sycommon-python-lib 0.2.7a51__tar.gz → 0.2.7a53__tar.gz

{sycommon_python_lib-0.2.7a51 → sycommon_python_lib-0.2.7a53}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.7a51
+Version: 0.2.7a53
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -9,24 +9,24 @@ Requires-Dist: aiohttp==3.14.3
 Requires-Dist: aiomysql==0.3.2
 Requires-Dist: anyio==4.14.2
 Requires-Dist: decorator==5.3.1
-Requires-Dist: deepagents==0.6.12
+Requires-Dist: deepagents==0.7.1
 Requires-Dist: elasticsearch==9.4.1
-Requires-Dist: fastapi==0.139.2
+Requires-Dist: fastapi==0.141.1
 Requires-Dist: jinja2==3.1.6
 Requires-Dist: kafka-python==3.0.9
 Requires-Dist: langchain==1.3.14
-Requires-Dist: langchain-core==1.5.1
+Requires-Dist: langchain-core==1.5.3
 Requires-Dist: langchain-openai==1.4.1
-Requires-Dist: langfuse==4.14.1
-Requires-Dist: langgraph==1.2.9
-Requires-Dist: langgraph-checkpoint-postgres==3.1.0
+Requires-Dist: langfuse==4.14.2
+Requires-Dist: langgraph==1.2.10
+Requires-Dist: langgraph-checkpoint-postgres==3.1.1
 Requires-Dist: langgraph-checkpoint-redis==0.5.1
 Requires-Dist: ldap3==2.9.1
 Requires-Dist: loguru==0.7.3
-Requires-Dist: mysql-connector-python==9.7.0
+Requires-Dist: mysql-connector-python==26.7.0
 Requires-Dist: nacos-sdk-python<3.0,==2.0.11
 Requires-Dist: psutil==7.2.2
-Requires-Dist: pyxxl==0.4.7
+Requires-Dist: pyxxl==0.4.8
 Requires-Dist: pydantic==2.13.4
 Requires-Dist: python-dotenv==1.2.2
 Requires-Dist: python-multipart==0.0.32
@@ -36,14 +36,14 @@ Requires-Dist: sentry-sdk[fastapi]==2.66.1
 Requires-Dist: sqlalchemy[asyncio]==2.0.51
 Requires-Dist: starlette[full]==1.3.1
 Requires-Dist: tiktoken==0.13.0
-Requires-Dist: uvicorn==0.51.0
+Requires-Dist: uvicorn==0.52.1
 Requires-Dist: wecom-aibot-python-sdk==1.0.2
-Requires-Dist: twine==6.2.0
+Requires-Dist: twine==7.0.0
 Requires-Dist: minio==7.2.20
-Requires-Dist: langchain-mcp-adapters==0.3.0
+Requires-Dist: langchain-mcp-adapters==0.3.1
 Requires-Dist: fastapi-mcp==0.4.0
 Requires-Dist: psycopg[binary,pool]==3.3.4
-Requires-Dist: agent-client-protocol==0.11.0
+Requires-Dist: agent-client-protocol==0.12.0
 Requires-Dist: pypinyin==0.55.0
 
 # sycommon-python-lib

{sycommon_python_lib-0.2.7a51 → sycommon_python_lib-0.2.7a53}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sycommon-python-lib"
-version = "0.2.7a51"
+version = "0.2.7a53"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -10,24 +10,24 @@ dependencies = [
     "aiomysql==0.3.2",
     "anyio==4.14.2",
     "decorator==5.3.1",
-    "deepagents==0.6.12",
+    "deepagents==0.7.1",
     "elasticsearch==9.4.1",
-    "fastapi==0.139.2",
+    "fastapi==0.141.1",
     "jinja2==3.1.6",
     "kafka-python==3.0.9",
     "langchain==1.3.14",
-    "langchain-core==1.5.1",
+    "langchain-core==1.5.3",
     "langchain-openai==1.4.1",
-    "langfuse==4.14.1",
-    "langgraph==1.2.9",
-    "langgraph-checkpoint-postgres==3.1.0",
+    "langfuse==4.14.2",
+    "langgraph==1.2.10",
+    "langgraph-checkpoint-postgres==3.1.1",
     "langgraph-checkpoint-redis==0.5.1",
     "ldap3==2.9.1",
     "loguru==0.7.3",
-    "mysql-connector-python==9.7.0",
+    "mysql-connector-python==26.7.0",
     "nacos-sdk-python==2.0.11,<3.0",
     "psutil==7.2.2",
-    "pyxxl==0.4.7",
+    "pyxxl==0.4.8",
     "pydantic==2.13.4",
     "python-dotenv==1.2.2",
     "python-multipart==0.0.32",
@@ -37,14 +37,14 @@ dependencies = [
     "sqlalchemy[asyncio]==2.0.51",
     "starlette[full]==1.3.1",
     "tiktoken==0.13.0",
-    "uvicorn==0.51.0",
+    "uvicorn==0.52.1",
     "wecom-aibot-python-sdk==1.0.2",
-    "twine==6.2.0",
+    "twine==7.0.0",
     "minio==7.2.20",
-    "langchain-mcp-adapters==0.3.0",
+    "langchain-mcp-adapters==0.3.1",
     "fastapi-mcp==0.4.0",
     "psycopg[binary,pool]==3.3.4",
-    "agent-client-protocol==0.11.0",
+    "agent-client-protocol==0.12.0",
     "pypinyin==0.55.0",
 ]
 

