mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-07-28 08:56:13 +00:00
60e50537f3
* fix(subagents): prohibit task tool in general-purpose system prompt (#4159) The general-purpose subagent correctly lists `task` in disallowed_tools to prevent recursive nesting. However, the system prompt did not explicitly tell the LLM that `task` is unavailable. When the subagent sees the parent agent use `task`, it infers the tool is available and attempts to call it, triggering a LangGraph tool validation error. Add an explicit <tool_restrictions> block to the system prompt stating that `task` is NOT available and the subagent must NEVER attempt to call it. This prevents the LLM from attempting the call in the first place, rather than relying on runtime rejection. Add a regression test verifying the prompt contains the prohibition. * fix(security): register tool_restrictions in input sanitization denylist PR #4161 added <tool_restrictions> to general_purpose.py subagent prompt but did not register it in _BLOCKED_TAG_NAMES. The anti-drift test test_denylist_covers_framework_authority_blocks caught this: forging <tool_restrictions> in untrusted input could trick the model into believing it has (or lacks) tool restrictions it does not. Add 'tool_restrictions' to _BLOCKED_TAG_NAMES alongside the other subagent authority blocks (file_editing_workflow / guidelines / output_format / working_directory).
72 lines
3.2 KiB
Python
72 lines
3.2 KiB
Python
"""Tests for subagent availability and prompt exposure under local bash hardening."""
|
|
|
|
from deerflow.agents.lead_agent import prompt as prompt_module
|
|
from deerflow.subagents import registry as registry_module
|
|
|
|
|
|
def test_get_available_subagent_names_hides_bash_when_host_bash_disabled(monkeypatch) -> None:
|
|
monkeypatch.setattr(registry_module, "is_host_bash_allowed", lambda: False)
|
|
|
|
names = registry_module.get_available_subagent_names()
|
|
|
|
assert names == ["general-purpose"]
|
|
|
|
|
|
def test_get_available_subagent_names_keeps_bash_when_allowed(monkeypatch) -> None:
|
|
monkeypatch.setattr(registry_module, "is_host_bash_allowed", lambda: True)
|
|
|
|
names = registry_module.get_available_subagent_names()
|
|
|
|
assert names == ["general-purpose", "bash"]
|
|
|
|
|
|
def test_build_subagent_section_hides_bash_examples_when_unavailable(monkeypatch) -> None:
|
|
monkeypatch.setattr(prompt_module, "get_available_subagent_names", lambda: ["general-purpose"])
|
|
|
|
section = prompt_module._build_subagent_section(3)
|
|
|
|
# When bash is not available, it should not appear at all (aligned with Codex:
|
|
# unavailable roles are omitted, not listed as disabled)
|
|
assert "**bash**" not in section
|
|
assert 'bash("npm test")' not in section
|
|
assert 'read_file("/mnt/user-data/workspace/README.md")' in section
|
|
assert "available tools (ls, read_file, web_search, etc.)" in section
|
|
|
|
|
|
def test_build_subagent_section_includes_bash_when_available(monkeypatch) -> None:
|
|
monkeypatch.setattr(prompt_module, "get_available_subagent_names", lambda: ["general-purpose", "bash"])
|
|
|
|
section = prompt_module._build_subagent_section(3)
|
|
|
|
assert "For command execution (git, build, test, deploy operations)" in section
|
|
assert 'bash("npm test")' in section
|
|
assert "available tools (bash, ls, read_file, web_search, etc.)" in section
|
|
|
|
|
|
def test_bash_subagent_prompt_mentions_workspace_relative_paths() -> None:
|
|
from deerflow.subagents.builtins.bash_agent import BASH_AGENT_CONFIG
|
|
|
|
assert "Treat `/mnt/user-data/workspace` as the default working directory for file IO" in BASH_AGENT_CONFIG.system_prompt
|
|
assert "`hello.txt`, `../uploads/input.csv`, and `../outputs/result.md`" in BASH_AGENT_CONFIG.system_prompt
|
|
|
|
|
|
def test_general_purpose_subagent_prompt_mentions_workspace_relative_paths() -> None:
|
|
from deerflow.subagents.builtins.general_purpose import GENERAL_PURPOSE_CONFIG
|
|
|
|
assert "Treat `/mnt/user-data/workspace` as the default working directory for coding and file IO" in GENERAL_PURPOSE_CONFIG.system_prompt
|
|
assert "`hello.txt`, `../uploads/input.csv`, and `../outputs/result.md`" in GENERAL_PURPOSE_CONFIG.system_prompt
|
|
|
|
|
|
def test_general_purpose_subagent_prompt_prohibits_task_tool() -> None:
|
|
"""The system prompt must explicitly tell the LLM that `task` is unavailable.
|
|
|
|
Without this, subagents may attempt to call `task` after seeing the parent
|
|
agent use it, triggering a LangGraph tool validation error (#4159).
|
|
"""
|
|
from deerflow.subagents.builtins.general_purpose import GENERAL_PURPOSE_CONFIG
|
|
|
|
prompt = GENERAL_PURPOSE_CONFIG.system_prompt
|
|
assert "task" in prompt.lower()
|
|
assert "NOT available" in prompt or "must NEVER" in prompt
|
|
assert "disallowed_tools" not in prompt # don't leak internal implementation details
|