foxclaw 0.1.2 → 0.1.3

package/python/foxclaw/core/compaction.py

@@ -25,7 +25,6 @@ import re
 from dataclasses import dataclass, field
 
 
-# 粗略 token 估算:中文约 1 字符 ≈ 1 token,英文约 4 字符 ≈ 1 token。
 def estimate_tokens(text: str) -> int:
     if not text:
         return 0
@@ -38,8 +37,6 @@ def estimate_messages_tokens(messages: list) -> int:
     return sum(estimate_tokens(str(m.get("content", ""))) for m in messages)
 
 
-# 关键标识符:不能在摘要中丢失的(ID、长数字、订单号、哈希、金额等)
-# 不用外层 \b:¥/逗号不是单词字符,会导致金额匹配失败。
 _IDENTIFIER_PAT = re.compile(
     r"[a-zA-Z]{2,}_[a-zA-Z0-9]{4,}|[a-f0-9]{8,}|[0-9]{6,}|¥[\d,]+(?:\.\d+)?")
 
@@ -56,14 +53,14 @@ def extract_identifiers(messages: list) -> list[str]:
 
 @dataclass
 class CompactionResult:
-    messages: list = field(default_factory=list)     # 压缩后的消息列表
-    method: str = "none"                             # llm_summary/partial_summary/truncate/none
+    messages: list = field(default_factory=list)
+    method: str = "none"
     original_count: int = 0
     compacted_count: int = 0
     original_tokens: int = 0
     compacted_tokens: int = 0
     preserved_identifiers: list = field(default_factory=list)
-    note: str = ""                                   # 说明(如压缩跳过原因)
+    note: str = ""
 
     def to_dict(self) -> dict:
         return {
@@ -101,8 +98,6 @@ def group_tool_calls(messages: list) -> list:
         m = messages[i]
         buf.append(m)
         if m.get("role") == "assistant" and (m.get("tool_calls") or []):
-            # 本 assistant 声明了工具调用 → 把紧随其后、id 匹配的 tool 结果
-            # 全部并入同一组,确保「声明与结果同进同出」。
             ids = {tc.get("id") for tc in (m.get("tool_calls") or [])}
             j = i + 1
             while j < n:
@@ -125,10 +120,10 @@ class Compactor:
 
     def __init__(self, router=None, max_tokens: int = 6000,
                  keep_recent: int = 4, oversized_token: int = 2000):
-        self.router = router                 # ModelRouter,用于 LLM 摘要(可空→走截断兜底)
-        self.max_tokens = max_tokens         # 超过此 token 触发压缩
-        self.keep_recent = keep_recent       # 最近保留几条原样
-        self.oversized_token = oversized_token  # 单条超此值视为"超大消息"
+        self.router = router
+        self.max_tokens = max_tokens
+        self.keep_recent = keep_recent
+        self.oversized_token = oversized_token
 
     def needs_compaction(self, messages: list) -> bool:
         return estimate_messages_tokens(messages) > self.max_tokens
@@ -146,13 +141,9 @@ class Compactor:
             res.compacted_tokens = res.original_tokens
             return res
 
-        # 分区:系统消息 / 待压缩的早期消息 / 保留的近期消息
         system_msgs = [m for m in messages if m.get("role") == "system"]
         non_system = [m for m in messages if m.get("role") != "system"]
         keep = max(0, self.keep_recent)
-        # 按**原子组**保留(而非按条数),保证 assistant.tool_calls 与其 tool 结果
-        # 同进同出。按条数切会在「一轮多工具」时把 tool 结果与其声明切散 →
-        # provider 报 400。详见 group_tool_calls docstring。
         _groups = group_tool_calls(non_system)
         if keep and _groups:
             recent = [m for g in _groups[-keep:] for m in g]
@@ -161,8 +152,6 @@ class Compactor:
             recent, to_compress = [], non_system
         else:
             recent, to_compress = [], non_system
-        # 防御:若仍不配对(极端边界/上游已产生的畸形序列),宁可放弃压缩,
-        # 也不产出非法消息序列 —— 压缩不生效只是浪费 token,发出去 400 是整轮失败。
         _declared = {tc.get("id") for m in (recent + to_compress)
                      for tc in (m.get("tool_calls") or [])}
         _orphans = [m for m in (recent + to_compress)
@@ -185,15 +174,12 @@ class Compactor:
 
         res.preserved_identifiers = extract_identifiers(to_compress)
 
