📄 system_prompt.py (第 85-183 行)

def build_system_prompt_parts(agent, system_message=None):
    stable_parts: List[str] = []
    
    # ── 身份层 ──
    # 优先加载 SOUL.md，回退到 DEFAULT_AGENT_IDENTITY
    _soul_content = _r.load_soul_md()
    if _soul_content:
        stable_parts.append(_soul_content)
    else:
        stable_parts.append(DEFAULT_AGENT_IDENTITY)
    
    # ── 帮助指南 ──
    stable_parts.append(HERMES_AGENT_HELP_GUIDANCE)
    
    # ── 任务完成指南（防幻觉）──
    if agent._task_completion_guidance and agent.valid_tool_names:
        stable_parts.append(TASK_COMPLETION_GUIDANCE)
    
    # ── 工具感知行为指南 ──
    tool_guidance = []
    if "memory" in agent.valid_tool_names:
        tool_guidance.append(MEMORY_GUIDANCE)
    if "session_search" in agent.valid_tool_names:
        tool_guidance.append(SESSION_SEARCH_GUIDANCE)
    if "skill_manage" in agent.valid_tool_names:
        tool_guidance.append(SKILLS_GUIDANCE)
    
    # ── 工具使用强制执行 ──
    # 告诉模型必须真正调用工具，而非描述意图
    if _inject:
        stable_parts.append(TOOL_USE_ENFORCEMENT_GUIDANCE)
    
    # ── 模型家族特定指南 ──
    if "gemini" in model_lower:
        stable_parts.append(GOOGLE_MODEL_OPERATIONAL_GUIDANCE)
    if "gpt" in model_lower or "grok" in model_lower:
        stable_parts.append(OPENAI_MODEL_EXECUTION_GUIDANCE)

📄 prompt_builder.py (第 41-61 行)

def _scan_context_content(content, filename):
    """扫描上下文文件，检测 prompt 注入攻击"""
    findings = _scan_for_threats(content, scope="context")
    if findings:
        logger.warning("Context file %s blocked: %s", filename,
                       ", ".join(findings))
        return f"[BLOCKED: {filename} contained potential " \
               f"prompt injection. Content not loaded.]"
    return content

System Prompt 三层结构

工具执行调度流程

📄 tool_executor.py (第 135-149 行)

def _tool_search_scoped_names(agent):
    """返回会话可调用的工具名集合
    
    防止受限工具集的会话（子代理、Kanban worker、
    网关会话）访问未被授权的工具。
    
    结果缓存在 agent 上，当工具注册表代
    号变化时（如 MCP 服务器重连）自动刷新。
    """
    cached = getattr(agent, "_scoped_tool_names", None)
    if cached is not None:
        return cached
    # 构建授权工具名集合...
    return frozenset(valid_tool_names)

📄 tool_guardrails.py (第 20-60 行)

IDEMPOTENT_TOOL_NAMES = frozenset({
    "read_file", "search_files", "web_search",
    "web_extract", "session_search",
    "browser_snapshot", "browser_console",
    "mcp_filesystem_read_file", ...
})

MUTATING_TOOL_NAMES = frozenset({
    "terminal", "execute_code", "write_file",
    "patch", "todo", "memory", "skill_manage",
    "browser_click", "browser_type",
    "send_message", "cronjob", "delegate_task",
})

📄 tool_guardrails.py (第 63-124 行)

@dataclass(frozen=True)
class ToolCallGuardrailConfig:
    """工具调用循环检测阈值"""
    
    warnings_enabled: bool = True
    hard_stop_enabled: bool = False
    
    # ── 精确失败检测 ──
    exact_failure_warn_after: int = 2      # 2次相同失败后警告
    exact_failure_block_after: int = 5     # 5次后阻断
    
    # ── 同工具失败检测 ──
    same_tool_failure_warn_after: int = 3  # 3次后警告
    same_tool_failure_halt_after: int = 8  # 8次后停止
    
    # ── 无进度检测（幂等工具）──
    no_progress_warn_after: int = 2        # 2次无进度后警告
    no_progress_block_after: int = 5       # 5次后阻断

📄 tool_guardrails.py (第 144-151 行)

@dataclass(frozen=True)
class ToolGuardrailDecision:
    """工具调用护栏决策"""
    action: str = "allow"   # allow | warn | block | halt
    code: str = "allow"
    message: str = ""

System Prompt 构建引擎

⬇️

⬇️

⬇️

Tool Executor + Guardrails

⬇️