{sycommon_python_lib-0.2.7a51 → sycommon_python_lib-0.2.7a53}/src/sycommon/agent/deep_agent.py

@@ -60,6 +60,7 @@ from sycommon.middleware.tool_result_truncation import ToolResultTruncationMiddl
 from sycommon.agent.middleware.skill_write_guard import SkillWriteGuardMiddleware
 from sycommon.agent.middleware.sandbox_path_guard import SandboxPathGuardMiddleware
 from sycommon.agent.middleware.sensitive_guard import SensitiveGuardMiddleware
+from sycommon.agent.middleware.model_request_prep import ModelRequestPrepMiddleware
 from deepagents.middleware.summarization import create_summarization_tool_middleware  # noqa: F401 保留 re-export
 from sycommon.agent.summarization_utils import build_summarization_middleware
 from sycommon.agent.resume_compactor import maybe_compact_before_resume
@@ -80,265 +81,6 @@ if TYPE_CHECKING:
     from langchain.agents.middleware.types import AgentState, ContextT, ModelRequest, ModelResponse, ResponseT
     from langgraph.runtime import Runtime
 
-
-def _patch_agent_streaming(agent):
-    """Monkey-patch factory.py _execute_model_async to fix stream_mode="messages".
-
-    根因: langchain factory.py (<=1.3.2) 的 _execute_model_async 有两个问题:
-      1. 调用 model_.ainvoke(messages) 不传 config → callbacks 不传播
-      2. 使用 ainvoke (非流式) 而非 astream → on_llm_new_token 不触发
-
-    修复: 替换 amodel_node 闭包中的 _execute_model_async, 改用 astream 并传入
-    从 ContextVar 读取的 config。astream 每个 token 触发 on_llm_new_token,
-    StreamMessagesHandler 拦截后推送给 stream_mode="messages" 的消费者。
-
-    为什么是最内层替换(而非 Middleware): _execute_model_async 位于所有中间件
-    (含 deepagents tail 的 MemoryMiddleware/FilesystemMiddleware 等会 modify_request
-    的 awrap_model_call)的最内层。替换它不绕过任何中间件; 用 Middleware 方案则只能
-    插在"用户中间件"层, 会绕过更内层的 MemoryMiddleware 注入。故保留 monkey-patch。
-
-    加固: 闭包结构按"自由变量名"定位 cell(不依赖固定索引), 任一不符即跳过 patch
-    并降级为非流式(功能正常, 只是不逐 token 推送), 而非打错补丁导致静默失效。
-
-    TODO: 等官方修复 (langchain >1.3.x, _execute_model_async 改用 astream) 后
-    删除此函数及调用即可。
-    """
-    # 已验证兼容的版本范围(超出仅警告, 不阻断 —— 闭包强校验是真正的安全网)
-    # 1.3.10/1.3.11/1.3.12/1.3.13 + langchain_core 1.4.8/1.4.9 确认闭包结构兼容
-    # (factory.py 在 1.3.12→1.3.13 逐字节无变化 —— PyPI sdist diff 实证;
-    #  amodel_node freevars 含 _execute_model_async, 内层 freevars 含
-    #  _get_bound_model/_handle_model_output), patch 正常生效。
-    # 1.3.13 的 _execute_model_async 仍为 ainvoke + 不传 config (factory.py:1467),
-    # 官方仍未修复, 补丁仍需保留。
-    _VERIFIED = {"langchain": "1.3.13", "langchain_core": "1.4.9"}
-    try:
-        import langchain as _lc
-        import langchain_core as _lcc
-        _cur = {"langchain": getattr(_lc, "__version__", "?"),
-                "langchain_core": getattr(_lcc, "__version__", "?")}
-        if _cur != _VERIFIED:
-            SYLogger.warning(
-                f"[StreamingPatch] langchain 版本 {_cur} 与已验证 {_VERIFIED} 不一致; "
-                f"闭包强校验仍会兜底, 但建议复核 _execute_model_async 是否已改用 astream")
-    except Exception:
-        pass
-
-    try:
-        from langchain_core.messages import AIMessageChunk as _AIC, AIMessage as _AIM
-        from langchain_core.runnables.config import var_child_runnable_config
-
-        node = agent.nodes.get("model")
-        if node is None:
-            SYLogger.warning(
-                "[DeepAgent] model node not found, skip streaming patch")
-            return
-
-        inner = node.node  # RunnableSeq
-        if not hasattr(inner, 'steps') or not inner.steps:
-            SYLogger.warning(
-                "[DeepAgent] model node has no steps, skip streaming patch")
-            return
-
-        # RunnableCallable(trace=False, afunc=amodel_node)
-        step0 = inner.steps[0]
-        afunc = getattr(step0, "afunc", None)  # amodel_node
-        if afunc is None or afunc.__closure__ is None:
-            SYLogger.warning(
-                "[DeepAgent] amodel_node afunc/closure 缺失, skip streaming patch")
-            return
-
-        # ---- 按自由变量名定位 cell（不依赖固定索引）----
-        def _cell_by_name(fn, name):
-            """从闭包函数 fn 中按 co_freevars 名取出对应 cell 对象（取不到返回 None）。"""
-            names = fn.__code__.co_freevars
-            if name not in names or fn.__closure__ is None:
-                return None
-            return fn.__closure__[names.index(name)]
-
-        exec_cell = _cell_by_name(afunc, "_execute_model_async")
-        if exec_cell is None:
-            SYLogger.warning(
-                f"[DeepAgent] amodel_node 闭包未含 _execute_model_async "
-                f"(freevars={afunc.__code__.co_freevars}), skip streaming patch")
-            return
-
-        original_execute = exec_cell.cell_contents
