sycommon-python-lib 0.2.7a7__tar.gz → 0.2.7a8__tar.gz

{sycommon_python_lib-0.2.7a7 → sycommon_python_lib-0.2.7a8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sycommon-python-lib
-Version: 0.2.7a7
+Version: 0.2.7a8
 Summary: Add your description here
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -9,7 +9,7 @@ Requires-Dist: aiohttp==3.14.1
 Requires-Dist: aiomysql==0.3.2
 Requires-Dist: anyio==4.14.1
 Requires-Dist: decorator==5.3.1
-Requires-Dist: deepagents==0.6.11
+Requires-Dist: deepagents==0.6.12
 Requires-Dist: elasticsearch==9.4.1
 Requires-Dist: fastapi==0.138.1
 Requires-Dist: jinja2==3.1.6

{sycommon_python_lib-0.2.7a7 → sycommon_python_lib-0.2.7a8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sycommon-python-lib"
-version = "0.2.7a7"
+version = "0.2.7a8"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -10,7 +10,7 @@ dependencies = [
     "aiomysql==0.3.2",
     "anyio==4.14.1",
     "decorator==5.3.1",
-    "deepagents==0.6.11",
+    "deepagents==0.6.12",
     "elasticsearch==9.4.1",
     "fastapi==0.138.1",
     "jinja2==3.1.6",

{sycommon_python_lib-0.2.7a7 → sycommon_python_lib-0.2.7a8}/src/sycommon/agent/deep_agent.py

@@ -44,7 +44,7 @@ from typing import Any, AsyncGenerator, Dict, List, Optional, Tuple, TYPE_CHECKI
 
 import yaml
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, model_validator
 from langchain_core.messages import HumanMessage, BaseMessage, AIMessageChunk, AIMessage, SystemMessage
 from langchain_core.tools import BaseTool, tool
 
@@ -57,6 +57,7 @@ from sycommon.agent.sandbox.sandbox_recovery import SandboxRecoveryManager
 from sycommon.agent.chat_events import ChatEvent, ChatEventBuilder, DEFAULT_AGENT_NAME
 from sycommon.middleware.token_tracking import TokenTrackingMiddleware
 from sycommon.middleware.tool_result_truncation import ToolResultTruncationMiddleware
+from sycommon.agent.middleware.skill_write_guard import SkillWriteGuardMiddleware
 from deepagents.middleware.summarization import create_summarization_tool_middleware  # noqa: F401 保留 re-export
 from sycommon.agent.summarization_utils import build_summarization_middleware
 
@@ -373,13 +374,42 @@ class AgentConfig(BaseModel):
     # 沙箱配置
     sandbox_service_name: str = "shengye-platform-sandbox"
     sandbox_timeout: int = 300
-    skills_dir: Optional[str] = None
-    # 技能是否已同步到沙箱：True 时跳过 _sync_skills_to_sandbox 的 atree 检查，
-    # 但仍会基于 skills_dir 注入 /skills（即 SkillsMiddleware 照常挂载）。
-    # 注意：不要用「把 skills_dir 置 None」来跳过同步——那会连带关闭技能注入。
+    # system 技能:本地仓库目录路径 → 同步到沙箱 /skills/system(只读)
+    system_skills_dir: Optional[str] = None
+    # user 技能:标记启用沙箱 /skills/user(可写,内容由 MinIO 按 user 灌入);
+    # 本地兜底路径仅当目录存在时用于开发期同步,生产期为 None。
+    user_skills_dir: Optional[str] = None
+    # 技能是否已同步到沙箱:True 时跳过 _sync_skills_to_sandbox 的 atree 检查,
+    # 但 skills 注入(SkillsMiddleware)不受影响。
     skills_already_synced: bool = False
     memory_dir: Optional[str] = None
 
+    @property
+    def skills_dir(self) -> Optional[str]:
+        """兼容旧字段:取 system_skills_dir(迁移期防外部调用崩)。"""
+        return self.system_skills_dir
+
+    @model_validator(mode="before")
+    @classmethod
+    def _map_legacy_skills_dir(cls, data: Any) -> Any:
+        """旧 skills_dir=... 映射到 system_skills_dir 并告警(修 I3)。
+
+        pydantic v2 默认 ignore 未知字段,而 skills_dir 现在是只读 property
+        (非字段)——直接传 skills_dir=... 会被静默丢弃,导致 agent 无技能却无报错。
+        这里在解析前拦截:若仍用旧 kwarg,映射到 system_skills_dir + DeprecationWarning。
+        """
+        if isinstance(data, dict) and "skills_dir" in data \
+                and "system_skills_dir" not in data:
+            import warnings
+            warnings.warn(
+                "AgentConfig(skills_dir=...) 已弃用,请改用 system_skills_dir="
+                "(system 只读)+ user_skills_dir=(user 可写)。本次按 system 处理。",
+                DeprecationWarning,
+                stacklevel=2,
+            )
+            data = {**data, "system_skills_dir": data.pop("skills_dir")}
+        return data
+
     # 工具
     tools: List[BaseTool] = Field(default_factory=list)
 
@@ -1165,17 +1195,16 @@ async def create_deep_agent(
     tid = thread_id or user_id
     agent_config = {"configurable": {"thread_id": tid}}
 
-    # 确定沙箱路径
-    # skills_dir: 本地目录路径 → 注入沙箱 /skills（SkillsMiddleware 据此挂载）
-    # memory_dir: 非路径字符串 → 标记启用沙箱 /memory/AGENTS.md
-    skills_path = "/skills" if config.skills_dir else None
+    # 沙箱 skills 双层结构:/skills/system(只读,仓库源)+ /skills/user(可写,MinIO 按 user 灌入)
+    system_path = "/skills/system" if config.system_skills_dir else None
+    user_path = "/skills/user" if config.user_skills_dir else None
     memory_path = "/memory/AGENTS.md" if config.memory_dir else None
 
-    # 同步 skills 到沙箱（按目录名检查，已存在则跳过）
-    # 仅在未同步过时执行 atree 检查 + 上传；skills_already_synced=True 时跳过同步，
-    # 但 skills_path 注入不受影响，确保 SkillsMiddleware 始终能挂载。
-    if config.skills_dir and sandbox_backend and not config.skills_already_synced:
-        await _sync_skills_to_sandbox(config.skills_dir, sandbox_backend)
+    # 同步 system 技能到沙箱(按版本检查,已同步则跳过)+ chmod 只读保护
+    # skills_already_synced=True 时跳过同步,但 system_path/user_path 注入不受影响。
+    if config.system_skills_dir and sandbox_backend and not config.skills_already_synced:
+        await _sync_skills_to_sandbox(config.system_skills_dir, sandbox_backend,
+                                      sandbox_dest="/skills/system", chmod_readonly=True)
 
     # 创建 agent
     from deepagents import create_deep_agent as _create_deep_agent
@@ -1196,6 +1225,7 @@ async def create_deep_agent(
         ToolResultTruncationMiddleware(),
         TokenTrackingMiddleware(model_name=config.model_name, user_id=user_id),
         summarization_mw,
+        SkillWriteGuardMiddleware(),          # 系统 /skills/system 只读守卫(先于白名单)
     ]
 
     # RubricMiddleware：复用 FilesystemMiddleware 的工具（底层走 HTTPSandboxBackend HTTP 远程调用）
@@ -1228,8 +1258,15 @@ async def create_deep_agent(
         "debug": config.debug,
         "middleware": middleware_list,
     }
-    if skills_path:
-        agent_kwargs["skills"] = [skills_path]
+    # deepagents SkillsMiddleware 支持多 source (path, label),后 source 覆盖先 source
+    # → user 在后,user 同名技能优先于 system
+    _sources = []
+    if system_path:
+        _sources.append((system_path, "系统"))
+    if user_path:
+        _sources.append((user_path, "用户"))
+    if _sources:
+        agent_kwargs["skills"] = _sources
     if memory_path:
         agent_kwargs["memory"] = [memory_path]
 
@@ -1299,21 +1336,24 @@ def _parse_skill_version(content: str) -> str:
 async def _sync_skills_to_sandbox(
     skills_dir: str,
     backend: HTTPSandboxBackend,
+    *,
+    sandbox_dest: str = "/skills",
+    chmod_readonly: bool = False,
 ) -> None:
-    """同步技能目录到沙箱（按版本检查，版本不一致则全量覆盖）
+    """同步技能目录到沙箱(按版本检查,版本不一致则全量覆盖)
 
-    技能来源是仓库内的 skills/ 目录（随部署持久，不随 Pod 重启丢失），
-    版本比较只看沙箱 /skills/{name}/SKILL.md，无需 MinIO 锚点：
+    技能来源是仓库内的 skills/ 目录(随部署持久,不随 Pod 重启丢失),
+    版本比较只看沙箱 sandbox_dest/{name}/SKILL.md,无需 MinIO 锚点:
     - 沙箱有该技能且 version 一致 → 跳过
-    - 沙箱没有 / version 不一致 → 从本地 skills/ 全量上传到沙箱
+    - 沙箱没有 / 版本不一致 → 从本地 skills/ 全量上传到沙箱
     """
     if not os.path.isdir(skills_dir):
         return
 
     try:
-        # 获取沙箱 /skills 下已有的目录列表
+        # 获取沙箱 sandbox_dest 下已有的目录列表
         existing_dirs = set()
-        tree_result = await backend.atree("/skills", max_depth=1)
+        tree_result = await backend.atree(sandbox_dest, max_depth=1)
         if tree_result and tree_result.tree and tree_result.tree.children:
             for child in tree_result.tree.children:
                 if child.is_dir:
@@ -1336,12 +1376,12 @@ async def _sync_skills_to_sandbox(
                 except Exception:
                     pass
 
-            # 比较版本：只从沙箱 /skills/{name}/SKILL.md 读取
+            # 比较版本:只从沙箱 sandbox_dest/{name}/SKILL.md 读取
             remote_version = ""
             if skill_name in existing_dirs:
                 try:
                     remote_content = await backend.aread(
-                        f"/skills/{skill_name}/SKILL.md")
+                        f"{sandbox_dest}/{skill_name}/SKILL.md")
                     if remote_content:
                         remote_version = _parse_skill_version(remote_content)
                 except Exception:
@@ -1349,29 +1389,39 @@ async def _sync_skills_to_sandbox(
 
             if remote_version and remote_version == local_version:
                 SYLogger.debug(
-                    f"[DeepAgent] 技能版本一致，跳过: {skill_name} v{local_version}")
+                    f"[DeepAgent] 技能版本一致,跳过: {skill_name} v{local_version}")
                 backend._synced_skills.add(skill_name)
                 skip_count += 1
                 continue
 
-            # 版本不一致或无版本，删除旧目录后全量覆盖
+            # 版本不一致或无版本,删除旧目录后全量覆盖
             if skill_name in existing_dirs:
                 try:
-                    await backend.aexecute(f"rm -rf /skills/{skill_name}")
+                    await backend.aexecute(f"rm -rf {sandbox_dest}/{skill_name}")
                     SYLogger.info(
-                        f"[DeepAgent] 技能版本不一致，覆盖: {skill_name} "
+                        f"[DeepAgent] 技能版本不一致,覆盖: {skill_name} "
                         f"({remote_version or '无版本'} → {local_version})")
                 except Exception as e:
                     SYLogger.warning(
                         f"[DeepAgent] 删除旧版技能失败: {skill_name}, {e}")
 
             # 全量上传整个技能目录到沙箱
-            await backend.async_sync_dirs([(src, f"/skills/{skill_name}")])
+            await backend.async_sync_dirs([(src, f"{sandbox_dest}/{skill_name}")])
             backend._synced_skills.add(skill_name)
             skill_count += 1
             SYLogger.info(
                 f"[DeepAgent] 全量同步技能到沙箱: {skill_name} v{local_version}")
 
+        if chmod_readonly:
+            try:
+                # sandbox_dest 是虚拟绝对路径(/skills/system),沙箱 shell 不重映射裸绝对路径,
+                # 须拼 $_SANDBOX_WORKSPACE 指向真实 workspace 才能命中。否则 chmod 静默失败。
+                await backend.aexecute(
+                    f'chmod -R 555 "$_SANDBOX_WORKSPACE{sandbox_dest}"')
+                SYLogger.info(f"[DeepAgent] 已设只读: chmod -R 555 {sandbox_dest}")
+            except Exception as e:
+                SYLogger.warning(f"[DeepAgent] chmod 只读失败(忽略): {e}")
+
         SYLogger.info(
             f"[DeepAgent] 技能同步完成: 同步 {skill_count} 个, 跳过 {skip_count} 个")
     except Exception as e:
@@ -1398,9 +1448,11 @@ async def _create_sandbox_backend(
     memory_dir.mkdir(parents=True, exist_ok=True)
     sync_dirs.append((str(memory_dir), "/memory"))
 
-    # 确定 skills_dir，传递给沙箱后端用于懒同步
-    if config.skills_dir:
-        skills_dir_for_backend = str(Path(config.skills_dir))
+    # 确定 skills_dir，传递给沙箱后端用于懒同步。
+    # 懒同步按 os.path.join(_skills_dir, scope, skill_name) 解析本地源(system/user/<域>),
+    # 故 _skills_dir 须是 system/ 与 user/ 的【父目录】(<repo>/skills),而非 system_skills_dir 本身。
+    if config.system_skills_dir:
+        skills_dir_for_backend = str(Path(config.system_skills_dir).parent)
     else:
         skills_dir_for_backend = str(project_root / "skills")
 

{sycommon_python_lib-0.2.7a7 → sycommon_python_lib-0.2.7a8}/src/sycommon/agent/middleware/skill_api_whitelist.py

@@ -30,15 +30,13 @@ from langgraph.prebuilt.tool_node import ToolCallRequest
 
 from sycommon.logging.kafka_log import SYLogger
 
-# 命令路径形如  skills/sy-oa-skill/workflow-todo/scripts/x.py
-#               skills/sy-syt-skill/shengye-platform-zhongdeng/SKILL.md
-#               skills/sy-syt-skill/generate-plan/...     （有/无 scripts/ 都识别）
-# 取「skills/<顶级技能>/」的【第一段】作顶级技能名（如 sy-oa-skill），
-# 配合 SkillApiWhitelist 按顶级技能（5 个域）配置——每个域的 allowlist 是其下
-# 所有子技能出网地址的并集。用 (?:/|$) 锚定段尾，避免误吞后续路径段。
-# (?<![\w]) 否定左查找：要求 skills 前不是单词字符，避免误匹配 myskills/、
-# theskills/ 等含 skills 子串的路径（行首、空格、引号、/ 后均成立）。
-_SKILL_TOP_RE = re.compile(r'(?<![\w])skills/([A-Za-z0-9_\-]+)(?:/|$)')
+# 命令路径形如  skills/system/sy-oa-skill/workflow-todo/scripts/x.py
+#               skills/user/sy-oa-skill/SKILL.md
+# 拆为 system/user 双层后,顶层段是 system|user,需跳过它取【第二段】作域级技能名
+# (如 sy-oa-skill),配合 SkillApiWhitelist 按顶级域配置。
+# (?<![\w]) 否定左查找:要求 skills 前不是单词字符,避免误匹配 myskills/。
+_SKILL_TOP_RE = re.compile(
+    r'(?<![\w])skills/(?:system|user)/([A-Za-z0-9_\-]+)(?:/|$)')
 
 # BASE_URL 占位符 ${VAR}
 _PLACEHOLDER_RE = re.compile(r'\$\{([A-Z_][A-Z0-9_]*)\}')

sycommon_python_lib-0.2.7a8/src/sycommon/agent/middleware/skill_write_guard.py

@@ -0,0 +1,61 @@
+"""系统技能只读守卫中间件。
+
+拦 write_file / edit_file / execute 三类写操作对 /skills/system 的命中,
+返回 error ToolMessage(不调 handler,短路)。/skills/user 不拦。
+
+双层防护之一(另一层是沙箱 chmod -R 555 /skills/system):
+本中间件负责给 agent 清晰错误反馈并 fail-closed,chmod 负责兜底防 shell 绕过。
+"""
+import re
+from langchain.agents.middleware.types import AgentMiddleware
+from langchain_core.messages import ToolMessage
+from langgraph.prebuilt.tool_node import ToolCallRequest
+
+# /skills/system 或 /skills/system/... (行尾/引号/空白/斜杠均可作边界,防匹配 /skills/systembackup)
+_PROTECTED_PATH_RE = re.compile(r'/skills/system(?:/|\s|"|\'|$)')
+
+# 写动作动词(命令首或分号/管道/空格后)
+_WRITE_VERB_RE = re.compile(
+    r'(^|[\s;&|])(rm|rmdir|mv|cp|chmod|chown|tee|truncate|install|rsync|scp|dd)\b')
+# 输出重定向 > 或 >>
+_REDIRECT_RE = re.compile(r'>>?')
+
+_WRITE_TOOLS = {"write_file", "edit_file"}
+_DENIED_MSG = ("Error: 系统技能 /skills/system 为只读,禁止修改/删除。"
+               "如需定制,请复制到用户技能 /skills/user/ 后编辑。")
+
+
+def _is_protected_path(p: str) -> bool:
+    s = (p or "").strip().replace("\\", "/")
+    return s == "/skills/system" or s.startswith("/skills/system/")
+
+
+def _command_writes_system(cmd: str) -> bool:
+    if not _PROTECTED_PATH_RE.search(cmd or ""):
+        return False
+    return bool(_WRITE_VERB_RE.search(cmd) or _REDIRECT_RE.search(cmd))
+
+
+class SkillWriteGuardMiddleware(AgentMiddleware):
+    """拦对 /skills/system 的写。仅实现 awrap_tool_call(异步链路)。"""
+
+    async def awrap_tool_call(self, request: ToolCallRequest, handler):
+        tc = request.tool_call
+        name = tc.get("name")
+        args = tc.get("args", {}) or {}
+
+        if name in _WRITE_TOOLS:
+            fp = args.get("file_path") if isinstance(args, dict) else ""
+            if _is_protected_path(fp):
+                return ToolMessage(content=_DENIED_MSG, name=name,
+                                   tool_call_id=tc.get("id", ""), status="error")
+            return await handler(request)
+
+        if name == "execute":
+            command = args.get("command", "") if isinstance(args, dict) else ""
+            if _command_writes_system(command):
+                return ToolMessage(content=_DENIED_MSG, name="execute",
+                                   tool_call_id=tc.get("id", ""), status="error")
+            return await handler(request)
+
+        return await handler(request)

{sycommon_python_lib-0.2.7a7 → sycommon_python_lib-0.2.7a8}/src/sycommon/agent/multi_agent_team.py

@@ -45,6 +45,7 @@ from sycommon.agent.sandbox.sandbox_recovery import SandboxRecoveryManager
 from sycommon.agent.chat_events import ChatEvent, ChatEventBuilder, DEFAULT_AGENT_NAME
 from sycommon.middleware.token_tracking import TokenTrackingMiddleware
 from sycommon.middleware.tool_result_truncation import ToolResultTruncationMiddleware
+from sycommon.agent.middleware.skill_write_guard import SkillWriteGuardMiddleware
 from deepagents.middleware.summarization import create_summarization_tool_middleware  # noqa: F401 保留 re-export
 from sycommon.agent.summarization_utils import build_summarization_middleware
 
@@ -131,9 +132,19 @@ class TeamConfig(BaseModel):
 
     sandbox_service_name: str = "shengye-platform-sandbox"
     sandbox_timeout: int = 300
-    skills_dir: Optional[str] = None
+    # system 技能:本地仓库目录 → 同步到沙箱 /skills/system(只读)
+    system_skills_dir: Optional[str] = None
+    # user 技能:标记启用沙箱 /skills/user(可写,内容由 MinIO 灌入)
+    user_skills_dir: Optional[str] = None
+    # 技能是否已同步到沙箱:True 时跳过 _sync_skills_to_sandbox
+    skills_already_synced: bool = False
     memory_dir: Optional[str] = None
 
+    @property
+    def skills_dir(self) -> Optional[str]:
+        """兼容旧字段:取 system_skills_dir。"""
+        return self.system_skills_dir
+
     shared_tools: List[BaseTool] = Field(default_factory=list)
 
     debug: bool = False
@@ -578,6 +589,21 @@ async def create_multi_agent_team(
     tid = thread_id or user_id
     agent_config = {"configurable": {"thread_id": tid}}
 
+    # 同步 system 技能到沙箱(按版本检查)+ chmod 只读保护(与单 Agent 路径对齐)
+    if config.system_skills_dir and sandbox_backend and not config.skills_already_synced:
+        from sycommon.agent.deep_agent import _sync_skills_to_sandbox
+        await _sync_skills_to_sandbox(config.system_skills_dir, sandbox_backend,
+                                      sandbox_dest="/skills/system", chmod_readonly=True)
+
+    # 沙箱 skills 双层路径(用于 SkillsMiddleware 双 source)
+    system_path = "/skills/system" if config.system_skills_dir else None
+    user_path = "/skills/user" if config.user_skills_dir else None
+    skill_sources = []
+    if system_path:
+        skill_sources.append((system_path, "系统"))
+    if user_path:
+        skill_sources.append((user_path, "用户"))   # user 在后 → 同名优先
+
     # 创建子 agents（递归支持嵌套团队）
     from deepagents import create_deep_agent
     from deepagents.middleware.subagents import CompiledSubAgent
@@ -587,6 +613,7 @@ async def create_multi_agent_team(
         ToolResultTruncationMiddleware(),
         TokenTrackingMiddleware(model_name=config.model_name, user_id=user_id),
         summarization_mw,
+        SkillWriteGuardMiddleware(),
     ]
     shared = config.shared_tools or [get_current_date]
 
@@ -632,7 +659,7 @@ async def create_multi_agent_team(
         model=model,
         tools=config.shared_tools or [get_current_date],
         backend=sandbox_backend,
-        skills=["/skills"],
+        skills=skill_sources or None,
         memory=["/memory/AGENTS.md"],
         checkpointer=checkpointer,
         system_prompt=config.coordinator_prompt,
@@ -643,6 +670,7 @@ async def create_multi_agent_team(
             ToolResultTruncationMiddleware(),
             TokenTrackingMiddleware(model_name=config.model_name, user_id=user_id),
             coord_summarization_mw,
+            SkillWriteGuardMiddleware(),
         ],
     )
 
@@ -679,9 +707,10 @@ async def _create_sandbox_backend_for_team(
     memory_dir.mkdir(parents=True, exist_ok=True)
     sync_dirs.append((str(memory_dir), "/memory"))
 
-    # 确定 skills_dir，传递给沙箱后端用于懒同步
-    if config.skills_dir:
-        skills_dir_for_backend = str(Path(config.skills_dir))
+    # 懒同步按 os.path.join(_skills_dir, scope, skill_name) 解析本地源(system/<域>),
+    # 故 _skills_dir 须是 system/ 与 user/ 的【父目录】。
+    if config.system_skills_dir:
+        skills_dir_for_backend = str(Path(config.system_skills_dir).parent)
     else:
         skills_dir_for_backend = str(project_root / "skills")
 

{sycommon_python_lib-0.2.7a7 → sycommon_python_lib-0.2.7a8}/src/sycommon/agent/sandbox/http_sandbox_backend.py

@@ -9,6 +9,7 @@ HTTP 客户端沙箱后端
 import asyncio
 import base64
 import os
+import re
 import ssl
 import sys
 import tempfile
@@ -36,6 +37,12 @@ try:
 except ImportError:
     _SSL_CONTEXT = ssl.create_default_context()
 
+# 技能访问路径解析:/skills/(system|user)/<域>/...
+# 前导斜杠可选(命令里可能是 cd skills/system/x),(?<![\w]) 防误匹配 myskills/
+_SKILL_PATH_RE = re.compile(
+    r'(?:^|[\s/\'"])skills/(system|user)/([a-zA-Z0-9_\-]+)/'
+)
+
 
 def _read_file_safe(path: str) -> bytes:
     with open(path, "rb") as f:
@@ -851,33 +858,29 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
         if not self._skills_dir:
             return
 
-        import re
-        # 匹配 /skills/<skill_name>/ 或 skills/<skill_name>/
-        match = re.search(r'/skills/([a-zA-Z0-9_\-]+)/', path)
-        if not match:
-            match = re.search(r'(?:^|\s|")skills/([a-zA-Z0-9_\-]+)/', path)
+        match = _SKILL_PATH_RE.search(path)
         if not match:
             return
-
-        skill_name = match.group(1)
-        if skill_name in self._synced_skills:
+        scope, skill_name = match.group(1), match.group(2)
+        cache_key = f"{scope}/{skill_name}"
+        if cache_key in self._synced_skills:
             return
 
-        skill_dir = os.path.join(self._skills_dir, skill_name)
+        skill_dir = os.path.join(self._skills_dir, scope, skill_name)
         if not os.path.isdir(skill_dir):
-            self._synced_skills.add(skill_name)
+            self._synced_skills.add(cache_key)
             return
 
         try:
             await self.async_sync_dirs([
-                (skill_dir, f"/skills/{skill_name}")
+                (skill_dir, f"/skills/{scope}/{skill_name}")
             ])
-            self._synced_skills.add(skill_name)
+            self._synced_skills.add(cache_key)
             SYLogger.info(
-                f"[Sandbox] 懒同步技能目录: {skill_name}/")
+                f"[Sandbox] 懒同步技能目录: {cache_key}/")
         except Exception as e:
             SYLogger.warning(
-                f"[Sandbox] 懒同步技能目录失败: {skill_name}, {e}")
+                f"[Sandbox] 懒同步技能目录失败: {cache_key}, {e}")
 
     def _lazy_sync_skill_from_path_sync(self, path: str) -> None:
         """同步版本的懒同步（在同步文件操作中调用）
@@ -887,32 +890,29 @@ class HTTPSandboxBackend(FileOperationsMixin, SandboxBackendProtocol):
         if not self._skills_dir:
             return
 
-        import re
-        match = re.search(r'/skills/([a-zA-Z0-9_\-]+)/', path)
-        if not match:
-            match = re.search(r'(?:^|\s|")skills/([a-zA-Z0-9_\-]+)/', path)
+        match = _SKILL_PATH_RE.search(path)
         if not match:
             return
-
-        skill_name = match.group(1)
-        if skill_name in self._synced_skills:
+        scope, skill_name = match.group(1), match.group(2)
+        cache_key = f"{scope}/{skill_name}"
+        if cache_key in self._synced_skills:
             return
 
-        skill_dir = os.path.join(self._skills_dir, skill_name)
+        skill_dir = os.path.join(self._skills_dir, scope, skill_name)
         if not os.path.isdir(skill_dir):
-            self._synced_skills.add(skill_name)
+            self._synced_skills.add(cache_key)
             return
 
         try:
             # 同步版本直接调用同步上传方法
             self._upload_directory_sync(
-                skill_dir, f"/skills/{skill_name}", mode="full")
-            self._synced_skills.add(skill_name)
+                skill_dir, f"/skills/{scope}/{skill_name}", mode="full")
+            self._synced_skills.add(cache_key)
             SYLogger.info(
-                f"[Sandbox] 懒同步技能目录(sync): {skill_name}/")
+                f"[Sandbox] 懒同步技能目录(sync): {cache_key}/")
         except Exception as e:
             SYLogger.warning(
-                f"[Sandbox] 懒同步技能目录失败(sync): {skill_name}, {e}")
+                f"[Sandbox] 懒同步技能目录失败(sync): {cache_key}, {e}")
 
     async def _sync_async(self, *, timeout: int = None) -> dict:
         """同步目录（异步版本）

{sycommon_python_lib-0.2.7a7 → sycommon_python_lib-0.2.7a8}/src/sycommon/agent/sandbox/minio_sync.py

@@ -326,6 +326,20 @@ class MinioSyncService(metaclass=SingletonMeta):
         else:
             files.append(path)
 
+    def _exclude_system_skills(self, files: list[str]) -> list[str]:
+        """过滤掉 /skills/system/ 前缀文件——system 是只读仓库产物,不进 MinIO。
+
+        路径形如 skills/system/sy-oa-skill/...(collect_sandbox_files 已 strip 根 user_id
+        前缀,根盘符 / 由调用方拼接)。兼容带不带前导斜杠。
+        """
+        out = []
+        for fp in files:
+            norm = fp.replace("\\", "/").lstrip("/")
+            if norm == "skills/system" or norm.startswith("skills/system/"):
+                continue
+            out.append(fp)
+        return out
+
     async def sync_sandbox_to_minio(self, sandbox_backend, user_id: str) -> int:
         """扫描沙箱目录，增量同步文件到 MinIO
 
@@ -357,6 +371,7 @@ class MinioSyncService(metaclass=SingletonMeta):
             return 0
 
         sandbox_files = self.collect_sandbox_files(tree_result)
+        sandbox_files = self._exclude_system_skills(sandbox_files)
         if not sandbox_files:
             # 沙箱为空，清理 MinIO 中该用户的所有文件
             try:
@@ -523,6 +538,11 @@ class MinioSyncService(metaclass=SingletonMeta):
             if rel_path and rel_path not in existing_files:
                 to_restore.append(rel_path)
 
+        # 排除 /skills/system —— system 是只读仓库产物,由本地仓库注入,
+        # 绝不从 MinIO 恢复(否则旧的/遗留 system 副本会落回用户沙箱,污染只读区)。
+        # 与 sync_sandbox_to_minio 的排除对称,守住「system 不进 MinIO」不变式。
+        to_restore = self._exclude_system_skills(to_restore)
+
         if not to_restore:
             SYLogger.info(f"[MinIO] 沙箱文件完整，无需恢复: user={user_id}")
             return 0

{sycommon_python_lib-0.2.7a7 → sycommon_python_lib-0.2.7a8}/src/sycommon/agent/summarization_utils.py

@@ -206,10 +206,9 @@ async def _patched_awrap_model_call(self, request, handler):
     real_tokens = _extract_last_usage_total_tokens(effective_messages)
 
     # 估算值（用于日志对比）
-    try:
-        estimated = _approx_counter(counted_messages, tools=request.tools)
-    except TypeError:
-        estimated = _approx_counter(counted_messages)
+    # langchain-core>=1.4.8 的 count_tokens_approximately 原生支持 tools=，
+    # 不再需要 try/except TypeError 兜底。
+    estimated = _approx_counter(counted_messages, tools=request.tools)
 
     # 如果有真实 token，临时替换 token_counter 使 _orig 内部判断也用真实值
     # 这样 _should_summarize 和 _determine_cutoff_index 都能拿到正确的 token 数
@@ -301,6 +300,11 @@ except ImportError:
 # 虽然不能改变 __init__ 的默认参数（Python 在定义时求值），
 # 但可以防止任何运行时读取 DEFAULT_SUMMARY_PROMPT 的代码拿到英文版。
 _summ_mod.DEFAULT_SUMMARY_PROMPT = CUSTOM_SUMMARY_PROMPT
+# deepagents 0.6.12 起 SummarizationMiddleware 的默认 prompt 改读
+# DEEPAGENTS_DEFAULT_SUMMARY_PROMPT（在模块加载时由 DEFAULT_SUMMARY_PROMPT 派生），
+# 因此只替换 DEFAULT_SUMMARY_PROMPT 已无法阻断新链路，需同步覆盖派生常量。
+if hasattr(_summ_mod, "DEEPAGENTS_DEFAULT_SUMMARY_PROMPT"):
+    _summ_mod.DEEPAGENTS_DEFAULT_SUMMARY_PROMPT = CUSTOM_SUMMARY_PROMPT
 try:
     import langchain.agents.middleware.summarization as _lc_summ_mod
     _lc_summ_mod.DEFAULT_SUMMARY_PROMPT = CUSTOM_SUMMARY_PROMPT