Add files via upload

2026-08-19 01:17:16 +02:00 · 2026-08-18 20:36:34 +08:00
parent 5aa2c382b0
commit 5720de0d27
50 changed files with 11832 additions and 0 deletions
@@ -0,0 +1,195 @@
+package builtin
+
+// 内置工具名称常量
+// 所有代码中使用内置工具名称的地方都应该使用这些常量，而不是硬编码字符串
+const (
+	// 漏洞管理工具
+	ToolRecordVulnerability = "record_vulnerability"
+	ToolListVulnerabilities = "list_vulnerabilities"
+	ToolGetVulnerability    = "get_vulnerability"
+
+	// 资产管理工具
+	ToolCreateAsset       = "create_asset"
+	ToolGetAsset          = "get_asset"
+	ToolQueryAssets       = "query_assets"
+	ToolUpdateAsset       = "update_asset"
+	ToolDeleteAsset       = "delete_asset"
+	ToolCompleteAssetScan = "complete_asset_scan"
+
+	// 项目黑板（事实）工具
+	ToolUpsertProjectFact    = "upsert_project_fact"
+	ToolGetProjectFact       = "get_project_fact"
+	ToolListProjectFacts     = "list_project_facts"
+	ToolSearchProjectFacts   = "search_project_facts"
+	ToolDeprecateProjectFact = "deprecate_project_fact"
+	ToolRestoreProjectFact   = "restore_project_fact"
+
+	// 知识库工具
+	ToolListKnowledgeRiskTypes = "list_knowledge_risk_types"
+	ToolSearchKnowledgeBase    = "search_knowledge_base"
+
+	// 视觉分析（本地图片 → VL 模型 → 文本摘要）
+	ToolAnalyzeImage = "analyze_image"
+
+	// 长耗时工具执行控制（后台 execution 查询/等待/取消）
+	ToolGetToolExecution    = "get_tool_execution"
+	ToolWaitToolExecution   = "wait_tool_execution"
+	ToolCancelToolExecution = "cancel_tool_execution"
+
+	// WebShell 助手工具（AI 在 WebShell 管理 - AI 助手 中使用）
+	ToolWebshellExec      = "webshell_exec"
+	ToolWebshellFileList  = "webshell_file_list"
+	ToolWebshellFileRead  = "webshell_file_read"
+	ToolWebshellFileWrite = "webshell_file_write"
+
+	// WebShell 连接管理工具（用于通过 MCP 管理 webshell 连接）
+	ToolManageWebshellList   = "manage_webshell_list"
+	ToolManageWebshellAdd    = "manage_webshell_add"
+	ToolManageWebshellUpdate = "manage_webshell_update"
+	ToolManageWebshellDelete = "manage_webshell_delete"
+	ToolManageWebshellTest   = "manage_webshell_test"
+
+	// 批量任务队列（与 Web 端批量任务一致，供模型创建/启停/查询队列）
+	ToolBatchTaskList            = "batch_task_list"
+	ToolBatchTaskGet             = "batch_task_get"
+	ToolBatchTaskCreate          = "batch_task_create"
+	ToolBatchTaskStart           = "batch_task_start"
+	ToolBatchTaskRerun           = "batch_task_rerun"
+	ToolBatchTaskPause           = "batch_task_pause"
+	ToolBatchTaskDelete          = "batch_task_delete"
+	ToolBatchTaskUpdateMetadata  = "batch_task_update_metadata"
+	ToolBatchTaskUpdateSchedule  = "batch_task_update_schedule"
+	ToolBatchTaskScheduleEnabled = "batch_task_schedule_enabled"
+	ToolBatchTaskAdd             = "batch_task_add_task"
+	ToolBatchTaskUpdate          = "batch_task_update_task"
+	ToolBatchTaskRemove          = "batch_task_remove_task"
+
+	// C2 工具集（合并同类项，8 个统一工具）
+	ToolC2Listener   = "c2_listener"    // 监听器管理（create/start/stop/list/get/update/delete）
+	ToolC2Session    = "c2_session"     // 会话管理（list/get/set_sleep/kill/delete）
+	ToolC2Task       = "c2_task"        // 任务下发（统一 task_type 参数）
+	ToolC2TaskManage = "c2_task_manage" // 任务管理（get_result/wait/list/cancel）
+	ToolC2Payload    = "c2_payload"     // Payload 生成（oneliner/build）
+	ToolC2Event      = "c2_event"       // 事件查询
+	ToolC2Profile    = "c2_profile"     // Malleable Profile 管理（list/get/create/update/delete）
+	ToolC2File       = "c2_file"        // 文件管理（list/get_result）
+)
+
+// IsBuiltinTool 检查工具名称是否是内置工具
+func IsBuiltinTool(toolName string) bool {
+	switch toolName {
+	case ToolRecordVulnerability,
+		ToolListVulnerabilities,
+		ToolGetVulnerability,
+		ToolCreateAsset,
+		ToolGetAsset,
+		ToolQueryAssets,
+		ToolUpdateAsset,
+		ToolDeleteAsset,
+		ToolCompleteAssetScan,
+		ToolUpsertProjectFact,
+		ToolGetProjectFact,
+		ToolListProjectFacts,
+		ToolSearchProjectFacts,
+		ToolDeprecateProjectFact,
+		ToolRestoreProjectFact,
+		ToolListKnowledgeRiskTypes,
+		ToolSearchKnowledgeBase,
+		ToolAnalyzeImage,
+		ToolGetToolExecution,
+		ToolWaitToolExecution,
+		ToolCancelToolExecution,
+		ToolWebshellExec,
+		ToolWebshellFileList,
+		ToolWebshellFileRead,
+		ToolWebshellFileWrite,
+		ToolManageWebshellList,
+		ToolManageWebshellAdd,
+		ToolManageWebshellUpdate,
+		ToolManageWebshellDelete,
+		ToolManageWebshellTest,
+		ToolBatchTaskList,
+		ToolBatchTaskGet,
+		ToolBatchTaskCreate,
+		ToolBatchTaskStart,
+		ToolBatchTaskRerun,
+		ToolBatchTaskPause,
+		ToolBatchTaskDelete,
+		ToolBatchTaskUpdateMetadata,
+		ToolBatchTaskUpdateSchedule,
+		ToolBatchTaskScheduleEnabled,
+		ToolBatchTaskAdd,
+		ToolBatchTaskUpdate,
+		ToolBatchTaskRemove,
+		// C2 工具
+		ToolC2Listener,
+		ToolC2Session,
+		ToolC2Task,
+		ToolC2TaskManage,
+		ToolC2Payload,
+		ToolC2Event,
+		ToolC2Profile,
+		ToolC2File:
+		return true
+	default:
+		return false
+	}
+}
+
+// GetAllBuiltinTools 返回所有内置工具名称列表
+func GetAllBuiltinTools() []string {
+	return []string{
+		ToolRecordVulnerability,
+		ToolListVulnerabilities,
+		ToolGetVulnerability,
+		ToolCreateAsset,
+		ToolGetAsset,
+		ToolQueryAssets,
+		ToolUpdateAsset,
+		ToolDeleteAsset,
+		ToolCompleteAssetScan,
+		ToolUpsertProjectFact,
+		ToolGetProjectFact,
+		ToolListProjectFacts,
+		ToolSearchProjectFacts,
+		ToolDeprecateProjectFact,
+		ToolRestoreProjectFact,
+		ToolListKnowledgeRiskTypes,
+		ToolSearchKnowledgeBase,
+		ToolAnalyzeImage,
+		ToolGetToolExecution,
+		ToolWaitToolExecution,
+		ToolCancelToolExecution,
+		ToolWebshellExec,
+		ToolWebshellFileList,
+		ToolWebshellFileRead,
+		ToolWebshellFileWrite,
+		ToolManageWebshellList,
+		ToolManageWebshellAdd,
+		ToolManageWebshellUpdate,
+		ToolManageWebshellDelete,
+		ToolManageWebshellTest,
+		ToolBatchTaskList,
+		ToolBatchTaskGet,
+		ToolBatchTaskCreate,
+		ToolBatchTaskStart,
+		ToolBatchTaskRerun,
+		ToolBatchTaskPause,
+		ToolBatchTaskDelete,
+		ToolBatchTaskUpdateMetadata,
+		ToolBatchTaskUpdateSchedule,
+		ToolBatchTaskScheduleEnabled,
+		ToolBatchTaskAdd,
+		ToolBatchTaskUpdate,
+		ToolBatchTaskRemove,
+		// C2 工具
+		ToolC2Listener,
+		ToolC2Session,
+		ToolC2Task,
+		ToolC2TaskManage,
+		ToolC2Payload,
+		ToolC2Event,
+		ToolC2Profile,
+		ToolC2File,
+	}
+}
@@ -0,0 +1,475 @@
+// Package mcp 外部 MCP 客户端 - 基于官方 go-sdk 实现，保证协议兼容性
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"os/exec"
+	"strings"
+	"sync"
+	"time"
+
+	"cyberstrike-ai/internal/config"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+	"go.uber.org/zap"
+)
+
+const (
+	clientName    = "CyberStrikeAI"
+	clientVersion = "1.0.0"
+)
+
+// sdkClient 基于官方 MCP Go SDK 的外部 MCP 客户端，实现 ExternalMCPClient 接口
+type sdkClient struct {
+	session *mcp.ClientSession
+	client  *mcp.Client
+	logger  *zap.Logger
+	mu      sync.RWMutex
+	status  string // "disconnected", "connecting", "connected", "error"
+}
+
+// newSDKClientFromSession 用已连接成功的 session 构造（供 createSDKClient 内部使用）
+func newSDKClientFromSession(session *mcp.ClientSession, client *mcp.Client, logger *zap.Logger) *sdkClient {
+	return &sdkClient{
+		session: session,
+		client:  client,
+		logger:  logger,
+		status:  "connected",
+	}
+}
+
+// lazySDKClient 延迟连接：Initialize() 时才调用官方 SDK 建立连接，对外实现 ExternalMCPClient
+type lazySDKClient struct {
+	serverCfg     config.ExternalMCPServerConfig
+	logger        *zap.Logger
+	sessionCancel context.CancelFunc
+	inner         ExternalMCPClient // connected SDK client
+	mu            sync.RWMutex
+	status        string
+}
+
+func newLazySDKClient(serverCfg config.ExternalMCPServerConfig, logger *zap.Logger) *lazySDKClient {
+	return &lazySDKClient{
+		serverCfg: serverCfg,
+		logger:    logger,
+		status:    "connecting",
+	}
+}
+
+func (c *lazySDKClient) setStatus(s string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.status = s
+}
+
+func (c *lazySDKClient) GetStatus() string {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	if c.inner != nil {
+		return c.inner.GetStatus()
+	}
+	return c.status
+}
+
+func (c *lazySDKClient) IsConnected() bool {
+	c.mu.RLock()
+	inner := c.inner
+	c.mu.RUnlock()
+	if inner != nil {
+		return inner.IsConnected()
+	}
+	return false
+}
+
+func (c *lazySDKClient) Initialize(ctx context.Context) error {
+	c.mu.Lock()
+	if c.inner != nil {
+		c.mu.Unlock()
+		return nil
+	}
+	c.mu.Unlock()
+
+	sessionCtx, sessionCancel := context.WithCancel(context.Background())
+	type connectResult struct {
+		inner ExternalMCPClient
+		err   error
+	}
+	resultCh := make(chan connectResult)
+	abandoned := make(chan struct{})
+	go func() {
+		inner, err := createSDKClient(sessionCtx, c.serverCfg, c.logger)
+		select {
+		case resultCh <- connectResult{inner: inner, err: err}:
+		case <-abandoned:
+			if inner != nil {
+				_ = inner.Close()
+			}
+			sessionCancel()
+		}
+	}()
+
+	var result connectResult
+	select {
+	case result = <-resultCh:
+	case <-ctx.Done():
+		close(abandoned)
+		sessionCancel()
+		c.setStatus("error")
+		return ctx.Err()
+	}
+
+	if err := ctx.Err(); err != nil {
+		sessionCancel()
+		if result.inner != nil {
+			_ = result.inner.Close()
+		}
+		c.setStatus("error")
+		return err
+	}
+
+	if result.err != nil {
+		sessionCancel()
+		c.setStatus("error")
+		return result.err
+	}
+
+	c.mu.Lock()
+	if c.inner != nil {
+		c.mu.Unlock()
+		sessionCancel()
+		if result.inner != nil {
+			_ = result.inner.Close()
+		}
+		return nil
+	}
+	c.inner = result.inner
+	c.sessionCancel = sessionCancel
+	c.mu.Unlock()
+	c.setStatus("connected")
+	return nil
+}
+
+func (c *lazySDKClient) ListTools(ctx context.Context) ([]Tool, error) {
+	c.mu.RLock()
+	inner := c.inner
+	c.mu.RUnlock()
+	if inner == nil {
+		return nil, fmt.Errorf("未连接")
+	}
+	return inner.ListTools(ctx)
+}
+
+func (c *lazySDKClient) CallTool(ctx context.Context, name string, args map[string]interface{}) (*ToolResult, error) {
+	c.mu.RLock()
+	inner := c.inner
+	c.mu.RUnlock()
+	if inner == nil {
+		return nil, fmt.Errorf("未连接")
+	}
+	return inner.CallTool(ctx, name, args)
+}
+
+func (c *lazySDKClient) Close() error {
+	c.mu.Lock()
+	inner := c.inner
+	sessionCancel := c.sessionCancel
+	c.inner = nil
+	c.sessionCancel = nil
+	c.mu.Unlock()
+	c.setStatus("disconnected")
+	if sessionCancel != nil {
+		sessionCancel()
+	}
+	if inner != nil {
+		return inner.Close()
+	}
+	return nil
+}
+
+// markDisconnected 在检测到传输层断连时关闭底层 session，避免 IsConnected 仍返回 true。
+func (c *lazySDKClient) markDisconnected() {
+	c.mu.Lock()
+	inner := c.inner
+	sessionCancel := c.sessionCancel
+	c.inner = nil
+	c.sessionCancel = nil
+	c.mu.Unlock()
+	if sessionCancel != nil {
+		sessionCancel()
+	}
+	if inner != nil {
+		_ = inner.Close()
+	}
+	c.setStatus("disconnected")
+}
+
+func (c *sdkClient) setStatus(s string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.status = s
+}
+
+func (c *sdkClient) GetStatus() string {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.status
+}
+
+func (c *sdkClient) IsConnected() bool {
+	return c.GetStatus() == "connected"
+}
+
+func (c *sdkClient) Initialize(ctx context.Context) error {
+	// sdkClient 由 createSDKClient 在 Connect 成功后才创建，因此 Initialize 时已经连接
+	// 此方法仅用于满足 ExternalMCPClient 接口，实际连接在 createSDKClient 中完成
+	return nil
+}
+
+func (c *sdkClient) ListTools(ctx context.Context) ([]Tool, error) {
+	if c.session == nil {
+		return nil, fmt.Errorf("未连接")
+	}
+	res, err := c.session.ListTools(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	if res == nil {
+		return nil, nil
+	}
+	return sdkToolsToOur(res.Tools), nil
+}
+
+func (c *sdkClient) CallTool(ctx context.Context, name string, args map[string]interface{}) (*ToolResult, error) {
+	if c.session == nil {
+		return nil, fmt.Errorf("未连接")
+	}
+	params := &mcp.CallToolParams{
+		Name:      name,
+		Arguments: args,
+	}
+	res, err := c.session.CallTool(ctx, params)
+	if err != nil {
+		return nil, err
+	}
+	return sdkCallToolResultToOurs(res), nil
+}
+
+func (c *sdkClient) Close() error {
+	c.setStatus("disconnected")
+	if c.session != nil {
+		err := c.session.Close()
+		c.session = nil
+		return err
+	}
+	return nil
+}
+
+// sdkToolsToOur 将 SDK 的 []*mcp.Tool 转为我们的 []Tool
+func sdkToolsToOur(tools []*mcp.Tool) []Tool {
+	if len(tools) == 0 {
+		return nil
+	}
+	out := make([]Tool, 0, len(tools))
+	for _, t := range tools {
+		if t == nil {
+			continue
+		}
+		schema := make(map[string]interface{})
+		if t.InputSchema != nil {
+			// SDK InputSchema 可能为 *jsonschema.Schema 或 map，统一转为 map
+			if m, ok := t.InputSchema.(map[string]interface{}); ok {
+				schema = m
+			} else {
+				_ = json.Unmarshal(mustJSON(t.InputSchema), &schema)
+			}
+		}
+		desc := t.Description
+		shortDesc := desc
+		if t.Annotations != nil && t.Annotations.Title != "" {
+			shortDesc = t.Annotations.Title
+		}
+		out = append(out, Tool{
+			Name:             t.Name,
+			Description:      desc,
+			ShortDescription: shortDesc,
+			InputSchema:      schema,
+		})
+	}
+	return out
+}
+
+// sdkCallToolResultToOurs 将 SDK 的 *mcp.CallToolResult 转为我们的 *ToolResult
+func sdkCallToolResultToOurs(res *mcp.CallToolResult) *ToolResult {
+	if res == nil {
+		return &ToolResult{Content: []Content{}}
+	}
+	content := sdkContentToOurs(res.Content)
+	return &ToolResult{
+		Content: content,
+		IsError: res.IsError,
+	}
+}
+
+func sdkContentToOurs(list []mcp.Content) []Content {
+	if len(list) == 0 {
+		return nil
+	}
+	out := make([]Content, 0, len(list))
+	for _, c := range list {
+		switch v := c.(type) {
+		case *mcp.TextContent:
+			out = append(out, Content{Type: "text", Text: v.Text})
+		default:
+			out = append(out, Content{Type: "text", Text: fmt.Sprintf("%v", c)})
+		}
+	}
+	return out
+}
+
+func mustJSON(v interface{}) []byte {
+	b, _ := json.Marshal(v)
+	return b
+}
+
+// createSDKClient 根据配置创建并连接外部 MCP 客户端（使用官方 SDK），返回实现 ExternalMCPClient 的 *sdkClient
+// 若连接失败返回 (nil, error)。ctx 用于连接超时与取消。
+func createSDKClient(ctx context.Context, serverCfg config.ExternalMCPServerConfig, logger *zap.Logger) (ExternalMCPClient, error) {
+	timeout := time.Duration(serverCfg.Timeout) * time.Second
+	if timeout <= 0 {
+		timeout = 30 * time.Second
+	}
+
+	transport := serverCfg.GetTransportType()
+	if transport == "" {
+		return nil, fmt.Errorf("配置缺少 command 或 url，且未指定 type/transport")
+	}
+
+	// 构造 ClientOptions：KeepAlive 心跳
+	var clientOpts *mcp.ClientOptions
+	if serverCfg.KeepAlive > 0 {
+		clientOpts = &mcp.ClientOptions{
+			KeepAlive: time.Duration(serverCfg.KeepAlive) * time.Second,
+		}
+	}
+
+	client := mcp.NewClient(&mcp.Implementation{
+		Name:    clientName,
+		Version: clientVersion,
+	}, clientOpts)
+
+	var t mcp.Transport
+	switch transport {
+	case "stdio":
+		if serverCfg.Command == "" {
+			return nil, fmt.Errorf("stdio 模式需要配置 command")
+		}
+		// 必须用 exec.Command 而非 CommandContext：doConnect 返回后 ctx 会被 cancel，
+		// 若用 CommandContext(ctx) 会立刻杀掉子进程，导致 ListTools 等后续请求失败、显示 0 工具
+		cmd := exec.Command(serverCfg.Command, serverCfg.Args...)
+		if len(serverCfg.Env) > 0 {
+			cmd.Env = append(cmd.Env, envMapToSlice(serverCfg.Env)...)
+		}
+		ct := &mcp.CommandTransport{Command: cmd}
+		if serverCfg.TerminateDuration > 0 {
+			ct.TerminateDuration = time.Duration(serverCfg.TerminateDuration) * time.Second
+		}
+		t = ct
+	case "sse":
+		if serverCfg.URL == "" {
+			return nil, fmt.Errorf("sse 模式需要配置 url")
+		}
+		// SSE 是长连接（GET 流持续打开），不能设置 http.Client.Timeout（会在超时后杀掉整个连接导致 EOF）。
+		// 超时由每次 ListTools/CallTool 的 context 单独控制。
+		httpClient := httpClientForLongLived(serverCfg.Headers)
+		t = &mcp.SSEClientTransport{
+			Endpoint:   serverCfg.URL,
+			HTTPClient: httpClient,
+		}
+	case "http":
+		if serverCfg.URL == "" {
+			return nil, fmt.Errorf("http 模式需要配置 url")
+		}
+		httpClient := httpClientWithTimeoutAndHeaders(timeout, serverCfg.Headers)
+		st := &mcp.StreamableClientTransport{
+			Endpoint:   serverCfg.URL,
+			HTTPClient: httpClient,
+		}
+		if serverCfg.MaxRetries > 0 {
+			st.MaxRetries = serverCfg.MaxRetries
+		}
+		t = st
+	default:
+		return nil, fmt.Errorf("不支持的传输模式: %s（支持: stdio, sse, http）", transport)
+	}
+
+	session, err := client.Connect(ctx, t, nil)
+	if err != nil {
+		return nil, fmt.Errorf("连接失败: %w", err)
+	}
+
+	return newSDKClientFromSession(session, client, logger), nil
+}
+
+func envMapToSlice(env map[string]string) []string {
+	m := make(map[string]string)
+	for _, s := range os.Environ() {
+		if i := strings.IndexByte(s, '='); i > 0 {
+			m[s[:i]] = s[i+1:]
+		}
+	}
+	for k, v := range env {
+		m[k] = v
+	}
+	out := make([]string, 0, len(m))
+	for k, v := range m {
+		out = append(out, k+"="+v)
+	}
+	return out
+}
+
+func httpClientWithTimeoutAndHeaders(timeout time.Duration, headers map[string]string) *http.Client {
+	transport := http.DefaultTransport
+	if len(headers) > 0 {
+		transport = &headerRoundTripper{
+			headers: headers,
+			base:    http.DefaultTransport,
+		}
+	}
+	return &http.Client{
+		Timeout:   timeout,
+		Transport: transport,
+	}
+}
+
+// httpClientForLongLived 创建不设超时的 HTTP 客户端，用于 SSE 等长连接传输。
+// SSE 的 GET 流会持续打开，http.Client.Timeout 会在超时后强制关闭连接导致 EOF。
+// 超时由调用方通过 context 控制。
+func httpClientForLongLived(headers map[string]string) *http.Client {
+	transport := http.DefaultTransport
+	if len(headers) > 0 {
+		transport = &headerRoundTripper{
+			headers: headers,
+			base:    http.DefaultTransport,
+		}
+	}
+	return &http.Client{
+		Transport: transport,
+		// 不设 Timeout，SSE 长连接的超时由 per-request context 控制
+	}
+}
+
+type headerRoundTripper struct {
+	headers map[string]string
+	base    http.RoundTripper
+}
+
+func (h *headerRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	for k, v := range h.headers {
+		req.Header.Set(k, v)
+	}
+	return h.base.RoundTrip(req)
+}
@@ -0,0 +1,192 @@
+package mcp
+
+import (
+	"context"
+	"errors"
+	"io"
+	"strings"
+	"time"
+
+	"go.uber.org/zap"
+)
+
+const (
+	// externalReconnectMinInterval 两次自动重连之间的最短间隔
+	externalReconnectMinInterval = 30 * time.Second
+	// externalReconnectMaxBackoff 指数退避上限
+	externalReconnectMaxBackoff = 5 * time.Minute
+)
+
+// isConnectionDeadError 判断错误是否表示底层传输已断开（而非调用方主动取消或超时）。
+func isConnectionDeadError(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+		return false
+	}
+	if errors.Is(err, io.EOF) {
+		return true
+	}
+	s := strings.ToLower(err.Error())
+	return strings.Contains(s, "eof") ||
+		strings.Contains(s, "client is closing") ||
+		strings.Contains(s, "connection closed") ||
+		strings.Contains(s, "connection reset") ||
+		strings.Contains(s, "broken pipe")
+}
+
+// handleConnectionDead 在 ListTools/CallTool 等操作失败且判定为断连时，标记客户端并调度重连。
+func (m *ExternalMCPManager) handleConnectionDead(name string, client ExternalMCPClient, err error) {
+	if !isConnectionDeadError(err) {
+		return
+	}
+	m.logger.Warn("检测到外部MCP连接已断开，将尝试自动重连",
+		zap.String("name", name),
+		zap.Error(err),
+	)
+	m.markClientDisconnected(name, client, err)
+	m.scheduleReconnect(name)
+}
+
+func (m *ExternalMCPManager) markClientDisconnected(name string, client ExternalMCPClient, err error) {
+	if lazy, ok := client.(*lazySDKClient); ok {
+		lazy.markDisconnected()
+	}
+	m.mu.Lock()
+	if err != nil {
+		m.errors[name] = "连接已断开: " + err.Error()
+	}
+	m.mu.Unlock()
+	m.toolCountsMu.Lock()
+	m.toolCounts[name] = 0
+	m.toolCountsMu.Unlock()
+}
+
+func (m *ExternalMCPManager) onClientConnected(name string) {
+	m.clearReconnectState(name)
+}
+
+func (m *ExternalMCPManager) clearReconnectState(name string) {
+	m.reconnectMu.Lock()
+	delete(m.reconnectAttempts, name)
+	delete(m.reconnectLastTry, name)
+	delete(m.reconnecting, name)
+	m.reconnectMu.Unlock()
+}
+
+func (m *ExternalMCPManager) reconnectBackoff(attempts int) time.Duration {
+	if attempts <= 0 {
+		return 0
+	}
+	d := externalReconnectMinInterval
+	for i := 1; i < attempts && d < externalReconnectMaxBackoff; i++ {
+		d *= 2
+	}
+	if d > externalReconnectMaxBackoff {
+		return externalReconnectMaxBackoff
+	}
+	return d
+}
+
+func (m *ExternalMCPManager) scheduleReconnect(name string) {
+	m.mu.RLock()
+	cfg, exists := m.configs[name]
+	enabled := exists && m.isEnabled(cfg)
+	m.mu.RUnlock()
+	if !enabled {
+		return
+	}
+	go m.tryReconnect(name)
+}
+
+func (m *ExternalMCPManager) tryReconnect(name string) {
+	m.reconnectMu.Lock()
+	if m.reconnecting[name] {
+		m.reconnectMu.Unlock()
+		return
+	}
+	attempts := m.reconnectAttempts[name]
+	if wait := m.reconnectBackoff(attempts); wait > 0 {
+		if last, ok := m.reconnectLastTry[name]; ok {
+			if elapsed := time.Since(last); elapsed < wait {
+				remaining := wait - elapsed
+				m.reconnectMu.Unlock()
+				m.scheduleReconnectAfter(name, remaining)
+				return
+			}
+		}
+	}
+	m.reconnecting[name] = true
+	m.reconnectMu.Unlock()
+
+	defer func() {
+		m.reconnectMu.Lock()
+		delete(m.reconnecting, name)
+		m.reconnectMu.Unlock()
+	}()
+
+	m.mu.RLock()
+	cfg, exists := m.configs[name]
+	enabled := exists && m.isEnabled(cfg)
+	client, hasClient := m.clients[name]
+	connecting := hasClient && client.GetStatus() == "connecting"
+	m.mu.RUnlock()
+
+	if !enabled {
+		m.logger.Debug("跳过自动重连（外部MCP已停用）", zap.String("name", name))
+		return
+	}
+	if connecting {
+		m.logger.Debug("跳过自动重连（连接正在进行中）", zap.String("name", name))
+		return
+	}
+
+	m.reconnectMu.Lock()
+	m.reconnectLastTry[name] = time.Now()
+	m.reconnectAttempts[name] = attempts + 1
+	attemptNum := m.reconnectAttempts[name]
+	m.reconnectMu.Unlock()
+
+	m.logger.Info("正在自动重连外部MCP",
+		zap.String("name", name),
+		zap.Int("attempt", attemptNum),
+	)
+
+	if err := m.startClient(name, true); err != nil {
+		m.logger.Warn("自动重连外部MCP失败",
+			zap.String("name", name),
+			zap.Error(err),
+		)
+	}
+}
+
+// scheduleReconnectAfterFailure 在自动重连失败后，按当前退避间隔预约下一次重试。
+func (m *ExternalMCPManager) scheduleReconnectAfterFailure(name string) {
+	m.mu.RLock()
+	cfg, exists := m.configs[name]
+	enabled := exists && m.isEnabled(cfg)
+	m.mu.RUnlock()
+	if !enabled {
+		return
+	}
+	m.reconnectMu.Lock()
+	wait := m.reconnectBackoff(m.reconnectAttempts[name])
+	m.reconnectMu.Unlock()
+	m.logger.Info("自动重连失败，将按退避间隔再次尝试",
+		zap.String("name", name),
+		zap.Duration("after", wait),
+	)
+	m.scheduleReconnectAfter(name, wait)
+}
+
+// scheduleReconnectAfter 在 delay 后触发 tryReconnect（delay<=0 时立即执行）。
+func (m *ExternalMCPManager) scheduleReconnectAfter(name string, delay time.Duration) {
+	if delay <= 0 {
+		go m.tryReconnect(name)
+		return
+	}
+	time.AfterFunc(delay, func() {
+		m.tryReconnect(name)
+	})
+}
@@ -0,0 +1,215 @@
+package mcp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"testing"
+	"time"
+
+	"cyberstrike-ai/internal/config"
+
+	"go.uber.org/zap"
+)
+
+func TestIsConnectionDeadError(t *testing.T) {
+	t.Parallel()
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"nil", nil, false},
+		{"eof", io.EOF, true},
+		{"wrapped eof", fmt.Errorf("connection closed: %w", io.EOF), true},
+		{"client closing", errors.New(`calling "tools/list": client is closing: EOF`), true},
+		{"connection reset", errors.New("read tcp: connection reset by peer"), true},
+		{"canceled", context.Canceled, false},
+		{"deadline", context.DeadlineExceeded, false},
+		{"other", errors.New("invalid params"), false},
+	}
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			if got := isConnectionDeadError(tc.err); got != tc.want {
+				t.Fatalf("isConnectionDeadError(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestLazySDKClient_MarkDisconnected(t *testing.T) {
+	c := &lazySDKClient{status: "connected"}
+	c.inner = &sdkClient{status: "connected"}
+	c.markDisconnected()
+	if c.IsConnected() {
+		t.Fatal("expected disconnected after markDisconnected")
+	}
+	if c.GetStatus() != "disconnected" {
+		t.Fatalf("expected status disconnected, got %s", c.GetStatus())
+	}
+}
+
+func TestHandleConnectionDead_MarksLazyClientDisconnected(t *testing.T) {
+	logger := zap.NewNop()
+	m := NewExternalMCPManager(logger)
+
+	name := "dead-mcp"
+	cfg := config.ExternalMCPServerConfig{
+		Type:              "http",
+		URL:               "http://example.com/mcp",
+		ExternalMCPEnable: true,
+	}
+	m.mu.Lock()
+	m.configs[name] = cfg
+	client := newLazySDKClient(cfg, logger)
+	client.inner = &sdkClient{status: "connected"}
+	client.status = "connected"
+	m.clients[name] = client
+	m.mu.Unlock()
+
+	deadErr := errors.New(`connection closed: calling "tools/list": client is closing: EOF`)
+	m.handleConnectionDead(name, client, deadErr)
+
+	if client.IsConnected() {
+		t.Fatal("expected disconnected after handleConnectionDead")
+	}
+	if m.GetError(name) == "" {
+		t.Fatal("expected error message to be recorded")
+	}
+	counts := m.GetToolCounts()
+	if counts[name] != 0 {
+		t.Fatalf("expected tool count 0 after disconnect, got %d", counts[name])
+	}
+}
+
+func TestReconnectBackoff(t *testing.T) {
+	t.Parallel()
+	if d := (&ExternalMCPManager{}).reconnectBackoff(0); d != 0 {
+		t.Fatalf("attempt 0: got %v", d)
+	}
+	if d := (&ExternalMCPManager{}).reconnectBackoff(1); d != externalReconnectMinInterval {
+		t.Fatalf("attempt 1: got %v", d)
+	}
+	if d := (&ExternalMCPManager{}).reconnectBackoff(10); d != externalReconnectMaxBackoff {
+		t.Fatalf("attempt 10: got %v, want cap %v", d, externalReconnectMaxBackoff)
+	}
+}
+
+func TestTryReconnect_RateLimited(t *testing.T) {
+	logger := zap.NewNop()
+	m := NewExternalMCPManager(logger)
+
+	name := "rate-limited"
+	m.reconnectMu.Lock()
+	m.reconnectLastTry[name] = time.Now()
+	m.reconnectAttempts[name] = 2
+	m.reconnectMu.Unlock()
+
+	m.tryReconnect(name)
+
+	m.reconnectMu.Lock()
+	attempts := m.reconnectAttempts[name]
+	m.reconnectMu.Unlock()
+	if attempts != 2 {
+		t.Fatalf("rate limited reconnect should not increment attempts, got %d", attempts)
+	}
+}
+
+func TestTryReconnect_SkipsWhenDisabled(t *testing.T) {
+	logger := zap.NewNop()
+	m := NewExternalMCPManager(logger)
+
+	name := "disabled-mcp"
+	m.mu.Lock()
+	m.configs[name] = config.ExternalMCPServerConfig{
+		Type:              "http",
+		URL:               "http://example.com/mcp",
+		ExternalMCPEnable: false,
+	}
+	m.mu.Unlock()
+
+	m.tryReconnect(name)
+
+	m.reconnectMu.Lock()
+	attempts := m.reconnectAttempts[name]
+	m.reconnectMu.Unlock()
+	if attempts != 0 {
+		t.Fatalf("disabled MCP should not increment reconnect attempts, got %d", attempts)
+	}
+}
+
+func TestTryReconnect_SkipsWhenConnecting(t *testing.T) {
+	logger := zap.NewNop()
+	m := NewExternalMCPManager(logger)
+
+	name := "connecting-mcp"
+	cfg := config.ExternalMCPServerConfig{
+		Type:              "http",
+		URL:               "http://example.com/mcp",
+		ExternalMCPEnable: true,
+	}
+	client := newLazySDKClient(cfg, logger)
+	client.setStatus("connecting")
+
+	m.mu.Lock()
+	m.configs[name] = cfg
+	m.clients[name] = client
+	m.mu.Unlock()
+
+	m.tryReconnect(name)
+
+	m.reconnectMu.Lock()
+	attempts := m.reconnectAttempts[name]
+	m.reconnectMu.Unlock()
+	if attempts != 0 {
+		t.Fatalf("connecting MCP should not increment reconnect attempts, got %d", attempts)
+	}
+}
+
+func TestStartClientAutoReconnect_SkipsWhenDisabled(t *testing.T) {
+	logger := zap.NewNop()
+	m := NewExternalMCPManager(logger)
+	m.stopRefresh = make(chan struct{})
+
+	name := "stopped"
+	m.mu.Lock()
+	m.configs[name] = config.ExternalMCPServerConfig{
+		Type:              "http",
+		URL:               "http://example.com/mcp",
+		ExternalMCPEnable: false,
+	}
+	m.mu.Unlock()
+
+	if err := m.startClient(name, true); err != nil {
+		t.Fatalf("startClient: %v", err)
+	}
+
+	m.mu.RLock()
+	cfg := m.configs[name]
+	_, hasClient := m.clients[name]
+	m.mu.RUnlock()
+	if cfg.ExternalMCPEnable {
+		t.Fatal("auto reconnect should not enable stopped MCP")
+	}
+	if hasClient {
+		t.Fatal("auto reconnect should not create client when disabled")
+	}
+}
+
+func TestOnClientConnected_ClearsReconnectState(t *testing.T) {
+	m := &ExternalMCPManager{
+		reconnectAttempts: map[string]int{"x": 3},
+		reconnectLastTry:  map[string]time.Time{"x": time.Now()},
+		reconnecting:      map[string]bool{"x": true},
+	}
+	m.onClientConnected("x")
+
+	m.reconnectMu.Lock()
+	defer m.reconnectMu.Unlock()
+	if len(m.reconnectAttempts) != 0 || len(m.reconnectLastTry) != 0 || len(m.reconnecting) != 0 {
+		t.Fatal("expected reconnect state cleared")
+	}
+}
@@ -0,0 +1,296 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"cyberstrike-ai/internal/mcp/builtin"
+)
+
+const (
+	defaultExecutionWaitTimeout = 60 * time.Second
+	maxExecutionWaitTimeout     = 10 * time.Minute
+	defaultPartialPreviewBytes  = 4096
+	maxPartialPreviewBytes      = 64 * 1024
+)
+
+// RegisterExecutionControlTools exposes execution handle operations to Eino as
+// ordinary MCP tools. This keeps the agent loop native: the model calls a tool,
+// receives a bounded result, and may call wait_tool_execution again if needed.
+func RegisterExecutionControlTools(server *Server, external *ExternalMCPManager) {
+	if server == nil {
+		return
+	}
+
+	server.RegisterTool(Tool{
+		Name:             builtin.ToolGetToolExecution,
+		Description:      "查询后台工具 execution 的当前状态、结果和错误。用于外部 MCP 工具等待超时后，凭 execution_id 继续查看进度。",
+		ShortDescription: "查询后台工具执行状态",
+		InputSchema: map[string]interface{}{
+			"type": "object",
+			"properties": map[string]interface{}{
+				"execution_id":             map[string]interface{}{"type": "string", "description": "工具执行 ID"},
+				"include_partial_output":   map[string]interface{}{"type": "boolean", "description": "是否返回运行中已产生输出的尾部预览，默认 true"},
+				"partial_output_max_bytes": map[string]interface{}{"type": "number", "description": "partial_output 最多返回字节数，默认 4096，最大 65536"},
+			},
+			"required": []string{"execution_id"},
+		},
+	}, func(ctx context.Context, args map[string]interface{}) (*ToolResult, error) {
+		id := stringArg(args, "execution_id")
+		if id == "" {
+			return textToolResult("execution_id 必填", true), nil
+		}
+		exec := lookupToolExecution(server, external, id)
+		if exec == nil {
+			return textToolResult("未找到该 execution_id: "+id, true), nil
+		}
+		return textToolResult(formatExecutionForModel(exec, executionFormatOptionsFromArgs(args)), false), nil
+	})
+
+	server.RegisterTool(Tool{
+		Name:             builtin.ToolWaitToolExecution,
+		Description:      "继续等待一个后台工具 execution 完成。每次等待都有 timeout_seconds 上限；若仍未完成，会返回当前状态，模型可稍后再次调用。",
+		ShortDescription: "有界等待后台工具执行",
+		InputSchema: map[string]interface{}{
+			"type": "object",
+			"properties": map[string]interface{}{
+				"execution_id":             map[string]interface{}{"type": "string", "description": "工具执行 ID"},
+				"timeout_seconds":          map[string]interface{}{"type": "number", "description": "本次最多等待秒数，默认 60，最大 600"},
+				"include_partial_output":   map[string]interface{}{"type": "boolean", "description": "是否返回运行中已产生输出的尾部预览，默认 true"},
+				"partial_output_max_bytes": map[string]interface{}{"type": "number", "description": "partial_output 最多返回字节数，默认 4096，最大 65536"},
+			},
+			"required": []string{"execution_id"},
+		},
+	}, func(ctx context.Context, args map[string]interface{}) (*ToolResult, error) {
+		id := stringArg(args, "execution_id")
+		if id == "" {
+			return textToolResult("execution_id 必填", true), nil
+		}
+		wait := durationSecondsArg(args, "timeout_seconds", defaultExecutionWaitTimeout, maxExecutionWaitTimeout)
+		snap, err := waitToolExecutionSnapshot(ctx, server, external, id, wait)
+		if err != nil && !errors.Is(err, ErrExecutionWaitTimeout) {
+			return textToolResult("等待 execution 失败: "+err.Error(), true), nil
+		}
+		if snap == nil || snap.Execution == nil {
+			return textToolResult("未找到该 execution_id: "+id, true), nil
+		}
+		body := formatExecutionForModel(snap.Execution, executionFormatOptionsFromArgs(args))
+		if errors.Is(err, ErrExecutionWaitTimeout) {
+			body += "\n\n本次等待已到达 timeout_seconds，上述 execution 仍未完成。可继续等待、取消，或采用其他步骤。"
+		}
+		return textToolResult(body, false), nil
+	})
+
+	server.RegisterTool(Tool{
+		Name:             builtin.ToolCancelToolExecution,
+		Description:      "取消一个后台工具 execution。用于外部 MCP 工具长时间运行、误调用或用户要求停止时。",
+		ShortDescription: "取消后台工具执行",
+		InputSchema: map[string]interface{}{
+			"type": "object",
+			"properties": map[string]interface{}{
+				"execution_id": map[string]interface{}{"type": "string", "description": "工具执行 ID"},
+				"reason":       map[string]interface{}{"type": "string", "description": "取消原因，可选，会写入终止说明"},
+			},
+			"required": []string{"execution_id"},
+		},
+	}, func(ctx context.Context, args map[string]interface{}) (*ToolResult, error) {
+		id := stringArg(args, "execution_id")
+		if id == "" {
+			return textToolResult("execution_id 必填", true), nil
+		}
+		reason := stringArg(args, "reason")
+		if server.CancelToolExecutionWithNote(id, reason) {
+			return textToolResult("已请求取消内部工具 execution: "+id, false), nil
+		}
+		if external != nil && external.CancelToolExecutionWithNote(id, reason) {
+			return textToolResult("已请求取消外部 MCP execution: "+id, false), nil
+		}
+		return textToolResult("未找到进行中的 execution，或该 execution 已结束: "+id, true), nil
+	})
+}
+
+func waitToolExecutionSnapshot(ctx context.Context, server *Server, external *ExternalMCPManager, id string, wait time.Duration) (*ExecutionSnapshot, error) {
+	if server != nil && server.executionService != nil && server.executionService.getEntry(id) != nil {
+		return server.executionService.Wait(ctx, id, wait)
+	}
+	if external != nil && external.executionService != nil && external.executionService.getEntry(id) != nil {
+		return external.executionService.Wait(ctx, id, wait)
+	}
+	if server != nil && server.executionService != nil {
+		if snap, err := server.executionService.Get(id); err == nil {
+			return snap, nil
+		}
+	}
+	if external != nil && external.executionService != nil {
+		return external.executionService.Get(id)
+	}
+	exec := lookupToolExecution(server, external, id)
+	if exec == nil {
+		return nil, fmt.Errorf("execution not found: %s", id)
+	}
+	return &ExecutionSnapshot{Execution: exec}, nil
+}
+
+func lookupToolExecution(server *Server, external *ExternalMCPManager, id string) *ToolExecution {
+	if server != nil {
+		if exec, ok := server.GetExecution(id); ok && exec != nil {
+			return exec
+		}
+	}
+	if external != nil {
+		if exec, ok := external.GetExecution(id); ok && exec != nil {
+			return exec
+		}
+	}
+	return nil
+}
+
+type executionFormatOptions struct {
+	includePartialOutput bool
+	partialMaxBytes      int
+}
+
+func executionFormatOptionsFromArgs(args map[string]interface{}) executionFormatOptions {
+	includePartial := true
+	if raw, ok := args["include_partial_output"]; ok {
+		if b, ok := raw.(bool); ok {
+			includePartial = b
+		} else if s := strings.TrimSpace(fmt.Sprint(raw)); s != "" {
+			includePartial = strings.EqualFold(s, "true") || s == "1" || strings.EqualFold(s, "yes")
+		}
+	}
+	maxBytes := intArg(args, "partial_output_max_bytes", defaultPartialPreviewBytes, maxPartialPreviewBytes)
+	return executionFormatOptions{includePartialOutput: includePartial, partialMaxBytes: maxBytes}
+}
+
+func formatExecutionForModel(exec *ToolExecution, opts executionFormatOptions) string {
+	if exec == nil {
+		return "execution: null"
+	}
+	payload := map[string]interface{}{
+		"execution_id": exec.ID,
+		"tool":         exec.ToolName,
+		"status":       exec.Status,
+		"started_at":   exec.StartTime.Format(time.RFC3339),
+	}
+	if exec.EndTime != nil {
+		payload["ended_at"] = exec.EndTime.Format(time.RFC3339)
+	}
+	if exec.Duration > 0 {
+		payload["duration"] = exec.Duration.String()
+	}
+	if exec.Error != "" {
+		payload["error"] = exec.Error
+	}
+	if exec.Result != nil {
+		payload["result"] = ToolResultPlainText(exec.Result)
+		payload["is_error"] = exec.Result.IsError
+	}
+	if opts.includePartialOutput && exec.PartialOutput != "" {
+		partial := tailStringBytes(exec.PartialOutput, opts.partialMaxBytes)
+		payload["partial_output"] = partial
+		payload["partial_output_bytes"] = exec.PartialOutputBytes
+		payload["partial_output_truncated"] = exec.PartialOutputTruncated || len([]byte(partial)) < len([]byte(exec.PartialOutput))
+		if exec.PartialOutputUpdatedAt != nil {
+			payload["partial_output_updated_at"] = exec.PartialOutputUpdatedAt.Format(time.RFC3339)
+		}
+	}
+	b, err := json.MarshalIndent(payload, "", "  ")
+	if err != nil {
+		return fmt.Sprintf("execution_id: %s\nstatus: %s\nerror: %s", exec.ID, exec.Status, exec.Error)
+	}
+	return string(b)
+}
+
+func tailStringBytes(s string, maxBytes int) string {
+	if maxBytes <= 0 {
+		maxBytes = defaultPartialPreviewBytes
+	}
+	b := []byte(s)
+	if len(b) <= maxBytes {
+		return s
+	}
+	return string(b[len(b)-maxBytes:])
+}
+
+func textToolResult(text string, isErr bool) *ToolResult {
+	return &ToolResult{Content: []Content{{Type: "text", Text: text}}, IsError: isErr}
+}
+
+func stringArg(args map[string]interface{}, key string) string {
+	if args == nil {
+		return ""
+	}
+	raw, ok := args[key]
+	if !ok || raw == nil {
+		return ""
+	}
+	switch v := raw.(type) {
+	case string:
+		return strings.TrimSpace(v)
+	default:
+		return strings.TrimSpace(fmt.Sprint(v))
+	}
+}
+
+func durationSecondsArg(args map[string]interface{}, key string, def, max time.Duration) time.Duration {
+	if args == nil {
+		return def
+	}
+	var seconds float64
+	switch v := args[key].(type) {
+	case int:
+		seconds = float64(v)
+	case int64:
+		seconds = float64(v)
+	case float64:
+		seconds = v
+	case json.Number:
+		f, _ := v.Float64()
+		seconds = f
+	case string:
+		f, _ := strconv.ParseFloat(strings.TrimSpace(v), 64)
+		seconds = f
+	}
+	if seconds <= 0 {
+		return def
+	}
+	d := time.Duration(seconds * float64(time.Second))
+	if max > 0 && d > max {
+		return max
+	}
+	return d
+}
+
+func intArg(args map[string]interface{}, key string, def, max int) int {
+	if args == nil {
+		return def
+	}
+	var n int
+	switch v := args[key].(type) {
+	case int:
+		n = v
+	case int64:
+		n = int(v)
+	case float64:
+		n = int(v)
+	case json.Number:
+		i, _ := v.Int64()
+		n = int(i)
+	case string:
+		i, _ := strconv.Atoi(strings.TrimSpace(v))
+		n = i
+	}
+	if n <= 0 {
+		return def
+	}
+	if max > 0 && n > max {
+		return max
+	}
+	return n
+}
@@ -0,0 +1,625 @@
+package mcp
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"cyberstrike-ai/internal/authctx"
+
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+)
+
+const (
+	ToolExecutionStatusQueued      = "queued"
+	ToolExecutionStatusRunning     = "running"
+	ToolExecutionStatusCompleted   = "completed"
+	ToolExecutionStatusFailed      = "failed"
+	ToolExecutionStatusCancelled   = "cancelled"
+	ToolExecutionStatusHardTimeout = "hard_timeout"
+	ToolExecutionStatusOrphaned    = "orphaned"
+)
+
+var ErrExecutionWaitTimeout = errors.New("tool execution wait timeout")
+
+// ExecutionRunFunc is the blocking operation owned by a worker.
+type ExecutionRunFunc func(context.Context) (*ToolResult, error)
+
+type ExecutionPreRunFunc func(context.Context, *ToolExecution) (func(), error)
+
+// ExecutionDoneFunc observes the final persisted state. It is invoked once,
+// including for late completions after an agent has stopped waiting.
+type ExecutionDoneFunc func(*ToolExecution)
+
+type ExecutionRequest struct {
+	ID             string
+	ToolName       string
+	Arguments      map[string]interface{}
+	ConversationID string
+	OwnerUserID    string
+	HardTimeout    time.Duration
+	PreRun         ExecutionPreRunFunc
+	Run            ExecutionRunFunc
+	OnDone         ExecutionDoneFunc
+}
+
+type ExecutionHandle struct {
+	ID string
+}
+
+type ExecutionSnapshot struct {
+	Execution *ToolExecution
+}
+
+type executionEntry struct {
+	exec   *ToolExecution
+	cancel context.CancelFunc
+	done   chan struct{}
+	preRun ExecutionPreRunFunc
+	run    ExecutionRunFunc
+	result *ToolResult
+	err    error
+}
+
+// ExecutionService keeps Eino-facing tool calls synchronous while moving the
+// untrusted blocking work into cancellable workers with explicit execution IDs.
+type ExecutionService struct {
+	storage MonitorStorage
+	logger  *zap.Logger
+
+	mu             sync.Mutex
+	entries        map[string]*executionEntry
+	abortUserNotes map[string]string
+	maxInMemory    int
+	resultMaxBytes int
+	spillRootDir   string
+}
+
+func NewExecutionService(storage MonitorStorage, logger *zap.Logger) *ExecutionService {
+	if logger == nil {
+		logger = zap.NewNop()
+	}
+	return &ExecutionService{
+		storage:        storage,
+		logger:         logger,
+		entries:        make(map[string]*executionEntry),
+		abortUserNotes: make(map[string]string),
+		maxInMemory:    1000,
+		resultMaxBytes: DefaultToolResultMaxBytes,
+	}
+}
+
+func (s *ExecutionService) ConfigureToolResultMaxBytes(maxBytes int) {
+	if s == nil {
+		return
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.resultMaxBytes = maxBytes
+}
+
+// ConfigureToolResultSpillRoot sets the reduction-compatible root used when
+// oversized tool results are spilled to local files (empty → tmp/reduction).
+func (s *ExecutionService) ConfigureToolResultSpillRoot(rootDir string) {
+	if s == nil {
+		return
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.spillRootDir = strings.TrimSpace(rootDir)
+}
+
+func (s *ExecutionService) Submit(ctx context.Context, req ExecutionRequest) (*ExecutionHandle, error) {
+	if s == nil {
+		return nil, fmt.Errorf("execution service is nil")
+	}
+	if req.Run == nil {
+		return nil, fmt.Errorf("execution run func is nil")
+	}
+	id := strings.TrimSpace(req.ID)
+	if id == "" {
+		id = uuid.New().String()
+	}
+	start := time.Now()
+	exec := &ToolExecution{
+		ID:             id,
+		ToolName:       strings.TrimSpace(req.ToolName),
+		Arguments:      cloneArgsMap(req.Arguments),
+		Status:         ToolExecutionStatusQueued,
+		StartTime:      start,
+		ConversationID: strings.TrimSpace(req.ConversationID),
+		OwnerUserID:    strings.TrimSpace(req.OwnerUserID),
+	}
+	if exec.ConversationID == "" {
+		exec.ConversationID = MCPConversationIDFromContext(ctx)
+	}
+	if exec.OwnerUserID == "" {
+		if principal, ok := authctx.PrincipalFromContext(ctx); ok {
+			exec.OwnerUserID = principal.UserID
+		}
+	}
+
+	runCtx := detachedExecutionContext(ctx)
+	var cancel context.CancelFunc
+	if req.HardTimeout > 0 {
+		runCtx, cancel = context.WithTimeout(runCtx, req.HardTimeout)
+	} else {
+		runCtx, cancel = context.WithCancel(runCtx)
+	}
+	entry := &executionEntry{exec: exec, cancel: cancel, done: make(chan struct{}), preRun: req.PreRun, run: req.Run}
+
+	s.mu.Lock()
+	if _, exists := s.entries[id]; exists {
+		s.mu.Unlock()
+		cancel()
+		return nil, fmt.Errorf("execution already exists: %s", id)
+	}
+	s.entries[id] = entry
+	s.cleanupOldEntriesLocked()
+	s.mu.Unlock()
+
+	if s.storage != nil {
+		if err := s.storage.SaveToolExecution(exec); err != nil {
+			s.logger.Warn("保存执行记录到数据库失败", zap.Error(err), zap.String("executionId", id))
+		}
+	}
+	notifyToolRunBegin(ctx, id)
+
+	go s.runWorker(runCtx, entry, req.OnDone)
+	return &ExecutionHandle{ID: id}, nil
+}
+
+func (s *ExecutionService) runWorker(ctx context.Context, entry *executionEntry, onDone ExecutionDoneFunc) {
+	id := entry.exec.ID
+	ctx = WithMCPExecutionID(ctx, id)
+	if conv := strings.TrimSpace(entry.exec.ConversationID); conv != "" {
+		ctx = WithMCPConversationID(ctx, conv)
+	}
+	var release func()
+	defer func() {
+		if release != nil {
+			release()
+		}
+		entry.cancel()
+		notifyToolRunEnd(ctx, id)
+		close(entry.done)
+	}()
+
+	if entry.preRun != nil {
+		var preErr error
+		release, preErr = entry.preRun(ctx, cloneToolExecution(entry.exec))
+		if preErr != nil {
+			s.finishEntry(ctx, entry, nil, preErr, onDone)
+			return
+		}
+	}
+	s.markEntryRunning(entry)
+
+	result, err := entryResultRecover(ctx, entry.exec.ToolName, s.logger, func() (*ToolResult, error) {
+		return nilSafeRun(ctx, entry)
+	})
+	s.finishEntry(ctx, entry, result, err, onDone)
+}
+
+func (s *ExecutionService) markEntryRunning(entry *executionEntry) {
+	if s == nil || entry == nil || entry.exec == nil {
+		return
+	}
+	s.mu.Lock()
+	if !isExecutionTerminal(entry.exec.Status) {
+		entry.exec.Status = ToolExecutionStatusRunning
+	}
+	runningExec := cloneToolExecution(entry.exec)
+	s.mu.Unlock()
+	if s.storage != nil {
+		if err := s.storage.SaveToolExecution(runningExec); err != nil {
+			s.logger.Warn("保存执行记录到数据库失败", zap.Error(err), zap.String("executionId", runningExec.ID))
+		}
+	}
+}
+
+func (s *ExecutionService) finishEntry(ctx context.Context, entry *executionEntry, result *ToolResult, err error, onDone ExecutionDoneFunc) {
+	id := entry.exec.ID
+	cancelledWithUserNote := s.applyAbortUserNoteToCancelledToolResult(id, &result, &err)
+
+	now := time.Now()
+	s.mu.Lock()
+	spill := ToolResultSpillConfig{
+		RootDir:        s.spillRootDir,
+		ConversationID: entry.exec.ConversationID,
+		ExecutionID:    id,
+	}
+	if ctx != nil {
+		if pid := MCPProjectIDFromContext(ctx); pid != "" {
+			spill.ProjectID = pid
+		}
+		if conv := MCPConversationIDFromContext(ctx); conv != "" {
+			spill.ConversationID = conv
+		}
+	}
+	result = NormalizeToolResultForStorageWithSpill(result, s.resultMaxBytes, spill)
+	entry.result = result
+	entry.err = err
+	entry.exec.EndTime = &now
+	entry.exec.Duration = now.Sub(entry.exec.StartTime)
+	if err != nil {
+		switch {
+		case errors.Is(err, context.DeadlineExceeded):
+			entry.exec.Status = ToolExecutionStatusHardTimeout
+			entry.exec.Error = "工具执行超过硬超时限制"
+		case errors.Is(err, context.Canceled):
+			entry.exec.Status = ToolExecutionStatusCancelled
+			entry.exec.Error = "已手动终止或任务已取消"
+		default:
+			entry.exec.Status = ToolExecutionStatusFailed
+			entry.exec.Error = err.Error()
+		}
+	} else if result != nil && result.IsError {
+		if cancelledWithUserNote {
+			entry.exec.Status = ToolExecutionStatusCancelled
+			entry.exec.Error = ""
+		} else if isBackgroundWaitToolResult(result) {
+			entry.exec.Status = ToolExecutionStatusCompleted
+			entry.exec.Error = ""
+		} else {
+			entry.exec.Status = ToolExecutionStatusFailed
+			entry.exec.Error = firstToolResultText(result, "工具执行返回错误结果")
+		}
+		entry.exec.Result = result
+	} else {
+		entry.exec.Status = ToolExecutionStatusCompleted
+		if result == nil {
+			result = &ToolResult{Content: []Content{{Type: "text", Text: "工具执行完成，但未返回结果"}}}
+			entry.result = result
+		}
+		entry.exec.Result = result
+	}
+	finalExec := cloneToolExecution(entry.exec)
+	s.mu.Unlock()
+
+	if s.storage != nil {
+		if saveErr := s.storage.SaveToolExecution(finalExec); saveErr != nil {
+			s.logger.Warn("保存执行记录到数据库失败", zap.Error(saveErr), zap.String("executionId", id))
+		}
+	}
+	if onDone != nil {
+		onDone(finalExec)
+	}
+}
+
+func nilSafeRun(ctx context.Context, entry *executionEntry) (*ToolResult, error) {
+	if entry == nil {
+		return nil, fmt.Errorf("execution entry is nil")
+	}
+	if entry.run == nil {
+		return nil, fmt.Errorf("execution run func not wired")
+	}
+	return entry.run(ctx)
+}
+
+func entryResultRecover(ctx context.Context, toolName string, logger *zap.Logger, fn func() (*ToolResult, error)) (res *ToolResult, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			if logger != nil {
+				logger.Error("tool execution worker panic recovered", zap.Any("recover", r), zap.String("toolName", toolName), zap.Stack("stack"))
+			}
+			err = fmt.Errorf("tool execution panic: %v", r)
+		}
+	}()
+	return fn()
+}
+
+func (s *ExecutionService) Wait(ctx context.Context, executionID string, timeout time.Duration) (*ExecutionSnapshot, error) {
+	entry := s.getEntry(executionID)
+	if entry == nil {
+		return s.getPersistedSnapshot(executionID)
+	}
+	if isExecutionTerminal(entry.exec.Status) {
+		return &ExecutionSnapshot{Execution: cloneToolExecution(entry.exec)}, nil
+	}
+
+	var timeoutCh <-chan time.Time
+	var timer *time.Timer
+	if timeout > 0 {
+		timer = time.NewTimer(timeout)
+		timeoutCh = timer.C
+		defer timer.Stop()
+	}
+
+	select {
+	case <-entry.done:
+		return &ExecutionSnapshot{Execution: cloneToolExecution(entry.exec)}, nil
+	case <-timeoutCh:
+		return &ExecutionSnapshot{Execution: cloneToolExecution(entry.exec)}, ErrExecutionWaitTimeout
+	case <-ctxDone(ctx):
+		return &ExecutionSnapshot{Execution: cloneToolExecution(entry.exec)}, ctx.Err()
+	}
+}
+
+func (s *ExecutionService) Get(executionID string) (*ExecutionSnapshot, error) {
+	entry := s.getEntry(executionID)
+	if entry != nil {
+		return &ExecutionSnapshot{Execution: cloneToolExecution(entry.exec)}, nil
+	}
+	return s.getPersistedSnapshot(executionID)
+}
+
+func (s *ExecutionService) AppendPartialOutput(executionID, chunk string) bool {
+	id := strings.TrimSpace(executionID)
+	if s == nil || id == "" || chunk == "" {
+		return false
+	}
+	now := time.Now()
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	entry := s.entries[id]
+	if entry == nil || entry.exec == nil {
+		return false
+	}
+	appendPartialOutput(entry.exec, chunk, defaultPartialOutputMaxBytes, now)
+	return true
+}
+
+func (s *ExecutionService) Cancel(executionID, note string) bool {
+	id := strings.TrimSpace(executionID)
+	if id == "" || s == nil {
+		return false
+	}
+	s.mu.Lock()
+	entry := s.entries[id]
+	if entry == nil || isExecutionTerminal(entry.exec.Status) {
+		s.mu.Unlock()
+		return false
+	}
+	if strings.TrimSpace(note) != "" {
+		s.abortUserNotes[id] = strings.TrimSpace(note)
+	}
+	cancel := entry.cancel
+	s.mu.Unlock()
+	if cancel != nil {
+		cancel()
+	}
+	return true
+}
+
+func (s *ExecutionService) ActiveRunningExecutionIDs() map[string]struct{} {
+	if s == nil {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	out := make(map[string]struct{})
+	for id, entry := range s.entries {
+		if entry != nil && entry.exec != nil && !isExecutionTerminal(entry.exec.Status) {
+			out[id] = struct{}{}
+		}
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
+}
+
+func (s *ExecutionService) CancelAll(note string) {
+	if s == nil {
+		return
+	}
+	s.mu.Lock()
+	cancels := make([]context.CancelFunc, 0, len(s.entries))
+	for id, entry := range s.entries {
+		if entry == nil || isExecutionTerminal(entry.exec.Status) {
+			continue
+		}
+		if strings.TrimSpace(note) != "" {
+			s.abortUserNotes[id] = strings.TrimSpace(note)
+		}
+		if entry.cancel != nil {
+			cancels = append(cancels, entry.cancel)
+		}
+	}
+	s.mu.Unlock()
+	for _, cancel := range cancels {
+		cancel()
+	}
+}
+
+func (s *ExecutionService) getEntry(executionID string) *executionEntry {
+	if s == nil {
+		return nil
+	}
+	id := strings.TrimSpace(executionID)
+	if id == "" {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.entries[id]
+}
+
+func (s *ExecutionService) getPersistedSnapshot(executionID string) (*ExecutionSnapshot, error) {
+	id := strings.TrimSpace(executionID)
+	if id == "" {
+		return nil, fmt.Errorf("execution_id is required")
+	}
+	if s != nil && s.storage != nil {
+		exec, err := s.storage.GetToolExecution(id)
+		if err == nil && exec != nil {
+			return &ExecutionSnapshot{Execution: exec}, nil
+		}
+		if err != nil {
+			return nil, err
+		}
+	}
+	return nil, fmt.Errorf("execution not found: %s", id)
+}
+
+func (s *ExecutionService) applyAbortUserNoteToCancelledToolResult(executionID string, result **ToolResult, err *error) (cancelledWithUserNote bool) {
+	note := strings.TrimSpace(s.takeAbortUserNote(executionID))
+	if note == "" {
+		return false
+	}
+	hasErr := err != nil && *err != nil
+	hasRes := result != nil && *result != nil
+	if !hasErr && !hasRes {
+		return false
+	}
+	partial := ""
+	if hasRes {
+		partial = ToolResultPlainText(*result)
+	}
+	if partial == "" && hasErr {
+		partial = (*err).Error()
+	}
+	merged := MergePartialToolOutputAndAbortNote(partial, note)
+	if err != nil {
+		*err = nil
+	}
+	if result != nil {
+		*result = &ToolResult{Content: []Content{{Type: "text", Text: merged}}, IsError: true}
+	}
+	return true
+}
+
+func (s *ExecutionService) takeAbortUserNote(id string) string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	note := s.abortUserNotes[id]
+	delete(s.abortUserNotes, id)
+	return note
+}
+
+func (s *ExecutionService) cleanupOldEntriesLocked() {
+	if s.maxInMemory <= 0 || len(s.entries) <= s.maxInMemory {
+		return
+	}
+	type oldEntry struct {
+		id        string
+		startTime time.Time
+	}
+	var terminal []oldEntry
+	for id, entry := range s.entries {
+		if entry != nil && entry.exec != nil && isExecutionTerminal(entry.exec.Status) {
+			terminal = append(terminal, oldEntry{id: id, startTime: entry.exec.StartTime})
+		}
+	}
+	for len(s.entries) > s.maxInMemory && len(terminal) > 0 {
+		oldest := 0
+		for i := 1; i < len(terminal); i++ {
+			if terminal[i].startTime.Before(terminal[oldest].startTime) {
+				oldest = i
+			}
+		}
+		delete(s.entries, terminal[oldest].id)
+		terminal = append(terminal[:oldest], terminal[oldest+1:]...)
+	}
+}
+
+func firstToolResultText(result *ToolResult, fallback string) string {
+	if result != nil {
+		for _, c := range result.Content {
+			if strings.TrimSpace(c.Text) != "" {
+				return c.Text
+			}
+		}
+	}
+	return fallback
+}
+
+func isBackgroundWaitToolResult(result *ToolResult) bool {
+	text := strings.ToLower(strings.TrimSpace(ToolResultPlainText(result)))
+	if text == "" {
+		return false
+	}
+	hasExecutionID := strings.Contains(text, "execution_id:") || strings.Contains(text, `"execution_id"`)
+	hasRunningStatus := strings.Contains(text, "status: running") || strings.Contains(text, "status: queued") ||
+		strings.Contains(text, `"status": "running"`) || strings.Contains(text, `"status":"running"`) ||
+		strings.Contains(text, `"status": "queued"`) || strings.Contains(text, `"status":"queued"`)
+	hasSoftWaitSignal := strings.Contains(text, "工具已提交到后台执行") ||
+		strings.Contains(text, "本次等待已到达") ||
+		strings.Contains(text, "wait_timeout:") ||
+		strings.Contains(text, "background execution") ||
+		strings.Contains(text, "still running") ||
+		strings.Contains(text, "仍未完成")
+	return hasExecutionID && hasRunningStatus && hasSoftWaitSignal
+}
+
+func isExecutionTerminal(status string) bool {
+	switch strings.TrimSpace(strings.ToLower(status)) {
+	case ToolExecutionStatusCompleted, ToolExecutionStatusFailed, ToolExecutionStatusCancelled, ToolExecutionStatusHardTimeout, ToolExecutionStatusOrphaned:
+		return true
+	default:
+		return false
+	}
+}
+
+func ctxDone(ctx context.Context) <-chan struct{} {
+	if ctx == nil {
+		return nil
+	}
+	return ctx.Done()
+}
+
+func detachedExecutionContext(ctx context.Context) context.Context {
+	if ctx == nil {
+		return context.Background()
+	}
+	return context.WithoutCancel(ctx)
+}
+
+func cloneArgsMap(in map[string]interface{}) map[string]interface{} {
+	if in == nil {
+		return map[string]interface{}{}
+	}
+	out := make(map[string]interface{}, len(in))
+	for k, v := range in {
+		out[k] = v
+	}
+	return out
+}
+
+func cloneToolExecution(in *ToolExecution) *ToolExecution {
+	if in == nil {
+		return nil
+	}
+	out := *in
+	out.Arguments = cloneArgsMap(in.Arguments)
+	if in.Result != nil {
+		res := *in.Result
+		if in.Result.Content != nil {
+			res.Content = append([]Content(nil), in.Result.Content...)
+		}
+		out.Result = &res
+	}
+	if in.EndTime != nil {
+		t := *in.EndTime
+		out.EndTime = &t
+	}
+	if in.PartialOutputUpdatedAt != nil {
+		t := *in.PartialOutputUpdatedAt
+		out.PartialOutputUpdatedAt = &t
+	}
+	return &out
+}
+
+func appendPartialOutput(exec *ToolExecution, chunk string, maxBytes int, updatedAt time.Time) {
+	if exec == nil || chunk == "" {
+		return
+	}
+	if maxBytes <= 0 {
+		maxBytes = defaultPartialOutputMaxBytes
+	}
+	exec.PartialOutputBytes += int64(len([]byte(chunk)))
+	combined := exec.PartialOutput + chunk
+	if len([]byte(combined)) > maxBytes {
+		b := []byte(combined)
+		combined = string(b[len(b)-maxBytes:])
+		exec.PartialOutputTruncated = true
+	}
+	exec.PartialOutput = combined
+	t := updatedAt
+	exec.PartialOutputUpdatedAt = &t
+}
@@ -0,0 +1,41 @@
+package mcp
+
+import (
+	"context"
+	"testing"
+)
+
+func TestExecutionServiceBackgroundWaitResultCompletesWaitTool(t *testing.T) {
+	service := NewExecutionService(nil, nil)
+	handle, err := service.Submit(context.Background(), ExecutionRequest{
+		ToolName: "wait_tool_execution",
+		Run: func(context.Context) (*ToolResult, error) {
+			return &ToolResult{
+				Content: []Content{{Type: "text", Text: `{
+  "execution_id": "3eaaa391-050b-4be1-a870-48a855923cb7",
+  "tool": "exec",
+  "status": "running"
+}
+
+本次等待已到达 timeout_seconds，上述 execution 仍未完成。可继续等待、取消，或采用其他步骤。`}},
+				IsError: true,
+			}, nil
+		},
+	})
+	if err != nil {
+		t.Fatalf("Submit: %v", err)
+	}
+	snap, err := service.Wait(context.Background(), handle.ID, 0)
+	if err != nil {
+		t.Fatalf("Wait: %v", err)
+	}
+	if snap == nil || snap.Execution == nil {
+		t.Fatal("missing execution snapshot")
+	}
+	if snap.Execution.Status != ToolExecutionStatusCompleted {
+		t.Fatalf("status = %q, want %q", snap.Execution.Status, ToolExecutionStatusCompleted)
+	}
+	if snap.Execution.Result == nil || !snap.Execution.Result.IsError {
+		t.Fatal("model-facing result should remain IsError")
+	}
+}
@@ -0,0 +1,230 @@
+package mcp
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"go.uber.org/zap"
+)
+
+type blockingExternalMCPClient struct {
+	started chan struct{}
+	calls   chan string
+	release chan struct{}
+	result  *ToolResult
+	count   atomic.Int32
+}
+
+func newBlockingExternalMCPClient(resultText string) *blockingExternalMCPClient {
+	return &blockingExternalMCPClient{
+		started: make(chan struct{}),
+		calls:   make(chan string, 8),
+		release: make(chan struct{}),
+		result:  &ToolResult{Content: []Content{{Type: "text", Text: resultText}}},
+	}
+}
+
+func (c *blockingExternalMCPClient) Initialize(ctx context.Context) error { return nil }
+func (c *blockingExternalMCPClient) ListTools(ctx context.Context) ([]Tool, error) {
+	return []Tool{{Name: "slow_tool"}}, nil
+}
+func (c *blockingExternalMCPClient) CallTool(ctx context.Context, name string, args map[string]interface{}) (*ToolResult, error) {
+	c.count.Add(1)
+	select {
+	case c.calls <- name:
+	default:
+	}
+	select {
+	case <-c.started:
+	default:
+		close(c.started)
+	}
+	select {
+	case <-c.release:
+		return c.result, nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+func (c *blockingExternalMCPClient) Close() error      { return nil }
+func (c *blockingExternalMCPClient) IsConnected() bool { return true }
+func (c *blockingExternalMCPClient) GetStatus() string { return "connected" }
+
+type failingExternalMCPClient struct{}
+
+func (c *failingExternalMCPClient) Initialize(ctx context.Context) error { return nil }
+func (c *failingExternalMCPClient) ListTools(ctx context.Context) ([]Tool, error) {
+	return []Tool{{Name: "fail_tool"}}, nil
+}
+func (c *failingExternalMCPClient) CallTool(ctx context.Context, name string, args map[string]interface{}) (*ToolResult, error) {
+	return nil, errors.New("boom")
+}
+func (c *failingExternalMCPClient) Close() error      { return nil }
+func (c *failingExternalMCPClient) IsConnected() bool { return true }
+func (c *failingExternalMCPClient) GetStatus() string { return "connected" }
+
+func TestExternalMCPManager_CallToolBoundedWaitThenContinue(t *testing.T) {
+	manager := NewExternalMCPManager(zap.NewNop())
+	manager.ConfigureToolWaitTimeoutSeconds(1)
+	manager.toolWaitTimeout = 10 * time.Millisecond
+	client := newBlockingExternalMCPClient("slow result ready")
+	manager.clients["lab"] = client
+
+	callCtx, callCancel := context.WithCancel(context.Background())
+	result, executionID, err := manager.CallTool(callCtx, "lab::slow_tool", map[string]interface{}{"target": "example"})
+	if err != nil {
+		t.Fatalf("CallTool returned error: %v", err)
+	}
+	if executionID == "" {
+		t.Fatal("expected execution id")
+	}
+	if result == nil || !result.IsError {
+		t.Fatalf("expected soft timeout tool result, got %#v", result)
+	}
+	text := ToolResultPlainText(result)
+	if !strings.Contains(text, executionID) || !strings.Contains(text, "wait_tool_execution") {
+		t.Fatalf("timeout result should include execution id and wait guidance, got %q", text)
+	}
+
+	select {
+	case <-client.started:
+	default:
+		t.Fatal("worker did not start")
+	}
+	callCancel()
+	close(client.release)
+
+	snapshot, err := manager.executionService.Wait(context.Background(), executionID, time.Second)
+	if err != nil {
+		t.Fatalf("Wait returned error: %v", err)
+	}
+	if snapshot == nil || snapshot.Execution == nil {
+		t.Fatal("expected execution snapshot")
+	}
+	if snapshot.Execution.Status != ToolExecutionStatusCompleted {
+		t.Fatalf("status = %q, want completed", snapshot.Execution.Status)
+	}
+	if got := ToolResultPlainText(snapshot.Execution.Result); got != "slow result ready" {
+		t.Fatalf("result = %q, want slow result ready", got)
+	}
+}
+
+func TestExecutionControlWaitToolReturnsCompletedResult(t *testing.T) {
+	manager := NewExternalMCPManager(zap.NewNop())
+	manager.toolWaitTimeout = 10 * time.Millisecond
+	client := newBlockingExternalMCPClient("control wait result")
+	manager.clients["lab"] = client
+
+	result, executionID, err := manager.CallTool(context.Background(), "lab::slow_tool", nil)
+	if err != nil {
+		t.Fatalf("CallTool returned error: %v", err)
+	}
+	if result == nil || !result.IsError || executionID == "" {
+		t.Fatalf("expected soft timeout and execution id, got result=%#v id=%q", result, executionID)
+	}
+
+	server := NewServer(zap.NewNop())
+	RegisterExecutionControlTools(server, manager)
+	close(client.release)
+
+	waitResult, _, err := server.CallTool(context.Background(), "wait_tool_execution", map[string]interface{}{
+		"execution_id":    executionID,
+		"timeout_seconds": 1,
+	})
+	if err != nil {
+		t.Fatalf("wait_tool_execution returned error: %v", err)
+	}
+	if waitResult == nil || waitResult.IsError {
+		t.Fatalf("expected successful wait result, got %#v", waitResult)
+	}
+	body := ToolResultPlainText(waitResult)
+	if !strings.Contains(body, `"status": "completed"`) || !strings.Contains(body, "control wait result") {
+		t.Fatalf("wait result body missing completed status/result: %s", body)
+	}
+}
+
+func TestExternalMCPManager_PerServerConcurrencyLimitsWorkers(t *testing.T) {
+	manager := NewExternalMCPManager(zap.NewNop())
+	manager.toolWaitTimeout = 10 * time.Millisecond
+	manager.ConfigureResilience(ExternalMCPResilienceConfig{
+		MaxConcurrentPerServer:  1,
+		MaxConcurrentTotal:      4,
+		CircuitFailureThreshold: -1,
+		CircuitCooldown:         time.Second,
+	})
+	client := newBlockingExternalMCPClient("ok")
+	manager.clients["lab"] = client
+
+	done1 := make(chan struct{})
+	go func() {
+		_, _, _ = manager.CallTool(context.Background(), "lab::slow_tool", nil)
+		close(done1)
+	}()
+	select {
+	case <-client.calls:
+	case <-time.After(time.Second):
+		t.Fatal("first worker did not enter client")
+	}
+
+	type callOutcome struct {
+		executionID string
+		err         error
+	}
+	done2 := make(chan callOutcome, 1)
+	go func() {
+		_, executionID, err := manager.CallTool(context.Background(), "lab::slow_tool", nil)
+		done2 <- callOutcome{executionID: executionID, err: err}
+	}()
+	select {
+	case <-client.calls:
+		t.Fatal("second worker entered client before per-server slot was released")
+	case <-time.After(50 * time.Millisecond):
+	}
+	var second callOutcome
+	select {
+	case second = <-done2:
+	case <-time.After(time.Second):
+		t.Fatal("second call did not return after bounded wait")
+	}
+	if second.err != nil || second.executionID == "" {
+		t.Fatalf("second call should return queued execution id after bounded wait, id=%q err=%v", second.executionID, second.err)
+	}
+	snapshot, err := manager.executionService.Get(second.executionID)
+	if err != nil {
+		t.Fatalf("Get queued execution: %v", err)
+	}
+	if snapshot == nil || snapshot.Execution == nil || snapshot.Execution.Status != ToolExecutionStatusQueued {
+		t.Fatalf("second execution status = %#v, want queued", snapshot)
+	}
+	close(client.release)
+	select {
+	case <-client.calls:
+	case <-time.After(time.Second):
+		t.Fatal("second worker did not enter client after slot release")
+	}
+	<-done1
+}
+
+func TestExternalMCPManager_CircuitBreakerOpensAfterFailures(t *testing.T) {
+	manager := NewExternalMCPManager(zap.NewNop())
+	manager.ConfigureResilience(ExternalMCPResilienceConfig{
+		MaxConcurrentPerServer:  2,