-        # 强校验 _execute_model_async 自身的闭包含预期三个自由变量
-        _gbm_cell = _cell_by_name(original_execute, "_get_bound_model")
-        _hmo_cell = _cell_by_name(original_execute, "_handle_model_output")
-        _name_cell = _cell_by_name(original_execute, "name")
-        if _gbm_cell is None or _hmo_cell is None:
-            SYLogger.warning(
-                f"[DeepAgent] _execute_model_async 闭包结构不符 "
-                f"(freevars={getattr(original_execute, '__code__', None) and original_execute.__code__.co_freevars}), "
-                f"skip streaming patch（降级为非流式，功能正常）")
-            return
-        _get_bound_model = _gbm_cell.cell_contents
-        _handle_model_output = _hmo_cell.cell_contents
-        _name = _name_cell.cell_contents if _name_cell is not None else None
-
-        def _clamp_max_tokens_for_model(model_, messages):
-            """在 raw_model 上执行 _clamp_max_tokens 逻辑。
-
-            由于 create_deep_agent 提取了 raw_model（绕过了 LLMWithTokenTracking 包装），
-            原本在 LLMWithTokenTracking._agenerate 中自动执行的 _clamp_max_tokens 被跳过，
-            导致 max_tokens 不随 input tokens 动态调整，当 input + max_output > context_window
-            时触发 400 错误。此函数补上这一逻辑。
-
-            注意：_get_bound_model 返回的可能是 _ChatModelBinding（RunnableBindingBase 子类），
-            需要通过 .bound 取到真正的 ChatOpenAI，否则 max_tokens 只设在 wrapper 上不生效。
-            """
-            from sycommon.config.LLMConfig import LLMConfig
-            from sycommon.config.Config import Config
-            from sycommon.llm.token_utils import clamp_max_tokens
-            try:
-                # 解包 binding wrapper，取到真正的 ChatModel
-                raw_model = getattr(model_, 'bound', model_)
-                llm_config = Config().get_llm_config(getattr(raw_model, 'model', None))
-                if not llm_config:
-                    return
-                llm_cfg = LLMConfig(**llm_config)
-                max_tokens_limit = getattr(llm_cfg, 'maxTokens', None)
-                if not max_tokens_limit:
-                    return
-                max_output = getattr(raw_model, 'max_tokens', None)
-                if not max_output:
-                    return
-                dynamic_max = clamp_max_tokens(
-                    raw_model, messages,
-                    context_window=max_tokens_limit,
-                    max_output_tokens=max_output,
-                )
-                SYLogger.debug(
-                    f"[StreamingPatch] clamp max_tokens: "
-                    f"context={max_tokens_limit}, max_output={max_output} → {dynamic_max}")
-            except Exception as e:
-                SYLogger.warning(
-                    f"[StreamingPatch] clamp max_tokens failed: {e}")
-
-        async def _patched_execute_model_async(request):
-            """替代 factory._execute_model_async: 用 astream + config 实现流式回调。"""
-            from langchain.agents.middleware.types import ModelResponse
-
-            SYLogger.warning(
-                f"[STREAM-DEBUG] _patched_execute_model_async ENTERED | "
-                f"messages={len(request.messages)} 条 | "
-                f"has_system={bool(request.system_message)}")
-            model_, effective_response_format = _get_bound_model(request)
-            messages = request.messages
-
-            # 🔑 根治摘要泄漏：将 lc_source="summarization" 的 HumanMessage 内容
-            # 注入到 system_message 而非直接丢弃，保持记忆连续性。
-            # 根因分析（2026-06-06 端到端测试确认）：
-            # 1. SummarizationMiddleware 将摘要注入为 HumanMessage
-            # 2. 模型看到 HumanMessage 后容易将其作为对话内容回显/复述
-            # 3. 之前完全移除摘要导致压缩后模型丢失所有记忆
-            # 修复策略：提取摘要内容 → 注入 SystemMessage（模型视其为指令/背景知识，
-            # 回显概率远低于 HumanMessage）→ 从 messages 中移除原始 HumanMessage
-            _summary_text = None
-            _filtered_messages = []
-            for _msg in messages:
-                if (isinstance(_msg, HumanMessage)
-                        and getattr(_msg, "additional_kwargs", {}).get("lc_source") == "summarization"):
-                    _raw = _msg.content or ""
-                    # 去掉 <internal_context_data> 包装标签，提取纯摘要
-                    _summary_text = re.sub(
-                        r'</?internal_context_data>', '', _raw, flags=re.DOTALL
-                    ).strip()
-                    SYLogger.debug(
-                        "[DeepAgent] 摘要已从 HumanMessage 提取，将注入 system_message")
-                else:
-                    _filtered_messages.append(_msg)
-            messages = _filtered_messages
-
-            if _summary_text and request.system_message:
-                from deepagents.middleware._utils import append_to_system_message
