langchain-agentx-python 2.1.2__py3-none-any.whl → 2.1.5__py3-none-any.whl

langchain_agentx/__init__.py

@@ -11,7 +11,7 @@ from langchain_agentx import create_loop_agent
 ```
 """
 
-__version__ = "2.1.2"
+__version__ = "2.1.5"
 
 from .loop import (  # noqa: F401
     create_loop_agent,

langchain_agentx/loop/exit/exit_logic.py

@@ -263,7 +263,7 @@ class AgentLoopState(TypedDict):
     _run_id: str | None  # 当前 run 标识（loop_start_node 注入）
     token_budget_continuation_count: int  # CC：token budget nudge 已执行次数
     token_budget_continue_requested: bool  # 为 True 时 loop_controller 注入 nudge 并回到 model
-    abort_terminal_reason: str | None  # CC 式中断终态：aborted_streaming / aborted_tools / hook_stopped
+    abort_terminal_reason: str | None  # aborted_streaming / aborted_tools / hook_stopped / classifier_denial_limit
     finish_reason: str | None  # Provider 协议层：这一轮 completion 为何停
     finish_reasons: list[str]  # finish_reason 历史（观测用）
     section_cache: dict[str, str | None]  # SystemPromptSection session 级缓存（key=name, value=compute() 结果）

langchain_agentx/loop/exit/reason_codes.py

@@ -23,6 +23,8 @@ TERMINAL_REASON_INVARIANT_VIOLATION = "invariant_violation"
 TERMINAL_REASON_ABORTED_STREAMING = "aborted_streaming"
 TERMINAL_REASON_ABORTED_TOOLS = "aborted_tools"
 TERMINAL_REASON_HOOK_STOPPED = "hook_stopped"
+# Auto classifier 熔断到顶（headless）：仅终止当前 Agent loop，对齐 CC AbortError
+TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT = "classifier_denial_limit"
 
 # ---------------------------------------------------------------------------
 # transition.reason（控制流路由观测，不是终态）
@@ -57,6 +59,7 @@ ERROR_TERMINAL_REASONS = frozenset(
         TERMINAL_REASON_INVARIANT_VIOLATION,
         TERMINAL_REASON_MAX_TOKENS,
         TERMINAL_REASON_BLOCKING_LIMIT,
+        TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT,
     }
 )
 
@@ -78,6 +81,7 @@ __all__ = [
     "TERMINAL_REASON_ABORTED_STREAMING",
     "TERMINAL_REASON_ABORTED_TOOLS",
     "TERMINAL_REASON_HOOK_STOPPED",
+    "TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT",
     "ERROR_TERMINAL_REASONS",
     "TRANSITION_NEXT_TURN",
     "TRANSITION_API_ERROR_TERMINAL",

langchain_agentx/loop/exit/terminal.py

@@ -19,6 +19,7 @@ from .reason_codes import (
     TERMINAL_REASON_ABORTED_STREAMING,
     TERMINAL_REASON_ABORTED_TOOLS,
     TERMINAL_REASON_BLOCKING_LIMIT,
+    TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT,
     TERMINAL_REASON_CONTENT_FILTER,
     TERMINAL_REASON_HOOK_STOPPED,
     TERMINAL_REASON_STOP_HOOK_PREVENTED,
@@ -58,6 +59,7 @@ _ERROR_TERMINAL_REASONS = frozenset(
         TERMINAL_REASON_HOOK_STOPPED,
         TERMINAL_REASON_ABORTED_STREAMING,
         TERMINAL_REASON_ABORTED_TOOLS,
+        TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT,
         TERMINAL_REASON_INVARIANT_VIOLATION,
     }
 )

langchain_agentx/loop/graph/builtin_loop_control.py

@@ -18,10 +18,12 @@ from langgraph.types import Command
 from ..exit.reason_codes import (
     TERMINAL_REASON_ABORTED_STREAMING,
     TERMINAL_REASON_ABORTED_TOOLS,
+    TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT,
     TERMINAL_REASON_HOOK_STOPPED,
 )
 from ..loop_abort import LoopAbortSignal
 from ..model.orphan_tool_results import synthetic_tool_messages_for_orphan_tool_calls
+from ...tool_runtime.classifier_denial_limit import ClassifierDenialLimitAbort
 from ...tool_runtime.permission_context import clear_auto_approved_window
 from ...tool_runtime.tool_message_status import apply_tool_message_status_to_result
 
