deer-flow/backend/tests/test_context_compaction_observation.py
Nan Gao 13f0a7f263
feat(extensions): let an out-of-tree extension observe what the agent did (#4863)
* feat(extensions): let an out-of-tree extension observe what the agent did

DeerFlow's extension system can contribute middleware, services and routes,
but an extension cannot answer basic questions about a run without reaching
into host internals. Several of the facts it would need are destroyed by the
operations that produce them:

  * The middleware chain injects and rewrites a lot of context — date
    reminders, recalled memory, compaction summaries, durable-context data,
    image payloads, activated skill bodies. Downstream, none of it is
    attributable: at the model-call boundary an injected HumanMessage is
    indistinguishable from the user's own, and anything wanting to tell them
    apart has to pattern-match prompt wording, which breaks on the next copy
    edit.

  * Two runs of "the same agent" are only comparable if the chain enforced the
    same limits, prompts and thresholds. Recovering that from outside means
    reading private attributes and guessing which of them change behaviour — a
    guess that rots silently as middlewares gain fields.

  * The lead-agent factory resolves a model after runtime overrides, renders a
    prompt, filters tools through authorization and composes a stack, all
    inside one synchronous call, and none of it survives: a middleware sees its
    neighbours but not the prompt, the run worker sees a graph but not what
    went into it.

  * Summarization is destructive by design. N messages leave the context and
    one summary enters it; afterwards only the summary exists, so "which
    messages became this?" is not reconstructible.

This adds seven neutral facilities so those facts are recorded where they are
still true, and releases the contract package as 0.2.0.

Message provenance
  Producers stamp `deerflow_content_kind` / `deerflow_producer_kind` onto the
  messages they inject or rewrite. Stamping is unconditional — a fact whose
  presence depends on whether an observer is installed is not a fact — and the
  keys are server-owned, so provenance cannot be forged from a request.

Middleware self-description
  Twelve middlewares declare their own behaviour-affecting parameters through
  a duck-typed `release_policy_parameters()`. Long text is hashed rather than
  embedded: a declaration is an identity, not a copy of the prompt.

Agent assembly descriptor
  `assemble_lead_agent()` returns the graph plus a descriptor whose fingerprint
  answers "did anything about this agent change between these two runs?".
  `make_lead_agent()` keeps its graph-only signature — it is the LangGraph
  Server ABI declared in langgraph.json. Tools and skills are sorted before
  hashing because their assembly order is incidental; middlewares are not,
  because stack order decides what wraps what. Host build identity is reported
  but excluded from the fingerprint, so a redeploy does not invalidate every
  agent's identity.

Context compaction observation
  Summarization emits the content hashes of the messages it is about to remove
  joined to the summary that replaced them. Content is the only identity
  available at that seam: the summary does not become a message, and what later
  projects it into a request renders it bounded and escaped rather than
  verbatim.

Neutral policy, transform and MCP-source facts
  Guardrail decisions are published to runtime context under a `__`-prefixed
  key; result-rewriting middlewares append a declared, ordered transform trail;
  MCP tools carry their credential-free logical origin.

Extension route identity
  Contributed routes are session-authenticated and cannot opt out, but
  "logged in" and "administrator" are different questions. Extensions get a
  neutral projection of the caller rather than the host's auth context, and
  `require_admin` fails closed when identity cannot be determined.

Extension-owned tables
  An extension that persists data owns its own MetaData and migration chain, so
  its tables are absent from Base.metadata and `alembic revision --autogenerate`
  proposes dropping them. Extensions declare a table prefix, which is rejected
  at registration if it would shadow a host table.

The contract package stays dependency-free and imports no host code; every new
Protocol method has a default so later additions remain additive. The loader's
pre-1.0 rule requires an exact major.minor match, so extensions written against
0.1 are now refused at startup with an actionable install hint rather than
loading into a host that implements a different surface.

uv.lock records the contract package's new version, so `uv sync --locked` still
resolves on a fresh checkout.

* fix(backend): sort gateway service imports
2026-08-23 09:57:12 +08:00

216 lines
8.3 KiB
Python

"""Compaction destroys the mapping it is observed by.
Summarization replaces N messages with one summary. After the fact, only the
summary survives, so 'which messages became this summary' is not reconstructible
from state — it has to be emitted at the moment of the transform.
"""
from __future__ import annotations
from types import SimpleNamespace
from unittest.mock import AsyncMock, MagicMock
import pytest
from deerflow_extension_api import CompactionEvent, canonical_hash
def test_event_records_both_ends_of_the_transform():
event = CompactionEvent(
transform_kind="summarization",
transform_version="1",
source_content_hashes=("h1", "h2"),
output_content_hash="h3",
compacted_message_count=2,
kept_message_count=4,
)
assert event.source_content_hashes == ("h1", "h2")
assert event.output_content_hash == "h3"
def test_source_hashes_are_a_tuple_so_the_event_cannot_be_mutated_after_emission():
event = CompactionEvent(
transform_kind="summarization",
transform_version="1",
source_content_hashes=("h1",),
output_content_hash="h3",
compacted_message_count=1,
kept_message_count=1,
)
with pytest.raises(AttributeError):
event.output_content_hash = "other"
_UNOBSERVED = object()
def _observed_extensions(observer=None):
"""A real ``LoadedExtensions`` carrying one compaction observer.
``replace`` on the ambient set rather than a hand-built stub: the
middleware reads other fields off ``_extensions`` too (the system-model
call path), so a namespace carrying only the observer tuple would pass
these tests while diverging from what the middleware is handed in
production.
"""
from dataclasses import replace
from deerflow.extensions import get_agent_build_extensions
return replace(get_agent_build_extensions(), context_compaction_observers=(("test-source", observer or (lambda event, context=None: None)),))
def test_source_hashes_are_computed_on_content_directly_not_a_stringified_copy():
"""Regression: hashing ``str(message.content)`` would defeat canonical_hash's
key-order normalization for multimodal (``list[dict]``) content, which
``view_image_middleware`` and other producers routinely inject. Two
logically identical messages whose dict content differs only in key
insertion order must hash the same.
"""
from langchain_core.messages import HumanMessage
from deerflow.agents.middlewares.summarization_middleware import DeerFlowSummarizationMiddleware
a = HumanMessage(content=[{"type": "text", "text": "hi"}, {"b": 1, "a": 2}])
b = HumanMessage(content=[{"type": "text", "text": "hi"}, {"a": 2, "b": 1}])
middleware = DeerFlowSummarizationMiddleware(model=MagicMock(), extensions=_observed_extensions())
hashes = middleware._freeze_compaction_sources([a, b])
assert hashes[0] == hashes[1]
assert hashes[0] == canonical_hash(a.content)
# str() on a dict renders insertion order, so the pre-stringified form
# this guards against would not have matched.
assert str(a.content) != str(b.content)
# --- Driving a real compaction --------------------------------------------
#
# Mirrors tests/test_summarization_middleware.py's `_messages` / `_middleware` /
# `_runtime` fixture helpers rather than inventing a second way to drive the
# middleware: a static model, `token_counter=len`, and a runtime carrying a
# plain `context` mapping.
def _messages() -> list:
from langchain_core.messages import AIMessage, HumanMessage
return [
HumanMessage(content="user-1"),
AIMessage(content="assistant-1"),
HumanMessage(content="user-2"),
AIMessage(content="assistant-2"),
]
def _runtime(thread_id: str | None = "thread-1") -> SimpleNamespace:
context = {}
if thread_id is not None:
context["thread_id"] = thread_id
return SimpleNamespace(context=context)
def _middleware(*, trigger=("messages", 4), keep=("messages", 2), extensions=_UNOBSERVED):
from deerflow.agents.middlewares.summarization_middleware import DeerFlowSummarizationMiddleware
model = MagicMock()
model.invoke.return_value = SimpleNamespace(text="compressed summary")
model.ainvoke = AsyncMock(return_value=SimpleNamespace(text="compressed summary"))
model.with_config.return_value = model
return DeerFlowSummarizationMiddleware(
model=model,
trigger=trigger,
keep=keep,
token_counter=len,
extensions=_observed_extensions() if extensions is _UNOBSERVED else extensions,
)
class TestSummarizationEmitsTheEvent:
@pytest.mark.asyncio
async def test_a_compaction_notifies_observers_once(self, monkeypatch):
from deerflow.agents.middlewares import summarization_middleware
events = []
monkeypatch.setattr(
summarization_middleware,
"notify_context_compacted",
lambda event, extensions=None: events.append(event),
)
middleware = _middleware()
result = await middleware.abefore_model({"messages": _messages()}, _runtime())
assert result is not None
assert len(events) == 1
event = events[0]
assert event.transform_kind == "summarization"
assert event.compacted_message_count == 2
assert event.kept_message_count == 2
assert event.source_content_hashes == (
canonical_hash("user-1"),
canonical_hash("assistant-1"),
)
assert event.output_content_hash == canonical_hash("compressed summary")
@pytest.mark.asyncio
async def test_no_event_is_emitted_when_the_trigger_does_not_fire(self, monkeypatch):
from deerflow.agents.middlewares import summarization_middleware
events = []
monkeypatch.setattr(
summarization_middleware,
"notify_context_compacted",
lambda event, extensions=None: events.append(event),
)
# A trigger threshold far above the message count never fires, so
# compaction never runs and the record half is never reached.
middleware = _middleware(trigger=("messages", 100))
result = await middleware.abefore_model({"messages": _messages()}, _runtime())
assert result is None
assert events == []
class TestAnInstallWithNoObserverPaysNothing:
"""Hashing the sources is an O(context-size) canonical-JSON pass.
Every install runs this middleware; almost none of them register a
compaction observer. The check cannot live in ``notify_context_compacted``
— by the time it is called the hashing has already happened — so the freeze
site has to make it itself.
"""
def test_the_sources_are_not_hashed_when_nothing_observes(self):
from dataclasses import replace
from deerflow.extensions import get_agent_build_extensions
unobserved = replace(get_agent_build_extensions(), context_compaction_observers=())
middleware = _middleware(extensions=unobserved)
assert middleware._freeze_compaction_sources(_messages()) == ()
def test_the_sources_are_hashed_when_an_observer_is_registered(self):
middleware = _middleware(extensions=_observed_extensions())
assert middleware._freeze_compaction_sources(_messages()) == tuple(canonical_hash(m.content) for m in _messages())
@pytest.mark.asyncio
async def test_the_compaction_itself_still_happens_unobserved(self, monkeypatch):
"""The skip must cost the run nothing but the hashes."""
from dataclasses import replace
from deerflow.agents.middlewares import summarization_middleware
from deerflow.extensions import get_agent_build_extensions
events = []
monkeypatch.setattr(summarization_middleware, "notify_context_compacted", lambda event, extensions=None: events.append(event))
unobserved = replace(get_agent_build_extensions(), context_compaction_observers=())
result = await _middleware(extensions=unobserved).abefore_model({"messages": _messages()}, _runtime())
assert result is not None, "compaction must still run; only the observation bookkeeping is skipped"
# The middleware still calls notify (which would itself no-op on the
# empty observer tuple); what it must not do is compute the hashes.
assert [e.source_content_hashes for e in events] == [()]