-                _summary_directive = (
-                    "\n\n<system_context>\n"
-                    "以下是之前对话历史的压缩摘要，作为你的内部记忆使用。"
-                    "把它当作你自己的回忆，绝对不要在回复中重复、复述或引用此内容的任何部分。\n"
-                    f"{_summary_text}\n"
-                    "</system_context>"
-                )
-                _new_sys = append_to_system_message(
-                    request.system_message, _summary_directive)
-                request = request.override(system_message=_new_sys)
-
-            if request.system_message:
-                messages = [request.system_message, *messages]
-
-            # 动态调整 max_tokens，防止 input + max_output 超过上下文窗口
-            _clamp_max_tokens_for_model(model_, messages)
-
-            # 从 ContextVar 读取 LangGraph 注入的 config（含 StreamMessagesHandler）
-            config = var_child_runnable_config.get()
-
-            # 用 astream 替代 ainvoke, 每个 token 规发 on_llm_new_token
-            # 注意: ChatModel.astream() 产出的是 AIMessageChunk（BaseMessageChunk），
-            # 不是 ChatGenerationChunk，因此累加结果直接就是消息本身，没有 .message 属性。
-            import time as _t
-            _t0 = _t.monotonic()
-            _msg_count = len(messages) if hasattr(messages, '__len__') else -1
-            SYLogger.info(
-                f"[LLM-CALL] astream 开始: model={getattr(model_, 'model', '?')}, "
-                f"messages={_msg_count} 条")
-            chunks: list = []
-            _first_chunk_at = None
-            async for chunk in model_.astream(messages, config=config):
-                if _first_chunk_at is None:
-                    _first_chunk_at = _t.monotonic()
-                    SYLogger.info(
-                        f"[LLM-CALL] 首个 chunk 到达, 耗时 {_first_chunk_at - _t0:.2f}s")
-                chunks.append(chunk)
-
-            if not chunks:
-                # astream 无产出时降级到原始 ainvoke（不走流式）
-                SYLogger.warning(
-                    "[StreamingPatch] astream returned empty, fallback to ainvoke")
-                output = await model_.ainvoke(messages, config=config)
-            else:
-                SYLogger.info(
-                    f"[LLM-CALL] astream 结束, 共 {len(chunks)} 个 chunk, "
-                    f"总耗时 {_t.monotonic() - _t0:.2f}s")
-                generation = chunks[0]
-                for c in chunks[1:]:
-                    generation += c
-                # astream 累加结果可能是 AIMessageChunk（多数情况）或包裹了 .message 的
-                # ChatGenerationChunk（少数自定义模型）。两种都兼容。
-                ai_message = getattr(generation, "message", generation)
-                if isinstance(ai_message, _AIC):
-                    ai_message = _AIM(
-                        content=ai_message.content,
-                        additional_kwargs=ai_message.additional_kwargs,
-                        tool_calls=ai_message.tool_calls,
-                        usage_metadata=getattr(
-                            ai_message, "usage_metadata", None),
-                        response_metadata=getattr(
-                            ai_message, "response_metadata", {}),
-                        id=ai_message.id,
-                    )
-                output = ai_message
-
-            if _name:
-                output.name = _name
-
-            handled_output = _handle_model_output(
-                output, effective_response_format)
-            return ModelResponse(
-                result=handled_output["messages"],
-                structured_response=handled_output.get("structured_response"),
-            )
-
-        # 替换闭包 cell → amodel_node 调用 patched 版本
-        exec_cell.cell_contents = _patched_execute_model_async
-        SYLogger.info(
-            f"[DeepAgent] _execute_model_async patched (astream + config) "
-            f"| langchain={_cur.get('langchain')} core={_cur.get('langchain_core')}")
-
-    except Exception as e:
-        SYLogger.warning(f"[DeepAgent] streaming patch failed: {e}")
-
-
 @tool
 def get_current_date() -> str:
     """获取当前日期时间"""
@@ -410,6 +152,13 @@ class AgentConfig(BaseModel):
     scoped_skills_dir: Optional[str] = None
     # 沙箱挂载点 scope,如 "shengye-platform/oa"。仅当 scoped_skills_dir 非空时生效。
     scoped_skills_scope: Optional[str] = None
+    # 技能 ACL 白名单(仅 system 技能)。None=不过滤(向后兼容/平台 RPC/管理员);
+    # 非 None 时 _sync_skills_to_sandbox 只同步集合内的技能,并删除沙箱里
+    # 已存在但不在集合内的 system 技能(撤销已授权过的技能——沙箱 per-user 跨
+    # 会话持久,撤销必须主动删,否则 SkillsMiddleware 仍能 ls 到)。由应用层根据
+    # 数字员工 ACL 规则解析后注入。scoped/user 技能不受此字段约束
+    # (scoped 由服务端路由硬编码,user 由 MinIO 按 user 灌入)。
+    system_skills_allow: Optional[set[str]] = None
     memory_dir: Optional[str] = None
 
     @property
@@ -1280,11 +1029,11 @@ async def create_deep_agent(
     )
 
     # 🔑 提取底层 ChatOpenAI 原始模型
-    # LLMWithTokenTracking 重写了 _agenerate（非流式路径），
-    # 导致 ainvoke 不走 astream 路径。
-    # 本文件的 _patch_agent_streaming() 会替换模型节点的 _execute_model_async，
-    # 改用 model.astream() 触发流式回调；提取 raw_model 确保 astream / bind_tools
-    # 等方法在原始 ChatOpenAI 上工作，而不是被 LLMWithTokenTracking 的包装拦截。
+    # deepagents/langchain factory 需要 BaseChatModel 才能 bind_tools（结构化输出 /
+    # 工具调用），而 LLMWithTokenTracking 不是 BaseChatModel 子类（缺 bind_tools 等），
+    # 故提取 raw_model。streaming=True 让 langchain-core 的 _should_stream 更早命中，
+    # 配合 StreamMessagesHandler（_StreamingCallbackHandler）实现隐式逐 token 流式
+    # （langchain-core >= 1.5.3，无需手动 patch _execute_model_async）。
     raw_model = getattr(model, 'llm', model)
     if raw_model is not model:
         print(
@@ -1322,9 +1071,11 @@ async def create_deep_agent(
     # 每次 create_agent（新会话首回合）跑一遍：版本没变时开销仅为 1+N 次元数据小读取。
     if config.system_skills_dir and sandbox_backend:
         await _sync_skills_to_sandbox(config.system_skills_dir, sandbox_backend,
-                                      sandbox_dest="/skills/system", chmod_readonly=True)
+                                      sandbox_dest="/skills/system", chmod_readonly=True,
+                                      allow_skills=config.system_skills_allow)
 
     # 同步接口专属技能到沙箱(只读)。与 system 同一套 version 感知增量同步机制。
+    # scoped 技能由服务端路由硬编码(scope),前端不可改,不在技能 ACL 范围,不传 allow_skills。
     if config.scoped_skills_dir and config.scoped_skills_scope and sandbox_backend:
         await _sync_skills_to_sandbox(config.scoped_skills_dir, sandbox_backend,
                                       sandbox_dest=scoped_path, chmod_readonly=True)
@@ -1363,6 +1114,7 @@ async def create_deep_agent(
         ToolResultTruncationMiddleware(),
         TokenTrackingMiddleware(model_name=config.model_name, user_id=user_id),
         summarization_mw,
+        ModelRequestPrepMiddleware(),     # 紧跟 summarization：摘要重定位 + 动态压 max_tokens
         SkillWriteGuardMiddleware(),          # 系统 /skills/system 只读守卫(先于白名单)
         SandboxPathGuardMiddleware(user_id),  # 宿主绝对路径规范化/拦截(防越权读他人沙箱文件)
     ]
@@ -1441,10 +1193,6 @@ async def create_deep_agent(
         except Exception:
             pass
 
-    # 🔑 Patch _execute_model_async: 将 ainvoke 替换为 astream + config
-    # 修复 stream_mode="messages" 只返回 1 chunk 的问题
-    _patch_agent_streaming(agent)
-
     recovery_manager = SandboxRecoveryManager(sandbox_backend)
 
     return DeepAgent(
@@ -1556,6 +1304,7 @@ async def _sync_skills_to_sandbox(
     *,
     sandbox_dest: str = "/skills",
     chmod_readonly: bool = False,
+    allow_skills: Optional[set[str]] = None,
 ) -> None:
     """同步技能目录到沙箱(按版本检查,版本不一致则全量覆盖)
 
@@ -1564,6 +1313,11 @@ async def _sync_skills_to_sandbox(
     - 沙箱有该技能且 version 一致 → 跳过
     - 沙箱没有 / 版本不一致 → 从本地 skills/ 全量上传到沙箱
 
+    技能 ACL(allow_skills): None=不过滤(向后兼容/管理员/平台 RPC)。
+    非 None 时:(1) 枚举本地技能阶段跳过不在白名单的;(2) 删除沙箱里已存在
+    但本次不在白名单的技能(撤销 enforcement——沙箱 per-user 跨会话持久,
+    管理员在两次会话间撤销授权时必须主动删,否则 SkillsMiddleware 仍能 ls 到)。
+
     性能: 比对与上传均绕过 backend 的懒同步(_skip_lazy_sync=True),
     避免「比对 read SKILL.md 前先整目录上传」「删除前先上传再删」的往返浪费。
     多技能的 SKILL.md 比对用 gather 并发; batch_upload 服务端无条件覆盖,
@@ -1579,6 +1333,9 @@ async def _sync_skills_to_sandbox(
             src = os.path.join(skills_dir, skill_name)
             if not os.path.isdir(src):
                 continue
+            # 技能 ACL:不在白名单的技能既不同步也不留痕(仅在 allow_skills 非 None 时)
+            if allow_skills is not None and skill_name not in allow_skills:
+                continue
             local_version = ""
             local_skill_md = os.path.join(src, "SKILL.md")
             if os.path.isfile(local_skill_md):
@@ -1597,6 +1354,39 @@ async def _sync_skills_to_sandbox(
                 if child.is_dir:
                     existing_dirs.add(child.name)
 