@@ -144,28 +146,47 @@ def _with_injected_agent_tool_model(request: Any) -> Any:
     return patched_request
 
 
+def _tool_abort_command(
+    request: Any,
+    *,
+    terminal_reason: str,
+    content_template: str | None = None,
+) -> Command:
+    tc = request.tool_call
+    pending = [dict(tc)] if isinstance(tc, dict) else []
+    synth = (
+        synthetic_tool_messages_for_orphan_tool_calls(
+            pending_tool_calls=pending,
+            reason="user_interrupted",
+            content_template=content_template,
+        )
+        if pending
+        else []
+    )
+    return Command(
+        update={
+            "abort_terminal_reason": terminal_reason,
+            "messages": synth,
+        }
+    )
+
+
 def builtin_sync_tool_wrapper(request: Any, handler: Any) -> Any:
     try:
         result = handler(_with_injected_agent_tool_model(request))
         return apply_tool_message_status_to_result(result)
+    except ClassifierDenialLimitAbort as exc:
+        return _tool_abort_command(
+            request,
+            terminal_reason=TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT,
+            content_template=exc.message,
+        )
     except LoopAbortSignal as sig:
         if sig.terminal_reason != TERMINAL_REASON_ABORTED_TOOLS:
             raise
-        tc = request.tool_call
-        pending = [dict(tc)] if isinstance(tc, dict) else []
-        synth = (
-            synthetic_tool_messages_for_orphan_tool_calls(
-                pending_tool_calls=pending,
-                reason="user_interrupted",
-            )
-            if pending
-            else []
-        )
-        return Command(
-            update={
-                "abort_terminal_reason": TERMINAL_REASON_ABORTED_TOOLS,
-                "messages": synth,
-            }
+        return _tool_abort_command(
+            request,
+            terminal_reason=TERMINAL_REASON_ABORTED_TOOLS,
         )
 
 
@@ -173,24 +194,18 @@ async def builtin_async_tool_wrapper(request: Any, handler: Any) -> Any:
     try:
         result = await handler(_with_injected_agent_tool_model(request))
         return apply_tool_message_status_to_result(result)
+    except ClassifierDenialLimitAbort as exc:
+        return _tool_abort_command(
+            request,
+            terminal_reason=TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT,
+            content_template=exc.message,
+        )
     except LoopAbortSignal as sig:
         if sig.terminal_reason != TERMINAL_REASON_ABORTED_TOOLS:
             raise
-        tc = request.tool_call
-        pending = [dict(tc)] if isinstance(tc, dict) else []
-        synth = (
-            synthetic_tool_messages_for_orphan_tool_calls(
-                pending_tool_calls=pending,
-                reason="user_interrupted",
-            )
-            if pending
-            else []
-        )
-        return Command(
-            update={
-                "abort_terminal_reason": TERMINAL_REASON_ABORTED_TOOLS,
-                "messages": synth,
-            }
+        return _tool_abort_command(
+            request,
+            terminal_reason=TERMINAL_REASON_ABORTED_TOOLS,
         )
 
 

langchain_agentx/loop/graph/graph_edges.py

@@ -58,6 +58,7 @@ from ..exit.reason_codes import (
     DEFAULT_TOKEN_BUDGET_MAX_CONTINUATIONS,
     TERMINAL_REASON_ABORTED_STREAMING,
     TERMINAL_REASON_ABORTED_TOOLS,
+    TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT,
     TERMINAL_REASON_COMPLETED,
     TERMINAL_REASON_HOOK_STOPPED,
     TERMINAL_REASON_INVARIANT_VIOLATION,
