From ed2ae2feb9e411ba894905894373f8347f0624ad Mon Sep 17 00:00:00 2001 From: suzmii Date: Wed, 26 Aug 2026 12:52:16 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8DAGC=E8=BF=90=E8=A1=8C?= =?UTF-8?q?=E6=97=B6=E6=B5=8B=E8=AF=95=E5=9B=9E=E5=BD=92?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 恢复 Direct Runtime 审核 Skill 索引注入并校正内置 Skill 内容指纹。 修复浏览器诊断、委派回执和 Runtime 失败投影的敏感信息脱敏边界。 收窄浏览器脱敏测试断言，避免将安全占位符误判为原始密钥。 --- .../resources/agc-skills/manifest.json | 4 +-- .../src-tauri/src/agent.rs | 2 ++ .../src-tauri/src/agent/direct_runtime.rs | 6 ++-- .../src/agent/generation/prompt_context.rs | 32 +++++++++++++++++++ .../src/agent/runtime_tools/delivery.rs | 12 ++++--- 5 files changed, 48 insertions(+), 8 deletions(-) diff --git a/apps/ai-game-creator-shell/src-tauri/resources/agc-skills/manifest.json b/apps/ai-game-creator-shell/src-tauri/resources/agc-skills/manifest.json index 257639210..82d0db49f 100644 --- a/apps/ai-game-creator-shell/src-tauri/resources/agc-skills/manifest.json +++ b/apps/ai-game-creator-shell/src-tauri/resources/agc-skills/manifest.json @@ -40,7 +40,7 @@ "agents/openai.yaml", "references/platform-art-contract.md" ], - "sha256": "8e5b54035bff777cd0714ab203cb27c753fc83cf22d93ae2389bf28bfaf05ef6" + "sha256": "6340ba68146823fe56f8ad265e3b8f9329cdc842d52ad63e72b05285bb23334e" }, { "name": "agc-web-game-development", @@ -76,7 +76,7 @@ "agents/openai.yaml", "references/browser-evidence-contract.md" ], - "sha256": "403a9341ece8c73d6e3bc09059b556b1c775a2f9ceb75c30541c9dd79fd52bd5" + "sha256": "a6f967cb1947e1d40215e2e7186a8b13fae71800aa04d6a47ef2b0af25890825" }, { "name": "agc-client-projection", diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent.rs b/apps/ai-game-creator-shell/src-tauri/src/agent.rs index 48082f781..69d3ffdff 100644 --- a/apps/ai-game-creator-shell/src-tauri/src/agent.rs +++ b/apps/ai-game-creator-shell/src-tauri/src/agent.rs @@ -22,6 +22,7 @@ mod runtime_driver; mod runtime_protocol; mod runtime_state; mod runtime_tools; +mod skill_pack; use codex_app_server::*; pub(crate) use codex_app_server::{ direct_game_creator_codex_chat_at, direct_game_creator_home_codex_chat, @@ -41,6 +42,7 @@ pub(crate) use runtime_driver::*; pub(crate) use runtime_protocol::*; pub(crate) use runtime_state::*; pub(crate) use runtime_tools::*; +pub(crate) use skill_pack::*; pub(crate) fn shutdown_game_creator_codex_app_servers() -> Result<(), String> { shutdown_game_creator_codex_app_servers_impl() diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/direct_runtime.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/direct_runtime.rs index c4aed6f08..bdfcef57d 100644 --- a/apps/ai-game-creator-shell/src-tauri/src/agent/direct_runtime.rs +++ b/apps/ai-game-creator-shell/src-tauri/src/agent/direct_runtime.rs @@ -13,7 +13,7 @@ const MAX_DIRECT_HOME_ATTACHMENT_MEDIA_TYPE_CHARS: usize = 96; const MIN_DIRECT_CLIENT_TURN_ID_CHARS: usize = 6; const MAX_DIRECT_CLIENT_TURN_ID_CHARS: usize = 160; const DIRECT_TAONIER_IDENTITY_GUIDANCE: &str = "对外身份合同：你是“陶泥儿”，是 Genarrative 的游戏创作助手。用户询问你是谁、你的名称或能力时，以陶泥儿的身份回答；不要把 Codex、ChatGPT、OpenAI、模型、通用 AI 助手或内部执行智能体当作自己的名称或对外身份。Codex app-server 仅是客户端内部执行技术；只有用户明确询问底层实现时才可如实说明，同时仍以陶泥儿自称。"; -const DIRECT_AGC_ENGINEERING_GUIDANCE: &str = "AGC 工程合同：当前 Codex cwd 是项目真实 `game/` 源码目录，只允许把项目源码写入该目录；原生文件工具、原生 patch 和命令参数中的文件路径必须相对于当前 cwd：合法写法是 `index.html`、`style.css`、`game.js`，禁止写 `game/index.html`、`../game/index.html`、项目根绝对路径或任何其它父目录路径；`game/...` 只用于 AGC 回执、manifest 和客户端投影，不用于 cwd 内的原生 patch。不要用原生文件或命令工具遍历父目录；`.agent/`、`assets/` 和项目根由客户端维护，不能请求扩权或直接改写。DirectProject 只提供当前工作区内的 Codex 原生文件、搜索、命令和图片查看能力，不提供外部工具目录。按用户意图自行检查、修改和验证，不要等待 Supervisor、harness 或宿主规划器。不要读取或输出凭据、Token、Cookie、auth.json、.env 或宿主私密路径。项目锁、付费提交、幂等账本、下载校验和客户端投影仍由客户端确定性掌管。游戏文件真实变化后由客户端登记资源和版本，Codex 不直接保存或伪造项目版本。"; +const DIRECT_AGC_ENGINEERING_GUIDANCE: &str = "AGC 工程合同：当前 Codex cwd 是项目真实 `game/` 源码目录，只允许把项目源码写入该目录；原生文件工具、原生 patch 和命令参数中的文件路径必须相对于当前 cwd：合法写法是 `index.html`、`style.css`、`game.js`，禁止写 `game/index.html`、`../game/index.html`、项目根绝对路径或任何其它父目录路径；`game/...` 只用于 AGC 回执、manifest 和客户端投影，不用于 cwd 内的原生 patch。不要用原生文件或命令工具遍历父目录；`.agent/`、`assets/` 和项目根由客户端维护，不能请求扩权或直接改写。DirectProject 提供 Codex 原生文件、搜索、命令、图片查看、Skill 能力，但只限当前工作区，不提供外部工具目录。按用户意图自行检查、修改和验证，不要等待 Supervisor、harness 或宿主规划器。不要读取或输出凭据、Token、Cookie、auth.json、.env 或宿主私密路径。项目锁、付费提交、幂等账本、下载校验和客户端投影仍由客户端确定性掌管。游戏文件真实变化后由客户端登记资源和版本，Codex 不直接保存或伪造项目版本。"; const DIRECT_CODEX_ART_SPEC_ASSET_PATH: &str = "assets/art-spec.png"; const DIRECT_CODEX_BACKGROUND_ASSET_PATH: &str = "assets/direct-game-background.png"; const DIRECT_CODEX_SPRITESHEET_ASSET_PATH: &str = "assets/art-spritesheet.png"; @@ -3634,12 +3634,14 @@ pub(crate) fn build_direct_codex_system_prompt(root: &Path) -> Result Result { + let skill_index = render_agc_skill_pack_index()?; let sections = vec![ "你是陶泥儿，是 Genarrative 面向用户的游戏创作助手，也是当前唯一执行主体。用户聊天内容会原样直接发送给你；先自行理解意图：普通对话直接回答且不触碰工作区，项目请求再按需要检查、修改、运行和验证，并用简洁中文报告真实结果。客户端不会根据关键词替你决定新建、续做、生图、试玩、返工或版本登记。".to_string(), DIRECT_TAONIER_IDENTITY_GUIDANCE.to_string(), "工作区边界：只在当前项目目录内工作；不要读取或输出凭据、Token、Cookie、auth.json、.env 或宿主私密路径。遇到阻断必须说明具体原因、文件和下一步，不要声称未验证的成功。".to_string(), DIRECT_AGC_ENGINEERING_GUIDANCE.to_string(), "工程执行要求：优先复用现有结构；按需读取真实文件，不依赖客户端预注入源码快照；修改后运行与改动相关的本地验证。不要创建 Supervisor、专业 Agent 或平行项目。".to_string(), + format!("提示词与技能：{skill_index}"), ]; Ok(sections .join("\n") @@ -6054,7 +6056,7 @@ mod tests { assert!(prompt.contains("desktop exception:")); assert!(prompt.contains("AGC 浏览器事实证据")); - assert!(!prompt.contains("secret"), "{prompt}"); + assert!(!prompt.contains("token=secret"), "{prompt}"); assert!( !prompt.contains(&root.path().display().to_string()), "{prompt}" diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/generation/prompt_context.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/generation/prompt_context.rs index c1506fa6d..db1b51976 100644 --- a/apps/ai-game-creator-shell/src-tauri/src/agent/generation/prompt_context.rs +++ b/apps/ai-game-creator-shell/src-tauri/src/agent/generation/prompt_context.rs @@ -450,6 +450,10 @@ pub(crate) fn sanitize_prompt_context(value: &str) -> String { let mut inside_private_key = false; for line in value.lines() { let lower = line.to_ascii_lowercase(); + if contains_sensitive_cli_flag(&lower) { + sanitized.push("[redacted sensitive context]".to_string()); + continue; + } if inside_private_key { if lower.contains("-----end") && lower.contains("private key") { inside_private_key = false; @@ -498,6 +502,30 @@ pub(crate) fn sanitize_prompt_context(value: &str) -> String { sanitized.join("\n") } +fn contains_sensitive_cli_flag(lower: &str) -> bool { + [ + "--password", + "--token", + "--secret", + "--api-key", + "--apikey", + "--authorization", + "--cookie", + ] + .into_iter() + .any(|flag| { + lower.split_whitespace().any(|token| { + let token = token.trim_matches(|character: char| { + matches!( + character, + ',' | ';' | '，' | '；' | '(' | ')' | '[' | ']' | '{' | '}' + ) + }); + token == flag || token.starts_with(&format!("{flag}=")) + }) + }) +} + // Prompt context is deliberately fail-closed: a line which looks like a // credential assignment is dropped in full before it can reach a model. An // error, however, is an operator-facing diagnostic. Dropping the whole line @@ -565,6 +593,10 @@ pub(crate) fn sanitize_error_context(value: &str) -> String { let mut inside_private_key = false; for line in value.lines() { let lower = line.to_ascii_lowercase(); + if contains_sensitive_cli_flag(&lower) { + sanitized.push("[redacted sensitive context]".to_string()); + continue; + } if inside_private_key { if lower.contains("-----end") && lower.contains("private key") { inside_private_key = false; diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/runtime_tools/delivery.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/runtime_tools/delivery.rs index fe4c06443..640b57011 100644 --- a/apps/ai-game-creator-shell/src-tauri/src/agent/runtime_tools/delivery.rs +++ b/apps/ai-game-creator-shell/src-tauri/src/agent/runtime_tools/delivery.rs @@ -878,15 +878,15 @@ pub(crate) fn publish_game_creator_agent_delegate_result( return; } }; - let result_detail = result_detail + let raw_result_detail = result_detail .filter(|value| !value.trim().is_empty()) .or(child_task.terminal_detail.as_deref()) .or(child_task.error.as_deref()) .unwrap_or(child_task.current_action.as_str()); let result_detail = redact_agent_runtime_error( root, - result_detail, - static_delegate_result_detail_max_chars(result_detail, 600), + raw_result_detail, + static_delegate_result_detail_max_chars(raw_result_detail, 600), ); if uses_durable_delivery { let existing_delivery = match read_static_delegate_delivery_at(root, delegation_id) { @@ -1072,9 +1072,13 @@ pub(crate) fn publish_game_creator_agent_delegate_result( if receipt_exists { return; } + let receipt_result_detail = sanitize_agent_runtime_text( + &sanitize_prompt_context(raw_result_detail), + static_delegate_result_detail_max_chars(raw_result_detail, 600), + ); let receipt_task = format!( "收到委派子任务终态回执。子 Agent：{}；状态：{}；结果：{}。这是已完成委派的回执，不要重复委派同一任务；请整合结果并决定后续，需要原目标时调用 conversation.read。", - child_task.agent_id, terminal_status, result_detail, + child_task.agent_id, terminal_status, receipt_result_detail, ); let receipt_link = AgentRuntimeTaskLink { parent_agent_id: None,