+        # 技能 ACL 撤销 enforcement:删除沙箱里已存在但本次不在白名单的技能。
+        # 沙箱 per-user 跨会话持久,管理员在两次会话间撤销授权时,必须主动删除
+        # 上一会话同步进来的技能,否则 SkillsMiddleware 仍能 ls 到 → agent 仍可调用,
+        # 违反"代码层强制、不信 agent 自控"。allow_skills 为 None 时跳过(无 ACL)。
+        if allow_skills is not None:
+            for stale in sorted(existing_dirs - allow_skills):
+                revoked = False
+                for _attempt in range(2):  # 最多重试一次,与版本不一致删除分支一致
+                    try:
+                        await backend.adelete(
+                            f"{sandbox_dest}/{stale}",
+                            recursive=True,
+                            _skip_lazy_sync=True)
+                        revoked = True
+                        break
+                    except Exception as e:
+                        SYLogger.warning(
+                            f"[DeepAgent] ACL 撤销删除失败(尝试{_attempt+1}): "
+                            f"{stale}, {e}")
+                if revoked:
+                    SYLogger.info(
+                        f"[DeepAgent] ACL 撤销:删除沙箱未授权技能 {stale} "
+                        f"@{sandbox_dest}")
+                else:
+                    SYLogger.error(
+                        f"[DeepAgent] ACL 撤销彻底失败,本次跳过: {stale}")
+                # 清懒同步缓存:_sync_skills_to_sandbox 用 plain skill_name 作 key,
+                # _lazy_sync_skill_from_path 用 "{scope}/{skill_name}",两种都清。
+                # sandbox_dest 形如 /skills/system,scope 取其最后一段。
+                scope = sandbox_dest.rsplit("/", 1)[-1]
+                backend._synced_skills.discard(stale)
+                backend._synced_skills.discard(f"{scope}/{stale}")
+
         # 并发读取所有已存在技能的沙箱 SKILL.md 比对版本(跳过懒同步)
         async def _read_remote_version(skill_name: str) -> str:
             if skill_name not in existing_dirs:
@@ -1624,6 +1414,19 @@ async def _sync_skills_to_sandbox(
             name: rv for (name, _, _), rv in zip(local_skills, remote_versions)
         }
 
+        # 并发预校验正文新鲜度：仅对「版本一致」的技能做。版本不一致/无版本的
+        # 直接当 stale，不进校验。历史上这一步是写在下方 for 循环里逐个 await 的，
+        # 多技能场景退化为串行（N 次 aread = N × RTT）。校验互相独立，gather 即可。
+        version_match_skills = [
+            (name, src) for name, ver, src in local_skills
+            if remote_version_map.get(name, "") and remote_version_map[name] == ver
+        ]
+        fresh_results = await asyncio.gather(
+            *[_verify_skill_content_fresh(backend, sandbox_dest, name, src)
+              for name, src in version_match_skills]
+        )
+        fresh_map = dict(zip([n for n, _ in version_match_skills], fresh_results))
+
         skill_count = 0
         skip_count = 0
         for skill_name, local_version, src in local_skills:
@@ -1633,9 +1436,8 @@ async def _sync_skills_to_sandbox(
                 # 版本一致仍校验正文关键内容，防止"version 字段已更新但正文未同步"
                 # （历史上出现过沙箱 SKILL.md 版本号新、正文旧的脏数据，导致 agent
                 # 永远读不到新版指令）。校验失败则强制走删除+重传。
-                if not await _verify_skill_content_fresh(
-                    backend, sandbox_dest, skill_name, src
-                ):
+                # fresh_map 在进入循环前已并发预取，这里只查表不再 await。
+                if not fresh_map.get(skill_name, False):
                     SYLogger.warning(
                         f"[DeepAgent] 技能版本一致但正文不一致，强制重传: {skill_name} "
                         f"v{local_version}")
@@ -1729,6 +1531,9 @@ async def _create_sandbox_backend(
         sync_dirs=sync_dirs,
         auto_sync=True,
         skills_dir=skills_dir_for_backend,
+        # 技能 ACL 白名单透传给沙箱后端:execute 命令引用被撤销技能的路径时,
+        # _lazy_sync_skill_from_path 会用它拦截重新上传,关闭撤销残留缺口。
+        skills_allow=config.system_skills_allow,
     )
 
     try: