foxclaw 0.1.0 → 0.1.3

package/python/tests/test_supervisor_triage.py

@@ -0,0 +1,102 @@
+"""主管分诊与自答策略回归。
+
+覆盖主管在「是否命中领域关键词」×「模型是否可用」下的派发决策:
+  · 关键词命中        → 直接路由到领域 Agent(快、确定),不额外调用一次 LLM 分诊;
+  · 未命中 + 模型可用 → 主管**直接自答**(dispatched_to=supervisor, self_answered=True);
+  · 未命中 + stub     → 走派发兜底(assistant),保持离线确定性。
+
+⚠ 历史说明(改名前为 test_llm_routing.py):本文件曾断言「关键词未命中 → LLM 分诊精修到
+finance」。那次精修实现在 `agents.py:_llm_classify`,但因每次要多一次约 5s 的串行 LLM
+往返,产品上被「主管直接自答」取代而退化为**死代码**(全仓库零调用点),已随本轮删除。
+原断言随之永远无法满足,长期为红,却被归因为「环境问题」——这是**误判**:它不是环境问题,
+是**测试过期**。现按真实行为重写,并把三种组合都锁住。
+
+用"假 router"模拟真机(is_stub=False),避免依赖真实 API key,全离线。
+"""
+import asyncio
+import sys
+import tempfile
+from pathlib import Path
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+import foxclaw.core.web_search as ws
+ws.needs_search = lambda q: False
+
+from foxclaw import Foxclaw
+
+
+def check(cond, msg):
+    if not cond:
+        raise AssertionError(f"✗ {msg}")
+    print(f"  ✓ {msg}")
+
+
+CLASSIFY_MARK = "只输出一个词"
+
+
+def main():
+    print("=" * 56)
+    print("主管分诊与自答策略回归")
+    print("=" * 56)
+    os_ = Foxclaw(data_dir=tempfile.mkdtemp())
+
+    calls = []
+
+    def fake(system, messages, max_tokens=2048, agent_id=""):
+        content = str(messages[-1]["content"]) if messages else ""
+        calls.append(content)
+        if CLASSIFY_MARK in content:
+            return "finance"
+        return "已处理"
+
+    os_.router.provider = "deepseek"
+    os_.router._client = object()
+    os_.router.complete = fake
+    check(os_.router.is_stub is False, "router 处于'可用'状态(非 stub)")
+
+    print("\n【1】关键词未命中 + 模型可用 → 主管直接自答(不再二次分诊)")
+    no_kw = "讲个笑话听听"
+    check(os_.supervisor._has_keyword_hit(no_kw) is False, f"「{no_kw[:12]}…」确无关键词命中")
+    r = asyncio.run(os_.supervisor.run_task(no_kw))
+    d1 = r["result"].get("dispatched_to")
+    check(d1 == "supervisor", f"未命中 → 主管自答(dispatched_to={d1},预期 supervisor)")
+    check(r["result"].get("self_answered") is True, "标记 self_answered=True(确为自答而非派发)")
+    check(bool(str(r["result"].get("sub_result") or "").strip()), "自答产出非空答复")
+    check(not any(CLASSIFY_MARK in c for c in calls), "全程未发出分诊 prompt(不再多花一次 LLM 往返)")
+
+    print("\n【1b】零星花费报备(无财务关键词)→ 认作财务命中,派给财务")
+    for line in ("今天买了一件衣服花了105块", "后天花了100洗车"):
+        check(os_.supervisor._has_keyword_hit(line), f"「{line[:12]}…」算作领域命中")
+        check(os_.supervisor._route(line) == "finance", f"「{line[:12]}…」→ finance")
+    check(os_.supervisor._route("每月房租3000占收入10000这样合理吗") == "finance",
+          "房租占比咨询 → finance")
+
+    print("\n【2】关键词命中 → 直接路由,不问 LLM 分诊(省成本)")
+    calls.clear()
+    r2 = asyncio.run(os_.supervisor.run_task("帮我做个预算分析"))
+    d2 = r2["result"].get("dispatched_to")
+    check(d2 == "finance", f"命中'预算' → 直接 finance(实为 {d2})")
+    check(not any(CLASSIFY_MARK in c for c in calls), "关键词命中时不发出分诊 prompt")
+
+    print("\n【3】stub + 关键词未命中 → 主管自处理(离线确定性)")
+    os_.router.provider = "stub"
+    os_.router._client = None
+    calls.clear()
+    r3 = asyncio.run(os_.supervisor.run_task("解释一下什么是航天器"))
+    check(os_.router.is_stub is True, "router 回到 stub")
+    d3 = r3["result"].get("dispatched_to")
+    check(d3 == "supervisor", f"stub 下未命中 → 主管自身处理(实为 {d3})")
