dingclaw 0.4.1__py3-none-any.whl

dingclaw/__init__.py

@@ -0,0 +1,17 @@
+"""DingTalk digital-avatar runtime with fail-closed delivery controls."""
+
+from .models import AgentResult, ConversationType, DeliveryStatus, DwsMessage, MessageStatus, PollResult
+
+__all__ = [
+    "AgentResult",
+    "ConversationType",
+    "DeliveryStatus",
+    "DwsMessage",
+    "MessageStatus",
+    "PollResult",
+]
+
+# Kept in step with pyproject by a test. It is not decoration: the panel
+# reports it at handshake, and a version that lies about which build is running
+# turns "reinstall and see" into the only available diagnostic.
+__version__ = "0.4.1"

dingclaw/agent.py

@@ -0,0 +1,665 @@
+"""Agent request contract, subprocess adapter, and safe fallback routing."""
+
+from __future__ import annotations
+
+import json
+import hashlib
+import os
+import pwd
+import resource
+import re
+import signal
+import subprocess
+import tempfile
+import threading
+from functools import partial
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Callable, Iterable, Mapping, Optional, Protocol, Sequence
+
+from .models import AgentAction, AgentResult, QuotedRef
+from .prompt_composer import PromptBudget, PromptBudgetError, compose_prompt
+
+
+class AgentError(RuntimeError):
+    """Base class for adapter failures."""
+
+
+class AgentTransientError(AgentError):
+    """Infrastructure failure for which another configured adapter may run."""
+
+
+class AgentOutputError(AgentError):
+    """Malformed model output for which another configured adapter may run."""
+
+
+class AgentUnavailableError(AgentError):
+    """All configured adapters failed at the infrastructure/output layer."""
+
+
+class WarmAgentTimeout(AgentTransientError):
+    """A pre-warmed process ran its whole timeout without answering.
+
+    Transient by inheritance, and that is the whole design: warm and cold
+    are the same model call, so a warm timeout is *the* attempt rather than
+    a reason to spend the timeout again cold. Being an AgentTransientError
+    means it already routes exactly like a cold timeout -- next adapter, and
+    failing that, the ordinary deferred retry.
+    """
+
+
+# Local subprocess-input guardrail, far below model context. Sized for the v2
+# byte-budgeted composer (skill 48k + batch 24k + context 27k + frame 3k, all
+# UTF-8 bytes) so a fully CJK prompt can never trip the limit spuriously.
+_MAX_PROMPT_BYTES = 120_000
+
+
+# Every live agent child, registered at spawn and dropped at completion.
+# Children run with start_new_session=True, which is exactly what makes a
+# terminal SIGTERM unable to reach them: without this registry, a daemon
+# restart (`launchctl kickstart -k` on every deploy) leaves an orphan claude
+# finishing a paid model call whose output has nowhere to go. Shutdown walks
+# this set and kills the process groups instead.
+_live_children_lock = threading.Lock()
+# Keyed by id() rather than held in a set: Popen is unhashable in some test
+# doubles, and identity is exactly the semantics wanted here anyway.
+_live_children: dict[int, subprocess.Popen] = {}
+
+
+def track_agent_child(process: subprocess.Popen) -> None:
+    with _live_children_lock:
+        _live_children[id(process)] = process
+
+
+def untrack_agent_child(process: subprocess.Popen) -> None:
+    with _live_children_lock:
+        _live_children.pop(id(process), None)
+
+
+def kill_tracked_agent_children() -> int:
+    """Kill every registered agent process group; the shutdown last resort.
+
+    Returns how many were killed, for the shutdown log. Safe against races
+    with normal completion: an already-dead child is a no-op, and untrack
+    after this walk pops something already gone.
+
+    SIGKILL outright, no SIGTERM ladder: these children owe no cleanup, and
+    the graceful path costs up to four seconds each -- three of them would
+    eat the whole launchd ExitTimeOut on their own. Kill them all first,
+    reap afterwards, so the cost is one signal sweep plus one wait sweep.
+    """
+    with _live_children_lock:
+        children = list(_live_children.values())
+        _live_children.clear()
+    for child in children:
+        try:
+            os.killpg(child.pid, signal.SIGKILL)
+        except (ProcessLookupError, PermissionError, OSError):
+            pass
+    for child in children:
+        try:
+            child.wait(timeout=1)
+        except Exception:
+            pass
+    return len(children)
+
+
+@dataclass(frozen=True)
+class ContextTurn:
+    """One transcript line as the prompt sees it."""
+
+    role: str
+    at: str
+    sender: str
+    text: str
+    quoted: str = ""
+
+    def as_payload(self) -> dict[str, str]:
+        payload = {"role": self.role, "at": self.at, "text": self.text}
+        if self.sender:
+            payload["sender"] = self.sender
+        if self.quoted:
+            payload["quoted"] = self.quoted
+        return payload
+
+    def size_bytes(self) -> int:
+        return len(
+            (self.role + self.at + self.sender + self.text + self.quoted).encode(
+                "utf-8"
+            )
+        )
+
+
+@dataclass(frozen=True)
+class AgentContext:
+    """Advisory conversation context; carried inside the untrusted JSON."""
+
+    memory: tuple[tuple[str, str], ...] = ()
+    summary: str = ""
+    recent_turns: tuple[ContextTurn, ...] = ()
+    # Turns after the agent's own last utterance — what it has not answered
+    # yet. Kept separate so the model never reads them as already handled.
+    since_last_reply: tuple[ContextTurn, ...] = ()
+
+
+@dataclass(frozen=True)
+class AgentRequest:
+    message_ids: tuple[str, ...]
+    conversation_id: str
+    conversation_type: str
+    sender_id: str
+    sender_name: str
+    text: str
+    skill_hash: str
+    tier: str = "restricted"
+    context: Optional[AgentContext] = None
+    quoted: tuple[Optional[QuotedRef], ...] = ()
+    # A steering instruction from the owner, typed into the panel when they
+    # triggered this reply by hand. Unlike everything in the message JSON it
+    # is trusted input, so it is rendered in the instruction half of the
+    # prompt -- but it steers wording only: the tier, the tools and the send
+    # gates are all unchanged by it.
+    owner_note: str = ""
+    # The wall clock at request build, ISO8601 with offset. The model runs
+    # with no tools and no other clock, so without this it guesses "now" from
+    # the newest transcript timestamp it can see -- measured 13 minutes stale
+    # in production. Rendered in the trusted frame; deliberately excluded
+    # from the request hash so retrying the same batch stays one job.
+    now: str = ""
+
+
+class AgentAdapter(Protocol):
+    name: str
+
+    def generate(self, request: AgentRequest) -> AgentResult:
+        ...
+
+
+@dataclass(frozen=True)
+class SubprocessRunResult:
+    returncode: int
+    stdout: str
+    stderr: str
+
+
+def run_agent_subprocess(
+    *,
+    name: str,
+    command: Sequence[str],
+    prompt: str,
+    timeout_seconds: int,
+    max_output_bytes: int,
+    extra_env_keys: tuple[str, ...] = (),
+    env_overrides: Optional[Mapping[str, str]] = None,
+    cwd: Optional[Path | str] = None,
+) -> SubprocessRunResult:
+    """Shared bounded subprocess execution for reply and maintenance agents."""
+    prompt_bytes = prompt.encode()
+    if len(prompt_bytes) > _MAX_PROMPT_BYTES:
+        raise AgentOutputError(f"{name} prompt exceeded byte limit")
+    # Popen reports a missing cwd as a bare FileNotFoundError naming neither
+    # the agent nor which of the two paths -- binary or directory -- was the
+    # one absent. Checking here keeps the workspace's own failure legible.
+    #
+    # Transient, deliberately unlike the ValueError an unpermitted environment
+    # override raises: a workspace can go missing for reasons outside this
+    # code, so the router should stay free to try the next adapter, whereas an
+    # override key is written at the call site and can only be wrong because
+    # the code is.
+    if cwd is not None and not os.path.isdir(cwd):
+        raise AgentTransientError(f"{name} working directory is missing: {cwd}")
+    with tempfile.TemporaryFile() as stdout_file, tempfile.TemporaryFile() as stderr_file:
+        try:
+            process = subprocess.Popen(
+                list(command),
+                stdin=subprocess.PIPE,
+                stdout=stdout_file,
+                stderr=stderr_file,
+                start_new_session=True,
+                # None means "inherit", which is what every caller got before
+                # this parameter existed. A caller that does pass one is
+                # bounding the blast radius: the privileged template runs with
+                # bypassPermissions, so wherever the daemon happens to sit --
+                # in production, a git checkout -- is otherwise the directory
+                # the agent is loose in, while `--add-dir {agent_workspace}`
+                # says the workspace was always the intended place to work.
+                cwd=cwd,
+                env=agent_environment(name, extra_env_keys, env_overrides),
+                preexec_fn=partial(limit_child_output, max_output_bytes),
+            )
+        except OSError as error:
+            raise AgentTransientError(f"{name} unavailable: {error}") from error
+        track_agent_child(process)
+        try:
+            returned_stdout, returned_stderr = process.communicate(
+                input=prompt_bytes, timeout=timeout_seconds
+            )
+        except subprocess.TimeoutExpired as error:
+            terminate_process_group(process)
+            raise AgentTransientError(f"{name} timeout") from error
+        finally:
+            untrack_agent_child(process)
+        stdout = _bounded_output(returned_stdout, stdout_file, max_output_bytes)
+        stderr = _bounded_output(returned_stderr, stderr_file, max_output_bytes)
+    if len(stdout) > max_output_bytes or len(stderr) > max_output_bytes:
+        raise AgentOutputError(f"{name} output exceeded byte limit")
+    stdout_text = stdout.decode("utf-8", errors="replace")
+    stderr_text = stderr.decode("utf-8", errors="replace")
+    if process.returncode != 0:
+        digest = hashlib.sha256((stderr or stdout)).hexdigest()[:16]
+        raise AgentTransientError(
+            f"{name} exited {process.returncode}; output_sha256={digest}"
+        )
+    return SubprocessRunResult(process.returncode, stdout_text, stderr_text)
+
+
+@dataclass(frozen=True)
+class SubprocessAgentAdapter:
+    name: str
+    command: Sequence[str]
+    skill_instructions: str
+    timeout_seconds: int = 120
+    max_output_bytes: int = 1_000_000
+    instruction_resolver: Optional[Callable[[AgentRequest], str]] = None
+    prompt_budget: Optional[PromptBudget] = None
+    extra_env_keys: tuple[str, ...] = ()
+    env_overrides: Mapping[str, str] = field(default_factory=dict)
+    cwd: Optional[Path | str] = None
+    owner_display_name: str = ""
+    # A WarmAgentPool, duck-typed to avoid the import cycle (the pool imports
+    # this module's process helpers). None means what it always meant: every
+    # call pays the cold start.
+    warm_pool: Any = None
+
+    def generate(self, request: AgentRequest) -> AgentResult:
+        instructions = (
+            self.instruction_resolver(request)
+            if self.instruction_resolver is not None
+            else self.skill_instructions
+        )
+        try:
+            prompt = compose_prompt(
+                request,
+                instructions,
+                budget=self.prompt_budget,
+                owner_display_name=self.owner_display_name,
+            )
+        except PromptBudgetError as error:
+            raise AgentOutputError(f"{self.name}: {error}") from error
+        warm = self._generate_warm(prompt)
+        if warm is not None:
+            # The warm result string is the same schema JSON the cold
+            # envelope unwraps to, so it goes through the identical parse
+            # and validation. A malformed one raises AgentOutputError
+            # exactly as a malformed cold output would.
+            return _parse_agent_output(self.name, warm)
+        run = run_agent_subprocess(
+            name=self.name,
+            command=self.command,
+            prompt=prompt,
+            timeout_seconds=self.timeout_seconds,
+            max_output_bytes=self.max_output_bytes,
+            extra_env_keys=self.extra_env_keys,
+            env_overrides=self.env_overrides,
+            cwd=self.cwd,
+        )
+        return _parse_agent_output(self.name, run.stdout)
+
+    def _generate_warm(self, prompt: str) -> Optional[str]:
+        """A result from the warm pool, or None meaning "go cold".
+
+        Every *fast* pool failure degrades silently: warm exists to shave the
+        process cold start, never to become a second way to lose a reply.
+        The exception is a warm process that ran its whole timeout -- warm
+        and cold are the same model call, so re-running it cold would spend
+        the timeout twice on an answer that is not coming either time. That
+        one is reported as the transient failure a cold timeout would raise,
+        and the ordinary retry machinery handles it from there.
+        """
+        if self.warm_pool is None:
+            return None
+        try:
+            return self.warm_pool.generate(
+                command=self.command,
+                prompt=prompt,
+                timeout_seconds=self.timeout_seconds,
+                env=agent_environment(
+                    self.name, self.extra_env_keys, self.env_overrides
+                ),
+                cwd=str(self.cwd) if self.cwd is not None else None,
+            )
+        except WarmAgentTimeout:
+            raise
+        except Exception:  # noqa: BLE001 - any other warm fault goes cold
+            return None
+
+
+class AgentRouter:
+    def __init__(self, adapters: Iterable[AgentAdapter]) -> None:
+        self.adapters = list(adapters)
+        if not self.adapters:
+            raise ValueError("at least one agent adapter is required")
+
+    def generate(self, request: AgentRequest) -> AgentResult:
+        failures: list[str] = []
+        for adapter in self.adapters:
+            try:
+                result = adapter.generate(request)
+                _validate_result(result)
+                return result
+            except (AgentTransientError, AgentOutputError) as error:
+                failures.append(f"{adapter.name}: {error}")
+        raise AgentUnavailableError("all agent adapters failed: " + "; ".join(failures))
+
+
+@dataclass(frozen=True)
+class BudgetedAgent:
+    fallback: AgentAdapter
+    budget_store: Any
+    daily_limit: int
+    budget_key_prefix: str = ""
+
+    @property
+    def name(self) -> str:
+        return "daily-budget"
+
+    def generate(self, request: AgentRequest) -> AgentResult:
+        day = datetime.now(timezone.utc).date().isoformat()
+        if self.budget_store.try_consume_agent_budget(
+            f"{self.budget_key_prefix}{day}", self.daily_limit
+        ):
+            return self.fallback.generate(request)
+        return AgentResult(
+            action=AgentAction.REPLY,
+            reply="收到。当前自动处理额度已达上限，本条消息未进入智能体处理。",
+            domain="local",
+            risk="low",
+            confidence=1.0,
+            reason="daily_agent_budget_exhausted",
+        )
+
+
+@dataclass(frozen=True)
+class PrivilegedReplyGuard:
+    """Minimal wrapper for the privileged chain: only breaks the command echo
+    loop (a reply that looks like an owner command would be parsed as one next
+    round, because our own sends carry a self identity)."""
+
+    fallback: AgentAdapter
+    command_prefixes: tuple[str, ...] = ()
+
+    @property
+    def name(self) -> str:
+        return "privileged-guard"
+
+    def generate(self, request: AgentRequest) -> AgentResult:
+        result = self.fallback.generate(request)
+        if result.action is AgentAction.REPLY and _reply_looks_like_command(
+            result.reply, self.command_prefixes
+        ):
+            return AgentResult(
+                action=AgentAction.REPLY,
+                reply="收到。生成结果包含指令形内容，已替换为本条安全回复。",
+                domain=result.domain or "control",
+                risk="medium",
+                confidence=1.0,
+                reason="local_reply_policy_reply_looks_like_command",
+            )
+        return result
+
+
+@dataclass(frozen=True)
+class LocalFirstAgent:
+    fallback: AgentAdapter
+    command_prefixes: tuple[str, ...] = ()
+
+    @property
+    def name(self) -> str:
+        return "local-first"
+
+    def generate(self, request: AgentRequest) -> AgentResult:
+        text = request.text.strip().casefold()
+        if text in {"你好", "您好", "在吗", "hi", "hello", "ping"}:
+            return AgentResult(
+                action=AgentAction.REPLY,
+                reply="在的，请说。",
+                domain="local",
+                risk="low",
+                confidence=1.0,
+                reason="local_greeting_template",
+            )
+        if _asks_for_realtime_status(text):
+            return AgentResult(
+                action=AgentAction.REPLY,
+                reply=(
+                    "收到。此消息涉及实时状态，当前自动回复没有查询权限；"
+                    "我不会给出未经核实的结论，请以对应系统记录或人工确认为准。"
+                ),
+                domain="local",
+                risk="medium",
+                confidence=1.0,
+                reason="realtime_status_requires_verification",
+            )
+        result = self.fallback.generate(request)
+        unsafe_reply_reason = _unsafe_reply_reason(
+            result.reply, self.command_prefixes
+        )
+        if result.action is AgentAction.REPLY and unsafe_reply_reason:
+            return AgentResult(
+                action=AgentAction.REPLY,
+                reply="收到。这个问题需要进一步核实或人工处理，我不会直接给出未经确认的结论。",
+                domain=result.domain or "local",
+                risk="medium",
+                confidence=1.0,
+                reason=f"local_reply_policy_{unsafe_reply_reason}",
+            )
+        if result.risk.casefold() == "high" or result.confidence < 0.5:
+            return AgentResult(
+                action=AgentAction.REPLY,
+                reply="收到。这个问题需要进一步核实或人工处理，我不会直接给出未经确认的结论。",
+                domain=result.domain or "local",
+                risk="medium",
+                confidence=1.0,
+                reason="local_high_risk_escalation",
+            )
+        return result
+
+
+def parse_structured_payload(agent_name: str, output: str) -> Mapping[str, Any]:
+    """Unwrap a CLI agent's stdout into the structured object it produced.
+
+    Handles Codex JSONL event streams, Claude --print envelopes whose
+    ``result`` is a JSON string, and ``structured_output`` wrappers.
+    """
+    text = output.strip()
+    if agent_name == "codex":
+        text = _last_codex_message(text) or text
+    try:
+        payload = json.loads(text)
+    except json.JSONDecodeError as error:
+        raise AgentOutputError(f"{agent_name} returned invalid JSON") from error
+    if isinstance(payload, Mapping) and isinstance(payload.get("result"), str):
+        try:
+            payload = json.loads(payload["result"])
+        except json.JSONDecodeError:
+            pass
+    if isinstance(payload, Mapping) and isinstance(payload.get("structured_output"), Mapping):
+        payload = payload["structured_output"]
+    if not isinstance(payload, Mapping):
+        raise AgentOutputError(f"{agent_name} result must be an object")
+    return payload
+
+
+def _parse_agent_output(agent_name: str, output: str) -> AgentResult:
+    payload = parse_structured_payload(agent_name, output)
+    try:
+        result = AgentResult(
+            action=AgentAction(str(payload["action"]).lower()),
+            reply=str(payload.get("reply", "")),
+            domain=str(payload.get("domain", "")),
+            risk=str(payload.get("risk", "")),
+            confidence=float(payload["confidence"]),
+            reason=str(payload.get("reason", "")),
+        )
+    except (KeyError, TypeError, ValueError) as error:
+        raise AgentOutputError(f"{agent_name} result has invalid fields") from error
+    _validate_result(result)
+    return result
+
+
+def _last_codex_message(output: str) -> str:
+    messages: list[str] = []
+    for line in output.splitlines():
+        try:
+            event: Any = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        if not isinstance(event, Mapping):
+            continue
+        item = event.get("item")
+        if isinstance(item, Mapping) and item.get("type") == "agent_message":
+            value = item.get("text")
+            if isinstance(value, str):
+                messages.append(value)
+    return messages[-1] if messages else ""
+
+
+def _validate_result(result: AgentResult) -> None:
+    if not 0 <= result.confidence <= 1:
+        raise AgentOutputError("confidence must be between 0 and 1")
+    if result.action is AgentAction.REPLY and not result.reply.strip():
+        raise AgentOutputError("reply action requires non-empty reply")
+    if len(result.reply) > 1500:
+        raise AgentOutputError("reply exceeds 1500 characters")
+    if result.action is AgentAction.SKIP and result.reply.strip():
+        raise AgentOutputError("skip action must not include reply")
+    if result.risk not in {"low", "medium", "high"}:
+        raise AgentOutputError("risk must be low, medium, or high")
+    if not result.domain.strip() or not result.reason.strip():
+        raise AgentOutputError("domain and reason must not be empty")
+
+
+def agent_environment(
+    agent_name: str,
+    extra_env_keys: tuple[str, ...] = (),
+    overrides: Optional[Mapping[str, str]] = None,
+) -> dict[str, str]:
+    """The environment a child agent is allowed to see. Public because the
+    media reader spawns children too, and a second hand-rolled copy of this
+    allowlist would drift from this one."""
+    allowed = {
+        "PATH",
+        "HOME",
+        "USER",
+        "HTTP_PROXY",
+        "HTTPS_PROXY",
+        "NO_PROXY",
+        "LANG",
+        "LC_ALL",
+        "TMPDIR",
+    }
+    if agent_name.casefold() == "codex":
+        allowed.add("CODEX_HOME")
+    allowed.update(extra_env_keys)
+    environment = {key: value for key, value in os.environ.items() if key in allowed}
+    # An override is bound by the same allowlist as an inherited value. The
+    # allowlist exists so that one place answers "what can a child see"; if a
+    # caller could name any variable, that answer would spread to every call
+    # site, and one of them naming the wrong variable would become a way to
+    # inject arbitrary environment into a subprocess we spawn with the
+    # operator's own credentials.
+    #
+    # A plain ValueError, deliberately unlike the AgentTransientError a missing
+    # working directory raises: callers write these keys literally, so an
+    # unpermitted one is a defect here rather than an environment the router
+    # should route around by falling back to the next adapter.
+    for key, value in (overrides or {}).items():
+        if key not in allowed:
+            raise ValueError(f"environment override not permitted: {key}")
+        # Empty means "leave it alone", so a caller can pass an unset config
+        # value straight through instead of branching on every key.
+        if value:
+            environment[key] = value
+    if not environment.get("USER"):
+        environment["USER"] = pwd.getpwuid(os.getuid()).pw_name
+    return environment
+
+
+def terminate_process_group(process: subprocess.Popen[bytes]) -> None:
+    try:
+        os.killpg(process.pid, signal.SIGTERM)
+        process.wait(timeout=2)
+    except (ProcessLookupError, subprocess.TimeoutExpired):
+        try:
+            os.killpg(process.pid, signal.SIGKILL)
+        except ProcessLookupError:
+            pass
+        process.wait(timeout=2)
+
+
+def _asks_for_realtime_status(text: str) -> bool:
+    status_words = ("发布", "上线", "部署", "进展", "状态", "完成", "修好", "合并")
+    question_words = (
+        "吗",
+        "没",
+        "没有",
+        "是否",
+        "怎样",
+        "怎么",
+        "如何",
+        "?",
+        "？",
+    )
+    return any(word in text for word in status_words) and any(
+        word in text for word in question_words
+    )
+
+
+def limit_child_output(max_output_bytes: int) -> None:
+    current_soft, current_hard = resource.getrlimit(resource.RLIMIT_FSIZE)
+    limit = max_output_bytes + 1
+    if current_hard != resource.RLIM_INFINITY:
+        limit = min(limit, current_hard)
+    resource.setrlimit(resource.RLIMIT_FSIZE, (limit, limit))
+
+
+def _bounded_output(
+    returned: Optional[bytes], output_file: Any, max_output_bytes: int
+) -> bytes:
+    if returned is not None:
+        return returned
+    output_file.seek(0)
+    return output_file.read(max_output_bytes + 1)
+
+
+def _reply_looks_like_command(reply: str, command_prefixes: tuple[str, ...]) -> bool:
+    stripped = reply.strip()
+    return any(
+        prefix and stripped.startswith(prefix) for prefix in command_prefixes
+    )
+
+
+def _unsafe_reply_reason(reply: str, command_prefixes: tuple[str, ...] = ()) -> str:
+    if _reply_looks_like_command(reply, command_prefixes):
+        return "reply_looks_like_command"
+    if re.search(r"https?://", reply, flags=re.IGNORECASE):
+        return "link"
+    if "@" in reply:
+        return "mention"
+    if re.search(
+        r"(?:sk-[a-z0-9_-]{8,}|client[_-]?secret|access[_-]?token|api[_-]?key|password\s*[:=])",
+        reply,
+        flags=re.IGNORECASE,
+    ):
+        return "credential_pattern"
+    if re.search(
+        r"(?:已|已经|刚刚).{0,4}(?:发布|上线|部署|合并|审批|完成|修复|处理)|"
+        r"(?:发布|上线|部署|合并|审批).{0,8}(?:完成|成功|通过)|"
+        r"我(?:会|马上|现在).{0,4}(?:发布|上线|部署|合并|审批)",
+        reply,
+    ):
+        return "unverified_action_claim"
+    if "# Source:" in reply or "个人 skill" in reply:
+        return "internal_context"
+    return ""