@@ -84,6 +85,7 @@ _ABORT_TERMINAL_REASONS = frozenset(
         TERMINAL_REASON_ABORTED_STREAMING,
         TERMINAL_REASON_ABORTED_TOOLS,
         TERMINAL_REASON_HOOK_STOPPED,
+        TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT,
     }
 )
 

langchain_agentx/tool_runtime/auto_mode/hook.py

@@ -93,6 +93,16 @@ class AutoModeAuthHook:
         """热更新 Auto Mode 配置（下一笔 decide 立即生效）。"""
         self._config = config
 
+    def _track_classifier_outcome(
+        self,
+        decision: AutoModeDecision,
+        ctx: "ToolExecutionContext",
+    ) -> None:
+        """L4 allow/deny → ClassifierDenialTracker（与 GAP-7 分轨；到顶动作 Phase 2）。"""
+        from ..classifier_denial_bridge import apply_classifier_denial_tracking
+
+        apply_classifier_denial_tracking(decision, ctx)
+
     def _emit_event(
         self,
         decision: AutoModeDecision,
@@ -236,6 +246,7 @@ class AutoModeAuthHook:
             llm_decision = await self._decide_llm(tool_name, tool_input, ctx, start_time)
             # L4 给出明确判断，直接返回
             if llm_decision.behavior in ("allow", "deny"):
+                self._track_classifier_outcome(llm_decision, ctx)
                 self._emit_event(llm_decision, tool_name, tool_input, ctx)
                 return llm_decision
             # L4 不可用（behavior == "ask"），继续到 L5

langchain_agentx/tool_runtime/auto_mode/state.py

@@ -9,8 +9,8 @@ tool_runtime/auto_mode/state.py — Auto Mode 全局状态
     AgentLoopConfig / settings.json → AutoModeState → AutoModeAuthHook
 
 当前裁剪范围：
-    - 暂不实现"连续 N 次 deny 自动退出 auto"逻辑（Phase 1 仅实现开关）
-    - denial_count 仅用于统计，不影响决策
+    - 熔断 SSOT 为 ClassifierDenialTracker（classifier_denial_tracking.py），不读 denial_count
+    - denial_count 仅观测累计；classifier deny 时由 bridge 可选 +1
 
 CC 源码对照：
     src/utils/permissions/autoModeState.ts

langchain_agentx/tool_runtime/classifier_denial_bridge.py

@@ -0,0 +1,92 @@
+"""
+classifier_denial_bridge.py — Auto Mode L4 ↔ ClassifierDenialTracker 接线
+
+职责：
+    判定哪些 AutoModeDecision 可计入 classifier 熔断；经 session_store 读写 tracker。
+    与 GAP-7 denial_tracking_bridge（L3 用户拒）严格分轨。
+
+链路位置：
+    AutoModeAuthHook.decide L4 出口 → 本模块计数；
+    到顶双分支见 classifier_denial_limit.apply_classifier_denial_limit_outcome。
+
+当前裁剪范围：
+    本模块仅计数；boundary / L1 / L3 / L5 / 合成拒不计。
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from .classifier_denial_tracking import (
+    ClassifierDenialConfig,
+    ClassifierDenialTracker,
+    ClassifierLimitDecision,
+)
+
+if TYPE_CHECKING:
+    from .auto_mode.decision import AutoModeDecision
+    from .models import ToolExecutionContext
+
+
+def is_countable_classifier_deny(decision: AutoModeDecision) -> bool:
+    """仅 L4 classifier 明确 deny 可计（对齐 CC recordDenial）。"""
+    return decision.layer == "L4" and decision.behavior == "deny"
+
+
+def is_countable_classifier_allow(decision: AutoModeDecision) -> bool:
+    """仅 L4 classifier 明确 allow 清连续（对齐 CC recordSuccess）。"""
+    return decision.layer == "L4" and decision.behavior == "allow"
+
+
+def resolve_classifier_tracker(
+    ctx: ToolExecutionContext,
+    config: ClassifierDenialConfig | None = None,
+) -> ClassifierDenialTracker | None:
+    store = getattr(ctx, "session_store", None)
+    if store is None:
+        return None
+    return store.get_classifier_denial_tracker(config=config)
+
+
+def apply_classifier_denial_tracking(
+    decision: AutoModeDecision,
+    ctx: ToolExecutionContext,
+    *,
+    config: ClassifierDenialConfig | None = None,
+) -> ClassifierLimitDecision | None:
+    """按决策更新 tracker；不可计时返回 None。
