedOutput, presetPrompt, budget, language = 'en' } = {}) {
+export function buildSpawnedPreamble({ parentName, parentVpId, agentName, mission, expectedOutput, presetPrompt, budget, allowTools = [], language = 'en' } = {}) {
   // Resolve template markers before embedding: the outer VP renderer treats
   // markers as sections of the whole soul and would drop the parent + contract.
   const locale = language === 'zh' || language === 'zh-CN' ? 'zh' : 'en';
@@ -35,8 +35,9 @@ export function buildSpawnedPreamble({ parentName, parentVpId, agentName, missio
     : presetPrompt;
   const contract = [
     rolePrompt || '',
+    `## Tool authority\nDefault persona tools plus explicit parent grants: ${JSON.stringify(allowTools)}. Parent grants override a default read-only role only within the mission's scope. Bash permits arbitrary shell/writes; it is not a sandbox. You cannot grant yourself tools or budget; report blockers to the parent. UpdateAgent is parent-only.`,
     expectedOutput ? `## expected_output\nReturn the requested structure; mark unverified facts and blockers honestly.\n${JSON.stringify(expectedOutput)}` : '',
-    budget ? `## Execution budget\n${JSON.stringify(budget)}\nLimits are ceilings, not targets. Stop once the mission is answered. Return partial findings before exhausting the budget; do not automatically restart the same work.` : '',
+    budget ? `## Execution budget\n${JSON.stringify(budget)}\nLimits are ceilings, not targets. Complete the assigned result, then stop; do not stop with a plan or promise to continue. If a tool or prerequisite is unavailable, return the evidence and blocker instead of searching for unavailable capabilities. Near the tool limit, prioritize a supported conclusion. At the limit, one tool-free report may be requested within the remaining time/token budget; do not automatically restart the work.` : '',
   ].filter(Boolean).join('\n\n');
   const m = [(mission || '').trim(), contract].filter(Boolean).join('\n\n');
   if (language === 'zh') {

package/yeaft/sub-agent/tool-access.js

@@ -0,0 +1,138 @@
+/**
+ * Child tool authorization policy.
+ *
+ * Persona tools are the baseline. `agent.allowTools` is an additional,
+ * replaceable allowlist of canonical tools from the parent registry. Bash is
+ * deliberately not wrapped or narrowed here: granting Bash grants the actual
+ * parent shell tool, including its write capabilities.
+ */
+import { getPersona } from '../personas.js';
+
+const MAX_TOOL_GRANTS = 32;
+const TOOL_NAME_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]{0,127}$/;
+
+export const RESTRICTED_TOOLS = new Set([
+  'SpawnAgent',
+  'Agent',          // legacy alias
+  'UpdateAgent',
+  'PromptAgent',
+  'SendMessage',    // legacy alias
+  'WaitAgent',
+  'CloseAgent',
+  'ListAgents',
+  'RouteForward',
+  'AskUser',
+  'CreateWorkItem',
+]);
+
+function canonicalTool(parentRegistry, name) {
+  if (!parentRegistry || typeof parentRegistry.get !== 'function') return null;
+  const tool = parentRegistry.get(name);
+  return tool && typeof tool.name === 'string' ? tool : null;
+}
+
+function isRestricted(tool, requestedName = null) {
+  return RESTRICTED_TOOLS.has(tool?.name) || (requestedName && RESTRICTED_TOOLS.has(requestedName));
+}
+
+/**
+ * Validate and canonicalize explicit child grants.
+ *
+ * @param {unknown} names
+ * @param {import('../tools/registry.js').ToolRegistry|null} parentRegistry
+ * @returns {{ ok: true, tools: string[] }|{ ok: false, error: string }}
+ */
+export function validateToolGrants(names, parentRegistry) {
+  if (!Array.isArray(names)) {
