ppxans-harness 2.6.0 → 3.2.1

package/src/config/settings.js

@@ -1,182 +1,156 @@
-// src/config/settings.js - 通用设置读写 (HTTP API 后端)
-// 覆盖 config/ppx.json 顶层字段: user / channels.http / security / agent 预设 (values/system_extra/citation_rule/mode)
-// 设计 (与 providers.js 对齐):
-//   - 唯一事实源 = config/ppx.json
-//   - 写盘: 备份原文件 → 原子写 (.tmp + rename) → 防配置丢失
-//   - 读取: 深度合并默认值 (loadConfig), 保证前端总能拿到完整结构
-//   - 热重载: 写盘后由调用方调 agent.reload() 重建内存
-import fs from "node:fs";
-import path from "node:path";
-import { loadConfig, DEFAULT_CONFIG } from "./index.js";
-import { withFileLock } from "../utils/store.js";
-import { warn } from "../utils/logger.js";
-
-function getConfigPath(root) {
-  return path.join(root, "config", "ppx.json");
-}
-
-// 读取当前 config (磁盘原文), 缺文件返回空
-export function readConfigRaw(root) {
-  const p = getConfigPath(root);
-  if (!fs.existsSync(p)) return {};
-  try { return JSON.parse(fs.readFileSync(p, "utf8")); } catch (e) { warn("config/ppx.json 读取失败:", e.message); return {}; }
-}
-
-// 写盘: 先备份 (保留最近 3 个), 再原子写 (tmp + rename)
-function writeConfigAtomic(root, cfg) {
-  const p = getConfigPath(root);
-  if (fs.existsSync(p)) {
-    const bak = p + ".bak-" + new Date().toISOString().replace(/[:.]/g, "-");
-    try { fs.copyFileSync(p, bak); } catch (e) { warn("备份失败:", e.message); }
-    try {
-      const dir = path.dirname(p);
-      const base = path.basename(p);
-      const baks = fs.readdirSync(dir)
-        .filter((f) => f.startsWith(base + ".bak-"))
-        .map((f) => ({ f, t: fs.statSync(path.join(dir, f)).mtimeMs }));
-      baks.sort((a, b) => b.t - a.t);
-      for (const old of baks.slice(3)) {
-        try { fs.unlinkSync(path.join(dir, old.f)); } catch {}
-      }
-    } catch {}
-  }
-  const tmp = p + ".tmp";
-  fs.writeFileSync(tmp, JSON.stringify(cfg, null, 2), "utf8");
-  fs.renameSync(tmp, p);
-}
-
-// 通用设置字段白名单 (GET 返回 + PUT 可改的顶层键)
-// 每个键对应 config 里的一个可编辑分区, 值里的字段再细分
-export const SETTINGS_FIELDS = {
-  user: ["name"],
-  http: ["port", "auth_token"],
-  security: ["allow_all", "command_timeout_ms", "code_act"],
-  agent: ["name", "mode", "citation_rule", "system_extra", "values"],
-  mcp: ["servers", "auto_connect"],
-  tools: ["disabled"],
-};
-
-// MCP 服务器字段白名单 (防注入任意字段)
-export const MCP_SERVER_KEYS = ["command", "args", "env", "prefix", "url", "headers", "timeout", "name"];
-
-// 安全视图: 抹掉敏感明文 (auth_token / api_key / mcp headers), 只暴露 set 标志
-function sanitizeSettings(cfg) {
-  const out = {
-    user: { name: cfg.user?.name || "兄弟" },
-    http: {
-      port: cfg.channels?.http?.port ?? 8899,
-      auth_token_set: !!(cfg.channels?.http?.auth_token),
-    },
-    security: {
-      allow_all: !!cfg.security?.allow_all,
-      command_timeout_ms: cfg.security?.command_timeout_ms ?? 30000,
-      code_act: !!cfg.security?.code_act,
-    },
-    agent: {
-      name: cfg.agent?.name || "皮皮虾",
-      mode: cfg.agent?.mode || "react",
-      citation_rule: cfg.agent?.citation_rule ?? "",
-      system_extra: cfg.agent?.system_extra ?? "",
-      values: Array.isArray(cfg.agent?.values) ? cfg.agent.values : (DEFAULT_CONFIG.agent?.values || []),
-    },
-    mcp: {
-      auto_connect: !!cfg.mcp?.auto_connect,
-      servers: Array.isArray(cfg.mcp?.servers) ? cfg.mcp.servers.map((s) => sanitizeMcpServer(s)) : [],
-    },
-    tools: {
-      disabled: Array.isArray(cfg.tools?.disabled) ? cfg.tools.disabled : [],
-    },
-  };
-  return out;
-}
-
-// MCP 服务器安全视图: 只暴露白名单字段, headers 抹掉明文只回 set 标志
-function sanitizeMcpServer(s) {
-  if (!s || typeof s !== "object") return {};
-  const out = {};
-  for (const k of MCP_SERVER_KEYS) {
-    if (k === "headers") {
-      if (s.headers && typeof s.headers === "object") out.headers_set = true;
-      continue;
-    }
-    if (k === "env") {
-      if (s.env && typeof s.env === "object") out.env_set = Object.keys(s.env).length > 0;
-      continue;
-    }
-    if (s[k] !== undefined) out[k] = s[k];
-  }
-  if (!out.name) out.name = s.command || s.url || "";
-  return out;
-}
-
-// GET /api/settings: 返回可编辑设置的安全视图
-export function getSettings(root) {
-  // 用 loadConfig 深合并默认值, 保证缺字段也有结构; 但 write 需基于磁盘原文避免覆盖默认
-  const merged = loadConfig(root);
-  return sanitizeSettings(merged);
-}
-
-// PUT /api/settings: 只更新白名单字段, 返回更新后的安全视图
-// patch = { user?, http?, security?, agent?, mcp?, tools? }
-// v1.0.8: patch 顶层/分区字段都按 SETTINGS_FIELDS 白名单过滤 (防注入任意字段); 写盘在文件锁内读-改-写 (防并发丢更新)
-export function updateSettings(root, patch) {
-  if (!patch || typeof patch !== "object") throw new Error("patch 必须是对象");
-  const p = getConfigPath(root);
-  return withFileLock(p, () => {
-    const cfg = readConfigRaw(root); // 锁内重读: 拿最新磁盘状态再改
-    // 只取白名单字段 (SETTINGS_FIELDS 定义每个分区可改的键)
-    const pick = (obj, keys) => {
-      const out = {};
-      for (const k of keys) if (obj && typeof obj === "object" && obj[k] !== undefined) out[k] = obj[k];
-      return out;
-    };
-    cfg.user = { ...(cfg.user || {}), ...pick(patch.user, SETTINGS_FIELDS.user) };
-    cfg.channels = cfg.channels || {};
-    cfg.channels.http = { ...(cfg.channels.http || {}), ...pick(patch.http, SETTINGS_FIELDS.http) };
-    cfg.security = { ...(cfg.security || {}), ...pick(patch.security, SETTINGS_FIELDS.security) };
-    cfg.agent = { ...(cfg.agent || {}), ...pick(patch.agent, SETTINGS_FIELDS.agent) };
-    cfg.mcp = { ...(cfg.mcp || {}), ...pick(patch.mcp, SETTINGS_FIELDS.mcp) };
-    cfg.tools = { ...(cfg.tools || {}), ...pick(patch.tools, SETTINGS_FIELDS.tools) };
-
-    // 校验
-    const port = cfg.channels.http.port;
-    if (port != null && (!Number.isInteger(port) || port < 1 || port > 65535)) throw new Error("HTTP 端口必须是 1-65535 的整数");
-    const timeout = cfg.security.command_timeout_ms;
-    if (timeout != null && (!Number.isFinite(timeout) || timeout < 1000)) throw new Error("命令超时至少 1000ms");
-    if (cfg.agent.values != null && !Array.isArray(cfg.agent.values)) throw new Error("核心价值必须是字符串数组");
-    if (cfg.agent.values && cfg.agent.values.some((v) => typeof v !== "string")) throw new Error("核心价值必须是字符串数组");
-    if (cfg.agent.mode != null && !/^[a-z-]{2,30}$/.test(String(cfg.agent.mode))) throw new Error("编排模式只含小写字母/横线");
-    // mcp.servers: 必须是对象数组, 每项至少 command 或 url, 只保留白名单字段
-    if (cfg.mcp.servers != null && !Array.isArray(cfg.mcp.servers)) throw new Error("MCP servers 必须是数组");
-    if (Array.isArray(cfg.mcp.servers)) {
-      const clean = [];
-      for (const s of cfg.mcp.servers) {
-        if (!s || typeof s !== "object") continue;
-        if (!s.command && !s.url) throw new Error("MCP 服务器至少需要 command(stdio) 或 url(http)");
-        const norm = {};
-        for (const k of MCP_SERVER_KEYS) if (s[k] !== undefined) norm[k] = s[k];
-        clean.push(norm);
-      }
-      cfg.mcp.servers = clean;
-    }
-    // tools.disabled: 必须是字符串数组
-    if (cfg.tools.disabled != null) {
-      if (!Array.isArray(cfg.tools.disabled)) throw new Error("tools.disabled 必须是字符串数组");
-      if (cfg.tools.disabled.some((t) => typeof t !== "string")) throw new Error("tools.disabled 必须是字符串数组");
-    }
-
-    writeConfigAtomic(root, cfg);
-    return sanitizeSettings(cfg);
-  });
-}
-
-// 应用 tools.disabled: 返回需要禁用的工具名列表 (供启动时/热重载时禁用)
-export function disabledTools(root) {
-  const { tools } = getSettings(root);
-  return Array.isArray(tools?.disabled) ? tools.disabled : [];
-}
-
-// 可编辑字段元数据 (供前端渲染表单, 免前端硬编码结构)
-export function settingsSchema() {
-  return SETTINGS_FIELDS;
-}
+// src/config/settings.js - 通用设置读写 (HTTP API 后端)
+// 覆盖 config/ppx.json 顶层字段: user / channels.http / security / agent 预设 (values/system_extra/citation_rule/mode)
+// 设计 (与 providers.js 对齐):
+//   - 唯一事实源 = config/ppx.json
+//   - 写盘: 备份原文件 → 原子写 (.tmp + rename) → 防配置丢失
+//   - 读取: 深度合并默认值 (loadConfig), 保证前端总能拿到完整结构
+//   - 热重载: 写盘后由调用方调 agent.reload() 重建内存
+import { loadConfig, DEFAULT_CONFIG } from "./index.js";
+import { withFileLock } from "../utils/store.js";
+import { configFilePath, readPpxConfig, writeConfigAtomic } from "../utils/config-file.js";
+
+const getConfigPath = configFilePath;
+
+// 读取当前 config (磁盘原文), 缺文件返回空
+export function readConfigRaw(root) {
+  return readPpxConfig(root, {});
+}
+
+// 通用设置字段白名单 (GET 返回 + PUT 可改的顶层键)
+// 每个键对应 config 里的一个可编辑分区, 值里的字段再细分
+export const SETTINGS_FIELDS = {
+  user: ["name"],
+  http: ["port", "auth_token"],
+  security: ["allow_all", "command_timeout_ms", "code_act", "deny"],
+  agent: ["name", "mode", "citation_rule", "system_extra", "values"],
+  mcp: ["servers", "auto_connect"],
+  tools: ["disabled"],
+};
+
+// MCP 服务器字段白名单 (防注入任意字段)
+export const MCP_SERVER_KEYS = ["command", "args", "env", "prefix", "url", "headers", "timeout", "name"];
+
+// 安全视图: 抹掉敏感明文 (auth_token / api_key / mcp headers), 只暴露 set 标志
+function sanitizeSettings(cfg) {
+  const out = {
+    user: { name: cfg.user?.name || "兄弟" },
+    http: {
+      port: cfg.channels?.http?.port ?? 8899,
+      auth_token_set: !!(cfg.channels?.http?.auth_token),
+    },
+    security: {
+      allow_all: !!cfg.security?.allow_all,
+      command_timeout_ms: cfg.security?.command_timeout_ms ?? 30000,
+      code_act: !!cfg.security?.code_act,
+      deny: Array.isArray(cfg.security?.deny) ? cfg.security.deny : [],
+    },
+    agent: {
+      name: cfg.agent?.name || "皮皮虾",
+      mode: cfg.agent?.mode || "react",
+      citation_rule: cfg.agent?.citation_rule ?? "",
+      system_extra: cfg.agent?.system_extra ?? "",
+      values: Array.isArray(cfg.agent?.values) ? cfg.agent.values : (DEFAULT_CONFIG.agent?.values || []),
+    },
+    mcp: {
+      auto_connect: !!cfg.mcp?.auto_connect,
+      servers: Array.isArray(cfg.mcp?.servers) ? cfg.mcp.servers.map((s) => sanitizeMcpServer(s)) : [],
+    },
+    tools: {
+      disabled: Array.isArray(cfg.tools?.disabled) ? cfg.tools.disabled : [],
+    },
+  };
+  return out;
+}
+
+// MCP 服务器安全视图: 只暴露白名单字段, headers 抹掉明文只回 set 标志
+function sanitizeMcpServer(s) {
+  if (!s || typeof s !== "object") return {};
+  const out = {};
+  for (const k of MCP_SERVER_KEYS) {
+    if (k === "headers") {
+      if (s.headers && typeof s.headers === "object") out.headers_set = true;
+      continue;
+    }
+    if (k === "env") {
+      if (s.env && typeof s.env === "object") out.env_set = Object.keys(s.env).length > 0;
+      continue;
+    }
+    if (s[k] !== undefined) out[k] = s[k];
+  }
+  if (!out.name) out.name = s.command || s.url || "";
+  return out;
+}
+
+// GET /api/settings: 返回可编辑设置的安全视图
+export function getSettings(root) {
+  // 用 loadConfig 深合并默认值, 保证缺字段也有结构; 但 write 需基于磁盘原文避免覆盖默认