+
+    可选同步 AutoModeState.denial_count 作观测（熔断不读该字段）。
+    """
+    tracker = resolve_classifier_tracker(ctx, config=config)
+    if tracker is None:
+        return None
+
+    if is_countable_classifier_deny(decision):
+        limit = tracker.record_denial()
+        _observe_auto_mode_denial_count()
+        return limit
+
+    if is_countable_classifier_allow(decision):
+        tracker.record_success()
+        return tracker.should_fallback()
+
+    return None
+
+
+def _observe_auto_mode_denial_count() -> None:
+    """观测计数；非熔断 SSOT。"""
+    try:
+        from .auto_mode.state import get_auto_mode_state
+
+        get_auto_mode_state().increment_denial()
+    except Exception:
+        return
+
+
+__all__ = [
+    "apply_classifier_denial_tracking",
+    "is_countable_classifier_allow",
+    "is_countable_classifier_deny",
+    "resolve_classifier_tracker",
+]

langchain_agentx/tool_runtime/classifier_denial_limit.py

@@ -0,0 +1,124 @@
+"""
+classifier_denial_limit.py — Classifier 熔断到顶双分支（CC handleDenialLimitExceeded）
+
+职责：
+    会话级 tracker 到顶后：CLI → ask；headless → 终止当前 Agent loop。
+
+链路位置：
+    OuterPermissionResolver 收到 L4 deny 后 → apply_classifier_denial_limit_outcome；
+    headless Abort 由 builtin_loop_control 捕获并写 abort_terminal_reason。
+
+当前裁剪范围：
+    仅作用于可计数的 L4 classifier deny；boundary / L3 / GAP-7 不走本路径。
+    Abort 作用域 = 当前 Agent loop，不杀整个 workflow graph。
+"""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from langchain_agentx.loop.exit.reason_codes import TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT
+
+from .classifier_denial_bridge import resolve_classifier_tracker
+from .models import AuthorizationDecision
+from .permission_decision import (
+    PermissionDecisionType,
+    attach_decision_reason,
+    make_decision_reason,
+)
+
+if TYPE_CHECKING:
+    from .models import ToolExecutionContext
+
+HEADLESS_ABORT_MESSAGE = (
+    "Agent aborted: too many classifier denials in headless mode"
+)
+
+
+class ClassifierDenialLimitAbort(Exception):
+    """Headless 下 classifier 熔断到顶：终止当前 Agent loop（非整 workflow）。"""
+
+    terminal_reason = TERMINAL_REASON_CLASSIFIER_DENIAL_LIMIT
+
+    def __init__(self, message: str = HEADLESS_ABORT_MESSAGE) -> None:
+        self.message = message
+        super().__init__(message)
+
+
+def _is_l4_classifier_deny(decision: AuthorizationDecision) -> bool:
+    """仅 Auto Mode L4 deny 参与到顶动作（与 bridge 可计口径一致）。"""
+    if decision.behavior != "deny":
+        return False
+    meta = decision.metadata or {}
+    return meta.get("auto_mode_layer") == "L4"
+
+
+def apply_classifier_denial_limit_outcome(
+    decision: AuthorizationDecision,
+    ctx: ToolExecutionContext,
+    *,
+    headless: bool,
+) -> AuthorizationDecision:
+    """对齐 CC handleDenialLimitExceeded。
+
+    未到顶或非 L4 deny → 原样返回；
+    CLI 到顶 → ask（warning + latest reason）；
+    headless 到顶 → raise ClassifierDenialLimitAbort。
+    """
+    if not _is_l4_classifier_deny(decision):
+        return decision
+
+    tracker = resolve_classifier_tracker(ctx)
+    if tracker is None:
+        return decision
+
+    lim = tracker.should_fallback()
+    if not lim.exceeded:
+        return decision
+
+    hit_total = lim.limit_kind == "total"
+    warning = (
+        f"{lim.total_denials} actions were blocked this session. "
+        "Please review the transcript before continuing."
+        if hit_total
+        else (
+            f"{lim.consecutive_denials} consecutive actions were blocked. "
+            "Please review the transcript before continuing."