+    return { ok: false, error: 'allow_tools must be an array of tool names' };
+  }
+  if (names.length > MAX_TOOL_GRANTS) {
+    return { ok: false, error: `allow_tools may contain at most ${MAX_TOOL_GRANTS} names` };
+  }
+  if (!parentRegistry || typeof parentRegistry.get !== 'function') {
+    return names.length === 0
+      ? { ok: true, tools: [] }
+      : { ok: false, error: 'parent tool registry is unavailable' };
+  }
+
+  const tools = [];
+  const seen = new Set();
+  for (const value of names) {
+    if (typeof value !== 'string' || !value.trim()) {
+      return { ok: false, error: 'allow_tools entries must be non-empty tool names' };
+    }
+    const name = value.trim();
+    if (!TOOL_NAME_RE.test(name)) {
+      return { ok: false, error: `Invalid tool name: ${name}` };
+    }
+    const tool = canonicalTool(parentRegistry, name);
+    if (!tool) return { ok: false, error: `Parent tool is not available: ${name}` };
+    if (isRestricted(tool, name)) {
+      return { ok: false, error: `Tool cannot be granted to a child agent: ${tool.name}` };
+    }
+    if (!seen.has(tool.name)) {
+      seen.add(tool.name);
+      tools.push(tool.name);
+    }
+  }
+  return { ok: true, tools };
+}
+
+function unregisterTool(registry, tool) {
+  registry.unregister(tool.name);
+  for (const alias of tool.aliases || []) registry.unregister(alias);
+}
+
+/**
+ * Create a live policy for one child. `refresh()` reconciles only the child
+ * registry; the parent registry is used as the source of canonical ToolDef
+ * objects and is never mutated.
+ *
+ * @param {import('../tools/registry.js').ToolRegistry|null} parentRegistry
+ * @param {object|null} agent
+ * @returns {{ allows(tool: object): boolean, refresh(childRegistry: import('../tools/registry.js').ToolRegistry): void }}
+ */
+export function createChildToolPolicy(parentRegistry, agent) {
+  const preset = agent?.personaData || getPersona(agent?.persona);
+  const baseline = preset && preset.id !== 'implementer'
+    ? new Set([
+      ...preset.tools.map(name => canonicalTool(parentRegistry, name)?.name || (name === 'Read' ? 'FileRead' : name)),
+      'DiscoverTools',
+    ])
+    : null;
+
+  const allows = (tool) => {
+    if (!tool || typeof tool.name !== 'string' || isRestricted(tool)) return false;
+
+    // Require the exact ToolDef owned by the parent. This prevents aliases or a
+    // child-local/MCP hot registration from manufacturing an allowed name.
+    if (canonicalTool(parentRegistry, tool.name) !== tool) return false;
+    if (baseline === null || baseline.has(tool.name)) return true;
+
+    for (const name of agent?.allowTools || []) {
+      const granted = canonicalTool(parentRegistry, name);
+      if (granted === tool && !isRestricted(granted, name)) return true;
+    }
+    return false;
+  };
+
+  const refresh = (childRegistry) => {
+    if (!childRegistry
+        || typeof childRegistry.getAllTools !== 'function'
+        || typeof childRegistry.register !== 'function'
+        || typeof childRegistry.unregister !== 'function') return;
+
+    for (const tool of childRegistry.getAllTools()) {
+      if (!allows(tool)) unregisterTool(childRegistry, tool);
+    }
+    if (!parentRegistry || typeof parentRegistry.getAllTools !== 'function') return;
+    for (const tool of parentRegistry.getAllTools()) {
+      if (!allows(tool)) continue;
+      const current = childRegistry.get(tool.name);
+      if (current && current !== tool) unregisterTool(childRegistry, current);
+      if (childRegistry.get(tool.name) !== tool) childRegistry.register(tool);
+    }
+  };
+
+  return { allows, refresh };
+}

package/yeaft/tasks/manager.js

@@ -20,7 +20,6 @@ import { getRuntimePlatformInfo } from '../runtime-platform.js';
 const LOG_PREVIEW_BYTES = 4096;
 const SUB_AGENT_LOG_PREVIEW_BYTES = 1024 * 1024;
 const DEFAULT_CANCEL_ESCALATION_MS = 2000;
-const PROMPT_TASK_LIMIT = 5;
 
 function logPreviewBytesFor(task) {
   return task?.kind === 'sub_agent' ? SUB_AGENT_LOG_PREVIEW_BYTES : LOG_PREVIEW_BYTES;
@@ -55,37 +54,6 @@ function publicSnapshot(task) {
   };
 }
 
-function taskKindLabel(kind, language) {
-  const zh = String(language || '').toLowerCase().startsWith('zh');
-  if (kind === 'sub_agent') return zh ? '子 Agent' : 'sub-agent';
-  if (kind === 'shell') return zh ? '后台命令' : 'background command';
-  return zh ? '后台任务' : 'background task';
-}
-
-function safeTaskName(task) {
-  const name = typeof task?.runtime?.name === 'string' ? task.runtime.name.trim() : '';
-  return /^[\p{L}\p{N}][\p{L}\p{N}._-]{0,63}$/u.test(name) ? name : '';
-}
-
-function promptTaskLabel(task, language) {
-  const name = task?.kind === 'sub_agent' ? safeTaskName(task) : '';
-  if (!name) return taskKindLabel(task?.kind, language);
-  return String(language || '').toLowerCase().startsWith('zh')
-    ? `子 Agent ${name}`
-    : `sub-agent ${name}`;
-}
-
-function taskStatusLabel(status, language) {
-  const zh = String(language || '').toLowerCase().startsWith('zh');
-  if (!zh) return String(status || 'running').replace(/_/g, ' ');
-  const labels = {
-    running: '运行中',
-    queued: '等待中',
-    cancelling: '正在取消',
-  };
-  return labels[status] || String(status || '运行中').replace(/_/g, ' ');
-}
-
 export class TaskManager {
   constructor({ yeaftDir, onEvent = null, runtimePlatform = null, cancelEscalationMs = DEFAULT_CANCEL_ESCALATION_MS } = {}) {
     if (!yeaftDir) throw new Error('TaskManager requires yeaftDir');
@@ -384,28 +352,4 @@ export class TaskManager {
     this.#emit('updated', task);
     return publicSnapshot(task);
   }
-
-  renderActiveTasksForPrompt(sessionId = null, { language = 'en', limit = PROMPT_TASK_LIMIT } = {}) {
-    const tasks = this.listActiveTasks(sessionId);
-    if (tasks.length === 0) return '';
-    const zh = String(language || '').toLowerCase().startsWith('zh');
-    const maxTasks = Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : PROMPT_TASK_LIMIT;
-    const visible = tasks.slice(0, maxTasks);
-    const lines = [zh ? '## 可能相关的任务' : '## Possibly Relevant Tasks'];
-    lines.push(zh
-      ? '以下任务仍在后台运行。需要进度或完整输出时使用任务工具查询；不要把它们当成记忆事实。'
-      : 'These tasks are still running in the background. Use the task tools for progress or full output; do not treat them as memory facts.');
-    for (const task of visible) {
-      const title = promptTaskLabel(task, language);
-      const detail = zh
-        ? `${taskKindLabel(task.kind, language)}，${taskStatusLabel(task.status, language)}`
-        : `${taskKindLabel(task.kind, language)}, ${taskStatusLabel(task.status, language)}`;
-      lines.push(`- ${title} (${detail})`);
-    }
-    if (tasks.length > visible.length) {
-      const remaining = tasks.length - visible.length;
-      lines.push(zh ? `- 另有 ${remaining} 个运行中任务，可用任务列表查看。` : `- ${remaining} more running task${remaining === 1 ? '' : 's'}; use the task list to inspect them.`);
-    }
-    return lines.join('\n');
-  }
 }

package/yeaft/templates/common-rules.md

@@ -2,10 +2,10 @@
 
 ## Compatibility Note
 
-Runtime prompt assembly now uses `core.md` plus active-tool guidance. This file remains packaged for deployments or integrations that still read the historical fragment directly.
+Runtime prompt assembly now uses `core.md`; tool behavior is carried by provider tool schemas. This file remains packaged for deployments or integrations that still read the historical fragment directly.
 
 <!-- lang:zh -->
 
 ## 兼容说明
 
-运行时 Prompt 现在由 `core.md` 和当前活跃工具指引组成。此文件继续随包发布，只用于仍直接读取旧 fragment 的部署或集成兼容。
+运行时 Prompt 现在使用 `core.md`；工具行为由 provider tool schema 承载。此文件继续随包发布，只用于仍直接读取旧 fragment 的部署或集成兼容。

package/yeaft/templates/personas/reviewer.md

@@ -4,6 +4,7 @@ name: Reviewer
 description: Critical read-only reviewer for code changes and designs
 modelTier: primary
 tools:
+  - GitRead
   - Read
   - Grep
   - Glob
@@ -18,7 +19,8 @@ You are a **Reviewer** sub-agent. Your job is to audit code or designs and surfa
 
 ## Operating Principles
 
-- **Read-only**: Never modify files.
+- **Read-only by default**: Do not modify files unless the parent explicitly grants the necessary tools for a scoped edit/verification task. Bash is not a read-only sandbox; keep it within the assigned scope.
+- **Diff first**: Start with `GitRead` status/diff to establish the actual change set, then inspect only the relevant files and lines.
 - **Evidence-based**: Every finding must cite `path:line`.
 - **Severity-tagged**: Label each finding `blocker | major | minor | nit`.
 - **Constructive**: Suggest fixes, not just complaints.
@@ -35,7 +37,8 @@ Structured list of findings. For each: severity, location, description, suggeste
 
 ## 操作原则
 
-- **只读**：不要修改文件。
+- **默认只读**：只有父级为明确的编辑/验证任务显式授予必要工具后，才可在该范围内写入。Bash 并非只读沙箱，不得扩大任务范围。
+- **先读 diff**：先用 `GitRead` 的 status/diff 确认实际改动范围，再只检查相关文件和行段。
 - **证据优先**：每个 finding 都必须引用 `path:line`。
 - **标注严重度**：每个 finding 标为 `blocker | major | minor | nit`。
 - **建设性**：不仅指出问题，也要给出修复建议。

package/yeaft/tools/activation.js

@@ -31,6 +31,7 @@ export const BACKGROUND_TASK_TOOL_NAMES = Object.freeze([
 ]);
 
 export const SUB_AGENT_MANAGEMENT_TOOL_NAMES = Object.freeze([
+  'UpdateAgent',
   'PromptAgent',
   'WaitAgent',
   'CloseAgent',
@@ -45,6 +46,7 @@ export const CONDITIONAL_BUILTIN_TOOL_NAMES = new Set([
   'ReadTaskLog',
   'CancelTask',
   'SpawnAgent',
+  'UpdateAgent',
   'PromptAgent',
   'WaitAgent',
   'CloseAgent',