@@ -108,6 +108,11 @@ import {
108108toClientToolDefinitions,
109109} from "../../pi-tool-definition-adapter.js";
110110import { createOpenClawCodingTools, resolveToolLoopDetectionConfig } from "../../pi-tools.js";
111+import {
112+resolveEffectiveToolPolicy,
113+resolveGroupToolPolicy,
114+resolveSubagentToolPolicyForSession,
115+} from "../../pi-tools.policy.js";
111116import { wrapStreamFnTextTransforms } from "../../plugin-text-transforms.js";
112117import { describeProviderRequestRoutingSummary } from "../../provider-attribution.js";
113118import { registerProviderStreamForModel } from "../../provider-stream.js";
@@ -126,10 +131,18 @@ import {
126131applySkillEnvOverridesFromSnapshot,
127132resolveSkillsPromptForRun,
128133} from "../../skills.js";
134+import {
135+isSubagentEnvelopeSession,
136+resolveSubagentCapabilityStore,
137+} from "../../subagent-capabilities.js";
129138import { resolveSystemPromptOverride } from "../../system-prompt-override.js";
130139import { buildSystemPromptParams } from "../../system-prompt-params.js";
131140import { buildSystemPromptReport } from "../../system-prompt-report.js";
132141import { resolveAgentTimeoutMs } from "../../timeout.js";
142+import {
143+buildEmptyExplicitToolAllowlistError,
144+collectExplicitToolAllowlistSources,
145+} from "../../tool-allowlist-guard.js";
133146import { UNKNOWN_TOOL_THRESHOLD } from "../../tool-loop-detection.js";
134147import {
135148resolveTranscriptPolicy,
@@ -451,6 +464,79 @@ export function applyEmbeddedAttemptToolsAllow<T extends { name: string }>(
451464return tools.filter((tool) => allowSet.has(tool.name));
452465}
453466467+function collectAttemptExplicitToolAllowlistSources(params: {
468+config?: EmbeddedRunAttemptParams["config"];
469+sessionKey?: string;
470+sandboxSessionKey?: string;
471+agentId?: string;
472+modelProvider?: string;
473+modelId?: string;
474+messageProvider?: string;
475+agentAccountId?: string | null;
476+groupId?: string | null;
477+groupChannel?: string | null;
478+groupSpace?: string | null;
479+spawnedBy?: string | null;
480+senderId?: string | null;
481+senderName?: string | null;
482+senderUsername?: string | null;
483+senderE164?: string | null;
484+sandboxToolPolicy?: { allow?: string[]; deny?: string[] };
485+toolsAllow?: string[];
486+}) {
487+const { agentId, globalPolicy, globalProviderPolicy, agentPolicy, agentProviderPolicy } =
488+resolveEffectiveToolPolicy({
489+config: params.config,
490+sessionKey: params.sessionKey,
491+agentId: params.agentId,
492+modelProvider: params.modelProvider,
493+modelId: params.modelId,
494+});
495+const groupPolicy = resolveGroupToolPolicy({
496+config: params.config,
497+sessionKey: params.sessionKey,
498+spawnedBy: params.spawnedBy,
499+messageProvider: params.messageProvider,
500+groupId: params.groupId,
501+groupChannel: params.groupChannel,
502+groupSpace: params.groupSpace,
503+accountId: params.agentAccountId,
504+senderId: params.senderId,
505+senderName: params.senderName,
506+senderUsername: params.senderUsername,
507+senderE164: params.senderE164,
508+});
509+const subagentStore = resolveSubagentCapabilityStore(params.sandboxSessionKey, {
510+cfg: params.config,
511+});
512+const subagentPolicy =
513+params.sandboxSessionKey &&
514+isSubagentEnvelopeSession(params.sandboxSessionKey, {
515+cfg: params.config,
516+store: subagentStore,
517+})
518+ ? resolveSubagentToolPolicyForSession(params.config, params.sandboxSessionKey, {
519+store: subagentStore,
520+})
521+ : undefined;
522+return collectExplicitToolAllowlistSources([
523+{ label: "tools.allow", allow: globalPolicy?.allow },
524+{ label: "tools.byProvider.allow", allow: globalProviderPolicy?.allow },
525+{
526+label: agentId ? `agents.${agentId}.tools.allow` : "agent tools.allow",
527+allow: agentPolicy?.allow,
528+},
529+{
530+label: agentId ? `agents.${agentId}.tools.byProvider.allow` : "agent tools.byProvider.allow",
531+allow: agentProviderPolicy?.allow,
532+},
533+{ label: "group tools.allow", allow: groupPolicy?.allow },
534+{ label: "sandbox tools.allow", allow: params.sandboxToolPolicy?.allow },
535+{ label: "subagent tools.allow", allow: subagentPolicy?.allow },
536+{ label: "runtime toolsAllow", allow: params.toolsAllow },
537+]);
538+}
539+454540export async function runEmbeddedAttempt(
455541params: EmbeddedRunAttemptParams,
456542): Promise<EmbeddedRunAttemptResult> {
@@ -802,6 +888,32 @@ export async function runEmbeddedAttempt(
802888tools: effectiveTools,
803889 clientTools,
804890});
891+const explicitToolAllowlistSources = collectAttemptExplicitToolAllowlistSources({
892+config: params.config,
893+sessionKey: params.sessionKey,
894+ sandboxSessionKey,
895+agentId: sessionAgentId,
896+modelProvider: params.provider,
897+modelId: params.modelId,
898+messageProvider: params.messageChannel ?? params.messageProvider,
899+agentAccountId: params.agentAccountId,
900+groupId: params.groupId,
901+groupChannel: params.groupChannel,
902+groupSpace: params.groupSpace,
903+spawnedBy: params.spawnedBy,
904+senderId: params.senderId,
905+senderName: params.senderName,
906+senderUsername: params.senderUsername,
907+senderE164: params.senderE164,
908+sandboxToolPolicy: sandbox?.tools,
909+toolsAllow: params.toolsAllow,
910+});
911+const emptyExplicitToolAllowlistError = buildEmptyExplicitToolAllowlistError({
912+sources: explicitToolAllowlistSources,
913+callableToolNames: effectiveTools.map((tool) => tool.name),
914+ toolsEnabled,
915+disableTools: params.disableTools,
916+});
805917if (params.runtimePlan) {
806918params.runtimePlan.tools.logDiagnostics(effectiveTools, runtimePlanModelContext);
807919} else {
@@ -2031,6 +2143,12 @@ export async function runEmbeddedAttempt(
20312143let skipPromptSubmission = false;
20322144try {
20332145const promptStartedAt = Date.now();
2146+if (emptyExplicitToolAllowlistError) {
2147+promptError = emptyExplicitToolAllowlistError;
2148+promptErrorSource = "precheck";
2149+skipPromptSubmission = true;
2150+log.warn(`[tools] ${emptyExplicitToolAllowlistError.message}`);
2151+}
2034215220352153// Run before_prompt_build hooks to allow plugins to inject prompt context.
20362154// Legacy compatibility: before_agent_start is also checked for context fields.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。