fix: 修复35个安全与功能缺陷，补全知识进化/数字孪生/行为采集模块
## 安全修复 (12项) - Webhook接口添加全局Token认证，过滤敏感请求头 - 修复JWT Base64 padding公式，防止签名验证绕过 - 数据库密码/飞书Token从源码移除，改为环境变量 - 工作流引擎添加路径遍历防护 (_resolve_safe_path) - eval()添加模板长度上限检查 - 审批API添加认证依赖 - 前端v-html增强XSS转义，console.log仅开发模式输出 - 500错误不再暴露内部异常详情 ## Agent运行时修复 (7项) - 删除_inject_knowledge_context中未定义db变量的finally块 - 工具执行添加try/except保护，异常不崩溃Agent - LLM重试计入budget计数器 - self_review异常时passed=False - max_iterations截断标记success=False - 工具参数JSON解析失败时记录警告日志 - run()开始时重置_llm_invocations计数器 ## 配置与基础设施 - DEBUG默认False，SQL_ECHO独立配置项 - init_db()补全13个缺失模型导入 - 新增WEBHOOK_AUTH_TOKEN/SQL_ECHO配置项 - 新增.env.example模板文件 ## 前端修复 (12项) - 登录改用URLSearchParams替代FormData - 401拦截器通过Pinia store统一清理状态 - SSE流超时从60s延长至300s - final/error事件时清除streamTimeout - localStorage聊天记录添加24h TTL - safeParseArgCount替代模板中裸JSON.parse - fetchUser 401时同时清除user对象 ## 新增模块 - 知识进化: knowledge_extractor/retriever/tasks - 数字孪生: shadow_executor/comparison模型 - 行为采集: behavior_middleware/collector/fingerprint_engine - 代码审查: code_review_agent/document_review_agent - 反馈学习: feedback_learner - 瓶颈检测/优化引擎/成本估算/需求估算 - 速率限制器 (rate_limiter) - Alembic迁移 015-020 ## 文档 - 商业化落地计划 - 8篇docs文档 (架构/API/部署/开发/贡献等) - Docker Compose生产配置 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
renjianbo
@@ -31,6 +31,8 @@ from app.services.agent_learning_service import (
|
||||
load_relevant_patterns,
|
||||
save_learning_pattern,
|
||||
)
|
||||
from app.services.execution_logger import execution_logger as _exec_logger
|
||||
from app.services.knowledge_retriever import knowledge_retriever
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
@@ -115,6 +117,49 @@ class AgentRuntime:
|
||||
# 返回 True 表示预算充足；返回 False 或抛出异常表示超限
|
||||
self.on_llm_invocation: Optional[Callable[[], Any]] = None
|
||||
|
||||
def _build_execution_log_kwargs(self, user_input: str, result: AgentResult, latency_ms: int) -> dict:
|
||||
"""从 AgentResult 构建 execution_logger 所需的参数字典。"""
|
||||
tool_chain = []
|
||||
for s in result.steps:
|
||||
if s.type == "tool_result" and s.tool_name:
|
||||
tool_chain.append({
|
||||
"tool_name": s.tool_name,
|
||||
"tool_input": s.tool_input,
|
||||
"tool_output": s.tool_result[:500] if s.tool_result else None,
|
||||
})
|
||||
steps_summary = [
|
||||
{"iteration": s.iteration, "type": s.type, "tool_name": s.tool_name,
|
||||
"content": (s.content or "")[:300]}
|
||||
for s in result.steps[-20:] # 最多保留最近 20 步
|
||||
]
|
||||
return dict(
|
||||
agent_id=None, # 由调用方设置
|
||||
agent_name=self.config.name,
|
||||
user_id=self.config.user_id,
|
||||
session_id=self.context.session_id,
|
||||
input_text=user_input,
|
||||
output_text=result.content,
|
||||
output_truncated=result.truncated,
|
||||
success=result.success,
|
||||
error_message=result.error,
|
||||
latency_ms=latency_ms,
|
||||
iterations_used=result.iterations_used,
|
||||
tool_calls_made=result.tool_calls_made,
|
||||
tool_chain=tool_chain if tool_chain else None,
|
||||
steps=steps_summary if steps_summary else None,
|
||||
model=self.config.llm.model,
|
||||
provider=self.config.llm.provider,
|
||||
)
|
||||
|
||||
def _fire_execution_log(self, user_input: str, result: AgentResult, start_time: float):
|
||||
"""Fire-and-forget 记录执行日志（非阻塞）。"""
|
||||
try:
|
||||
latency_ms = int((time.time() - start_time) * 1000)
|
||||
kwargs = self._build_execution_log_kwargs(user_input, result, latency_ms)
|
||||
_exec_logger.log_execution_fire_and_forget(**kwargs)
|
||||
except Exception:
|
||||
pass # 日志记录失败不影响主流程
|
||||
|
||||
async def run(self, user_input: str) -> AgentResult:
|
||||
"""
|
||||
执行 Agent 单轮对话。
|
||||
@@ -124,12 +169,17 @@ class AgentRuntime:
|
||||
max_iter = max(1, self.config.llm.max_iterations)
|
||||
self.context.iteration = 0
|
||||
self.context.tool_calls_made = 0
|
||||
self._llm_invocations = 0 # 每次 run() 重置 LLM 调用计数
|
||||
_run_start = time.time() # 执行开始时间，用于计算总延迟
|
||||
|
||||
# 1. 首次运行时加载长期记忆到 system prompt
|
||||
if not self._memory_context_loaded:
|
||||
await self._inject_memory_context(user_input)
|
||||
self._memory_context_loaded = True
|
||||
|
||||
# 1.5 知识检索增强：从知识库注入相关经验到 system prompt
|
||||
await self._inject_knowledge_context(user_input)
|
||||
|
||||
# 2. 追加用户消息
|
||||
self.context.add_user_message(user_input)
|
||||
|
||||
@@ -166,10 +216,12 @@ class AgentRuntime:
|
||||
logger.warning(err)
|
||||
steps.append(AgentStep(iteration=self.context.iteration, type="final", content=err))
|
||||
await self.memory.save_context(user_input, err, self.context.messages)
|
||||
return AgentResult(success=False, content=err, truncated=True,
|
||||
result = AgentResult(success=False, content=err, truncated=True,
|
||||
iterations_used=self.context.iteration,
|
||||
tool_calls_made=self.context.tool_calls_made,
|
||||
steps=steps, error=err)
|
||||
self._fire_execution_log(user_input, result, _run_start)
|
||||
return result
|
||||
|
||||
# 调用外部 LLM 预算回调（WorkflowEngine 注入，将 Agent 的 LLM 计入工作流预算）
|
||||
if self.on_llm_invocation:
|
||||
@@ -180,10 +232,12 @@ class AgentRuntime:
|
||||
logger.warning(err)
|
||||
steps.append(AgentStep(iteration=self.context.iteration, type="final", content=err))
|
||||
await self.memory.save_context(user_input, err, self.context.messages)
|
||||
return AgentResult(success=False, content=err, truncated=True,
|
||||
result = AgentResult(success=False, content=err, truncated=True,
|
||||
iterations_used=self.context.iteration,
|
||||
tool_calls_made=self.context.tool_calls_made,
|
||||
steps=steps, error=str(e))
|
||||
self._fire_execution_log(user_input, result, _run_start)
|
||||
return result
|
||||
|
||||
# 调用 LLM
|
||||
try:
|
||||
@@ -203,14 +257,17 @@ class AgentRuntime:
|
||||
type="tool_result",
|
||||
content=f"LLM 调用失败（可重试）: {err_str}",
|
||||
))
|
||||
self._llm_invocations += 1 # 重试也计入 LLM 调用预算
|
||||
continue
|
||||
return AgentResult(
|
||||
result = AgentResult(
|
||||
success=False,
|
||||
content=f"LLM 调用失败: {err_str}",
|
||||
iterations_used=self.context.iteration,
|
||||
tool_calls_made=self.context.tool_calls_made,
|
||||
error=err_str,
|
||||
)
|
||||
self._fire_execution_log(user_input, result, _run_start)
|
||||
return result
|
||||
|
||||
# 记录 LLM 调用次数（内部计数）
|
||||
self._llm_invocations += 1
|
||||
@@ -272,13 +329,15 @@ class AgentRuntime:
|
||||
)
|
||||
# 提取知识到全局知识池（Agent 间知识共享）
|
||||
await self._extract_global_knowledge(user_input, final_text, steps, review_score)
|
||||
return AgentResult(
|
||||
result = AgentResult(
|
||||
success=True,
|
||||
content=final_text,
|
||||
iterations_used=self.context.iteration,
|
||||
tool_calls_made=self.context.tool_calls_made,
|
||||
steps=steps,
|
||||
)
|
||||
self._fire_execution_log(user_input, result, _run_start)
|
||||
return result
|
||||
|
||||
# 有工具调用 → 先记录 assistant 消息（含 tool_calls）
|
||||
self.context.add_assistant_message(content or "", tool_calls, reasoning)
|
||||
@@ -290,6 +349,8 @@ class AgentRuntime:
|
||||
try:
|
||||
tc_args_list.append(json.loads(tc["function"].get("arguments", "{}")))
|
||||
except (json.JSONDecodeError, TypeError):
|
||||
raw_args = tc["function"].get("arguments", "")
|
||||
logger.warning("工具参数 JSON 解析失败，使用空对象: %.200s", str(raw_args))
|
||||
tc_args_list.append({})
|
||||
|
||||
steps.append(AgentStep(
|
||||
@@ -339,7 +400,13 @@ class AgentRuntime:
|
||||
# decision == "approved" → 继续执行
|
||||
|
||||
logger.info("Agent 执行工具 [%s]: %s", tname, targs)
|
||||
result = await self.tool_manager.execute(tname, targs)
|
||||
try:
|
||||
result = await self.tool_manager.execute(tname, targs)
|
||||
except Exception as tool_err:
|
||||
logger.error("工具 '%s' 执行异常: %s", tname, tool_err, exc_info=True)
|
||||
result = json.dumps({
|
||||
"error": f"工具 '{tname}' 执行异常: {tool_err}"
|
||||
}, ensure_ascii=False)
|
||||
|
||||
steps.append(AgentStep(
|
||||
iteration=self.context.iteration,
|
||||
@@ -359,10 +426,12 @@ class AgentRuntime:
|
||||
logger.warning(err)
|
||||
steps.append(AgentStep(iteration=self.context.iteration, type="tool_result",
|
||||
content=err, tool_name=tname))
|
||||
return AgentResult(success=False, content=err, truncated=True,
|
||||
result = AgentResult(success=False, content=err, truncated=True,
|
||||
iterations_used=self.context.iteration,
|
||||
tool_calls_made=self.context.tool_calls_made,
|
||||
steps=steps, error=err)
|
||||
self._fire_execution_log(user_input, result, _run_start)
|
||||
return result
|
||||
|
||||
if self.on_tool_executed:
|
||||
try:
|
||||
@@ -388,10 +457,10 @@ class AgentRuntime:
|
||||
|
||||
logger.warning("Agent 达到最大迭代次数 (%s)", max_iter)
|
||||
await self.memory.save_context(user_input, last_content or "（已达最大迭代次数）", self.context.messages)
|
||||
# 保存学习模式（即便截断，工具调用模式仍有参考价值）
|
||||
# 保存学习模式（即使截断，标记为未成功以便后续分析）
|
||||
if self.config.memory.learning_enabled:
|
||||
await self._save_learning_pattern(
|
||||
user_input, steps, success=True,
|
||||
user_input, steps, success=False,
|
||||
iterations_used=self.context.iteration,
|
||||
tool_calls_made=self.context.tool_calls_made,
|
||||
)
|
||||
@@ -404,14 +473,18 @@ class AgentRuntime:
|
||||
type="final",
|
||||
content=last_content,
|
||||
))
|
||||
return AgentResult(
|
||||
success=True,
|
||||
content=last_content or "已达最大迭代次数，但模型未返回最终回答。",
|
||||
truncation_msg = f"已达最大迭代次数 ({max_iter})，任务被截断"
|
||||
result = AgentResult(
|
||||
success=False,
|
||||
content=last_content or truncation_msg,
|
||||
truncated=True,
|
||||
iterations_used=self.context.iteration,
|
||||
tool_calls_made=self.context.tool_calls_made,
|
||||
steps=steps,
|
||||
error=truncation_msg,
|
||||
)
|
||||
self._fire_execution_log(user_input, result, _run_start)
|
||||
return result
|
||||
|
||||
async def run_stream(self, user_input: str) -> AsyncGenerator[dict, None]:
|
||||
"""
|
||||
@@ -433,6 +506,9 @@ class AgentRuntime:
|
||||
await self._inject_memory_context(user_input)
|
||||
self._memory_context_loaded = True
|
||||
|
||||
# 1.5 知识检索增强：从知识库注入相关经验到 system prompt
|
||||
await self._inject_knowledge_context(user_input)
|
||||
|
||||
# 2. 追加用户消息
|
||||
self.context.add_user_message(user_input)
|
||||
|
||||
@@ -581,6 +657,8 @@ class AgentRuntime:
|
||||
try:
|
||||
tc_args_list.append(json.loads(tc["function"].get("arguments", "{}")))
|
||||
except (json.JSONDecodeError, TypeError):
|
||||
raw_args = tc["function"].get("arguments", "")
|
||||
logger.warning("工具参数 JSON 解析失败，使用空对象: %.200s", str(raw_args))
|
||||
tc_args_list.append({})
|
||||
|
||||
yield {
|
||||
@@ -654,7 +732,13 @@ class AgentRuntime:
|
||||
# decision == "approved" → 继续执行
|
||||
|
||||
logger.info("Agent 执行工具 [%s]: %s", tname, targs)
|
||||
result = await self.tool_manager.execute(tname, targs)
|
||||
try:
|
||||
result = await self.tool_manager.execute(tname, targs)
|
||||
except Exception as tool_err:
|
||||
logger.error("工具 '%s' 执行异常: %s", tname, tool_err, exc_info=True)
|
||||
result = json.dumps({
|
||||
"error": f"工具 '{tname}' 执行异常: {tool_err}"
|
||||
}, ensure_ascii=False)
|
||||
|
||||
# yield tool_result 事件
|
||||
yield {
|
||||
@@ -758,9 +842,18 @@ class AgentRuntime:
|
||||
except Exception as e:
|
||||
logger.warning("加载学习模式失败: %s", e)
|
||||
return ""
|
||||
finally:
|
||||
if db:
|
||||
db.close()
|
||||
|
||||
async def _inject_knowledge_context(self, query: str) -> None:
|
||||
"""从知识进化库检索相关经验并注入 system prompt。"""
|
||||
try:
|
||||
enriched = knowledge_retriever.inject_knowledge(
|
||||
self.context.system_prompt, query
|
||||
)
|
||||
if enriched != self.context.system_prompt:
|
||||
self.context.set_system_prompt(enriched)
|
||||
logger.info("Agent 已注入相关知识库经验")
|
||||
except Exception as e:
|
||||
logger.debug("知识检索注入跳过: %s", e)
|
||||
|
||||
async def _save_learning_pattern(
|
||||
self, query: str, steps: List[AgentStep],
|
||||
@@ -911,7 +1004,8 @@ class AgentRuntime:
|
||||
}
|
||||
except Exception as e:
|
||||
logger.warning("self_review 执行失败: %s", e)
|
||||
return {"score": 0.5, "passed": True, "issues": [], "suggestions": [], "error": str(e)}
|
||||
return {"score": 0.0, "passed": False, "issues": [f"self_review 执行异常: {e}"],
|
||||
"suggestions": ["请检查 self_review 配置或 LLM 可用性"], "error": str(e)}
|
||||
|
||||
@staticmethod
|
||||
def _extract_tool_calls(response: Any) -> List[Dict[str, Any]]:
|
||||
|
||||
Reference in New Issue
Block a user