+        )
+    )
+    latest = decision.message or "blocked by classifier"
+    reason_text = f"{warning}\n\nLatest blocked action: {latest}"
+
+    if headless:
+        raise ClassifierDenialLimitAbort(HEADLESS_ABORT_MESSAGE)
+
+    if hit_total:
+        tracker.reset_after_total_limit()
+
+    meta = dict(decision.metadata or {})
+    meta["classifier_denial_limit"] = lim.limit_kind
+    meta["classifier_denial_consecutive"] = lim.consecutive_denials
+    meta["classifier_denial_total"] = lim.total_denials
+
+    ask = AuthorizationDecision(
+        behavior="ask",
+        message=reason_text,
+        policy_id=decision.policy_id,
+        ask_prompt=reason_text,
+        metadata=meta,
+    )
+    return attach_decision_reason(
+        ask,
+        make_decision_reason(
+            PermissionDecisionType.CLASSIFIER,
+            reason=reason_text,
+            classifier="auto-mode",
+        ),
+    )
+
+
+__all__ = [
+    "ClassifierDenialLimitAbort",
+    "HEADLESS_ABORT_MESSAGE",
+    "apply_classifier_denial_limit_outcome",
+]

langchain_agentx/tool_runtime/classifier_denial_tracking.py

@@ -0,0 +1,164 @@
+"""
+classifier_denial_tracking.py — Auto classifier 连续拒熔断计数（CC denialTracking.ts）
+
+职责：
+    会话级 consecutive/total 计数；仅服务 auto-mode LLM classifier deny/allow。
+    与 GAP-7 L3 DenialTracker 分通道，互不写入。
+
+链路位置：
+    AutoModeAuthHook L4 出口 → ClassifierDenialTracker；
+    Phase 2 到顶双分支（CLI ask / 问答停当前 Agent loop）读取 should_fallback。
+
+当前裁剪范围：
+    计数 + should_fallback；到顶 ask/Abort 见 classifier_denial_limit。
+    默认 enabled=True（对齐 CC 始终 tracking）。
+    子代理 fork_local() 隔离（对齐 CC localDenialTracking）。
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Literal
+
+
+@dataclass(frozen=True)
+class ClassifierDenialConfig:
+    """Classifier 熔断配置（默认启用，对齐 CC DENIAL_LIMITS）。"""
+
+    enabled: bool = True
+    max_consecutive: int = 3
+    max_total: int = 20
+
+
+@dataclass
+class ClassifierDenialState:
+    consecutive_denials: int = 0
+    total_denials: int = 0
+
+
+@dataclass(frozen=True)
+class ClassifierLimitDecision:
+    """是否已到顶（对齐 shouldFallbackToPrompting）。"""
+
+    exceeded: bool
+    limit_kind: Literal["consecutive", "total"] | None
+    consecutive_denials: int
+    total_denials: int
+
+
+class ClassifierDenialTracker:
+    """会话级 classifier 拒绝跟踪（OOP；非 per-tool 分桶）。"""
+
+    def __init__(self, config: ClassifierDenialConfig | None = None) -> None:
+        self._config = config or ClassifierDenialConfig()
+        self._state = ClassifierDenialState()
+
+    @property
+    def config(self) -> ClassifierDenialConfig:
+        return self._config
+
+    @property
+    def consecutive_denials(self) -> int:
+        return self._state.consecutive_denials
+
+    @property
+    def total_denials(self) -> int:
+        return self._state.total_denials
+
+    @staticmethod
+    def create_empty(config: ClassifierDenialConfig | None = None) -> ClassifierDenialTracker:
+        return ClassifierDenialTracker(config)
+
+    def record_denial(self) -> ClassifierLimitDecision:
+        """classifier deny：consecutive++ total++；返回是否已到顶。"""
+        if not self._config.enabled:
+            return self.should_fallback()
+        self._state.consecutive_denials += 1
+        self._state.total_denials += 1
+        return self.should_fallback()
+
+    def record_success(self) -> None:
+        """classifier allow：连续计数清零（total 不变）。"""
+        if not self._config.enabled:
+            return
+        if self._state.consecutive_denials == 0:
+            return
+        self._state.consecutive_denials = 0
+
+    def should_fallback(self) -> ClassifierLimitDecision:
+        """对齐 CC shouldFallbackToPrompting。"""
+        consec = self._state.consecutive_denials
+        total = self._state.total_denials
+        if not self._config.enabled:
+            return ClassifierLimitDecision(
+                exceeded=False,
+                limit_kind=None,
+                consecutive_denials=consec,
+                total_denials=total,
+            )
+        if consec >= self._config.max_consecutive:
+            return ClassifierLimitDecision(
+                exceeded=True,
+                limit_kind="consecutive",
+                consecutive_denials=consec,
+                total_denials=total,
+            )
+        if total >= self._config.max_total:
+            return ClassifierLimitDecision(
+                exceeded=True,
+                limit_kind="total",
+                consecutive_denials=consec,
+                total_denials=total,
+            )
+        return ClassifierLimitDecision(
+            exceeded=False,
+            limit_kind=None,
+            consecutive_denials=consec,
+            total_denials=total,
+        )
+
+    def reset_after_total_limit(self) -> None:
+        """对齐 CC：累计到顶后在交互 ask 路径清零 consecutive+total。"""
+        self._state.consecutive_denials = 0
+        self._state.total_denials = 0
+
+    def fork_local(self) -> ClassifierDenialTracker:
+        """子代理独立 tracker（对齐 CC localDenialTracking）。"""
+        return ClassifierDenialTracker(self._config)
+
+    def export_state(self) -> dict[str, Any]:
+        return {
+            "config": {
+                "enabled": self._config.enabled,
+                "max_consecutive": self._config.max_consecutive,
+                "max_total": self._config.max_total,
+            },
+            "state": {
+                "consecutive_denials": self._state.consecutive_denials,
+                "total_denials": self._state.total_denials,
+            },
+        }
+
+    @classmethod
+    def from_state(cls, data: dict[str, Any]) -> ClassifierDenialTracker:
+        raw_cfg = data.get("config") or {}
+        config = ClassifierDenialConfig(
+            enabled=bool(raw_cfg.get("enabled", True)),
+            max_consecutive=int(raw_cfg.get("max_consecutive", 3)),
+            max_total=int(raw_cfg.get("max_total", 20)),
+        )
+        tracker = cls(config)
+        raw_state = data.get("state") or {}
+        tracker._state = ClassifierDenialState(
+            consecutive_denials=int(raw_state.get("consecutive_denials", 0)),
+            total_denials=int(raw_state.get("total_denials", 0)),
+        )
+        return tracker
+
+
+__all__ = [
+    "ClassifierDenialConfig",
+    "ClassifierDenialState",
+    "ClassifierDenialTracker",
+    "ClassifierLimitDecision",
+]

langchain_agentx/tool_runtime/denial_tracking.py

@@ -9,7 +9,8 @@ denial_tracking.py — GAP-7 L3 连续拒绝跟踪（CC denialTracking.ts 对齐
     AgentSessionStore.denial_tracker namespace；Phase 2 由 HitlRaceCoordinator / pipeline 读写。
 
 当前裁剪范围：
-    默认 disabled（opt-in）；不含 Auto Mode 分类器 deny（见 AutoModeState.denial_count）。
+    默认 disabled（opt-in）；仅 L3 用户拒。
+    Auto classifier 连续拒见 classifier_denial_tracking.py（分通道，勿混入本模块）。
     子代理通过 fork_local() 隔离（对齐 CC localDenialTracking）。
 """
 

langchain_agentx/tool_runtime/outer_permission_resolver.py

@@ -3,6 +3,7 @@ outer_permission_resolver.py — 段 6 outer 裁决（GAP-3）
 
 职责：
     inner 产出 ask 后：auto 分类器消化 / headless fail-close deny；非 ask 原样返回。
+    classifier 熔断到顶：CLI → ask；headless → ClassifierDenialLimitAbort。
 
 链路位置：
     PermissionOrchestrator._resolve_outer
@@ -15,6 +16,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING, Any
 
+from .classifier_denial_limit import apply_classifier_denial_limit_outcome
 from .models import AuthorizationDecision
 from .permission_decision import PermissionDecisionType, attach_decision_reason, make_decision_reason
 from .policy import resolve_default_policy_engine
@@ -62,9 +64,13 @@ class OuterPermissionResolver:
         if mode == "auto":
             auto_decision = await self._run_auto_mode_hook(tool, data, ctx)
             if auto_decision is not None:
-                if auto_decision.behavior in ("allow", "deny"):
-                    return auto_decision
-                if auto_decision.behavior != "ask":
+                # L4 deny 后可能到顶：CLI→ask / headless→Abort（非整 workflow）
+                auto_decision = apply_classifier_denial_limit_outcome(
+                    auto_decision,
+                    ctx,
+                    headless=headless,
+                )
+                if auto_decision.behavior in ("allow", "deny", "ask"):
                     return auto_decision
 
         if headless: