同步

agent/capture_usage_test.go

@@ -0,0 +1,101 @@
+package agent
+
+import (
+	"context"
+	"errors"
+	"iter"
+	"testing"
+
+	"github.com/Autumn-27/artex/db"
+	"github.com/Autumn-27/norma/agentcore"
+	"github.com/Autumn-27/norma/llm"
+)
+
+type captureUsageProvider struct {
+	stream func(context.Context, func(llm.StreamEvent, error) bool)
+}
+
+func (p captureUsageProvider) Stream(ctx context.Context, _ llm.CompletionRequest) iter.Seq2[llm.StreamEvent, error] {
+	return func(yield func(llm.StreamEvent, error) bool) { p.stream(ctx, yield) }
+}
+
+func TestCaptureRunPersistsUsageOnProviderFailure(t *testing.T) {
+	wantErr := errors.New("provider failed after reporting usage")
+	provider := captureUsageProvider{stream: func(_ context.Context, yield func(llm.StreamEvent, error) bool) {
+		// 遵守迭代器协议:yield 返回 false 后立即停止,不再调用它。
+		if !yield(llm.StreamEvent{Type: llm.SEMessageStart, Usage: llm.Usage{InputTokens: 11, CacheReadTokens: 3}}, nil) {
+			return
+		}
+		if !yield(llm.StreamEvent{Type: llm.SETextDelta, Text: "partial"}, nil) {
+			return
+		}
+		if !yield(llm.StreamEvent{Type: llm.SEMessageDelta, Usage: llm.Usage{OutputTokens: 7, CacheWriteTokens: 2}}, nil) {
+			return
+		}
+		yield(llm.StreamEvent{}, wantErr)
+	}}
+
+	var activities []db.Activity
+	_, _, err := captureRun(context.Background(), agentcore.Options{Provider: provider, MaxTurns: 1}, "test", func(a db.Activity) {
+		activities = append(activities, a)
+	})
+	if !errors.Is(err, wantErr) {
+		t.Fatalf("captureRun error=%v, want %v", err, wantErr)
+	}
+	assertCapturedResultUsage(t, activities, 11, 7, 3, 2)
+}
+
+func TestCaptureRunPersistsUsageOnCancellation(t *testing.T) {
+	started := make(chan struct{})
+	provider := captureUsageProvider{stream: func(ctx context.Context, yield func(llm.StreamEvent, error) bool) {
+		// 遵守迭代器协议:yield 返回 false 后立即停止,不再调用它。
+		if !yield(llm.StreamEvent{Type: llm.SEMessageStart, Usage: llm.Usage{InputTokens: 13, CacheReadTokens: 5}}, nil) {
+			return
+		}
+		if !yield(llm.StreamEvent{Type: llm.SETextDelta, Text: "partial"}, nil) {
+			return
+		}
+		if !yield(llm.StreamEvent{Type: llm.SEMessageDelta, Usage: llm.Usage{OutputTokens: 9, CacheWriteTokens: 4}}, nil) {
+			return
+		}
+		close(started)
+		<-ctx.Done()
+		yield(llm.StreamEvent{}, ctx.Err())
+	}}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	var activities []db.Activity
+	done := make(chan error, 1)
+	go func() {
+		_, _, err := captureRun(ctx, agentcore.Options{Provider: provider, MaxTurns: 1}, "test", func(a db.Activity) {
+			activities = append(activities, a)
+		})
+		done <- err
+	}()
+	<-started
+	cancel()
+	if err := <-done; !errors.Is(err, context.Canceled) {
+		t.Fatalf("captureRun error=%v, want context canceled", err)
+	}
+	assertCapturedResultUsage(t, activities, 13, 9, 5, 4)
+}
+
+func assertCapturedResultUsage(t *testing.T, activities []db.Activity, input, output, read, write int) {
+	t.Helper()
+	results := 0
+	for _, activity := range activities {
+		if activity.Kind != "result" {
+			continue
+		}
+		results++
+		if activity.InputTokens == nil || *activity.InputTokens != input ||
+			activity.OutputTokens == nil || *activity.OutputTokens != output ||
+			activity.CacheReadTokens == nil || *activity.CacheReadTokens != read ||
+			activity.CacheWriteTokens == nil || *activity.CacheWriteTokens != write {
+			t.Fatalf("result usage=%+v, want input=%d output=%d read=%d write=%d", activity, input, output, read, write)
+		}
+	}
+	if results != 1 {
+		t.Fatalf("result activity count=%d, activities=%+v", results, activities)
+	}
+}

agent/constraints.go

@@ -0,0 +1,49 @@
+package agent
+
+import (
+	"strings"
+
+	"github.com/Autumn-27/artex/db"
+)
+
+// constraintBlock renders this task's operation constraints (task_constraints) as a
+// high-priority block appended to the planner/worker system prompt. allow/deny are
+// grouped; empty string when there are no constraints (or ts is nil). The framing
+// deliberately puts these ABOVE the exploration/expansion heuristics so a declared
+// boundary wins the tug-of-war against "chase another entry surface".
+func constraintBlock(ts *db.ExplorationStore) string {
+	if ts == nil {
+		return ""
+	}
+	rows, err := ts.ListConstraints()
+	if err != nil || len(rows) == 0 {
+		return ""
+	}
+	var allow, deny []string
+	for _, c := range rows {
+		text := strings.TrimSpace(c.Text)
+		if text == "" {
+			continue
+		}
+		if c.Kind == "allow" {
+			allow = append(allow, "- "+text)
+		} else {
+			deny = append(deny, "- "+text)
+		}
+	}
+	if len(allow) == 0 && len(deny) == 0 {
+		return ""
+	}
+	var b strings.Builder
+	b.WriteString("\n\n【操作约束（最高优先级，凌驾于下方一切探索/拓面启发式；每生成一条意图、每执行一个动作前都必须先自检是否违反，违反即不得进行）】：")
+	if len(allow) > 0 {
+		b.WriteString("\n允许的操作：\n")
+		b.WriteString(strings.Join(allow, "\n"))
+	}
+	if len(deny) > 0 {
+		b.WriteString("\n禁止的操作：\n")
+		b.WriteString(strings.Join(deny, "\n"))
+	}
+	b.WriteString("\n（发现约束之外的新目标/新端口/新主机，不等于获得授权：除非它落在上述允许范围内，否则记为 out-of-scope 事实并跳过，不得为其派生意图或执行动作。）")
+	return b.String()
+}

agent/coverage_params_test.go

@@ -0,0 +1,46 @@
+package agent
+
+import (
+	"testing"
+
+	actool "github.com/Autumn-27/norma/tool"
+)
+
+// hasRelatedParam reports whether insert_assets' schema still advertises the
+// per-item `related` parameter (properties.assets.items.properties.related).
+func hasRelatedParam(tool actool.CoreTool) bool {
+	props, ok := nestedMap(tool.InputSchema(), "properties", "assets", "items", "properties")
+	if !ok {
+		return false
+	}
+	_, ok = props["related"]
+	return ok
+}
+
+// TestStripCoverageParams verifies the insert_assets `related` param is visible
+// while coverage is on and hidden once it's off, and that stripping never mutates
+// the original tool's schema (deep copy).
+func TestStripCoverageParams(t *testing.T) {
+	ts := NewToolSet(nil, "")
+	insert := ts.insertAssets()
+	if !hasRelatedParam(insert) {
+		t.Fatal("insert_assets 应默认带 related 参数")
+	}
+
+	// Enabled (default): schema unchanged, related still present.
+	ts.SetCoverageEnabled(true)
+	if got := ts.StripCoverageParams([]actool.CoreTool{insert}); !hasRelatedParam(got[0]) {
+		t.Error("覆盖度开启时不应剔除 related 参数")
+	}
+
+	// Disabled: related stripped from the model-facing schema.
+	ts.SetCoverageEnabled(false)
+	out := ts.StripCoverageParams([]actool.CoreTool{insert})
+	if hasRelatedParam(out[0]) {
+		t.Error("覆盖度关闭时应隐藏 related 参数")
+	}
+	// The original tool must be untouched (deep copy, no shared-map mutation).
+	if !hasRelatedParam(insert) {
+		t.Error("StripCoverageParams 不应修改原始 tool 的 schema")
+	}
+}

agent/goals.go

@@ -15,6 +15,17 @@ import (
 // prompt, seeded into agent_prompts. No template vars are used today.
 const goalsDefaultTmpl = `你是渗透测试目标分解器。你的职责是从用户输入中识别出**最终要达成的结果**，而不是规划攻击步骤。
 