+    check(not r3["result"].get("self_answered"), "stub 下走派发路径,而非主管自答")
+    check(not any(CLASSIFY_MARK in c for c in calls), "stub 下不发出分诊 prompt")
+
+    print("\n" + "=" * 56)
+    print("主管分诊与自答策略回归通过")
+    print("=" * 56)
+
+
+def test_supervisor_triage():
+    main()
+
+
+if __name__ == "__main__":
+    main()

package/python/tests/test_taint.py

@@ -0,0 +1,112 @@
+"""
+数据污点追踪 + 动态审批门槛测试 —— 全离线。
+
+对齐 Meta Muse「eBPF 污点追踪」的软件版:会话一旦取回用户/敏感数据就打污点,
+之后外发/副作用动作的审批门槛动态提高。覆盖:
+  1. injection_guard.taint_level:来源 → 敏感度分级。
+  2. permission.evaluate 污点门槛:默认关闭(行为不变)/ 达标+外发 → TAINT_CONFIRM /
+     达标+只读 → 不触发 / 未达标 → 不触发。
+  3. base 污点传播:_dispatch_tool 取回 memory/web_search 后会话污点单调上升;
+     会话开始 _taint_reset 清零。
+"""
+import os, sys, types
+from pathlib import Path
+os.environ.setdefault("HF_HUB_OFFLINE", "1")
+os.environ.setdefault("TRANSFORMERS_OFFLINE", "1")
+os.environ["FOXCLAW_EMBEDDING_MODEL"] = "foxclaw-nonexistent-fast"
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from foxclaw.core import injection_guard as IG
+from foxclaw.skills import permission as PERM
+from foxclaw.agents.base import (
+    CognitiveAgent, _taint_get, _taint_raise, _taint_reset,
+)
+
+
+def _skill(side_effect="read", read_only=True, external=False, destructive=False):
+    """构造一个 permission.evaluate 可用的最小 skill-spec(duck-typed)。"""
+    return types.SimpleNamespace(
+        id=f"tool:test_{side_effect}",
+        params={},
+        side_effect=side_effect,
+        read_only=read_only,
+        external=external,
+        destructive=destructive,
+        trust_level=lambda: "high",
+    )
+
+
+def test_taint_level_grading():
+    assert IG.taint_level("web_search") == IG.TAINT_EXTERNAL == 1
+    assert IG.taint_level("knowledge") == IG.TAINT_PERSONAL == 2
+    assert IG.taint_level("file") == IG.TAINT_PERSONAL == 2
+    assert IG.taint_level("memory") == IG.TAINT_SENSITIVE == 3
+    assert IG.taint_level("unknown_source") == IG.TAINT_EXTERNAL
+
+
+def test_permission_taint_default_off_behavior_unchanged():
+    s = _skill(side_effect="send", read_only=False)
+    d = PERM.evaluate(s, {})
+    assert d.decision == "ask" and d.reason_code == PERM.SIDE_EFFECT_CONFIRM
+
+
+def test_permission_taint_blocks_send_when_sensitive():
+    s = _skill(side_effect="send", read_only=False)
+    d = PERM.evaluate(s, {}, taint_level=IG.TAINT_SENSITIVE,
+                      taint_threshold=IG.TAINT_PERSONAL)
+    assert d.decision == "ask" and d.reason_code == PERM.TAINT_CONFIRM
+    assert d.requires_confirmation
+
+
+def test_permission_taint_blocks_external_when_personal():
+    s = _skill(side_effect="read", read_only=False, external=True)
+    d = PERM.evaluate(s, {}, taint_level=IG.TAINT_PERSONAL,
+                      taint_threshold=IG.TAINT_PERSONAL)
+    assert d.decision == "ask" and d.reason_code == PERM.TAINT_CONFIRM
+
+
+def test_permission_taint_not_trigger_on_readonly():
+    s = _skill(side_effect="read", read_only=True)
+    d = PERM.evaluate(s, {}, taint_level=IG.TAINT_SENSITIVE,
+                      taint_threshold=IG.TAINT_PERSONAL)
+    assert d.decision == "allow"
+
+
+def test_permission_taint_not_trigger_below_threshold():
+    s = _skill(side_effect="send", read_only=False)
+    d = PERM.evaluate(s, {}, taint_level=IG.TAINT_EXTERNAL,
+                      taint_threshold=IG.TAINT_PERSONAL)
+    assert d.reason_code == PERM.SIDE_EFFECT_CONFIRM
+
+
+def test_taint_helpers_on_fake_agent():
+    a = types.SimpleNamespace(_think=lambda **k: None)
+    assert _taint_get(a) == 0
+    _taint_raise(a, IG.TAINT_EXTERNAL)
+    _taint_raise(a, IG.TAINT_SENSITIVE)
+    assert _taint_get(a) == IG.TAINT_SENSITIVE
+    _taint_reset(a)
+    assert _taint_get(a) == 0
+
+
+def test_dispatch_recall_memory_raises_taint():
+    a = types.SimpleNamespace(
+        _think=lambda **k: None,
+        _recall_memory=lambda q, top_k=5: [{"content": "用户偏好:喜欢简洁"}])
+    out = CognitiveAgent._dispatch_tool(a, "recall_memory", {"query": "偏好"})
+    assert "喜欢简洁" in out
+    assert _taint_get(a) == IG.TAINT_SENSITIVE
+
+
+def test_dispatch_web_search_raises_taint(monkeypatch):
+    from foxclaw.core import web_search as WS
+    monkeypatch.setattr(WS, "search_answer", lambda q: {"answer": "答案ABC", "references": []})
+    a = types.SimpleNamespace(_think=lambda **k: None)
+    out = CognitiveAgent._dispatch_tool(a, "web_search", {"query": "问题"})
+    assert "答案ABC" in out
+    assert _taint_get(a) == IG.TAINT_EXTERNAL
+
+
+if __name__ == "__main__":
+    import pytest
+    pytest.main([__file__, "-v"])

package/python/tests/test_task_stream.py

@@ -0,0 +1,74 @@
+"""D1:/api/task/stream SSE —— 任务执行流式化(逐 stage 进度 + act 逐 token + 最终 result)。
+与 test_streaming.py 的 /api/chat/stream 端点测试对称:那条测对话直答流式,这条测**走完整认知
+管线**的任务流式。核心逻辑(run_task_stream)在 test_agent_lifecycle 已直测,这里补端点级 SSE 打通。"""
+import os, sys, tempfile, json
+from pathlib import Path
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+
+def test_task_stream():
+    os.environ["FOXCLAW_SHADOW_ROUNDS"] = "6"
+    os.environ.setdefault("FOXCLAW_EMBEDDING_MODEL", "foxclaw-nonexistent-fast")
+    os.environ["FOXCLAW_STREAM_RATE"] = "60"
+    os.environ["FOXCLAW_DATA_DIR"] = tempfile.mkdtemp(prefix="foxclaw_taskstream_")
+    os.environ["FOXCLAW_SKIP_DOTENV"] = "1"
+    for _k in ("DEEPSEEK_API_KEY", "ANTHROPIC_API_KEY", "OPENAI_API_KEY",
+               "GOOGLE_API_KEY", "DASHSCOPE_API_KEY", "FOXCLAW_API_KEY"):
+        os.environ[_k] = ""
+
+    print("=" * 60); print("D1 · /api/task/stream 任务流式化验证"); print("=" * 60)
+
+    from fastapi.testclient import TestClient
+    import foxclaw.api as _api
+    from foxclaw.api import app
+    _api._STREAM_LIMITER.capacity = 60
+    _api._STREAM_LIMITER.rate = 1.0
+    _api._STREAM_LIMITER.tokens = 60.0
+
+    with TestClient(app) as c:
+        with c.stream("POST", "/api/task/stream",
+                      json={"task": "帮我分析一下本月开销", "agent_id": "office"}) as resp:
+            assert resp.status_code == 200, resp.status_code
+            stages, deltas, results, errors = [], [], [], []
+            for line in resp.iter_lines():
+                if not line or not line.startswith("data: "):
+                    continue
+                ev = json.loads(line[6:])
+                if "stage" in ev: stages.append(ev["stage"])
+                if "delta" in ev: deltas.append(ev["delta"])
+                if "result" in ev: results.append(ev["result"])
+                if "error" in ev: errors.append(ev["error"])
+            assert not errors, f"不应有 error 事件: {errors}"
+            assert "act" in stages, f"应有 stage 进度事件(含 act): {stages}"
+            assert len(deltas) > 0, "应有 act 逐 token delta 事件(证明流式透传经端点打通)"
+            assert len(results) == 1, f"应恰有一个最终 result 事件,实得 {len(results)}"
+            assert results[0].get("agent") == "office" and "result" in results[0], results[0]
+        print(f"[1] /api/task/stream SSE(stage={len(stages)} delta={len(deltas)} result=1) OK")
+
+        with c.stream("POST", "/api/task/stream",
+                      json={"task": "随便问问", "agent_id": "supervisor"}) as resp:
+            assert resp.status_code == 200, resp.status_code
+            stages, results, errors = [], [], []
+            for line in resp.iter_lines():
+                if not line or not line.startswith("data: "):
+                    continue
+                ev = json.loads(line[6:])
+                if "stage" in ev: stages.append(ev["stage"])
+                if "result" in ev: results.append(ev["result"])
+                if "error" in ev: errors.append(ev["error"])
+            assert not errors, f"不应有 error 事件: {errors}"
+            assert len(results) == 1, f"应恰有一个最终 result 事件,实得 {len(results)}"
+            r0 = results[0]
+            assert r0.get("agent") == "supervisor", \
+                f"P3-3:主管走自身 pipeline,不再回落 assistant(实为 {r0.get('agent')})"
+            assert "dispatch" in stages and "route" in stages, \
+                f"应见主管管线 stage(route/dispatch): {stages}"
+            assert r0["result"].get("dispatched_to") == "supervisor", \
+                f"stub 无关键词 → 主管自身处理(实为 {r0['result'].get('dispatched_to')})"
+        print("[2] agent_id=supervisor → 主管自身流式管线(P3-3,不再回落) OK")
+
+    print("\nD1 /api/task/stream 验证通过")
+
+
+if __name__ == "__main__":
+    test_task_stream()

package/python/tests/test_thinking_sse.py

@@ -0,0 +1,66 @@
+"""/api/chat/stream 的命名 SSE 事件:`event: thinking` 与正文 delta 分离。
+
+前端按事件名折叠展示推理;正文 delta 里不得出现推理文本(否则复制/落库会被污染)。
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+
+def test_chat_stream_emits_named_thinking_event():
+    if "foxclaw.api" in sys.modules:
+        import pytest
+        pytest.skip("需独立进程运行(模块级单例已固化),请用 tests/run_all.py")
+    os.environ.setdefault("FOXCLAW_DATA_DIR", tempfile.mkdtemp(prefix="foxclaw_think_"))
+
+    from fastapi.testclient import TestClient
+    from foxclaw.agents.base import CognitiveAgent
+    from foxclaw.api import app
+
+    def _fake_stream(self, task, stop_event=None, images=None, history=None,
+                     attachments=None, on_thinking=None, on_evidence=None):
+        if on_thinking is not None:
+            on_thinking("先分析一下用户意图")
+        yield "好的"
+
+    original = CognitiveAgent.stream_reply
+    CognitiveAgent.stream_reply = _fake_stream
+    try:
+        with TestClient(app) as c:
+            resp = c.post("/api/chat/stream", json={"task": "hi", "agent_id": "supervisor"})
+            assert resp.status_code == 200, resp.status_code
+            body = resp.text
+    finally:
+        CognitiveAgent.stream_reply = original
+
+    assert "event: thinking" in body, "推理必须以命名事件送出"
+    blocks = [b for b in body.split("\n\n") if b.strip()]
+    think_payloads, delta_payloads = [], []
+    for b in blocks:
+        name = "message"
+        data = None
+        for line in b.splitlines():
+            if line.startswith("event: "):
+                name = line[7:].strip()
+            elif line.startswith("data: "):
+                data = line[6:].strip()
+        if data is None:
+            continue
+        ev = json.loads(data)
+        if name == "thinking":
+            think_payloads.append(ev)
+        elif "delta" in ev:
+            delta_payloads.append(ev["delta"])
+
+    assert think_payloads, "应有 thinking 事件块"
+    assert "先分析一下用户意图" == "".join(p.get("thinking", "") for p in think_payloads)
+    joined = "".join(delta_payloads)
+    assert joined == "好的"
+    assert "先分析一下" not in joined, "推理不得混入正文 delta"

package/python/tests/test_thinking_stream.py

@@ -0,0 +1,76 @@
+"""推理过程可见:`_ThinkStripper` 不再丢弃思考,原生 reasoning 走独立 thinking 通道。
+
+背景:`core/model_router.py` 的 `_ThinkStripper.feed` 只返回可见正文,think 块内容被整段
+淘汰;openai-compatible 的 `delta.reasoning_content`(deepseek-reasoner 等)更是完全没读,
+用户只看到结论,看不到推理。现在两者都转成 `on_thinking` 回调 → SSE `event: thinking`。
+"""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+from foxclaw.core.model_router import ModelRouter, _ThinkStripper
+
+
+class _FakeCompletions:
+    def __init__(self, chunks):
+        self.chunks = chunks
+        self.kwargs: dict = {}
+
+    def create(self, **kwargs):
+        self.kwargs = kwargs
+        return iter(self.chunks)
+
+
+class _FakeClient:
+    def __init__(self, chunks):
+        self.chat = SimpleNamespace(completions=_FakeCompletions(chunks))
+
+
+def _chunk(content=None, reasoning=None):
+    delta = SimpleNamespace(content=content, reasoning_content=reasoning)
+    return SimpleNamespace(choices=[SimpleNamespace(delta=delta)])
+
+
+def _router(chunks) -> ModelRouter:
+    r = ModelRouter(provider="openai", model="gpt-4o-mini")
+    r._client = _FakeClient(chunks)
+    return r
+
+
+def test_stripper_returns_think_text_separately() -> None:
+    s = _ThinkStripper()
+    vis1, th1 = s.feed_events("答案前<thi")
+    assert (vis1, th1) == ("答案前", ""), "半个标签不能当正文吐出"
+    vis2, th2 = s.feed_events("nk>内部推理</think>答案")
+    assert vis2 == "答案"
+    assert th2 == "内部推理"
+
+
+def test_stripper_feed_still_visible_only() -> None:
+    s = _ThinkStripper()
+    assert s.feed("a<think>b</think>c") == "ac"
+
+
+def test_reasoning_content_goes_to_thinking_only() -> None:
+    r = _router([_chunk(None, "先想一下"), _chunk("你好"), _chunk("世界")])
+    think: list[str] = []
+    text = "".join(r.stream("sys", [{"role": "user", "content": "hi"}],
+                            on_thinking=think.append))
+    assert "".join(think) == "先想一下", "原生 reasoning_content 必须进推理通道"
+    assert text == "你好世界", "正文不得混入推理"
+
+
+def test_embedded_think_routed_to_callback() -> None:
+    r = _router([_chunk("<think>内嵌思考</think>答案是 42<think>补一句")])
+    think: list[str] = []
+    text = "".join(r.stream("sys", [{"role": "user", "content": "hi"}],
+                            on_thinking=think.append))
+    assert text == "答案是 42"
+    assert "内嵌思考" in "".join(think)
+    assert "补一句" not in text, "未闭合的 think 尾巴不得漏进正文"
+
+
+def test_no_callback_keeps_old_behavior() -> None:
+    r = _router([_chunk("<think>x</think>ok")])
+    assert "".join(r.stream("sys", [{"role": "user", "content": "hi"}])) == "ok"

package/python/tests/test_tool_center.py

@@ -0,0 +1,113 @@
+"""工具中心第1期 · 技能台真实化 + 安装审核门 + 治理 端到端验证。
+判定:assert 失败→Traceback→run_all 记失败;正常退出=通过。"""
+import sys, os, tempfile
+from pathlib import Path
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+def test_tool_center():
+    os.environ["FOXCLAW_SHADOW_ROUNDS"] = "6"
+    _DATA = tempfile.mkdtemp(prefix="foxclaw_toolc_")
+    os.environ["FOXCLAW_DATA_DIR"] = _DATA
+
+    from fastapi.testclient import TestClient
+    from foxclaw.api import app
+
+    WEBAPI = {"id": "wx_weather", "name": "天气", "description": "查天气", "kind": "web_api",
+              "triggers": ["天气"], "side_effect": "read",
+              "endpoint": "https://example.com/api/weather", "http_method": "GET"}
+
+    with TestClient(app) as c:
+        print("=" * 60); print("工具中心 · 技能台 + 审核门 + 治理 验证"); print("=" * 60)
+
+        r = c.post("/api/ahs/skills", json=WEBAPI)
+        assert r.status_code == 200, r.text
+        assert r.json()["created"] is True
+        print("[1] 安装 web_api 技能 OK")
+
+        r = c.get("/api/ahs/skills"); assert r.status_code == 200
+        ids = {s["id"]: s for s in r.json()["skills"]}
+        assert "wx_weather" in ids and ids["wx_weather"]["source"] == "user"
+        print("[2] 列表含新技能且 source=user OK")
+
+        r = c.post("/api/ahs/skills", json={**WEBAPI, "id": "x_local", "kind": "local"})
+        assert r.status_code == 400
+        print("[3] 拒绝 local kind(400) OK")
+
+        r = c.post("/api/ahs/skills", json={**WEBAPI, "id": "x_bad", "endpoint": "ftp://x"})
+        assert r.status_code == 400
+        print("[4] 拒非法 endpoint(400) OK")
+
+        r = c.post("/api/ahs/skills", json={"id": "x_mcp", "name": "m", "kind": "mcp", "side_effect": "read"})
+        assert r.status_code == 400
+        print("[5] mcp 缺 server/tool(400) OK")
+
+        r = c.patch("/api/ahs/skills/wx_weather", json={"enabled": False})
+        assert r.status_code == 200 and r.json()["skill"]["enabled"] is False
+        r = c.patch("/api/ahs/skills/wx_weather", json={"enabled": True})
+        assert r.json()["skill"]["enabled"] is True
+        print("[6] 启停切换 OK")
+
+        r = c.get("/api/ahs/skills")
+        builtin = next((s["id"] for s in r.json()["skills"] if s["source"] == "builtin"), None)
+        if builtin:
+            rd = c.delete(f"/api/ahs/skills/{builtin}")
+            assert rd.status_code == 409, rd.text
+            print("[7] 内置技能不可删(409) OK")
+            rc = c.post("/api/ahs/skills", json={**WEBAPI, "id": builtin})
+            assert rc.status_code == 409, rc.text
+            print("[7b] 用内置 id 安装被拒(409) OK")
+        else:
+            print("[7] 跳过(无内置技能)")
+
+        r = c.post("/api/ahs/skills/wx_weather/test", json={"args": {}})
+        assert r.status_code == 200 and "success" in r.json()
+        print("[8] 测试调用返回 SkillResult OK")
+
+        r = c.post("/api/ahs/skills", json={"id": "ssrf_t", "name": "s", "description": "", "kind": "web_api",
+                   "triggers": ["x"], "side_effect": "read", "endpoint": "http://127.0.0.1:8000/api/status"})
+        assert r.status_code == 403, r.text
+        assert r.json()["detail"]["error"] == "install_denied"
+        print("[9] 安装审核门 deny 本地地址(403) OK")
+
+        _send = {"id": "send_x", "name": "发信", "description": "", "kind": "web_api",
+                 "triggers": ["发"], "side_effect": "send", "endpoint": "https://example.com/send"}
+        r = c.post("/api/ahs/skills", json=_send)
+        assert r.status_code == 409 and r.json()["detail"]["needs_ack"] is True, r.text
+        r = c.post("/api/ahs/skills", json={**_send, "acknowledged": True})
+        assert r.status_code == 200, r.text
+        print("[9b] 副作用技能需确认(409→200) OK")
+
+        assert c.get("/api/ahs/breaker").status_code == 200
+        assert c.get("/api/ahs/hooks/audit").status_code == 200
+        print("[10] 治理端点(breaker/audit) OK")
+
+        sk = {s["id"]: s for s in c.get("/api/ahs/skills").json()["skills"]}
+        assert sk["calculator"]["trust"] == "high", sk["calculator"]["trust"]
+        assert sk["gmail_send"]["trust"] == "low", sk["gmail_send"]["trust"]
+        assert sk["wx_weather"]["trust"] == "mid"
+        print("[10b] 信任分级 high/mid/low OK")
+
+        c.post("/api/ahs/policy/deny", json={"id": "wx_weather"})
+        r = c.post("/api/ahs/skills/wx_weather/test", json={"args": {}, "confirmed": True}).json()
+        assert r["status"] == "blocked" and "封杀" in r["message"], r
+        assert next(s for s in c.get("/api/ahs/skills").json()["skills"] if s["id"] == "wx_weather")["blocked"] is True
+        assert "wx_weather" in c.get("/api/ahs/policy").json()["deny"]
+        assert c.delete("/api/ahs/policy/deny/wx_weather").status_code == 200
+        assert "wx_weather" not in c.get("/api/ahs/policy").json()["deny"]
+        assert next(s for s in c.get("/api/ahs/skills").json()["skills"] if s["id"] == "wx_weather")["blocked"] is False
+        print("[10c] deny 封杀/解封 kill-switch OK")
+
+        assert c.delete("/api/ahs/skills/wx_weather").status_code == 200
+        r = c.get("/api/ahs/skills"); assert "wx_weather" not in {s["id"] for s in r.json()["skills"]}
+        print("[11] 删除用户技能 OK")
+
+    from foxclaw import Foxclaw
+    os2 = Foxclaw(data_dir=_DATA)
+    assert os2.skill_registry.get("send_x") is not None, "重启后用户技能丢失"
+    assert os2.skill_registry.get("send_x").source == "user"
+    print("[12] 重启后用户技能仍在(持久化 round-trip) OK")
+
+    print("\n工具中心第1期验证全部通过")
+
+if __name__ == "__main__":
+    test_tool_center()

package/python/tests/test_tool_parallel.py

@@ -0,0 +1,113 @@
+"""工具调度:只读并发 / 写与未声明串行 / 单工具超时 / 污点回主线程合并。
+
+背景:`agents/mixins/tool_exec.py` 原本逐个 `_dispatch_tool` 串行,一个慢工具阻塞整轮,
+且完全无单工具超时——模型一次发两个只读工具(联网+召回)要等两倍时间,网络卡死则整轮挂住。
+"""
+
+from __future__ import annotations
+
+import threading
+import time
+
+from foxclaw.agents.mixins import tool_exec as _te
+from foxclaw.agents.mixins.tool_exec import ToolExecMixin
+
+
+class _Fake(ToolExecMixin):
+    """只保留调度层:闸门走真实 registry + permission,执行被 monkeypatch 替换。"""
+
+    def __init__(self):
+        self.calls: list[str] = []
+        self._taint_level = 0
+
+    def _think(self, **kwargs):
+        return None, None
+
+
+def _make(monkeypatch, behavior) -> _Fake:
+    fake = _Fake()
+
+    def _invoke(agent, name, args, taint_sink=None):
+        agent.calls.append(name)
+        return behavior(name, args, taint_sink)
+
+    monkeypatch.setattr(_te, "_invoke_tool", _invoke)
+    return fake
+
+
+def _calls(*pairs):
+    return [{"name": n, "args": a} for n, a in pairs]
+
+
+def test_readonly_tools_run_concurrently(monkeypatch) -> None:
+    barrier = threading.Barrier(2, timeout=3)
+
+    def behave(name, args, sink):
+        barrier.wait()
+        return f"{name}:ok"
+
+    fake = _make(monkeypatch, behave)
+    t0 = time.monotonic()
+    out = fake._run_tools(_calls(("web_search", {"query": "python 3.14"}),
+                                 ("recall_memory", {"query": "项目约定"})))
+    elapsed = time.monotonic() - t0
+    assert out == ["web_search:ok", "recall_memory:ok"]
+    assert elapsed < 2.0, f"两个只读工具应并发执行,实际耗时 {elapsed:.2f}s"
+
+
+def test_slow_tool_is_cut_off(monkeypatch) -> None:
+    monkeypatch.setenv("FOXCLAW_TOOL_TIMEOUT", "0.3")
+
+    def behave(name, args, sink):
+        time.sleep(2)
+        return "late"
+
+    fake = _make(monkeypatch, behave)
+    t0 = time.monotonic()
+    out = fake._dispatch_tool("web_search", {"query": "x"})
+    assert "超过" in out and "未返回" in out
+    assert "不要编造" in out
+    assert time.monotonic() - t0 < 1.5, "超时后必须立刻返回,不能等工具自己结束"
+
+
+def test_taint_collected_in_worker_and_merged_in_main(monkeypatch) -> None:
+    def behave(name, args, sink):
+        sink.append(3 if name == "web_search" else 2)
+        return "ok"
+
+    fake = _make(monkeypatch, behave)
+    fake._run_tools(_calls(("web_search", {"query": "x"}),
+                           ("recall_memory", {"query": "y"})))
+    assert fake._taint_level == 3, "并发执行后污点应取最大值合并回会话"
+
+
+def test_single_readonly_call_still_merged(monkeypatch) -> None:
+    def behave(name, args, sink):
+        sink.append(2)
+        return "ok"
+
+    fake = _make(monkeypatch, behave)
+    assert fake._dispatch_tool("recall_memory", {"query": "y"}) == "ok"
+    assert fake._taint_level == 2
+
+
+def test_undeclared_tool_never_executed_and_batch_serialized(monkeypatch) -> None:
+    def behave(name, args, sink):
+        return "ok"
+
+    fake = _make(monkeypatch, behave)
+    out = fake._run_tools(_calls(("web_search", {"query": "x"}),
+                                 ("write_file", {"path": "a.md"})))
+    assert "未知工具 write_file" in out[1]
+    assert fake.calls == ["web_search"], "未声明能力的工具必须被闸门挡住,不进入执行"
+
+
+def test_missing_required_arg_reports_instead_of_executing(monkeypatch) -> None:
+    def behave(name, args, sink):                 # pragma: no cover - 不应被调用
+        raise AssertionError("入参校验失败时不该执行工具")
+
+    fake = _make(monkeypatch, behave)
+    out = fake._run_tools([{"name": "web_search", "args": {}}])
+    assert "入参不合法" in out[0]
+    assert "query" in out[0]
+    assert fake.calls == []