sync: 185 file da Baida98/AI@ce1132ab (2026-08-25 18:35 UTC) [deploy-all]

agents/unified_loop.py

@@ -3510,13 +3510,13 @@ class UnifiedAgentLoop(DirectToolsMixin, PromptBuilderMixin, LLMSelectionMixin,
 
     async def run(self, goal: str, context: str = "", max_steps: int = 8,
                   on_step: StepCallback | None = None,
-                  session_id: str = "") -> dict[str, Any]:
+                  session_id: str = "", allow_tools: bool = True) -> dict[str, Any]:
         """Run the loop and close unexpected exceptions as a controlled FAILED state."""
         previous_state = _ACTIVE_LOOP_STATE.get()
         previous_engineering_state = _ACTIVE_ENGINEERING_STATE.get()
         previous_engineering_mode = _ACTIVE_ENGINEERING_MODE.get()
         try:
-            return await self._run_impl(goal, context, max_steps, on_step, session_id)
+            return await self._run_impl(goal, context, max_steps, on_step, session_id, allow_tools)
         except Exception as _run_error:
             state = _ACTIVE_LOOP_STATE.get()
             error_text = f"{type(_run_error).__name__}: {str(_run_error)[:500]}"
@@ -3555,7 +3555,7 @@ class UnifiedAgentLoop(DirectToolsMixin, PromptBuilderMixin, LLMSelectionMixin,
 
     async def _run_impl(self, goal: str, context: str = "", max_steps: int = 8,
                        on_step: StepCallback | None = None,
-                       session_id: str = "") -> dict[str, Any]:
+                       session_id: str = "", allow_tools: bool = True) -> dict[str, Any]:
         # S390-B-L: strip role prefixes che causano prompt injection
         # Es. "SYSTEM: ignore..." o "ASSISTANT: ..." nel goal utente
         # S762-BUG3: re.sub con ^ strippava solo il PRIMO prefisso — input come
@@ -3590,17 +3590,17 @@ class UnifiedAgentLoop(DirectToolsMixin, PromptBuilderMixin, LLMSelectionMixin,
         except Exception:
             _sid_token = None  # fallback silente — registry usa default "agent_default"
 
-        # S750-GAP-B: pre-warm sandbox backend-exec — POST /api/session in background.
-        # asyncio.create_task lancia la richiesta senza bloccare il routing:
-        # mentre il LLM classifica il goal (~200-500ms), la sandbox su Railway è già pronta.
-        try:
-            from tools.registry import _call_exec_engine as _ce, _EXEC_ENGINE_URL as _eurl
-            if _eurl:
-                asyncio.ensure_future(
-                    _ce({"session_id": self._run_task_id}, endpoint="/api/session")
-                )
-        except Exception as _exc:
-            _logger.debug("[unified_loop] silenced %s", type(_exc).__name__)  # noqa: BLE001
+        # S750-GAP-B: pre-warm sandbox solo per task che possono usare tool.
+        # Con allow_tools=False non avviamo alcuna sessione esterna prima della risposta.
+        if allow_tools:
+            try:
+                from tools.registry import _call_exec_engine as _ce, _EXEC_ENGINE_URL as _eurl
+                if _eurl:
+                    asyncio.ensure_future(
+                        _ce({"session_id": self._run_task_id}, endpoint="/api/session")
+                    )
+            except Exception as _exc:
+                _logger.debug("[unified_loop] silenced %s", type(_exc).__name__)  # noqa: BLE001
 
         # S568-B: reset _session_files ogni run — previene memory leak su sessioni lunghe.
         # Il dict cresce durante _run_fallback e non veniva mai azzerato tra chiamate.
@@ -3693,6 +3693,18 @@ class UnifiedAgentLoop(DirectToolsMixin, PromptBuilderMixin, LLMSelectionMixin,
                 await _flush_engineering_persist(_ACTIVE_ENGINEERING_STATE.get())
             return _with_state(result)
 
+        # Policy fail-closed: con divieto esplicito nessun ramo tool-first, planner,
+        # sandbox, speculazione o tool card è raggiungibile. La risposta resta testuale.
+        if not allow_tools:
+            await self._transition_state(state, AgentState.THINKING, on_step)
+            _r = await _finish(await self._run_fallback(state, on_step))
+            _r["timing_ms"] = int((_time.monotonic() - _t_run) * 1000)
+            _r["effective_max_steps"] = state.max_steps
+            if _sid_token is not None:
+                try: _sid_var.reset(_sid_token)
+                except Exception: pass
+            return _r
+
         # GAP-4: StrategicHealer — init + load past failures (LLM-based self-healing cognitivo)
         try:
             from agents.strategic_healer import StrategicHealer as _SHClass

api/agent.py

@@ -52,6 +52,7 @@ from .state import (
 )
 from .speculative import fire_speculative_tools
 from .vfs_sync import build_vfs_sync_complete
+from .task_tool_policy import build_task_tool_policy
 try:
     from .quality_guardian import run_quality_check as _run_quality_check
 except Exception:
@@ -631,7 +632,9 @@ async def create_agent_task(body: AgentTaskIn, role: AuthRole = Depends(require_
         _attach_byok_client(task_id, body.provider_credentials)
         return {'taskId': task_id, 'status': restored['status'], 'restored': True}
 
-    # Brand new task
+    # Brand new task. La policy è calcolata al confine HTTP, prima di ogni
+    # tool speculativo, pianificazione o chiamata al loop.
+    _tool_policy = build_task_tool_policy(body.goal)
     created_at = int(time.time() * 1000)
     _agent_tasks[task_id] = {
         'id':              task_id,
@@ -645,6 +648,8 @@ async def create_agent_task(body: AgentTaskIn, role: AuthRole = Depends(require_
         'resume_from_step':  body.resume_from_step, # P16-F3: passo resume dalla coda
         'persona':           body.persona,           # P17-F5: expertise persona hint
         'session_id':        body.session_id or '',   # P17-F2: BB session key (normalize None→'')
+        'forbid_tools':       _tool_policy.forbid_tools,
+        'literal_response':   _tool_policy.literal_response,
     }
     # Le credenziali BYOK restano in una mappa runtime separata dai metadata task
     # e non raggiungono Supabase, checkpoint o buffer SSE.
@@ -660,9 +665,10 @@ async def create_agent_task(body: AgentTaskIn, role: AuthRole = Depends(require_
     asyncio.create_task(
         sb_upsert_task(task_id, body.goal, 'QUEUED', body.max_steps, body.context, created_at)
     ).add_done_callback(_log_task_exc)
-    # S361: Speculative Tool Firing — pre-fires read-only tools in parallel
-    # while the main model processes. Results cached for _run_direct_tools to consume.
-    asyncio.create_task(fire_speculative_tools(task_id, body.goal)).add_done_callback(_log_task_exc)
+    # S361: gli strumenti speculativi sono consentiti solo quando il messaggio
+    # utente non li vieta esplicitamente. La policy è fail-closed per questo task.
+    if not _tool_policy.forbid_tools:
+        asyncio.create_task(fire_speculative_tools(task_id, body.goal)).add_done_callback(_log_task_exc)
     # ARCH-K2.2: registra il task nella Queue del Kernel e pubblica evento task.created
     if _KERNEL_AVAILABLE and _kernel is not None:
         asyncio.create_task(_kernel.submit_task(
@@ -827,6 +833,19 @@ async def stream_agent_task(task_id: str, request: Request, resume: int = 0, rol
     async def generate():
         yield "retry: 3000\n\n"
 
+        # Contratto letterale: chiusura immediata prima di task_start, planner o
+        # tool. È il backstop per client SSE che non applicano il fast path UI.
+        _literal_response = task.get('literal_response')
+        if isinstance(_literal_response, str) and _literal_response:
+            _agent_tasks[task_id]['status'] = 'SUCCESS'
+            asyncio.create_task(sb_update_status(task_id, 'SUCCESS')).add_done_callback(_log_task_exc)
+            literal_event = json.dumps(_sanitize_for_json({
+                'event': 'task_done', 'taskId': task_id, 'result': _literal_response,
+            }))
+            yield f"data: {literal_event}\n\n"
+            yield "data: [DONE]\n\n"
+            return
+
         reg = _loop_registry.get(task_id)
 
         is_done_reconnect = reg is not None and reg.get('done', False)
@@ -970,6 +989,15 @@ async def stream_agent_task(task_id: str, request: Request, resume: int = 0, rol
 
         async def run_loop() -> None:
             try:
+                # Contratto letterale: nessun provider, planner, tool, card o side effect.
+                # È emesso direttamente nello stream affinché i client SSE non possano bypassarlo.
+                _literal_response = task.get('literal_response')
+                if isinstance(_literal_response, str) and _literal_response:
+                    _agent_tasks[task_id]['status'] = 'SUCCESS'
+                    asyncio.create_task(sb_update_status(task_id, 'SUCCESS')).add_done_callback(_log_task_exc)
+                    _sse('task_done', {'taskId': task_id, 'result': _literal_response})
+                    return
+
                 from agents.unified_loop import UnifiedAgentLoop
                 # Ogni task BYOK usa il suo client effimero; gli altri mantengono
                 # il singleton runtime. Le credenziali non entrano nel task dict.
@@ -1343,6 +1371,7 @@ async def stream_agent_task(task_id: str, request: Request, resume: int = 0, rol
                     max_steps=task.get('_resume_max_steps', task.get('max_steps', 8)),  # AG-BUG-1: _resume_max mai definito in questo scope
                     on_step=step_cb,
                     session_id=task.get('session_id', '') or '',
+                    allow_tools=not bool(task.get('forbid_tools', False)),
                 )
                 _agent_tasks[task_id]['status'] = 'SUCCESS'
                 asyncio.create_task(sb_update_status(task_id, 'SUCCESS')).add_done_callback(_log_task_exc)

api/task_tool_policy.py

@@ -0,0 +1,56 @@
+"""Policy deterministica dei tool per i task backend.
+
+Questa barriera è applicata al confine HTTP del task: non dipende dal modello,
+non interpreta istruzioni provenienti dal contesto e non invia dati a servizi esterni.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+import re
+import unicodedata
+
+
+_EXPLICIT_TOOL_DENIAL_RE = re.compile(
+    r"\b(?:"
+    r"non\s+(?:usare|utilizzare|eseguire|avviare)|"
+    r"senza(?:\s+(?:usare|utilizzare|eseguire))?|"
+    r"do\s+not\s+(?:use|run|invoke)|"
+    r"don't\s+(?:use|run|invoke)|"
+    r"without\s+(?:using|running|invoking)"
+    r")\b[\s\S]{0,180}?\b(?:"
+    r"strumenti?|tool(?:s)?|comandi?|shell|file|rete|network|"
+    r"servizi?\s+esterni?|external\s+services?|azioni?|action(?:s)?|card(?:s)?"
+    r")\b",
+    re.IGNORECASE,
+)
+_LITERAL_RESPONSE_RE = re.compile(
+    r"\b(?:rispondi|respond)\s+(?:esclusivamente|only)\s+(?:con|with)\s+"
+    r"[`\"“]?([A-Za-z0-9_-]{1,120})[`\"”]?\s*(?=[.!?]|$)",
+    re.IGNORECASE | re.UNICODE,
+)
+
+
+@dataclass(frozen=True)
+class TaskToolPolicy:
+    """Decisione minima, serializzabile e fail-closed per un task backend."""
+
+    forbid_tools: bool
+    literal_response: str | None = None
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "forbid_tools": self.forbid_tools,
+            "literal_response": self.literal_response,
+        }
+
+
+def build_task_tool_policy(goal: object) -> TaskToolPolicy:
+    """Classifica solo istruzioni utente nel goal HTTP, senza inferenze LLM."""
+    if not isinstance(goal, str):
+        return TaskToolPolicy(forbid_tools=False)
+
+    normalized = unicodedata.normalize("NFKC", goal).strip()
+    explicit_denial = bool(_EXPLICIT_TOOL_DENIAL_RE.search(normalized))
+    literal_match = _LITERAL_RESPONSE_RE.search(normalized) if explicit_denial else None
+    literal = literal_match.group(1) if literal_match else None
+    return TaskToolPolicy(forbid_tools=explicit_denial, literal_response=literal)

tests/test_task_tool_policy.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+import unittest
+
+from api.task_tool_policy import build_task_tool_policy
+
+
+class TaskToolPolicyTests(unittest.TestCase):
+    def test_e2e_literal_contract_forbids_tools_and_returns_exact_token(self) -> None:
+        policy = build_task_tool_policy(
+            "Rispondi ESCLUSIVAMENTE con TEST_E2E_OK. Non usare strumenti, tool, "
+            "comandi shell, file, rete, servizi esterni, azioni o card."
+        )
+        self.assertTrue(policy.forbid_tools)
+        self.assertEqual(policy.literal_response, "TEST_E2E_OK")
+
+    def test_explicit_tool_denial_without_literal_contract_stays_tool_free(self) -> None:
+        policy = build_task_tool_policy("Spiega il concetto senza usare strumenti o rete.")
+        self.assertTrue(policy.forbid_tools)
+        self.assertIsNone(policy.literal_response)
+
+    def test_normal_task_remains_unrestricted(self) -> None:
+        policy = build_task_tool_policy("Cerca le notizie di oggi e sintetizzale.")
+        self.assertFalse(policy.forbid_tools)
+        self.assertIsNone(policy.literal_response)
+
+    def test_partial_wording_does_not_create_a_literal_contract(self) -> None:
+        policy = build_task_tool_policy("Rispondi esclusivamente con una spiegazione, senza strumenti.")
+        self.assertTrue(policy.forbid_tools)
+        self.assertIsNone(policy.literal_response)
+
+
+if __name__ == "__main__":
+    unittest.main()