+**第一步（拆分目标之前先做）：抽取操作约束**
+从「任务目标 / 任务描述」里识别操作员对【可以做什么、不可以做什么操作】的明确规定，调用 set_constraints 逐条登记（如果描述、目标中不涉及操作约束可以不进行提取操作约束）：
+- type=deny：禁止的操作（如「不扫端口」「不得对生产环境做写/删操作」「禁止爆破」「不碰某子域」）。
+- type=allow：明确允许/限定的操作范围（如「只允许被动侦察」「仅针对某域名」）。
+- 约束 ≠ 目标，也 ≠ 攻击步骤：它是对操作行为边界的规定。
+- **约束必须【自包含、写死具体目标】**：把「当前目标/当前端口/当前IP/当前域名/本站」这类**指代词**替换成任务目标/描述里的**具体值**。约束会被单独注入到执行阶段的提示里，脱离上下文后指代词无法判断指谁。
+  例：目标是 https://abc.example.net → 写「只允许测试 abc.example.net」而不是「只允许测试当前目标」；「仅测目标端口 443，不扫其他端口」而不是「只测当前端口」。若原文只说「当前目标」但目标地址已明确，就把地址填进去。
+- **只登记目标/描述里【明确写出或强调】的约束，严禁臆造**；拿不准类型时用 deny（更保守）。
+- 若目标/描述里确实没有任何操作约束，则**不要**调用 set_constraints。
+登记完约束（如有）后，再进行下面的目标拆分。
+
 **目标 = 最终可交付/可核验的结果**
 
 **不是目标的内容（禁止列为子目标）**：
@@ -90,7 +101,9 @@ func DecomposeGoals(ctx context.Context, c Config, dataDir, goalText, desc strin
 	// {{.EngagementDescription}} template var — else a prompt that references the var
 	// would inject the description twice. System prompt stays pure static instructions.
 	sys := renderSystem("goals", goalsDefaultTmpl, GoalsVars{DataDir: dataDir, Now: nowStr()})
-	tools := []actool.CoreTool{tsx.setGoals()}
+	// set_constraints 始终可用(不依赖 asset store):正文已含「先抽操作约束再拆目标」这步
+	// (可在 agent 编辑页改措辞),这里只需接上工具。
+	tools := []actool.CoreTool{tsx.setGoals(), tsx.setConstraints()}
 	// Wire add_task_scope only when we have a real asset store + task to write to.
 	// The scope-extraction tail is appended in lockstep so the prompt never asks for
 	// a tool that isn't present.
@@ -116,7 +129,8 @@ func DecomposeGoals(ctx context.Context, c Config, dataDir, goalText, desc strin
 		Tools:                  tools,
 		PermissionMode:         acperm.ModeBypass,
 		DisableBackgroundTasks: true,
-		MaxTurns:               6,
+		// 3 步(抽约束 → 登记范围 → 拆目标)各需一次工具调用,给足回合避免收尾前漏调 set_goals。
+		MaxTurns: 8,
 	}, userMsg, captureEmit)
 	// set_goals persisted the goals directly; read them back so the caller sees what
 	// was written (empty slice ⇒ the LLM produced nothing ⇒ caller falls back).

agent/mainagent.go

@@ -26,6 +26,7 @@ type MainAgent struct {
 	proxyCACert string            // recording proxy's CA cert path (HTTPS verify)
 	webSearch   WebSearchOpts     // web_search tool backend selection (off by default)
 	workDir     string            // shared work dir (surfaced in prompt as artifact-output target)
+	steerWork   func(intentID int64, msg string) error // engine callback: steer a running work (nil = off)
 }
 
 func NewMainAgent(prov llm.Provider, model, workDir string, tx *transcript.Store, window, maxTurns int) *MainAgent {
@@ -39,6 +40,10 @@ func (m *MainAgent) SetProxy(addr, caCert string) { m.proxyAddr, m.proxyCACert =
 // SetWebSearch selects the web_search backend for the main agent (off by default).
 func (m *MainAgent) SetWebSearch(o WebSearchOpts) { m.webSearch = o }
 
+// SetSteerWork wires the engine callback that lets the main agent's steer_work
+// tool inject a mid-run course-correction into a running work (nil = tool off).
+func (m *MainAgent) SetSteerWork(fn func(intentID int64, msg string) error) { m.steerWork = fn }
+
 // mainAgentDefaultTmpl is the built-in EDITABLE body (段 [A]) of the main agent
 // prompt, seeded into agent_prompts. Goal is a {{.Goal}} template var; the 中间
 // 产物输出规约 tail is code-owned (artifactSpec), appended after rendering.
@@ -48,7 +53,9 @@ const mainAgentDefaultTmpl = `你是一个授权渗透测试系统的"主 agent"
 2. 操舵（把人的意图落到系统）：
    - 人想"改方向/强调某类漏洞/重点某区域" → 用 add_hint 写提示（规划者下次会读到）。
    - 人想"立刻测某个具体目标" → 用 add_intent 直接注入一条高优先级意图（priority 8-10）。
+   - 人想"对某条正在运行的意图(work)实时纠偏（别再走 X、聚焦 Y）" → 用 steer_work（不打断、不丢已有进展，worker 下一步动作前生效）；先用 get_worker_output 看它在干嘛。方向整个错了则改用 add_intent 另下新意图。
    - 人想"新增一个要达成的最终目标" → 用 set_goals 增补目标。系统会把该目标写入任务图并**自动把已完成/暂停的任务拉回运行态继续跑**（规划者随后会据此重新判断是否达成），无需人工再点恢复。
+   - 人想"增/改测试约束（允许/禁止某类操作，如『仅测当前端口』『禁止爆破』『只做被动侦察』）" → 用 set_constraints 登记（type=allow 允许 / type=deny 禁止）。约束会在下一轮规划时注入 planner/worker 的提示词以框定探索边界；也可在总览「约束管理」里增删改。
 3. 用人话简洁回复，说明你做了什么。
 
 当前任务目标：{{.Goal}}
@@ -70,12 +77,25 @@ func (m *MainAgent) Chat(ctx context.Context, taskID int64, as *db.AssetStore, t
 		tsx.SetAssetStore(as, as.Companies())
 	}
 	tsx.SetTaskID(taskID)
+<<<<<<< Updated upstream
 	tsx.SetNotify(notify)          // add_hint wakes this task's planner (debounced)
 	tsx.SetResumeTask(resume)      // set_goals 新增目标 → 把已完成/暂停的任务拉回 running
 	tsx.SetNotifyGoal(notifyGoal)  // set_goals 新增目标 → 给 planner 记一条「人新增了目标：…」触发
 	// 领域工具 + 基础默认工具集（Read/Write/Edit/MultiEdit/LS/Glob/Grep/Bash）
 	base := append(tsx.MainAgentTools(), actool.DefaultTools()...)
+=======
+	tsx.SetCoverageEnabled(as == nil || as.CoverageEnabled(taskID))
+	tsx.SetNotify(notify)         // add_hint wakes this task's planner (debounced)
+	tsx.SetResumeTask(resume)     // set_goals 新增目标 → 把已完成/暂停的任务拉回 running
+	tsx.SetNotifyGoal(notifyGoal) // set_goals 新增目标 → 给 planner 记一条「人新增了目标：…」触发
+	tsx.steerWork = m.steerWork   // enable steer_work tool (nil = unavailable)
+	// 领域工具 + 基础默认工具集（Read/Write/Edit/MultiEdit/LS/Glob/Grep/Bash）
+	// 资产覆盖度功能关闭时剔除 add_task_scope/list_untested_assets（不入 prompt）。
+	base := append(tsx.DropCoverageTools(tsx.MainAgentTools()), actool.DefaultTools()...)
+	ctx = WithRunInfo(ctx, RunInfo{TaskID: taskID, ExplorationID: explorationID(ts)})
+>>>>>>> Stashed changes
 	tools, def, cleanup := AugmentTools(ctx, "mainagent", base)
+	tools = tsx.StripCoverageParams(tools) // 覆盖度关闭时隐藏 insert_assets 的 related 入参
 	defer cleanup()
 	// 本任务的工作目录 <workDir>/tasks/<taskID>，先建好。
 	mainDir := ensureRunDir(m.workDir, taskID, 0)

agent/planner.go

@@ -31,6 +31,7 @@ type Planner struct {
 	proxyCACert string                                 // recording proxy's CA cert path (HTTPS verify)
 	webSearch   WebSearchOpts                          // web_search tool backend selection (off by default)
 	workDir     string                                 // shared work dir (surfaced in prompt as artifact-output target)
+	injectConstraints func() bool                      // resolver: inject task operation constraints into system prompt? (nil = yes)
 
 	// todos keeps ONE plan-scratchpad per task (keyed by exploration id) so the
 	// planner's multi-step plan survives across wake-ups — each Plan() is a fresh
@@ -51,6 +52,14 @@ func (p *Planner) SetProxy(addr, caCert string) { p.proxyAddr, p.proxyCACert = a
 // SetWebSearch selects the web_search backend for the planner (off by default).
 func (p *Planner) SetWebSearch(o WebSearchOpts) { p.webSearch = o }
 
+// SetConstraintInject wires a resolver deciding whether this task's operation
+// constraints get injected into the planner system prompt. Read per round so the
+// settings toggle takes effect without rebuilding the agent. nil = inject (default).
+func (p *Planner) SetConstraintInject(fn func() bool) { p.injectConstraints = fn }
+
+// wantConstraints reports whether constraint injection is enabled (default yes).
+func (p *Planner) wantConstraints() bool { return p.injectConstraints == nil || p.injectConstraints() }
+
 // todoFor returns the task's persistent planning todo store, creating it on first
 // use. Shared across all of this task's planner wake-ups.
 func (p *Planner) todoFor(expID int64) *actool.TodoStore {
@@ -94,15 +103,29 @@ func renderPlannerTodos(items []actool.Todo) string {
 // TriggerEvent describes what concretely caused this planning round to fire, so
 // the planner looks first at the actual change instead of re-scanning the whole
 // overview. Kind:
+<<<<<<< Updated upstream
 //   "done"    — a worker finished intent IntentID (its output conclusion is fetched).
 //   "finding" — a worker reported a finding on intent IntentID (Detail = 摘要).
 //   "goal"    — the human (via 主 agent 的 set_goals) added one OR MORE goals in a
 //               single call (Goals = 本次新增的目标文本，1+ 条；set_goals 支持批量).
+=======
+//
+//	"done"    — a worker finished intent IntentID (its output conclusion is fetched).
+//	"finding" — a worker reported a finding on intent IntentID (Detail = 摘要).
+//	"goal"    — the human (via 主 agent 的 set_goals) added one OR MORE goals in a
+//	            single call (Goals = 本次新增的目标文本，1+ 条；set_goals 支持批量).
+//	"goal_deleted" — the human deleted a goal from 总览的目标管理 (Detail = 被删目标文本).
+//	"goal_edited"  — the human edited a goal from 总览的目标管理 (OldGoal→NewGoal 文本).
+//	"cancelled" — the human deleted intent IntentID (Detail = 删除原因). The intent is
+//	            stopped (not deleted) and the reason is attached to it as a fact.
+>>>>>>> Stashed changes
 type TriggerEvent struct {
 	Kind     string
 	IntentID int64
 	Detail   string
 	Goals    []string // Kind=="goal" 专用：本次 set_goals 新增的目标文本（1 条或多条）
+	OldGoal  string   // Kind=="goal_edited" 专用：修改前的目标文本
+	NewGoal  string   // Kind=="goal_edited" 专用：修改后的目标文本
 }
 
 // renderTriggers spells out the change(s) that fired this round: for a finished
@@ -123,8 +146,14 @@ func renderTriggers(ts *db.ExplorationStore, evs []TriggerEvent) string {
 			} else {
 				b.WriteString(fmt.Sprintf("\n- 人（主 agent）新增了 %d 个目标：%s —— 均为新的待达成目标，请逐一为尚无对应意图的目标补充探索方向。", len(ev.Goals), strings.Join(ev.Goals, "；")))
 			}
+		case "goal_deleted":
+			b.WriteString(fmt.Sprintf("\n- 人删除了该目标：%s —— 该目标已移除，请据此重判剩余目标/方向（不必再为它派意图）。", ev.Detail))
+		case "goal_edited":
+			b.WriteString(fmt.Sprintf("\n- 人修改了目标，由「%s」变为「%s」—— 请据新目标调整探索方向（原方向若已不适用请停派）。", ev.OldGoal, ev.NewGoal))
 		case "finding":
 			b.WriteString(fmt.Sprintf("\n- 意图 #%d（%s）的 worker 报告了一个 finding：%s", ev.IntentID, intentSummary(ts, ev.IntentID), ev.Detail))
+		case "cancelled":
+			b.WriteString(fmt.Sprintf("\n- 意图 #%d 由用户删除，意图内容是：%s、删除原因是：%s。该意图已停止（不再执行），其原因已作为事实挂在该意图上；请据此重新规划。", ev.IntentID, intentSummary(ts, ev.IntentID), ev.Detail))
 		default: // "done"
 			b.WriteString(fmt.Sprintf("\n- 意图 #%d（%s）的 worker 结束，输出结论：%s", ev.IntentID, intentSummary(ts, ev.IntentID), workerOutput(ts, ev.IntentID)))
 		}
@@ -222,7 +251,7 @@ const plannerDefaultTmpl = `你是一个授权渗透测试系统的"规划者"
    - 该方向在 recent_done_intents 里已尝试过（即使没产出）→ **不要原样重试**。把它当作【已封锁路线（blocked）】：仅当出现【材料性的新机理】——新事实、新资产、新参数、或一种明显不同的打法/构造——才重新派，且新意图的 summary 里要写清"这次和上次不同在哪"。**只是换个措辞、或"再试一次说不定行"都不算新机理，禁止重试。** 反之，若某条否定结论是 confidence=inferred 的弱证据、且该方向对目标关键，用【一条复核意图】去证实或推翻它是正当的（这属于新理由）。
    - 仅对【当前完全没有任何意图覆盖的全新方向】生成。
    - 所有已知方向都已被现有意图覆盖 → **不生成任何意图，直接结束本轮。**
-   - **保持路线多样、别过早收敛到一条**：当目标尚未达成时，若现有意图全都挤在【同一条攻击路线/同一类入口】上，而还存在【本质不同】的未覆盖方向（如另一种入口面、另一类资产、另一条利用链），优先补一条那样的分歧方向，而不是在同一条线上再加同义意图。理想状态是让 2–3 条彼此独立、机理不同的路线同时存活（如"从上传链打"与"从认证绕过打"）；只有当某条路线已交出【目标逼近】的证据时，才值得把资源集中过去。判断多样性看方向的实质差异，不看措辞。（这不与"0 意图正常"冲突：只有确存在本质不同且未覆盖的方向才补；空白路线若已被现有意图覆盖，仍旧 0 意图。）
+   - **保持路线多样、别过早收敛到一条**：当目标尚未达成时，若现有意图全都挤在【同一条攻击路线/同一类入口】上，而还存在【本质不同】的未覆盖方向（如另一种入口面、另一类资产、另一条利用链），优先补一条那样的分歧方向，而不是在同一条线上再加同义意图。**但这条【多样性】永远服从于顶部的【操作约束】**：只在不违反约束的前提下才拓展方向——被约束排除的入口面/端口/主机/操作，即使"本质不同"也绝不生成意图。理想状态是让 2–3 条彼此独立、机理不同的路线同时存活（如"从上传链打"与"从认证绕过打"）；只有当某条路线已交出【目标逼近】的证据时，才值得把资源集中过去。判断多样性看方向的实质差异，不看措辞。（这不与"0 意图正常"冲突：只有确存在本质不同且未覆盖的方向才补；空白路线若已被现有意图覆盖，仍旧 0 意图。）
 3.5. **串行利用链：分步派，别一次拆成并行。** 很多利用是一条**强依赖串行链**（如：①→ ② → ③）——后一步依赖前一步的**实际产出**。这种情况：
    - **不要**把 ①②③ 一次性作为多个并行意图下发（下游 worker 拿不到还不存在的前置产出，只会重复/空转）；
    - **用 TodoWrite 把整条链记成待办**（每步一条），然后**本轮只派"前置已满足"的那一步**（通常是第一步）；
@@ -255,13 +284,20 @@ func (p *Planner) Plan(ctx context.Context, taskID int64, as *db.AssetStore, ts
 		tsx.SetAssetStore(as, as.Companies())
 	}
 	tsx.SetTaskID(taskID)
+	tsx.SetCoverageEnabled(as == nil || as.CoverageEnabled(taskID))
 	tsx.killWork = p.killWork   // enable kill_work tool (nil = unavailable)
 	tsx.steerWork = p.steerWork // enable steer_work tool (nil = unavailable)
 	if origin, _ := ts.OriginFactID(); origin > 0 {
 		tsx.SetOwnerNode(origin) // planner-side anchors default to the task root (origin fact)
 	}
 	// 领域工具 + 基础默认工具集（Read/Write/Edit/MultiEdit/LS/Glob/Grep/Bash）
+<<<<<<< Updated upstream
 	base := append(tsx.PlannerTools(), actool.DefaultTools()...)
+=======
+	// 资产覆盖度功能关闭时剔除 add_task_scope/list_untested_assets（不入 prompt）。
+	base := append(tsx.DropCoverageTools(tsx.PlannerTools()), actool.DefaultTools()...)
+	ctx = WithRunInfo(ctx, RunInfo{TaskID: taskID, ExplorationID: explorationID(ts)})
+>>>>>>> Stashed changes
 	tools, def, cleanup := AugmentTools(ctx, "planner", base)
 	defer cleanup()
 	// 关键态势（刚完成的意图 + 预取的完整图）改放【本轮 user 输入】(见下方 input)，system
@@ -277,7 +313,11 @@ func (p *Planner) Plan(ctx context.Context, taskID int64, as *db.AssetStore, ts
 	}
 	// 本任务的工作目录 <workDir>/tasks/<taskID>，先建好。
 	taskDir := ensureRunDir(p.workDir, taskID, 0)
-	system, boundary := deferredSystem(plannerSystem(goal, p.workDir, taskDir), def)
+	sysBody := plannerSystem(goal, p.workDir, taskDir)
+	if p.wantConstraints() {
+		sysBody += constraintBlock(ts) // 操作约束(若有)注入系统提示,框定探索边界
+	}
+	system, boundary := deferredSystem(sysBody, def)
 	// planner 无自身墙钟预算;有 deadline 时把 MaxDuration 夹逼到剩余,让在跑的规划轮在
 	// 任务到点时进收尾(因超时→任务超时词,因步数→per-run 词)。
 	maxDur, clamped := clampMaxDuration(tc.DeadlineUnix, 0)

agent/provider.go

@@ -25,8 +25,9 @@ type Config struct {
 	BaseURL string
 	APIKey  string
 	Model   string
-	// Proxy routes all LLM requests through the given proxy URL (http/https/socks5).
-	// Empty falls back to the standard *_PROXY environment variables.
+	// Proxy routes all LLM requests through the given proxy URL (http/https/socks5,
+	// optionally with user:pass@ credentials). Empty means direct — it does NOT
+	// fall back to the standard *_PROXY environment variables.
 	Proxy string
 	// RatePerSecond / RatePerMinute cap the shared request rate across ALL agents
 	// using the provider (0 = that window unlimited).
@@ -191,6 +192,96 @@ func (c Config) NewProvider() (llm.Provider, error) {
 	return llm.NewProvider(lc)
 }
 
+<<<<<<< Updated upstream
+=======
+// IsQuotaExhaustedMessage deliberately recognizes only explicit balance,
+// billing, credit, or quota-exhaustion signals. Generic 429/rate-limit text,
+// authentication failures, network errors, and server failures are excluded.
+var nonFailoverHTTPStatus = regexp.MustCompile(`(?:status(?:\s+code)?|http(?:\s+status)?)\s*[=:]?\s*(?:401|403|5\d\d)\b`)
+var transientQuotaLimit = regexp.MustCompile(`(?i)(?:\b(?:rpm|tpm|rpd|qps)\b|quota[_\s-]*metric|rate[_\s-]*limit|too many requests|(?:requests?|tokens?)\s+(?:per|/)\s*(?:second|minute)|(?:per|/)\s*(?:second|minute)\s+(?:requests?|tokens?)|generate[_\s-]*requests[_\s-]*per[_\s-]*(?:minute|second)|tokens?[_\s-]*per[_\s-]*(?:minute|second))`)
+
+func IsQuotaExhaustedMessage(message string) bool {
+	message = strings.ToLower(message)
+	// Authentication/authorization and provider-side 5xx failures never rotate,
+	// even when a gateway happens to echo a quota-looking phrase in the body.
+	if nonFailoverHTTPStatus.MatchString(message) {
+		return false
+	}
+	// Provider APIs frequently describe an ordinary rate limit as "quota
+	// exceeded", especially Google-style responses containing a quota metric.
+	// These limits recover with time and must stay on the current provider.
+	if transientQuotaLimit.MatchString(message) {
+		return false
+	}
+	markers := []string{
+		"insufficient_quota", "quota_exceeded", "quota exceeded", "quota exhausted",
+		"exceeded your current quota", "billing_hard_limit_reached",
+		"billing hard limit", "billing_not_active", "credit balance", "insufficient credit",
+		"insufficient balance", "balance is too low", "payment required", "status 402",
+		"余额不足", "额度不足", "额度已用尽", "欠费",
+	}
+	for _, marker := range markers {
+		if strings.Contains(message, marker) {
+			return true
+		}
+	}
+	// gRPC RESOURCE_EXHAUSTED is overloaded for both account quota and ordinary
+	// request-rate limiting. Preserve it as an explicit exhaustion signal only
+	// when the same error does not identify a transient rate limit.
+	return strings.Contains(message, "resource_exhausted") &&
+		!strings.Contains(message, "rate limit") &&
+		!strings.Contains(message, "too many requests")
+}
+
+// quotaAwareTransport preserves Norma's normal retry behavior except for a 429
+// whose body explicitly says the account quota/balance is exhausted. Norma's
+// retry loop treats every 429 as transient; normalizing only that response to
+// 402 lets a task router fail over immediately while retaining the original
+// response body for provider-specific classification and audit logs.
+type quotaAwareTransport struct{ base http.RoundTripper }
+
+func (t quotaAwareTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	resp, err := t.base.RoundTrip(req)
+	if err != nil || resp == nil || resp.StatusCode != http.StatusTooManyRequests {
+		return resp, err
+	}
+	body, readErr := io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+	resp.Body = io.NopCloser(bytes.NewReader(body))
+	resp.ContentLength = int64(len(body))
+	if readErr != nil {
+		return resp, nil
+	}
+	if IsQuotaExhaustedMessage(string(body)) {
+		resp.StatusCode = http.StatusPaymentRequired
+		resp.Status = "402 Payment Required"
+	}
+	return resp, nil
+}
+
+func quotaAwareHTTPClient(proxy string) (*http.Client, error) {
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	proxy = strings.TrimSpace(proxy)
+	if proxy == "" {
+		transport.Proxy = nil // 留空=直连,不回退 HTTP_PROXY/HTTPS_PROXY 环境变量
+	} else {
+		proxyURL, err := url.Parse(proxy)
+		if err != nil {
+			return nil, fmt.Errorf("llm: invalid proxy %q: %w", proxy, err)
+		}
+		switch proxyURL.Scheme {
+		case "http", "https", "socks5":
+		case "":
+			return nil, fmt.Errorf("llm: proxy %q missing scheme (use http://, https:// or socks5://)", proxy)
+		default:
+			return nil, fmt.Errorf("llm: unsupported proxy scheme %q (use http, https or socks5)", proxyURL.Scheme)
+		}
+		transport.Proxy = http.ProxyURL(proxyURL)
+	}
+	return &http.Client{Transport: quotaAwareTransport{base: transport}}, nil
+}
+
+>>>>>>> Stashed changes
 // TestConnection makes a minimal real completion to verify the provider/model/
 // endpoint/key actually work. Returns the round-trip latency.
 func TestConnection(ctx context.Context, c Config) (time.Duration, error) {

