feat(tools): add_company_scope 默认绑定由 worker 改为 planner

- WorkerTools 移除 add_company_scope，PlannerTools 新增
- 新库 seed 默认绑定变为 mainagent/planner/auto
- 老库加一次性迁移 seedCompanyScopeRebind：加 planner、去 worker

agent/tools.go

@@ -1947,6 +1947,8 @@ func (t *ToolSet) PlannerTools() []actool.CoreTool {
 		t.addFinding(),
 		// list_companies：查看企业列表 + scope + 资产数（拿 company_id / 理解归属范围）。
 		t.listCompanies(),
+		// add_company_scope：规划时可把域名/IP/CIDR/ICP/关键词纳入某公司的资产范围（自动认领命中资产）。
+		t.addCompanyScope(),
 		// add_task_scope：主动把整根域/整公司/某子域/IP 纳入本任务测试范围(覆盖度分母)。
 		t.addTaskScope(),
 		// list_untested_assets：按需查本任务范围内未测资产(类型+分页)，自行决定补测。

agent/tools_insert.go

@@ -614,8 +614,9 @@ func (t *ToolSet) WorkerTools() []actool.CoreTool {
 		t.addFinding(), t.recordFact(),
 		// cross-work retrieval
 		t.searchAllWorkerTraces(), t.listWorkerTraces(), t.getWorkerTrace(),
-		// asset management (handlers guard nil store internally)
-		t.insertAssets(), t.addCompanyScope(), t.listAssets(), t.listCompanies(),
+		// asset management (handlers guard nil store internally)。
+		// add_company_scope 不给 worker：定义企业资产范围属规划/主控/Auto 的职责，worker 只执行探索。
+		t.insertAssets(), t.listAssets(), t.listCompanies(),
 	}
 }
 

server/orchestration.go

@@ -448,6 +448,7 @@ func (s *Server) seedOrchestrationTools() {
 	s.refreshBuiltinToolSchemas()
 	s.seedAutoDefaultBindings()
 	s.seedPlannerDefaultBindings()
+	s.seedCompanyScopeRebind()
 	s.seedAutoReportFindingBinding()
 	s.unbindGoalMetDefault()
 	s.reseedGoalsPrompt()     // goals 提示词加入「抽操作约束」步 → 旧库追加一版新默认(一次性)
@@ -718,6 +719,28 @@ func (s *Server) seedPlannerDefaultBindings() {
 	_ = s.m.pg.SetSetting(flag, "true")
 }
 
+// seedCompanyScopeRebind changes add_company_scope's default binding ONCE on
+// existing DBs (guarded by a settings flag): the tool moves off worker and onto
+// planner — defining a company's asset scope is a planning/main/auto concern, not
+// something a worker does mid-exploration. Fresh DBs already get planner via
+// PlannerTools() and lack worker via WorkerTools(); this only backfills old rows.
+// One-shot + flag-guarded so a user who later re-binds worker isn't overridden.
+func (s *Server) seedCompanyScopeRebind() {
+	const flag = "company_scope_rebind_v1" // worker→planner 默认绑定切换
+	if v, _, _ := s.m.pg.GetSetting(flag); v == "true" {
+		return
+	}
+	if err := s.m.pg.AddAgentToToolBinding("planner", []string{"add_company_scope"}); err != nil {
+		log.Printf("[planner] add_company_scope 默认绑定失败: %v", err)
+		return
+	}
+	if err := s.m.pg.RemoveAgentFromTool("worker", "add_company_scope"); err != nil {
+		log.Printf("[worker] add_company_scope 解绑失败: %v", err)
+		return
+	}
+	_ = s.m.pg.SetSetting(flag, "true")
+}
+
 // seedAutoDefaultBindings adds "auto" to the task-op + platform tools' bindings
 // ONCE (guarded by a settings flag), so existing DBs whose tool rows were seeded
 // before Auto existed still give Auto its default toolset — without re-adding it