+  const merged = loadConfig(root);
+  return sanitizeSettings(merged);
+}
+
+// PUT /api/settings: 只更新白名单字段, 返回更新后的安全视图
+// patch = { user?, http?, security?, agent?, mcp?, tools? }
+// v1.0.8: patch 顶层/分区字段都按 SETTINGS_FIELDS 白名单过滤 (防注入任意字段); 写盘在文件锁内读-改-写 (防并发丢更新)
+export function updateSettings(root, patch) {
+  if (!patch || typeof patch !== "object") throw new Error("patch 必须是对象");
+  const p = getConfigPath(root);
+  return withFileLock(p, () => {
+    const cfg = readConfigRaw(root); // 锁内重读: 拿最新磁盘状态再改
+    // 只取白名单字段 (SETTINGS_FIELDS 定义每个分区可改的键)
+    const pick = (obj, keys) => {
+      const out = {};
+      for (const k of keys) if (obj && typeof obj === "object" && obj[k] !== undefined) out[k] = obj[k];
+      return out;
+    };
+    cfg.user = { ...(cfg.user || {}), ...pick(patch.user, SETTINGS_FIELDS.user) };
+    cfg.channels = cfg.channels || {};
+    cfg.channels.http = { ...(cfg.channels.http || {}), ...pick(patch.http, SETTINGS_FIELDS.http) };
+    cfg.security = { ...(cfg.security || {}), ...pick(patch.security, SETTINGS_FIELDS.security) };
+    cfg.agent = { ...(cfg.agent || {}), ...pick(patch.agent, SETTINGS_FIELDS.agent) };
+    cfg.mcp = { ...(cfg.mcp || {}), ...pick(patch.mcp, SETTINGS_FIELDS.mcp) };
+    cfg.tools = { ...(cfg.tools || {}), ...pick(patch.tools, SETTINGS_FIELDS.tools) };
+
+    // 校验
+    const port = cfg.channels.http.port;
+    if (port != null && (!Number.isInteger(port) || port < 1 || port > 65535)) throw new Error("HTTP 端口必须是 1-65535 的整数");
+    const timeout = cfg.security.command_timeout_ms;
+    if (timeout != null && (!Number.isFinite(timeout) || timeout < 1000)) throw new Error("命令超时至少 1000ms");
+    if (cfg.security.deny != null && !Array.isArray(cfg.security.deny)) throw new Error("额外拒绝规则必须是字符串数组");
+    if (cfg.security.deny && cfg.security.deny.some((d) => typeof d !== "string")) throw new Error("额外拒绝规则必须是字符串数组");
+    if (cfg.agent.values != null && !Array.isArray(cfg.agent.values)) throw new Error("核心价值必须是字符串数组");
+    if (cfg.agent.values && cfg.agent.values.some((v) => typeof v !== "string")) throw new Error("核心价值必须是字符串数组");
+    if (cfg.agent.mode != null && !/^[a-z-]{2,30}$/.test(String(cfg.agent.mode))) throw new Error("编排模式只含小写字母/横线");
+    // mcp.servers: 必须是对象数组, 每项至少 command 或 url, 只保留白名单字段
+    if (cfg.mcp.servers != null && !Array.isArray(cfg.mcp.servers)) throw new Error("MCP servers 必须是数组");
+    if (Array.isArray(cfg.mcp.servers)) {
+      const clean = [];
+      for (const s of cfg.mcp.servers) {
+        if (!s || typeof s !== "object") continue;
+        if (!s.command && !s.url) throw new Error("MCP 服务器至少需要 command(stdio) 或 url(http)");
+        const norm = {};
+        for (const k of MCP_SERVER_KEYS) if (s[k] !== undefined) norm[k] = s[k];
+        clean.push(norm);
+      }
+      cfg.mcp.servers = clean;
+    }
+    // tools.disabled: 必须是字符串数组
+    if (cfg.tools.disabled != null) {
+      if (!Array.isArray(cfg.tools.disabled)) throw new Error("tools.disabled 必须是字符串数组");
+      if (cfg.tools.disabled.some((t) => typeof t !== "string")) throw new Error("tools.disabled 必须是字符串数组");
+    }
+
+    writeConfigAtomic(root, cfg);
+    return sanitizeSettings(cfg);
+  });
+}
+
+// 应用 tools.disabled: 返回需要禁用的工具名列表 (供启动时/热重载时禁用)
+export function disabledTools(root) {
+  const { tools } = getSettings(root);
+  return Array.isArray(tools?.disabled) ? tools.disabled : [];
+}
+
+// 可编辑字段元数据 (供前端渲染表单, 免前端硬编码结构)
+export function settingsSchema() {
+  return SETTINGS_FIELDS;
+}

package/src/core/policy.js

@@ -5,7 +5,7 @@
 //       循环何时停、降档、重试、注入方向盘, 全由本模块决策。
 //       依赖全部注入 (llm/tools/runTool/shrinkMessages/...), 无 agent 引用, 可独立测试。
 import { TOOL_ERROR_PREFIX } from "../tools/index.js";
-import { warn } from "../utils/logger.js";
+import { warn, debug } from "../utils/logger.js";
 
 // ---- 阈值默认值 (config.agent.* 可覆盖) ----
 export const DEFAULT_MAX_TOOL_ROUNDS = 8;
@@ -78,7 +78,7 @@ export async function callWithTimeoutRetry({
   budgetMs = null,           // 工具超时预算 (toolTimeoutOf 注入, 事件采集用)
   onEvent = null,
 }) {
-  const ev = (type, payload) => { if (onEvent) { try { onEvent(type, payload); } catch {} } };
+  const ev = (type, payload) => { if (onEvent) { try { onEvent(type, payload); } catch (e) { debug(`[core/policy] 已忽略异常: ${e && e.message ? e.message : e}`); } } };
   const t0 = Date.now();
   let result = await runTool(name, args);
   let elapsedMs = Date.now() - t0;
@@ -112,6 +112,8 @@ export class ToolLoopPolicy {
     this.exploreBreak = Number(c.explore_break_limit) || DEFAULT_EXPLORE_BREAK;
     this.repeatFlag = Number(c.repeat_flag_limit) || DEFAULT_REPEAT_FLAG;
     this.overflowShrinkMax = DEFAULT_OVERFLOW_SHRINK_MAX;
+    // 同轮独立工具调用并发执行 (2026-10-01 优化): 默认开, agent.parallel_tool_calls=false 回退串行
+    this.parallelToolCalls = c.parallel_tool_calls !== false;
     // 运行时状态 (每轮循环实例持有, 重启归零)
     this.errorRetries = 0;
     this.exploreStreak = 0;
@@ -142,7 +144,7 @@ export class ToolLoopPolicy {
     let repeatHit = false;
     for (const tc of called) {
       let a = {};
-      try { a = JSON.parse(tc.function.arguments || "{}"); } catch {}
+      try { a = JSON.parse(tc.function.arguments || "{}"); } catch (e) { debug(`[core/policy] 已忽略异常: ${e && e.message ? e.message : e}`); }
       const sig = (tc.function?.name || "") + "::" + JSON.stringify(a).slice(0, 120);
       this.seenSig.set(sig, (this.seenSig.get(sig) || 0) + 1);
       if (this.seenSig.get(sig) >= this.repeatFlag) repeatHit = true;
@@ -166,6 +168,24 @@ export class ToolLoopPolicy {
     this.errorRetries++;
     return true;
   }
+
+  // ---- 自省裁决 (Reflective 内核): 对工具失败做语义分类, 决定重试策略 ----
+  // 在机械次数重试之上加一道闸门: 硬拒绝类错误 (黑名单/审批拒/权限/deny/DENY_HINT)
+  // 不许盲目改写命令绕过, 直接拦停; 可修正类错误才走次数重试。
+  // 返回 { action: "stop"|"retry", reason } — 纯方法, 可独立测试。
+  selfReviewError(errors) {
+    if (!errors || !errors.length) return null;
+    const text = errors.join("\n");
+    // 硬拒绝特征: 命中命令守卫拦截 / 审批被拒 / 权限拒绝 / 黑名单
+    if (/命中后不要重试|改造命令绕过|硬黑名单|审批被拒绝|审批拒绝|权限.*拒|deny|DENY|拦截/i.test(text)) {
+      return {
+        action: "stop",
+        reason: "这是硬性拒绝类错误, 盲目重试或改写命令会绕过安全闸门 — 停下不重试, 说明原因或请用户调整配置。",
+      };
+    }
+    // 可修正类错误 (命令不存在/文件缺失/参数错等): 走次数重试道
+    return { action: "retry", reason: "可修正错误, 喂回模型重试 (仍受次数上限约束)" };
+  }
 }
 
 // ---- 工具循环主驱动 (原 PPXAgent._llmWithTools) ----
@@ -198,11 +218,11 @@ export async function runToolLoop({
 }) {
   const policy = new ToolLoopPolicy(config.agent || config);
   let messages = [...seedMessages];
-  const ev = (type, payload) => { if (onEvent) { try { onEvent(type, payload); } catch {} } };
+  const ev = (type, payload) => { if (onEvent) { try { onEvent(type, payload); } catch (e) { debug(`[core/policy] 已忽略异常: ${e && e.message ? e.message : e}`); } } };
 
   for (let round = 0; round < policy.maxRounds; round++) {
     if (isInterrupted()) return "[皮皮虾] 任务已被中断 (operator cancelled).";
-    if (onStep) { try { onStep({ type: "step", round, maxRounds: policy.maxRounds, ts: Date.now() }); } catch {} }
+    if (onStep) { try { onStep({ type: "step", round, maxRounds: policy.maxRounds, ts: Date.now() }); } catch (e) { debug(`[core/policy] 已忽略异常: ${e && e.message ? e.message : e}`); } }
 
     let resp;
     try {
@@ -232,25 +252,56 @@ export async function runToolLoop({
     }
 
     // 工具错误重试: 若本轮有工具失败, 汇总错误喂回模型修正后重试 (最多 maxErrorRetry 次)
-    const errors = [];
+    // 并发执行 (2026-10-01 优化, 审计 P1 遗留项): 同一轮的 tool_calls 相互独立
+    // (OpenAI 语义: 数组内无依赖), 串行会让 N 个独立调用的延迟线性叠加。
+    // Promise.all 保序: messages 回传顺序与 errors 汇总顺序仍与 tool_calls 一致,
+    // 下游 (recordTurn 重复检测 / 错误喂回) 语义不变。agent.parallel_tool_calls=false 回退串行。
+    const callable = [];
     for (const tc of toolCalls) {
       if (tc.type === "function" && tc.function) {
         let args = {};
-        try { args = JSON.parse(tc.function.arguments || "{}"); } catch {}
-        // v1.6.0 第四刀: 超时检测 + 幂等重试一次 (tool/timeout 事件采集 P50/P95/P99 数据基础)
-        const { result } = await callWithTimeoutRetry({
-          name: tc.function.name,
-          args,
-          runTool,
-          isIdempotent: isIdempotentTool(tc.function.name),
-          budgetMs: toolTimeoutOf(tc.function.name),
-          onEvent,
-        });
-        messages.push({ role: "tool", tool_call_id: tc.id, content: toToolContent(result, policy.resultBudget) });
-        if (result.startsWith(TOOL_ERROR_PREFIX)) errors.push(result);
+        try { args = JSON.parse(tc.function.arguments || "{}"); } catch (e) { debug(`[core/policy] 已忽略异常: ${e && e.message ? e.message : e}`); }
+        callable.push({ tc, args });
+      }
+    }
+    // v1.6.0 第四刀语义保留: 超时检测 + 幂等重试一次 (tool/timeout 事件采集 P50/P95/P99 数据基础)
+    const execOne = ({ tc, args }) => callWithTimeoutRetry({
+      name: tc.function.name,
+      args,
+      runTool,
+      isIdempotent: isIdempotentTool(tc.function.name),
+      budgetMs: toolTimeoutOf(tc.function.name),
+      onEvent,
+    }).then((r) => ({ tc, ...r }));
+    const errors = [];
+    const collect = (tc, result) => {
+      // 2026-10-03 修复 (P1): 原 tool 消息只有非标 `_id`, 缺 OpenAI 规范要求的 tool_call_id
+      // → 严格校验后端 (OpenAI 官方 / vLLM) 第二轮必 400。补上标准字段; `_id` 保留兼容内部消费方
+      messages.push({ role: "tool", tool_call_id: tc.id, _id: tc.id, content: toToolContent(result, policy.resultBudget) });
+      if (result.startsWith(TOOL_ERROR_PREFIX)) errors.push(result);
+    };
+    if (policy.parallelToolCalls) {
+      const settled = await Promise.all(callable.map(execOne));
+      for (const { tc, result } of settled) collect(tc, result);
+    } else {
+      // 串行回退路径 (旧行为): 逐个执行 + 逐个回传
+      for (const item of callable) {
+        const { result } = await execOne(item);
+        collect(item.tc, result);
       }
     }
     if (policy.shouldRetryErrors(errors)) {
+      // 自省裁决 (Reflective 内核): 硬拒绝类错误直接拦停, 不得盲目改写命令绕过
+      // 语义闸门在次数闸门之前: 即使重试次数未满, 硬拒绝也不重试 (安全红线)
+      const verdict = policy.selfReviewError(errors);
+      if (verdict && verdict.action === "stop") {
+        ev("tool/self_review_stop", { round, reason: verdict.reason, retries: policy.errorRetries });
+        messages.push({
+          role: "user",
+          content: "自省裁决: " + verdict.reason + "\n失败详情:\n" + errors.join("\n") + "\n请停止重试, 直接基于已有信息给出结论, 或向用户说明原因。",
+        });
+        continue;
+      }
       ev("tool/error_retry", { round, errors: errors.length, retries: policy.errorRetries, max: policy.maxErrorRetry });
       messages.push({
         role: "user",

package/src/core/trace.js

@@ -11,14 +11,15 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import fs from "node:fs";
 import path from "node:path";
-import { ensureDir, logicalDay } from "../utils/store.js";
+import { logsDir, logicalDay } from "../utils/store.js";
+import { shortId } from "../utils/id.js";
 import { scrubPII } from "../utils/pii.js";
 
 const als = new AsyncLocalStorage();
 const MAX_PAYLOAD = 2000; // 单条事件载荷上限, 防爆文件
 
 export function genTraceId() {
-  return "t_" + Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
+  return shortId("t_", 8);
 }
 
 // 入口包装: 生成新 traceId, 所有异步子调用自动继承
@@ -41,9 +42,8 @@ export function hasTrace() {
 // ---- 事件流写入器 (agent 构造时实例化一个, 全局复用) ----
 export class EventTracer {
   constructor(dataDir) {
-    this.dir = path.join(dataDir, "logs", "traces");
-    ensureDir(this.dir);
-    this.sessionId = "s_" + Date.now().toString(36) + Math.random().toString(36).slice(2, 6);
+    this.dir = logsDir(dataDir); // 与 utils/trace.js 同一目录 (logs/traces)
+    this.sessionId = shortId("s_", 6);
     this.count = 0;
   }
 
@@ -61,8 +61,10 @@ export class EventTracer {
       sessionId: this.sessionId,
       traceId: store?.traceId || null,
       seq: this.count,
-      type,
+      // ...safe 在 type 之前 (2026-09-18 修复): payload 自带 type 键时不得覆盖埋点事件类型,
+      //   否则 events-*.jsonl 中 type 与实际语义不符, 基于 type 的检索/统计失真
       ...safe,
+      type,
     };
     if (opts.durationMs != null) entry.durationMs = Math.round(opts.durationMs);
     if (opts.error != null) entry.error = String(opts.error).slice(0, 500);