agent/toolcatalog.go

@@ -37,9 +37,9 @@ func builtinToolsByAgent() map[string][]actool.CoreTool {
 		"mainagent": ts.MainAgentTools(),
 		"planner":   ts.PlannerTools(),
 		"worker":    ts.WorkerTools(),
-		// goals（目标拆解器）默认绑 set_goals：它靠这个工具把拆出的目标写进图。
-		// 与 mainagent 共用同一受管工具，web 端可改描述/schema、按 agent 勾选。
-		"goals": {ts.setGoals()},
+		// goals（目标拆解器）默认绑 set_goals + set_constraints：靠它们把拆出的目标、
+		// 抽出的操作约束写进库。与 mainagent 共用同一受管工具，web 端可改描述/schema、按 agent 勾选。
+		"goals": {ts.setGoals(), ts.setConstraints()},
 		// auto 默认绑漏洞上报 + 资产管理工具，其他域工具可在 UI 按需勾选。
 		// 新库由此 seed 写入；老库由 seedAutoDefaultBindings 迁移。
 		"auto": {ts.addFinding(), ts.insertAssets(), ts.addCompanyScope(), ts.listAssets(), ts.listCompanies()},

agent/tools.go

@@ -52,6 +52,12 @@ type ToolSet struct {
 	ts     *db.ExplorationStore
 	worker string
 	taskID int64 // PG tasks.id; 0 when unknown (tests / orchestrator cross-task reads)
+	// coverageDisabled mirrors tasks.coverage_enabled=false. Stored inverted so the
+	// zero value (all existing ToolSet constructions) means ENABLED — matching the
+	// DB default (true). When true: graphOverviewData drops the coverage block, the
+	// auto-scope hook (insertAssets) is skipped, and add_task_scope/list_untested_assets
+	// are filtered out of the agent's tool list. The scope field stays regardless.
+	coverageDisabled bool
 	// ownerNode is the exploration node that writes attach to: assets this run
 	// touches get anchored to it as lineage/provenance (NOT visibility — the asset
 	// graph is global and shared). Worker = its claimed intent; planner = begin root.
@@ -146,6 +152,90 @@ func NewToolSet(ts *db.ExplorationStore, worker string) *ToolSet {
 // dual-write to the standalone findings table (which survives task deletion).
 func (t *ToolSet) SetTaskID(id int64) { t.taskID = id }
 
+// SetCoverageEnabled records whether this task has the asset-coverage feature on
+// (default enabled). Passing false makes graphOverviewData omit the coverage block,
+// the insertAssets auto-scope hook a no-op, and CoverageTools reports the two
+// coverage-only tools so callers can drop them from the agent's tool list.
+func (t *ToolSet) SetCoverageEnabled(enabled bool) { t.coverageDisabled = !enabled }
+
+// CoverageDisabled reports whether the coverage feature is off for this task.
+func (t *ToolSet) CoverageDisabled() bool { return t.coverageDisabled }
+
+// coverageOnlyTools are the LLM tools that only make sense when asset coverage is
+// on. When the feature is off they are filtered out of the agent's tool list so
+// they neither pollute the prompt nor let the model build a disabled denominator.
+var coverageOnlyTools = map[string]bool{"add_task_scope": true, "list_untested_assets": true}
+
+// DropCoverageTools returns tools with the coverage-only ones removed when this
+// task has the feature disabled; otherwise it returns tools unchanged.
+func (t *ToolSet) DropCoverageTools(tools []actool.CoreTool) []actool.CoreTool {
+	if !t.coverageDisabled {
+		return tools
+	}
+	out := tools[:0:0]
+	for _, tool := range tools {
+		if coverageOnlyTools[tool.Name()] {
+			continue
+		}
+		out = append(out, tool)
+	}
+	return out
+}
+
+// StripCoverageParams hides coverage-only parameters (currently insert_assets'
+// per-item `related`, which only decides whether an asset enters the coverage
+// denominator) from the model-facing schema when coverage is disabled — the param
+// has no effect then, so showing it just pollutes the prompt. MUST run on the FINAL
+// tool list (after AugmentTools/ToolResolve): the DB tools table is authoritative on
+// schema, so stripping the code schema earlier would be overwritten. No-op when
+// enabled or when the list has no insert_assets. The schema is deep-copied before
+// editing so the shared/DB schema map is never mutated.
+func (t *ToolSet) StripCoverageParams(tools []actool.CoreTool) []actool.CoreTool {
+	if !t.coverageDisabled {
+		return tools
+	}
+	for i, tool := range tools {
+		if tool.Name() != "insert_assets" {
+			continue
+		}
+		schema := deepCopyJSONMap(tool.InputSchema())
+		if props, ok := nestedMap(schema, "properties", "assets", "items", "properties"); ok {
+			delete(props, "related")
+		}
+		tools[i] = DecorateTool(tool, tool.Description(), schema)
+	}
+	return tools
+}
+
+// deepCopyJSONMap returns a JSON round-trip deep copy of a schema map so callers can
+// edit it without touching the original (which may be shared/cached). Falls back to
+// the input on any marshal error (edits then become best-effort no-ops upstream).
+func deepCopyJSONMap(m map[string]any) map[string]any {
+	b, err := json.Marshal(m)
+	if err != nil {
+		return m
+	}
+	var out map[string]any
+	if json.Unmarshal(b, &out) != nil {
+		return m
+	}
+	return out
+}
+
+// nestedMap walks a chain of string keys through nested map[string]any values,
+// returning the final map and whether the whole path resolved to one.
+func nestedMap(m map[string]any, keys ...string) (map[string]any, bool) {
+	cur := m
+	for _, k := range keys {
+		next, ok := cur[k].(map[string]any)
+		if !ok {
+			return nil, false
+		}
+		cur = next
+	}
+	return cur, true
+}
+
 // Cross-task reuse: exported accessors returning the per-task tool logic bound to
 // THIS ToolSet's store. Host-side orchestration tools build a ToolSet for an
 // arbitrary task, then Call these — so cross-task reads/hint reuse the exact
@@ -285,12 +375,286 @@ func (t *ToolSet) graphOverviewData() map[string]any {
 			_ = json.Unmarshal(h.Payload, &p)
 			hsum = append(hsum, map[string]any{"id": h.ID, "state": h.State, "text": p["text"]})
 		}
+<<<<<<< Updated upstream
 		out["hints"] = hsum
 		// lineage from the exploration edges: an intent's parents (what it
 		// derived_from — possibly several facts combined) and its yields (the
 		// facts/findings it produced). factFrom maps a fact → the intent that
 		// produced it. This is the relationship layer the flat lists lacked.
 		edges, _ := t.ts.Edges(5000)
+=======
+	}
+	out["running_intents"] = compactIntents(running, parentsOf, yieldsOf)
+	out["recent_done_intents"] = compactIntents(recentDone, parentsOf, yieldsOf)
+	out["frontier_open"] = len(fr)
+	// findings (confirmed vulns) and facts (worker exploration results) are
+	// now distinct node kinds. recent_facts surfaces fact summaries (esp.
+	// negative results) so the planner sees them in one call; full content
+	// via node_detail(id).
+	vulnNodes, _ := t.ts.ListByKind(db.KindFinding, 1000)
+	factNodes, _ := t.ts.ListByKind(db.KindFact, 1000) // newest first
+	out["findings"] = len(vulnNodes)                   // 确认漏洞数（目标判定看它）
+	out["facts"] = len(factNodes)                      // 探索事实/结论数（含否定结论）
+	recentFacts := make([]map[string]any, 0, 20)
+	for _, n := range factNodes {
+		if len(recentFacts) >= 20 {
+			break
+		}
+		m := compactNode(n)
+		if from := factFrom[n.ID]; from > 0 {
+			m["from_intent"] = from // 本事实由哪个意图产生
+		}
+		// confidence 带进概览：让规划者一眼看出哪条结论只是 inferred（尤其否定结论
+		// 别当铁案）；evidence 较长，留给 node_detail(id)。
+		var fp map[string]any
+		if json.Unmarshal(n.Payload, &fp) == nil {
+			if c, ok := fp["confidence"].(string); ok && c != "" {
+				m["confidence"] = c
+			}
+		}
+		recentFacts = append(recentFacts, m)
+	}
+	out["recent_facts"] = recentFacts // 最近事实的 {id, summary, from_intent, confidence?}，详情/证据用 node_detail(id)
+	// the original task (root) so the planner always has it, not just the
+	// decomposed goals.
+	if description, goal, err := t.ts.Root(); err == nil {
+		out["task"] = map[string]any{"description": description, "goal": goal}
+	}
+	// Direct source tasks are a live, read-only blackboard view. Keep their
+	// summaries in a separate field so their intents never enter this task's
+	// frontier or get mistaken for locally claimable work.
+	out["related_tasks"] = t.relatedTaskOverviews()
+	// coverage：粗略的资产测试覆盖度参考——范围(task_scope)内的资产里，被 fact 碰过的
+	// 占比 + by_type(按类型的 总数/已测)。要看未测的具体资产由 agent 按需调 list_untested_assets 自行判断。仅任务上下文有。
+	// 资产覆盖度功能关闭时(coverageDisabled)：只保留 scope/hosts(范围边界与目标主机的
+	// 感知信息，company 关联经由 scope 在此浮现)，丢弃 denominator/tested/pct/by_type/note
+	// 等覆盖度度量，避免污染上下文、也不诱导已隐藏的 add_task_scope/list_untested_assets。
+	if t.as != nil && t.ts != nil && t.taskID > 0 {
+		{
+			m := map[string]any{}
+			if !t.coverageDisabled {
+				if cov, err := t.as.TaskCoverageWithSources(t.taskID); err == nil {
+					m["denominator"] = cov.Denominator
+					m["tested"] = cov.Tested
+					m["by_type"] = cov.ByType
+					m["note"] = "coverage资产测试覆盖度（包括接口等各种相关资产），粗略估计、仅供参考：包含当前任务与直接关联任务的 scope、事实锚点；关联 scope 只读。容器型资产/大量枚举会让它偏低，勿据此认为已测完；可用 add_task_scope 增补本任务范围、list_untested_assets 看未测资产【通常不调用list_untested_assets，按照任务推进即可】；"
+					if cov.Denominator == 0 {
+						m["pct"] = nil
+						m["status"] = "范围未锚定"
+					} else {
+						m["pct"] = cov.Pct
+					}
+				}
+			}
+			// scope：当前测试范围的根资产（task_scope 原始行），让 agent 知道这个任务到底
+			// 圈定了哪些目标（不是全部测试资产，而是范围边界本身）。覆盖度开关无关，始终提供。
+			if rows, err := t.as.ListTaskScopeWithSources(t.taskID); err == nil && len(rows) > 0 {
+				scope := make([]map[string]any, 0, len(rows))
+				for _, r := range rows {
+					e := map[string]any{"kind": r.Kind, "source": r.Source, "task_id": r.TaskID}
+					if r.TaskID != t.taskID {
+						inheritedMap(e, r.TaskID)
+					}
+					switch {
+					case r.Domain != "":
+						e["value"] = r.Domain
+					case r.Net != "":
+						e["value"] = r.Net
+					case r.CompanyID != nil:
+						e["company_id"] = *r.CompanyID
+						if t.cs != nil {
+							if company, err := t.cs.GetCompany(*r.CompanyID); err == nil && company != nil {
+								e["company_name"] = company.Name
+							}
+							if rules, err := t.cs.GetScope(*r.CompanyID); err == nil {
+								keywords := make([]string, 0)
+								companyScope := make([]map[string]any, 0, len(rules))
+								for _, rule := range rules {
+									value := rule.Raw
+									if value == "" {
+										switch rule.Kind {
+										case "domain":
+											value = rule.Domain
+										case "ip", "cidr":
+											value = rule.Net
+										default:
+											value = rule.Value
+										}
+									}
+									entry := map[string]any{"kind": rule.Kind, "value": value}
+									if rule.Reason != "" {
+										entry["reason"] = rule.Reason
+									}
+									companyScope = append(companyScope, entry)
+									if rule.Kind == "keyword" && rule.Raw != "" {
+										keywords = append(keywords, rule.Raw)
+									}
+								}
+								if len(companyScope) > 0 {
+									e["company_scope"] = companyScope
+								}
+								if len(keywords) > 0 {
+									e["company_keywords"] = keywords
+								}
+							}
+						}
+					}
+					scope = append(scope, e)
+				}
+				m["scope"] = scope
+			}
+			if hosts, err := t.as.HostsByTaskWithSources(t.taskID); err == nil {
+				const hostContextLimit = 500
+				visible := hosts
+				if len(visible) > hostContextLimit {
+					visible = visible[:hostContextLimit]
+				}
+				m["hosts"] = visible
+				m["host_count"] = len(hosts)
+				if len(visible) < len(hosts) {
+					m["hosts_truncated"] = true
+				}
+			}
+			if len(m) > 0 {
+				out["coverage"] = m
+			}
+		}
+	}
+	return out
+}
+
+func inheritedMap(m map[string]any, sourceTaskID int64) map[string]any {
+	m["source_task_id"] = sourceTaskID
+	m["inherited"] = true
+	return m
+}
+
+const (
+	relatedOverviewTotalTextRunes     = 48_000
+	relatedOverviewMaxTextPerSource   = 8_000
+	relatedOverviewMaxGoalsPerSource  = 8
+	relatedOverviewMaxHintsPerSource  = 6
+	relatedOverviewMaxFactsPerSource  = 12
+	relatedOverviewMaxFindingsPerTask = 6
+	relatedOverviewMaxIntentsPerTask  = 8
+	relatedOverviewMaxScopePerSource  = 12
+)
+
+// overviewTextBudget bounds inherited prompt text while preserving a fair slice
+// for every direct source. Full evidence remains available through the on-demand
+// read tools, so truncation here does not discard persisted blackboard data.
+type overviewTextBudget struct {
+	remaining int
+	truncated bool
+}
+
+func relatedOverviewBudgetForSources(sourceCount int) int {
+	if sourceCount <= 0 {
+		return 0
+	}
+	if sourceCount > db.MaxTaskSourceCount {
+		sourceCount = db.MaxTaskSourceCount
+	}
+	perSource := relatedOverviewTotalTextRunes / sourceCount
+	if perSource > relatedOverviewMaxTextPerSource {
+		perSource = relatedOverviewMaxTextPerSource
+	}
+	return perSource
+}
+
+func (b *overviewTextBudget) take(value any, fieldLimit int) string {
+	var text string
+	switch value := value.(type) {
+	case string:
+		text = strings.TrimSpace(value)
+	case nil:
+		return ""
+	default:
+		text = strings.TrimSpace(fmt.Sprint(value))
+	}
+	if text == "" {
+		return ""
+	}
+	if b.remaining <= 0 || fieldLimit <= 0 {
+		b.truncated = true
+		return ""
+	}
+	runes := []rune(text)
+	limit := fieldLimit
+	if limit > b.remaining {
+		limit = b.remaining
+	}
+	if len(runes) > limit {
+		b.truncated = true
+		if limit == 1 {
+			text = "…"
+		} else {
+			text = string(runes[:limit-1]) + "…"
+		}
+		runes = []rune(text)
+	}
+	b.remaining -= len(runes)
+	return text
+}
+
+func recentTerminalIntents(store *db.ExplorationStore, limit int) []*db.Node {
+	if limit <= 0 {
+		return []*db.Node{}
+	}
+	const batch = 300
+	cursor := int64(0)
+	out := make([]*db.Node, 0, limit)
+	for len(out) < limit {
+		page, more, err := store.ListByKindPage(db.KindIntent, cursor, batch)
+		if err != nil || len(page) == 0 {
+			break
+		}
+		for _, intent := range page {
+			switch intent.State {
+			case "done", "blocked", "exhausted", "stopped":
+				out = append(out, intent)
+			}
+			if len(out) >= limit {
+				break
+			}
+		}
+		if !more {
+			break
+		}
+		cursor = page[len(page)-1].ID
+	}
+	return out
+}
+
+// relatedTaskOverviews distills persistent blackboard state from direct source
+// tasks. It intentionally reads each source's local store methods, never its own
+// related sources, so inheritance is one level only.
+func (t *ToolSet) relatedTaskOverviews() []map[string]any {
+	sources, err := t.ts.DirectSourceStores()
+	if err != nil {
+		return []map[string]any{}
+	}
+	if len(sources) > db.MaxTaskSourceCount {
+		sources = sources[:db.MaxTaskSourceCount]
+	}
+	perSourceTextBudget := relatedOverviewBudgetForSources(len(sources))
+	out := make([]map[string]any, 0, len(sources))
+	for _, source := range sources {
+		ts := source.Store
+		budget := overviewTextBudget{remaining: perSourceTextBudget}
+		item := map[string]any{
+			"source_task_id": source.Task.TaskID,
+			"inherited":      true,
+			"task": map[string]any{
+				"description": budget.take(source.Task.Description, 800),
+				"goal":        budget.take(source.Task.Goal, 800),
+				"status":      source.Task.Status,
+			},
+		}
+		stats, statsErr := ts.Stats()
+
+		edges, _ := ts.Edges(5000)
+>>>>>>> Stashed changes
 		parentsOf := map[int64][]int64{}
 		yieldsOf := map[int64][]int64{}
 		factFrom := map[int64]int64{}
@@ -923,6 +1287,80 @@ func (t *ToolSet) setGoals() actool.CoreTool {
 		})
 }
 
+type constraintItem struct {
+	Text string `json:"text"`
+	Type string `json:"type"` // allow | deny
+}
+
+// addOneConstraint 落一条操作约束到 task_constraints。origin 取 t.worker(缺省 system):
+// 拆解器写 "goals"、主 agent 写 "human"。
+func (t *ToolSet) addOneConstraint(it constraintItem) (int64, error) {
+	text := strings.TrimSpace(it.Text)
+	if text == "" {
+		return 0, fmt.Errorf("text 不能为空")
+	}
+	kind := strings.TrimSpace(strings.ToLower(it.Type))
+	if kind == "" {
+		kind = "deny" // 默认按禁止处理:未标注类型时更保守
+	}
+	if kind != "allow" && kind != "deny" {
+		return 0, fmt.Errorf("type 必须是 allow 或 deny")
+	}
+	return t.ts.AddConstraint(kind, text, t.worker)
+}
+
+// setConstraints 给【本任务】新增操作约束(allow=允许做什么 / deny=禁止做什么)。既是目标
+// 拆解器 round-0 抽约束的提交工具,也是主 agent 运行时补约束的工具——同一受管工具,可在 web
+// 端改描述/schema、按 agent 绑定。约束会被注入 planner/worker 的系统提示以约束探索边界。
+func (t *ToolSet) setConstraints() actool.CoreTool {
+	return writeTool("set_constraints",
+		"给【本任务】新增操作约束,用来框定探索边界:type=allow(允许做的操作)或 deny(禁止做的操作)。\n"+
+			"约束=对『可以/不可以做哪些操作』的规定(如『仅测当前端口,不扫其他端口』『禁止对生产库做写操作』『只允许被动侦察』),不是目标、也不是攻击步骤。\n"+
+			"★优先批量:多条放进 constraints 数组一次提交,返回 ids 与之等长同序(失败项 id=0,详情见 errors)。单条则省略 constraints 直接给顶层 text/type。\n"+
+			"只登记任务目标/描述里【明确写出】的约束,不要臆造;拿不准类型时用 deny(更保守)。",
+		obj(map[string]any{
+			"constraints": map[string]any{"type": "array", "description": "【优先用这个】要新增的约束数组,按顺序处理。每个元素:text(必填,一条约束)+ type(allow|deny)。返回 ids 与本数组等长、同序。", "items": map[string]any{"type": "object"}},
+			"text":        str("[单条] 一条操作约束的内容"),
+			"type":        str("[单条] allow(允许)或 deny(禁止);缺省按 deny 处理"),
+		}),
+		func(_ context.Context, in json.RawMessage) (actool.Result, error) {
+			if t.ts == nil {
+				return actool.Errorf("set_constraints 未启用: ExplorationStore 未初始化"), nil
+			}
+			var a struct {
+				Constraints    []constraintItem `json:"constraints"`
+				constraintItem                  // 单条模式:顶层 text/type
+			}
+			_ = json.Unmarshal(in, &a)
+			batch := len(a.Constraints) > 0
+			items := a.Constraints
+			if !batch {
+				items = []constraintItem{a.constraintItem}
+			}
+			ids := make([]int64, len(items))
+			errs := map[string]string{}
+			for i, it := range items {
+				id, err := t.addOneConstraint(it)
+				if err != nil {
+					errs[strconv.Itoa(i)] = err.Error()
+					continue
+				}
+				ids[i] = id
+			}
+			if !batch { // 单条:保持简单返回
+				if e, bad := errs["0"]; bad {
+					return actool.Errorf(e), nil
+				}
+				return actool.Text(fmt.Sprintf("constraint added: %d", ids[0])), nil
+			}
+			out := map[string]any{"ids": ids}
+			if len(errs) > 0 {
+				out["errors"] = errs
+			}
+			return jsonResult(out)
+		})
+}
+
 func (t *ToolSet) addHint() actool.CoreTool {
 	return writeTool("add_hint", "把人类/主 agent 的战略提示挂到探索图，规划者下次生成意图时会读到它。\n"+
 		"★优先批量：多条提示放进 hints 数组一次提交（比逐条调用省往返）。返回 ids 数组，与 hints 等长同序（失败项 id=0，详情见 errors）。单条则省略 hints 直接给顶层 text。",

agent/tools_insert.go

@@ -62,6 +62,13 @@ type assetInputItem struct {
 	// ---- endpoint ----
 	Method string           `json:"method"`
 	Params []map[string]any `json:"params"`
+
+	// Related marks whether this asset is relevant to the CURRENT test task and
+	// should therefore auto-enter the coverage system (task_scope denominator).
+	// nil = default true (relevant → auto-scoped). false = insert into the shared
+	// asset库 but keep it OUT of this task's coverage. Only consulted when the task
+	// has the coverage feature enabled; ignored (no auto-scope either way) when off.
+	Related *bool `json:"related"`
 }
 
 // insertAssets is the unified insert_assets agent tool.
@@ -150,6 +157,11 @@ func (t *ToolSet) insertAssets() actool.CoreTool {
 						"description": "请求参数列表，每条含 location(query/body/header/path)/name/value/type（可选，追加不覆盖）",
 						"items":       map[string]any{"type": "object"},
 					},
+					// 覆盖度相关：该资产是否与当前测试任务有关。
+					"related": map[string]any{
+						"type":        "boolean",
+						"description": "该资产是否与【当前测试任务】相关：true(默认)才自动纳入资产覆盖度(测试范围分母)，该资产会进入待测资产中，如果是和任务无关的，例如CDN仅存储静态资源类，必须设置为false或不进行资产插入；false 则只入库、不计入本任务覆盖度(如顺带发现的旁站/无关资产)。仅在任务开启资产覆盖度功能时生效。",
+					},
 				}, "type"),
 			},
 		}, "assets"),
@@ -274,11 +286,16 @@ func (t *ToolSet) insertAssets() actool.CoreTool {
 				t.anchorOwner(id)
 				// 自动入测试范围(source='auto')：只对 worker 顶层显式插入的这一项，按其
 				// 类型加保守范围；side-effect 派生的资产不经此处，故范围不盲目扩大。taskID=0 时无操作。
-				svcIP := item.ServiceIP
-				if svcIP == "" {
-					svcIP = item.IP
+				// 资产覆盖度功能关闭时不再累积测试范围(分母)；related=false(与当前任务无关)
+				// 的资产也只入库、不计入覆盖度。related 省略/null 视为 true(默认纳入)。
+				related := item.Related == nil || *item.Related
+				if !t.coverageDisabled && related {
+					svcIP := item.ServiceIP
+					if svcIP == "" {
+						svcIP = item.IP
+					}
+					_ = t.as.AddAutoScope(taskID, typ, item.Domain, item.URL, svcIP)
 				}
-				_ = t.as.AddAutoScope(taskID, typ, item.Domain, item.URL, svcIP)
 			}
 
 			return jsonResult(map[string]any{
@@ -595,8 +612,12 @@ func (t *ToolSet) MainAgentTools() []actool.CoreTool {
 	return []actool.CoreTool{
 		t.graphOverview(), t.listFindings(), t.listFacts(), t.nodeDetail(),
 		t.getWorkerOutput(), t.getWorkerTrace(), t.searchAllWorkerTraces(), t.addHint(), t.addIntent(),
+		// steer_work：人可对某条正在运行的意图(work)实时注入纠偏指令（不打断、不丢进展）。
+		t.steerWorkTool(),
 		// set_goals：人可在运行时给本任务补一个新的最终目标（规划者据此重判是否达成）。
 		t.setGoals(),
+		// set_constraints：人可在运行时给本任务补/改操作约束（allow/deny），约束 planner/worker 的探索边界。
+		t.setConstraints(),
 		// asset management (handlers guard nil store internally)
 		t.insertAssets(), t.addCompanyScope(), t.listAssets(),
 		t.addFinding(), t.recordFact(),

agent/worker.go

@@ -57,8 +57,19 @@ type Worker struct {
 	// extraTools are host-provided tools (e.g. traffic query, oast) appended to
 	// the worker's graph write-back tools.
 	extraTools []actool.CoreTool
+	// injectConstraints resolves whether this task's operation constraints get
+	// injected into the worker system prompt. Read per run so the settings toggle
+	// takes effect without rebuilding the agent. nil = inject (default).
+	injectConstraints func() bool
 }
 
+// SetConstraintInject wires a resolver deciding whether this task's operation
+// constraints get injected into the worker system prompt. nil = inject (default).
+func (w *Worker) SetConstraintInject(fn func() bool) { w.injectConstraints = fn }
+
+// wantConstraints reports whether constraint injection is enabled (default yes).
+func (w *Worker) wantConstraints() bool { return w.injectConstraints == nil || w.injectConstraints() }
+
 // SetRunTimeout configures the per-intent wall-clock budget for the main
 // exploration (0 = unlimited). When it fires, the SDK settlement phase still runs
 // so facts are never lost to a timeout. Safe to call before Execute.
@@ -141,7 +152,7 @@ const workerDefaultTmpl = `你是一个授权渗透测试系统的"执行者"(wo
 - report_finding：确认漏洞 → 记录(含 PoC，传 intent_id=你领到的意图id)。**只有你在本次运行里真实触发过该漏洞、拿到了可复现的证据（请求/响应或命令输出）才用它。** 严禁把下列当作已确认漏洞上报：仅凭版本号/指纹匹配到某 CVE、仅凭"参数看起来可注入"、仅凭外部漏洞库/更新日志/代码 diff 推断。**不要用查 CVE 库或"对比补丁版本"替代实际触发。** 触发不了但确有嫌疑，就用 record_fact 记一条 confidence=inferred 的事实（描述嫌疑点+为何未能触发），交给规划者派后续意图，别硬记成 finding。
 - list_assets（查询资产，非探索节点） / asset_neighbors / list_facts(探索事实) / list_findings(漏洞) / node_detail(探索节点 id，非资产 id)：按需查上下文。
 
-只在授权范围内操作。完成本意图后用一句话总结你做了什么、写回了哪些事实。务实、克制、聚焦这一条意图。`
+只在授权范围内操作；若系统提示顶部附有【操作约束】，那是最高优先级红线——任何命令/探测在执行前先自检是否违反，违反即不做（哪怕它落在你领到的意图里）。完成本意图后用一句话总结你做了什么、写回了哪些事实。务实、克制、聚焦这一条意图。`
 
 // workerTrafficBlock is 段 [B]: the traffic-tool note, code-injected only when
 // traffic capture is on (proxyAddr set). Not stored, not editable.
@@ -149,7 +160,7 @@ func workerTrafficBlock(proxyAddr string) string {
 	if proxyAddr == "" {
 		return ""
 	}
-	return "\n\n**流量工具**：\n- traffic_search / traffic_get：目标流量已被记录代理全量落库（本地文件树 data/traffic/<host>/<访问路径>/）。回看响应、找已访问过的资源，**先查流量、不要重复 curl 同一 URL**。traffic_search **必须指定 host**、默认只回 3 条极轻量索引(id/method/url/status/resp_len，无响应内容)，需要更多显式调大 limit；要看某条原文用 traffic_get(id)。"
+	return "\n\n**流量工具**：\n- traffic_search / traffic_get / traffic_blob：回看响应、找已访问过的资源，**先查流量、不要重复 curl 同一 URL**。traffic_search **必须指定 host**、默认只回 3 条极轻量索引(id/method/url/status/resp_len，无响应内容)，需要更多显式调大 limit；可用 body_contains 在请求/响应正文里做全文搜索(至少 3 字符，支持子串和中文，如找密码/密钥/报错/内网地址)；要看某条原文用 traffic_get(id)，其中超大正文显示为 @blob sha256:<hash>，用 traffic_blob(hash) 分段取全文。"
 }
 
 // artifactSpec is 段 [C]: the code-owned, non-editable tail appended to every
@@ -244,6 +255,8 @@ func renderWorkerGraphOverview(data map[string]any) string {
 func (w *Worker) Execute(ctx context.Context, name string, taskID int64, as *db.AssetStore, ts *db.ExplorationStore, intent *db.Node, hooks harness.HookRunner, emit func(db.Activity), enr EnrichTrigger, notifyFinding func(int64, string)) (harness.TerminalReason, WriteCounts, error) {
 	tsx := NewToolSet(ts, name)
 	tsx.SetTaskID(taskID)
+	coverageEnabled := as == nil || as.CoverageEnabled(taskID)
+	tsx.SetCoverageEnabled(coverageEnabled)
 	if as != nil {
 		tsx.SetAssetStore(as, as.Companies())
 	}
@@ -256,6 +269,7 @@ func (w *Worker) Execute(ctx context.Context, name string, taskID int64, as *db.
 	base := append(tsx.WorkerTools(), w.extraTools...)
 	base = append(base, actool.DefaultTools()...)
 	tools, def, cleanup := AugmentTools(ctx, "worker", base)
+	tools = tsx.StripCoverageParams(tools) // 覆盖度关闭时隐藏 insert_assets 的 related 入参
 	defer cleanup()
 
 	// 意图 + 全局态势改放【启动 user 消息】(见下方 input)，system 只留静态角色正文
@@ -264,7 +278,11 @@ func (w *Worker) Execute(ctx context.Context, name string, taskID int64, as *db.
 	// 压缩。本次意图的专属工作目录 <workDir>/tasks/<taskID>/i<intentID>，引擎侧先建好。
 	runDir := ensureRunDir(w.workDir, taskID, intent.ID)
 	overview := renderWorkerGraphOverview(tsx.graphOverviewData())
-	system, boundary := deferredSystem(workerSystem(w.proxyAddr, w.workDir, runDir), def)
+	sysBody := workerSystem(w.proxyAddr, w.workDir, runDir)
+	if w.wantConstraints() {
+		sysBody += constraintBlock(ts) // 操作约束(若有)注入系统提示,worker 执行时严格遵守
+	}
+	system, boundary := deferredSystem(sysBody, def)
 	// 任务级 deadline(经 ctx 注入)夹逼本 run 的墙钟预算 + 决定收尾词(见 taskclock.go)。
 	tc := taskClockFrom(ctx)
 	maxDur, clamped := clampMaxDuration(tc.DeadlineUnix, w.runTimeout)
@@ -340,8 +358,11 @@ func (w *Worker) Execute(ctx context.Context, name string, taskID int64, as *db.
 				// 意图明确针对的这些资产 → 自动纳入任务测试范围（与 insertAssets 同一套
 				// 保守粒度）。upsertTaskScope 的 ON CONFLICT DO NOTHING + uq_task_scope
 				// 唯一索引保证不会重复添加；重跑/重试同样是幂等 no-op。
-				for _, a := range assets {
-					_ = as.AddAutoScope(taskID, a.Type, a.Domain, a.URL, a.IP)
+				// 资产覆盖度功能关闭时不再累积测试范围(分母)。
+				if coverageEnabled {
+					for _, a := range assets {
+						_ = as.AddAutoScope(taskID, a.Type, a.Domain, a.URL, a.IP)
+					}
 				}
 			}
 		}