mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-06-09 17:12:01 +00:00
d9f4724950
* feat(tool-search): add hash-scoped promoted state to ThreadState * feat(tool-search): add immutable DeferredToolCatalog with stable hash * feat(tool-search): add build_deferred_tool_setup + Command-writing tool_search * refactor(tool-search): replace deferred-tool ContextVar with closures + graph state (#3272) Build the deferred catalog + tool_search tool per agent from the policy-filtered tool list (after skill allowed-tools), pass deferred_names + catalog_hash explicitly to DeferredToolFilterMiddleware and the prompt, and record promotions in ThreadState.promoted (scoped by catalog_hash) via a Command-returning tool_search. Removes DeferredToolRegistry and the _registry_var ContextVar so deferral no longer depends on build/execute sharing an async context. MCP tools are tagged with metadata[deerflow_mcp]; client.py assembles deferral the same way. Catalog is built AFTER tool-policy filtering (no policy-excluded tool can leak via tool_search) and assembly is fail-closed. Migrate tests off the deleted registry APIs; delete the obsolete ContextVar-based #2884 regression (re-covered by state-based tests in a follow-up). * test(tool-search): lock tool_search promotion into next model turn via graph state * test(tool-search): cross-context, policy-leak, fail-closed, #2884 isolation regressions * test(tool-search): align real-LLM e2e with closure-based deferred setup * docs: update DeferredToolFilterMiddleware description for closure+state design * style(tests): drop unused import in test_deferred_setup (ruff) * test(tool-search): harden merge_promoted + replace tautological catalog test From independent code review: - merge_promoted: use existing.get("catalog_hash") so a forward-incompatible or externally-injected persisted promoted dict triggers a replace instead of a KeyError crash; add regression test for the malformed-existing case. - test_deferred_catalog: replace the `== [] or True` tautology (a test that could never fail) with a deterministic invalid-regex->literal-fallback check (positive match on calc + negative empty match). - DeferredToolCatalog: comment why frozen-without-slots is required for the cached_property hash/names fields (adding slots=True would break them). * fix(tool-search): read tool_search.enabled from self._app_config in client DeerFlowClient._ensure_agent called get_app_config() directly to read tool_search.enabled, but the client already resolves and stores its config as self._app_config at construction (and uses it everywhere else). The bare call re-resolves config from disk at agent-build time, which raises FileNotFoundError in environments without a config.yaml (CI) — test_client.py's fixture only patches get_app_config during __init__, so the later call hit the real loader. Use self._app_config, matching the rest of the client. * test(tool-search): lock tool_search post-policy append ordering tool_search is appended after skill-allowlist filtering, so the allowlist can no longer deny it by name. Lock the intended contract: it only appears when allowed MCP tools survive the filter, and its catalog (derived from the already policy-filtered list) can never expose a denied tool. Addresses the ordering observation from the Copilot review on #3342.
67 lines
2.2 KiB
Python
67 lines
2.2 KiB
Python
from langchain_core.tools import tool as as_tool
|
|
from langgraph.types import Command
|
|
|
|
from deerflow.tools.builtins.tool_search import DeferredToolCatalog, _is_mcp_tool, build_deferred_tool_setup, build_tool_search_tool
|
|
|
|
|
|
@as_tool
|
|
def mcp_calc(expression: str) -> str:
|
|
"Evaluate arithmetic."
|
|
return expression
|
|
|
|
|
|
@as_tool
|
|
def local_echo(text: str) -> str:
|
|
"Echo text."
|
|
return text
|
|
|
|
|
|
def _tag_mcp(t):
|
|
t.metadata = {**(t.metadata or {}), "deerflow_mcp": True}
|
|
return t
|
|
|
|
|
|
def test_is_mcp_tool_reads_metadata():
|
|
assert _is_mcp_tool(_tag_mcp(mcp_calc)) is True
|
|
assert _is_mcp_tool(local_echo) is False
|
|
|
|
|
|
def test_setup_disabled_returns_empty():
|
|
setup = build_deferred_tool_setup([_tag_mcp(mcp_calc), local_echo], enabled=False)
|
|
assert setup.tool_search_tool is None
|
|
assert setup.deferred_names == frozenset()
|
|
assert setup.catalog_hash is None
|
|
|
|
|
|
def test_setup_no_mcp_returns_empty():
|
|
setup = build_deferred_tool_setup([local_echo], enabled=True)
|
|
assert setup.tool_search_tool is None
|
|
assert setup.deferred_names == frozenset()
|
|
|
|
|
|
def test_setup_builds_from_mcp_survivors():
|
|
setup = build_deferred_tool_setup([_tag_mcp(mcp_calc), local_echo], enabled=True)
|
|
assert setup.deferred_names == frozenset({"mcp_calc"})
|
|
assert setup.tool_search_tool is not None
|
|
assert setup.tool_search_tool.name == "tool_search"
|
|
assert setup.catalog_hash
|
|
|
|
|
|
def test_tool_search_returns_command_with_hash_scoped_promotion():
|
|
catalog = DeferredToolCatalog((mcp_calc,))
|
|
ts = build_tool_search_tool(catalog)
|
|
out = ts.invoke({"type": "tool_call", "name": "tool_search", "args": {"query": "select:mcp_calc"}, "id": "tc1"})
|
|
assert isinstance(out, Command)
|
|
promoted = out.update["promoted"]
|
|
assert promoted == {"catalog_hash": catalog.hash, "names": ["mcp_calc"]}
|
|
msg = out.update["messages"][0]
|
|
assert msg.tool_call_id == "tc1" and msg.name == "tool_search"
|
|
assert "mcp_calc" in msg.content
|
|
|
|
|
|
def test_tool_search_no_match_empty_names():
|
|
catalog = DeferredToolCatalog((mcp_calc,))
|
|
ts = build_tool_search_tool(catalog)
|
|
out = ts.invoke({"type": "tool_call", "name": "tool_search", "args": {"query": "select:nonexistent"}, "id": "tc2"})
|
|
assert out.update["promoted"]["names"] == []
|