-        # —— 渐进降级 ——
         summary = None
         method = "truncate"
-        # 1. LLM 完整摘要
         if self.router is not None:
             summary = self._try_summarize(to_compress, res.preserved_identifiers)
             if summary:
                 method = "llm_summary"
-        # 2. 部分摘要:排除超大消息后再试
         if summary is None and self.router is not None:
             trimmed = [m for m in to_compress
                        if estimate_tokens(str(m.get("content", ""))) <= self.oversized_token]
@@ -201,7 +187,6 @@ class Compactor:
                 summary = self._try_summarize(trimmed, res.preserved_identifiers)
                 if summary:
                     method = "partial_summary"
-        # 3. 截断兜底
         if summary is None:
             summary = self._truncate_fallback(to_compress, res.preserved_identifiers)
             method = "truncate"
@@ -211,14 +196,11 @@ class Compactor:
         compacted = system_msgs + [summary_msg] + recent
         compacted_tokens = estimate_messages_tokens(compacted)
 
-        # 校验:压缩须真的显著变小(至少省 10%),否则放弃——避免系统消息过大时
-        # 压缩无效还白加摘要导致反而更大。
         if compacted_tokens >= res.original_tokens * 0.9:
             res.messages = list(messages)
             res.method = "skipped_ineffective"
             res.compacted_count = len(messages)
             res.compacted_tokens = res.original_tokens
-            # 提示:压缩无效通常因系统消息/近期消息本身已占满预算
             sys_tokens = estimate_messages_tokens(system_msgs)
             res.note = (f"压缩跳过:有效压缩空间不足(系统消息占 {sys_tokens} token)。"
                         f"建议精简系统提示或调大上下文预算。")
@@ -242,7 +224,7 @@ class Compactor:
                 return list(messages), None
             res = self.compact(messages)
             if res.method == "none" or res.method.startswith("skipped"):
-                return list(messages), res      # 压缩没生效 → 原样,结果仅用于观测
+                return list(messages), res
             return res.messages, res
         except Exception:
             return list(messages), None

package/python/foxclaw/core/config.py

@@ -22,7 +22,7 @@ class LayeredConfig:
     """三层配置合并原语。持有各层 dict 的引用 —— 若某层的集合值是可变对象(如 SkillPolicy 的
     user deny set),原地增删会被 merged_set/policy_locked 实时反映,无需重建。"""
 
-    def __init__(self, policy: dict = None, user: dict = None, runtime: dict = None):
+    def __init__(self, policy: dict | None = None, user: dict | None = None, runtime: dict | None = None):
         self.policy = dict(policy or {})
         self.user = dict(user or {})
         self.runtime = dict(runtime or {})
@@ -61,5 +61,5 @@ def load_policy_layer(data_dir=None) -> dict:
                 d = json.loads(p.read_text(encoding="utf-8"))
                 deny |= set(d.get("deny") or [])
             except Exception:
-                pass          # policy.json 损坏不应拖垮启动;宁可少锁不错锁,由运维排查
+                pass
     return {"deny": sorted(deny)}

package/python/foxclaw/core/confirm_nonce.py

@@ -25,10 +25,9 @@ import time
 from dataclasses import dataclass, field
 from typing import Optional, Tuple
 
-#: 视为「关键操作」的副作用级别(发送/支付);destructive 无条件算关键
 CRITICAL_SIDE_EFFECTS = ("send", "pay")
 
-DEFAULT_TTL = 300.0        # 秒;确认码有效期
+DEFAULT_TTL = 300.0
 
 
 def action_fingerprint(action: str, args: dict) -> str:
@@ -78,14 +77,13 @@ class ConfirmationBroker:
         self._items: dict[str, PendingConfirm] = {}
         self._lock = threading.Lock()
 
-    # ── 签发 ────────────────────────────────────────────
     def issue(self, session: str, action: str, args: dict,
-              ttl: float = None) -> dict:
+              ttl: float | None = None) -> dict:
         """签发一个绑定到 (会话, 动作, 参数) 的一次性确认码。"""
         now = self._clock()
         ttl = self.ttl if ttl is None else float(ttl)
         item = PendingConfirm(
-            nonce=secrets.token_hex(8),          # 16 hex 字符,人类也能念出来
+            nonce=secrets.token_hex(8),
             action=action or "",
             fingerprint=action_fingerprint(action or "", args or {}),
             session=session or "",
@@ -99,9 +97,8 @@ class ConfirmationBroker:
         return {"nonce": item.nonce, "action": item.action,
                 "expires_at": item.expires, "ttl": ttl}
 
-    # ── 校验并消费 ──────────────────────────────────────
     def consume(self, session: str, nonce: str, action: str = "",
-                args: dict = None, now: float = None) -> Tuple[bool, str]:
+                args: dict | None = None, now: float | None = None) -> Tuple[bool, str]:
         """校验确认码并**立即作废**。返回 (是否通过, 原因码)。
 
         原因码:``ok`` / ``missing_nonce`` / ``unknown_nonce`` / ``already_used`` /
@@ -113,8 +110,6 @@ class ConfirmationBroker:
         now = now if now is not None else self._clock()
         with self._lock:
             item: Optional[PendingConfirm] = self._items.get(nonce)
-            # 先看这一条再清理:否则过期的码会被 _purge 抹掉,排错时只会看到
-            # unknown_nonce,分不清"从没发过"和"发过但过期了"
             if item is not None and item.expires <= now:
                 self._items.pop(nonce, None)
                 return False, "expired"
@@ -130,10 +125,9 @@ class ConfirmationBroker:
             if args is not None and item.fingerprint != action_fingerprint(item.action, args):
                 return False, "args_mismatch"
             item.used = True
-            self._items.pop(nonce, None)     # 单次使用:消费即删
+            self._items.pop(nonce, None)
             return True, "ok"
 
-    # ── 观测 ────────────────────────────────────────────
     def pending(self, session: str = "") -> list:
         """未消费且未过期的确认码(可按会话过滤),供排查/前端展示。"""
         now = self._clock()
@@ -142,7 +136,7 @@ class ConfirmationBroker:
             return [it.to_dict() for it in self._items.values()
                     if not it.used and (not session or it.session == session)]
 
-    def purge(self, now: float = None) -> int:
+    def purge(self, now: float | None = None) -> int:
         now = now if now is not None else self._clock()
         with self._lock:
             return self._purge_locked(now)

package/python/foxclaw/core/envfile.py

@@ -37,10 +37,10 @@ def load_env_file(path: str | Path) -> List[str]:
     shadows: List[str] = []
     for key, value in (dotenv_values(target) or {}).items():
         if not key:
-            continue                    # 文件里的注释行会解出 None 键
+            continue
         value = (value or "").strip()
         if not value:
-            continue                    # 空值 = 未配置,不覆盖系统环境
+            continue
         current = os.environ.get(key, "").strip()
         if current and current != value:
             shadows.append(key)

package/python/foxclaw/core/failure_policy.py

@@ -16,29 +16,24 @@ from __future__ import annotations
 
 from dataclasses import dataclass
 
-# ── 失败类型 ────────────────────────────────────────────────────────────
 OK = "ok"
-TIMEOUT = "timeout"                    # 单工具硬超时(工具轮主动放弃)
-TRANSIENT = "transient"                # 网络抖动/限流/5xx —— 重试有意义
-NOT_CONFIGURED = "not_configured"      # 没配 key/服务 —— 重试一万次也没用
-EMPTY = "empty"                        # 调通了但没内容(搜不到/没召回)
-INVALID_ARGS = "invalid_args"          # 模型给的参数不合法 —— 让模型自己改
-DENIED = "denied"                      # 策略禁用/未知工具 —— 不许绕过
-NEEDS_HUMAN = "needs_human"            # 红线动作需确认 —— 只能人来做
-EXCEPTION = "exception"                # 工具内部抛异常
-UNKNOWN = "unknown"                    # 认不出来:保守(不重试、交人)
-
-#: 动作
+TIMEOUT = "timeout"
+TRANSIENT = "transient"
+NOT_CONFIGURED = "not_configured"
+EMPTY = "empty"
+INVALID_ARGS = "invalid_args"
+DENIED = "denied"
+NEEDS_HUMAN = "needs_human"
+EXCEPTION = "exception"
+UNKNOWN = "unknown"
+
 NONE = "none"
-RETRY = "retry"                        # 自动再试一次(仅只读)
-REPARAM = "reparam"                    # 让模型换参数/换查询词
-DEGRADE = "degrade"                    # 降级如实告知,不重试
-HAND_TO_HUMAN = "hand_to_human"        # 交人
-STOP = "stop"                          # 终止,不许再试
-
-#: 特征表。**顺序敏感**:先命中先返回。顺序上的两个坑都踩过:
-#:   · "未返回结果"(empty)不能先被 "未返回"(timeout) 吃掉;
-#:   · "不合法"(invalid_args)要在 "拒绝"(denied) 之前,否则参数错误被当成越权。
+RETRY = "retry"
+REPARAM = "reparam"
+DEGRADE = "degrade"
+HAND_TO_HUMAN = "hand_to_human"
+STOP = "stop"
+
 _RULES: tuple[tuple[str, tuple[str, ...]], ...] = (
     (DENIED, ("已被策略禁用", "被权限策略拒绝", "未知工具")),
     (NEEDS_HUMAN, ("需确认的动作", "需要你确认", "请用户确认", "只能由你亲自确认")),
@@ -50,7 +45,6 @@ _RULES: tuple[tuple[str, tuple[str, ...]], ...] = (
     (EXCEPTION, ("执行异常",)),
 )
 
-#: 类型 → (动作, 是否可重试, 给模型的一句硬提示)。提示写进回注文本,模型没法装作没看见。
 _ACTIONS: dict[str, tuple[str, bool, str]] = {
     TIMEOUT: (RETRY, True,
               "这一步超时未完成,已自动重试一次仍有问题。请如实说明这一步没做成,不要编造结果。"),
@@ -94,9 +88,6 @@ class Decision:
                 "retryable": self.retryable, "hint": self.hint}
 
 
-#: 失败回注的形态标记。工具执行侧的失败文本统一以 "(" 开头(见 tool_exec 的兜底),
-#: 另有少数异常文本不带括号。**不能**用"含 未/失败 就算失败"这种宽松判据:
-#: 搜索正文里"未来""失败案例"都会误伤,把成功结果标成失败。
 _FAILURE_MARKERS = ("执行异常", "入参不合法", "被权限策略拒绝", "缺少必填")
 
 
@@ -111,7 +102,7 @@ def classify(text: str) -> str:
     """把回注文本归类:``ok`` / 具体失败类型 / ``unknown``(认不出来,保守交人)。"""
     t = (text or "").strip()
     if not t:
-        return UNKNOWN                      # 空结果:不能当成功,也不确定成因
+        return UNKNOWN
     if not looks_like_failure(t):
         return OK
     low = t.lower()

package/python/foxclaw/core/gateway.py

@@ -19,15 +19,15 @@ class Gateway:
     def __init__(self, rate_per_min: int = 600, quota_per_hour: int = 20000,
                  max_clients: int = 4096):
         self.rate = max(1, int(rate_per_min))
-        self.capacity = float(self.rate)               # 桶容量 = 每分钟额度(允许突发到满桶)
-        self.refill = self.capacity / 60.0             # 令牌/秒
+        self.capacity = float(self.rate)
+        self.refill = self.capacity / 60.0
         self.quota = max(1, int(quota_per_hour))
         self.max_clients = max(64, int(max_clients))
         self._lock = threading.Lock()
-        self._buckets: dict = {}    # client -> [tokens, last_ts]
-        self._quota: dict = {}      # client -> [count, window_start]
-        self._seen: dict = {}       # client -> last_ts(用于空闲淘汰)
-        self.rejected = 0           # 累计拒绝数(可观测)
+        self._buckets: dict = {}
+        self._quota: dict = {}
+        self._seen: dict = {}
+        self.rejected = 0
 
     def check(self, client: str):
         """判定一次请求。返回 (allowed: bool, retry_after: int, reason: str)。
@@ -37,7 +37,6 @@ class Gateway:
             self._evict_locked(now)
             self._seen[client] = now
 
-            # ① 配额(固定 1 小时窗口)
             q = self._quota.get(client)
             if q is None or now - q[1] >= 3600.0:
                 q = [0, now]
@@ -46,7 +45,6 @@ class Gateway:
                 self.rejected += 1
                 return False, int(3600.0 - (now - q[1])) + 1, "quota"
 
-            # ② 令牌桶(突发限流)
             b = self._buckets.get(client)
             if b is None:
                 b = [self.capacity, now]
@@ -57,7 +55,6 @@ class Gateway:
                 self.rejected += 1
                 return False, int((1.0 - b[0]) / self.refill) + 1, "rate"
 
-            # 放行:扣 1 令牌 + 计 1 配额
             b[0] -= 1.0
             q[0] += 1
             return True, 0, ""
@@ -67,7 +64,6 @@ class Gateway:
         if len(self._seen) <= self.max_clients:
             return
         n_drop = len(self._seen) - self.max_clients + max(1, self.max_clients // 10)
-        # 按 last_ts 升序取最旧的 n_drop 个
         victims = sorted(self._seen.items(), key=lambda kv: kv[1])[:n_drop]
         for c, _ in victims:
             self._seen.pop(c, None)

package/python/foxclaw/core/governance_audit.py

@@ -46,11 +46,9 @@ from . import audit_chain
 ENV_SWITCH = "FOXCLAW_GOVERNANCE_AUDIT"
 TOPIC = "governance.decision"
 
-# verdict 合法取值(文档用,不做硬校验——审计不该因词汇笔误崩掉主流程)
-VERDICTS_RULING = ("allow", "warn", "deny", "confirm")   # 裁决类
-VERDICTS_EXECUTION = ("success", "failed")               # 执行类
+VERDICTS_RULING = ("allow", "warn", "deny", "confirm")
+VERDICTS_EXECUTION = ("success", "failed")
 
-# 已知层名(同上,仅文档)
 LAYERS = ("harness", "permission", "orchestration", "skill")
 
 
@@ -71,7 +69,6 @@ class GovernanceAuditor:
         self._spine = spine
         self._path = Path(sink_path) if sink_path else None
         self._lock = threading.Lock()
-        # 链尾 hash:首次落盘时从文件尾部补齐(重启后接着上一条链,而不是重开 GENESIS)
         self._last_hash: str | None = None
 
     @property
@@ -95,7 +92,7 @@ class GovernanceAuditor:
             "actor": actor,
             "action": action,
             "verdict": verdict,
-            "reason": (reason or "")[:200],          # 理由截断,防巨型异常串灌爆审计
+            "reason": (reason or "")[:200],
             "detail": detail or {},
             "ts": datetime.now(timezone.utc).isoformat(),
         }
@@ -103,7 +100,6 @@ class GovernanceAuditor:
         self._persist(rec)
         return did
 
-    # ── 内部:两个通道,各自独立 fail-safe ─────────────────────
 
     def _emit(self, rec: dict) -> None:
         if self._spine is None:

package/python/foxclaw/core/idempotency.py

@@ -27,7 +27,7 @@ from dataclasses import dataclass, field
 class _Record:
     key: str
     created: float
-    result: dict = field(default_factory=dict)   # 上次执行的结果(重发时原样返回)
+    result: dict = field(default_factory=dict)
 
 
 def make_key(domain: str, *parts: str, version: str = "v1") -> str:
@@ -52,16 +52,14 @@ class IdempotencyGuard:
     """
 
     def __init__(self, ttl_seconds: float = 3600, max_size: int = 10000,
-                 persist_path: str = None, spine=None,
+                 persist_path: str | None = None, spine=None,
                  compact_every: int = 1000):
         self.ttl = ttl_seconds
         self.max_size = max_size
         self.persist_path = persist_path
         self._store: dict[str, _Record] = {}
         self._lock = threading.RLock()
-        # 【P2-3】审计脊柱(可空,None 时静默)
         self._spine = spine
-        # 【P2-3】追加日志 + 定期 compact
         self._log_path = (persist_path + ".log") if persist_path else None
         self._compact_every = compact_every
         self._ops_since_compact = 0
@@ -82,7 +80,7 @@ class IdempotencyGuard:
             rec = self._store.get(key)
             return dict(rec.result) if rec else None
 
-    def mark(self, key: str, result: dict = None):
+    def mark(self, key: str, result: dict | None = None):
         """标记 key 已执行,记录结果。"""
         with self._lock:
             self._store[key] = _Record(key=key, created=time.time(),
@@ -92,9 +90,9 @@ class IdempotencyGuard:
                              result=self._store[key].result)
             need_compact = self._ops_since_compact >= self._compact_every
         if need_compact:
-            self._try_compact()     # 全量写盘放主锁外(见 _try_compact)
+            self._try_compact()
 
-    def check_and_mark(self, key: str, result: dict = None) -> bool:
+    def check_and_mark(self, key: str, result: dict | None = None) -> bool:
         """原子操作:若 key 未见过 → 标记并返回 True(应执行);
         若已见过 → 返回 False(应跳过)。
 
@@ -104,7 +102,7 @@ class IdempotencyGuard:
         with self._lock:
             self._evict_expired()
             if key in self._store:
-                return False        # 已处理过,跳过
+                return False
             self._store[key] = _Record(key=key, created=time.time(),
                                        result=dict(result or {}))
             self._enforce_capacity()
@@ -128,7 +126,6 @@ class IdempotencyGuard:
         if need_compact:
             self._try_compact()
 
-    # ── 内部:过期/容量/持久化 ──────────────────────────────
     def _evict_expired(self):
         if self.ttl <= 0:
             return
@@ -138,9 +135,6 @@ class IdempotencyGuard:
             del self._store[k]
 
     def _enforce_capacity(self):
-        # 超容量 → 淘汰最旧的(按 created)。
-        # 【P2-3】淘汰必须落 delete 日志:否则重启回放追加日志时,被淘汰的 key
-        # 会"复活"(mark 日志还在,没有对应的删除记录)。锁内调用。
         if len(self._store) <= self.max_size:
             return
         items = sorted(self._store.items(), key=lambda kv: kv[1].created)
@@ -148,7 +142,6 @@ class IdempotencyGuard:
             del self._store[k]
             self._persist_op("delete", k)
 
-    # ── 内部:持久化(追加日志 + 定期 compact)─────────────────
     def _persist_op(self, event: str, key: str, **fields):
         """【P2-3】追加一条日志(O(1) 写,不写全量)。锁内调用(append 很快,
         且在锁内可避免并发写同一文件交错)。失败计数 + 发事件,不影响主流程。"""
@@ -196,11 +189,10 @@ class IdempotencyGuard:
                             for k, r in self._store.items()
                             if self.ttl <= 0 or now - r.created <= self.ttl}
                 self._ops_since_compact = 0
-            # ── 以下为主锁外的慢 IO ──
             tmp = self.persist_path + ".tmp"
             with open(tmp, "w", encoding="utf-8") as f:
                 json.dump(snapshot, f, ensure_ascii=False)
-            os.replace(tmp, self.persist_path)   # 原子替换,防写一半损坏
+            os.replace(tmp, self.persist_path)
             if rotated and os.path.exists(rotated):
                 os.remove(rotated)
         except Exception:
@@ -222,7 +214,7 @@ class IdempotencyGuard:
             tmp = self.persist_path + ".tmp"
             with open(tmp, "w", encoding="utf-8") as f:
                 json.dump(data, f, ensure_ascii=False)
-            os.replace(tmp, self.persist_path)   # 原子替换,防写一半损坏
+            os.replace(tmp, self.persist_path)
             if self._log_path and os.path.exists(self._log_path):
                 os.remove(self._log_path)
             self._ops_since_compact = 0
@@ -254,8 +246,9 @@ class IdempotencyGuard:
         一份全量快照,失去"追加日志 O(1)"的意义。"""
         try:
             now = time.time()
-            if os.path.exists(self.persist_path):
-                with open(self.persist_path, encoding="utf-8") as f:
+            snapshot = self.persist_path
+            if snapshot is not None and os.path.exists(snapshot):
+                with open(snapshot, encoding="utf-8") as f:
                     data = json.load(f)
                 for k, v in data.items():
                     created = v.get("created", now)
@@ -272,18 +265,18 @@ class IdempotencyGuard:
                         try:
                             ev = json.loads(line)
                         except Exception:
-                            continue    # 跳过损坏行(append 末行可能写一半)
+                            continue
                         self._apply_log_event(ev, now)
                         replayed = True
             if replayed:
                 self._compact()
         except Exception:
-            pass        # 加载失败 → 从空开始,不影响启动
+            pass
 
     def stats(self) -> dict:
         with self._lock:
             self._evict_expired()
             return {"size": len(self._store), "max_size": self.max_size,
                     "ttl_seconds": self.ttl, "persisted": bool(self.persist_path),
-                    "persist_failures": self._persist_failures,      # 【P2-3】
-                    "ops_since_compact": self._ops_since_compact}    # 【P2-3】
+                    "persist_failures": self._persist_failures,
+                    "ops_since_compact": self._ops_since_compact}

package/python/foxclaw/core/injection_guard.py

@@ -18,7 +18,6 @@ import os
 import re
 import secrets
 
-# 典型注入/越权特征(中英)。命中不拦截,只在数据块里加醒目告警,提示模型"这是数据里的指令,别执行"。
 _MARKERS = [
     r"ignore\s+(all\s+)?(the\s+)?previous\s+instructions?",
     r"disregard\s+(the\s+)?(above|previous|prior)",
@@ -42,25 +41,17 @@ def scan(text: str) -> bool:
     return bool(text) and bool(_RE.search(str(text)))
 
 
-# ── 输出侧护栏(纵深防御第四道:DLP)────────────────────────────────────────────
-# 回复返回/落库前扫一道:① 密钥/令牌等敏感串 → 脱敏;② 系统提示词被整段吐出 → 拦截。
-# 纯正则、零额外模型调用(适配 flash 成本)。与"输入-隔离-模型"三层凑齐四道墙。
-
-# 常见密钥/令牌形态(含 Foxclaw 实际用的百度千帆 bce-v3 AppBuilder key)。
 _SECRET_PATTERNS = [
-    r"sk-[A-Za-z0-9]{20,}",                                  # OpenAI 风格
-    r"bce-v3/[A-Za-z0-9-]{6,}/[A-Za-z0-9]{6,}",              # 百度千帆 AppBuilder(Foxclaw 在用)
-    r"AKIA[0-9A-Z]{16}",                                     # AWS Access Key
-    r"gh[pousr]_[A-Za-z0-9]{20,}",                           # GitHub token
-    r"xox[baprs]-[A-Za-z0-9-]{10,}",                         # Slack token
-    r"Bearer\s+[A-Za-z0-9._\-]{20,}",                        # Bearer 令牌
+    r"sk-[A-Za-z0-9]{20,}",
+    r"bce-v3/[A-Za-z0-9-]{6,}/[A-Za-z0-9]{6,}",
+    r"AKIA[0-9A-Z]{16}",
+    r"gh[pousr]_[A-Za-z0-9]{20,}",
+    r"xox[baprs]-[A-Za-z0-9-]{10,}",
+    r"Bearer\s+[A-Za-z0-9._\-]{20,}",
     r"(api[_-]?key|secret|token|password|passwd)\s*[:=]\s*['\"]?[A-Za-z0-9._\-/]{12,}",
 ]
 _SECRET_RE = re.compile("|".join(_SECRET_PATTERNS), re.IGNORECASE)
 
-# 系统提示词泄露判定:不用"单个短语命中"(会误伤——如用户正常问"Principle 07 是什么")。
-# 改为**更强信号**:① 输出里出现 KERNEL 的长段**逐字串**(dump 才会逐字复现,提及概念不会);
-# ② 或同时出现 ≥2 个**章节标记**(无 kernel 参照时的兜底)。
 _SECTION_MARKS = ("【一、", "【二、", "【三、", "【四、", "【五、", "【六、", "【七、")
 
 
@@ -101,7 +92,6 @@ def _has_semantic_leak(text: str, kernel: str, threshold: float = 0.88,
         if model is None:
             return False
         import numpy as np
-        # 固定 ~200 字块;向量已 normalize → 余弦 = 点积。内核块进共享缓存(只编码一次)。
         kblocks = [kernel[i:i + 200] for i in range(0, len(kernel), 200)]
         tblocks = [text[i:i + 200] for i in range(0, len(text), 200)]
         kv = encode_cached(model, name, kblocks)
@@ -165,8 +155,6 @@ def guard_output(text: str, kernel: str = "") -> tuple:
     return (text, issues)
 
 
-# 分隔符伪造防护:外部内容里若自带 <untrusted>/</untrusted>,会伪造边界把恶意指令挤出隔离区
-# (经典分隔符注入)。包裹前把内容中一切 <(/)untrusted 的尖括号中和成 ‹,使其无法充当真边界。
 _UNTRUSTED_DELIM = re.compile(r"<\s*/?\s*untrusted", re.IGNORECASE)
 
 
@@ -196,17 +184,10 @@ def wrap_untrusted(text: str, source: str = "external") -> str:
     return block + note
 
 
-# ── 数据污点分级(Muse「eBPF 污点追踪」的纯软件版)────────────────────────────
-# 对齐 Meta Muse 的安全内核:不靠"模型自觉不泄露",而靠"数据一旦来自用户/敏感源,
-# 就在会话上打污点;之后凡外发/副作用动作,污点达标则动态提高审批门槛(见
-# skills.permission 的 taint_threshold)。这里只做「来源 → 敏感度」映射;污点的
-# 传播与裁决在调用方(agents.base / skills.permission)。
-#
-# 敏感度分级(数值越高越敏感,单调可比):
-TAINT_NONE = 0        # 无外部数据(会话初始态)
-TAINT_EXTERNAL = 1    # 外部不可控但非个人:web_search 结果
-TAINT_PERSONAL = 2    # 用户个人数据:知识库(knowledge)/文件(file)
-TAINT_SENSITIVE = 3   # 高敏感个人数据:个人记忆(memory)
+TAINT_NONE = 0
+TAINT_EXTERNAL = 1
+TAINT_PERSONAL = 2
+TAINT_SENSITIVE = 3
 
 _TAINT_BY_SOURCE = {
     "web_search": TAINT_EXTERNAL,