+		MaxConcurrentTotal:      4,
+		CircuitFailureThreshold: 1,
+		CircuitCooldown:         time.Minute,
+	})
+	manager.clients["lab"] = &failingExternalMCPClient{}
+
+	_, _, err := manager.CallTool(context.Background(), "lab::fail_tool", nil)
+	if err == nil || !strings.Contains(err.Error(), "boom") {
+		t.Fatalf("expected first call to fail with client error, got %v", err)
+	}
+	_, _, err = manager.CallTool(context.Background(), "lab::fail_tool", nil)
+	if err == nil || !strings.Contains(err.Error(), "熔断") {
+		t.Fatalf("expected circuit breaker rejection, got %v", err)
+	}
+}
@@ -0,0 +1,261 @@
+package mcp
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"cyberstrike-ai/internal/authctx"
+	"cyberstrike-ai/internal/config"
+
+	"go.uber.org/zap"
+)
+
+func TestExternalManagerEnforcesConfiguredAuthorizer(t *testing.T) {
+	manager := NewExternalMCPManager(zap.NewNop())
+	t.Cleanup(manager.StopAll)
+	manager.SetToolAuthorizer(func(context.Context, string, map[string]interface{}) error {
+		return errors.New("denied by policy")
+	})
+	ctx := authctx.WithPrincipal(context.Background(), authctx.NewPrincipal("u1", "user", "assigned", map[string]bool{"agent:execute": true}))
+	_, executionID, err := manager.CallTool(ctx, "server::tool", map[string]interface{}{})
+	if err == nil || !strings.Contains(err.Error(), "authorization denied") {
+		t.Fatalf("external call bypassed authorizer: %v", err)
+	}
+	if executionID == "" {
+		t.Fatal("denied external call should still return an execution id")
+	}
+	execution, ok := manager.GetExecution(executionID)
+	if !ok || execution == nil {
+		t.Fatalf("missing denied external execution %q", executionID)
+	}
+	if execution.Status != ToolExecutionStatusFailed || !strings.Contains(execution.Error, "denied by policy") {
+		t.Fatalf("denied external execution = %#v, want failed with policy error", execution)
+	}
+}
+
+func TestExternalMCPManager_AddOrUpdateConfig(t *testing.T) {
+	logger := zap.NewNop()
+	manager := NewExternalMCPManager(logger)
+
+	// 测试添加stdio配置
+	stdioCfg := config.ExternalMCPServerConfig{
+		Command:           "python3",
+		Args:              []string{"/path/to/script.py"},
+		Description:       "Test stdio MCP",
+		Timeout:           30,
+		ExternalMCPEnable: true,
+	}
+
+	err := manager.AddOrUpdateConfig("test-stdio", stdioCfg)
+	if err != nil {
+		t.Fatalf("添加stdio配置失败: %v", err)
+	}
+
+	// 测试添加HTTP配置
+	httpCfg := config.ExternalMCPServerConfig{
+		Type:              "http",
+		URL:               "http://127.0.0.1:8081/mcp",
+		Description:       "Test HTTP MCP",
+		Timeout:           30,
+		ExternalMCPEnable: false,
+	}
+
+	err = manager.AddOrUpdateConfig("test-http", httpCfg)
+	if err != nil {
+		t.Fatalf("添加HTTP配置失败: %v", err)
+	}
+
+	// 验证配置已保存
+	configs := manager.GetConfigs()
+	if len(configs) != 2 {
+		t.Fatalf("期望2个配置，实际%d个", len(configs))
+	}
+
+	if configs["test-stdio"].Command != stdioCfg.Command {
+		t.Errorf("stdio配置命令不匹配")
+	}
+
+	if configs["test-http"].URL != httpCfg.URL {
+		t.Errorf("HTTP配置URL不匹配")
+	}
+}
+
+func TestExternalMCPManager_RemoveConfig(t *testing.T) {
+	logger := zap.NewNop()
+	manager := NewExternalMCPManager(logger)
+
+	cfg := config.ExternalMCPServerConfig{
+		Command:           "python3",
+		ExternalMCPEnable: false,
+	}
+
+	manager.AddOrUpdateConfig("test-remove", cfg)
+
+	// 移除配置
+	err := manager.RemoveConfig("test-remove")
+	if err != nil {
+		t.Fatalf("移除配置失败: %v", err)
+	}
+
+	configs := manager.GetConfigs()
+	if _, exists := configs["test-remove"]; exists {
+		t.Error("配置应该已被移除")
+	}
+}
+
+func TestExternalMCPManager_GetStats(t *testing.T) {
+	logger := zap.NewNop()
+	manager := NewExternalMCPManager(logger)
+
+	// 添加多个配置
+	manager.AddOrUpdateConfig("enabled1", config.ExternalMCPServerConfig{
+		Command:           "python3",
+		ExternalMCPEnable: true,
+	})
+
+	manager.AddOrUpdateConfig("enabled2", config.ExternalMCPServerConfig{
+		URL:               "http://127.0.0.1:8081/mcp",
+		ExternalMCPEnable: true,
+	})
+
+	manager.AddOrUpdateConfig("disabled1", config.ExternalMCPServerConfig{
+		Command:           "python3",
+		ExternalMCPEnable: false,
+	})
+
+	stats := manager.GetStats()
+
+	if stats["total"].(int) != 3 {
+		t.Errorf("期望总数3，实际%d", stats["total"])
+	}
+
+	if stats["enabled"].(int) != 2 {
+		t.Errorf("期望启用数2，实际%d", stats["enabled"])
+	}
+
+	if stats["disabled"].(int) != 1 {
+		t.Errorf("期望停用数1，实际%d", stats["disabled"])
+	}
+}
+
+func TestExternalMCPManager_LoadConfigs(t *testing.T) {
+	logger := zap.NewNop()
+	manager := NewExternalMCPManager(logger)
+
+	externalMCPConfig := config.ExternalMCPConfig{
+		Servers: map[string]config.ExternalMCPServerConfig{
+			"loaded1": {
+				Command:           "python3",
+				ExternalMCPEnable: true,
+			},
+			"loaded2": {
+				URL:               "http://127.0.0.1:8081/mcp",
+				ExternalMCPEnable: false,
+			},
+		},
+	}
+
+	manager.LoadConfigs(&externalMCPConfig)
+
+	configs := manager.GetConfigs()
+	if len(configs) != 2 {
+		t.Fatalf("期望2个配置，实际%d个", len(configs))
+	}
+
+	if configs["loaded1"].Command != "python3" {
+		t.Error("配置1加载失败")
+	}
+
+	if configs["loaded2"].URL != "http://127.0.0.1:8081/mcp" {
+		t.Error("配置2加载失败")
+	}
+}
+
+// TestLazySDKClient_InitializeFails 验证无效配置时 SDK 客户端 Initialize 失败并设置 error 状态
+func TestLazySDKClient_InitializeFails(t *testing.T) {
+	logger := zap.NewNop()
+	// 使用不存在的 HTTP 地址，Initialize 应失败
+	cfg := config.ExternalMCPServerConfig{
+		Type:    "http",
+		URL:     "http://127.0.0.1:19999/nonexistent",
+		Timeout: 2,
+	}
+	c := newLazySDKClient(cfg, logger)
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	err := c.Initialize(ctx)
+	if err == nil {
+		t.Fatal("expected error when connecting to invalid server")
+	}
+	if c.GetStatus() != "error" {
+		t.Errorf("expected status error, got %s", c.GetStatus())
+	}
+	c.Close()
+}
+
+func TestExternalMCPManager_StartStopClient(t *testing.T) {
+	logger := zap.NewNop()
+	manager := NewExternalMCPManager(logger)
+
+	// 添加一个禁用的配置
+	cfg := config.ExternalMCPServerConfig{
+		Command:           "python3",
+		ExternalMCPEnable: false,
+	}
+
+	manager.AddOrUpdateConfig("test-start-stop", cfg)
+
+	// 尝试启动（可能会失败，因为没有真实的服务器）
+	err := manager.StartClient("test-start-stop")
+	if err != nil {
+		t.Logf("启动失败（可能是没有服务器）: %v", err)
+	}
+
+	// 停止
+	err = manager.StopClient("test-start-stop")
+	if err != nil {
+		t.Fatalf("停止失败: %v", err)
+	}
+
+	// 验证配置已更新为禁用
+	configs := manager.GetConfigs()
+	if configs["test-start-stop"].ExternalMCPEnable {
+		t.Error("配置应该已被禁用")
+	}
+}
+
+func TestExternalMCPManager_CallTool(t *testing.T) {
+	logger := zap.NewNop()
+	manager := NewExternalMCPManager(logger)
+
+	// 测试调用不存在的工具
+	_, _, err := manager.CallTool(context.Background(), "nonexistent::tool", map[string]interface{}{})
+	if err == nil {
+		t.Error("应该返回错误")
+	}
+
+	// 测试无效的工具名称格式
+	_, _, err = manager.CallTool(context.Background(), "invalid-tool-name", map[string]interface{}{})
+	if err == nil {
+		t.Error("应该返回错误（无效格式）")
+	}
+}
+
+func TestExternalMCPManager_GetAllTools(t *testing.T) {
+	logger := zap.NewNop()
+	manager := NewExternalMCPManager(logger)
+
+	ctx := context.Background()
+	tools, err := manager.GetAllTools(ctx)
+	if err != nil {
+		t.Fatalf("获取工具列表失败: %v", err)
+	}
+
+	// 如果没有连接的客户端，应该返回空列表
+	if len(tools) != 0 {
+		t.Logf("获取到%d个工具", len(tools))
+	}
+}
@@ -0,0 +1,147 @@
+package mcp
+
+import (
+	"context"
+	"strings"
+)
+
+// ToolRunRegistry 在工具开始/结束时登记当前 executionId，供对话页「仅终止当前工具」与监控页共用取消逻辑。
+type ToolRunRegistry interface {
+	RegisterRunningTool(conversationID, executionID string)
+	UnregisterRunningTool(conversationID, executionID string)
+}
+
+// EinoExecuteRunRegistry 登记进行中的 Eino filesystem execute，供「中断并继续」终止 amass 等长命令。
+type EinoExecuteRunRegistry interface {
+	RegisterActiveEinoExecute(conversationID string, cancel context.CancelFunc)
+	UnregisterActiveEinoExecute(conversationID string)
+	AbortActiveEinoExecute(conversationID, note string) bool
+	TakeEinoExecuteAbortNote(conversationID string) string
+}
+
+type toolRunRegistryCtxKey struct{}
+type einoExecuteRunRegistryCtxKey struct{}
+type mcpConversationIDCtxKey struct{}
+type mcpExecutionIDCtxKey struct{}
+type mcpProjectIDCtxKey struct{}
+
+// WithToolRunRegistry 将登记器注入 ctx（Eino / 原生 Agent 任务 ctx）。
+func WithToolRunRegistry(ctx context.Context, reg ToolRunRegistry) context.Context {
+	if ctx == nil || reg == nil {
+		return ctx
+	}
+	return context.WithValue(ctx, toolRunRegistryCtxKey{}, reg)
+}
+
+// ToolRunRegistryFromContext 取出登记器（无则 nil）。
+func ToolRunRegistryFromContext(ctx context.Context) ToolRunRegistry {
+	if ctx == nil {
+		return nil
+	}
+	v, _ := ctx.Value(toolRunRegistryCtxKey{}).(ToolRunRegistry)
+	return v
+}
+
+// WithEinoExecuteRunRegistry 将 Eino execute 取消登记器注入 ctx。
+func WithEinoExecuteRunRegistry(ctx context.Context, reg EinoExecuteRunRegistry) context.Context {
+	if ctx == nil || reg == nil {
+		return ctx
+	}
+	return context.WithValue(ctx, einoExecuteRunRegistryCtxKey{}, reg)
+}
+
+// EinoExecuteRunRegistryFromContext 取出 Eino execute 登记器（无则 nil）。
+func EinoExecuteRunRegistryFromContext(ctx context.Context) EinoExecuteRunRegistry {
+	if ctx == nil {
+		return nil
+	}
+	v, _ := ctx.Value(einoExecuteRunRegistryCtxKey{}).(EinoExecuteRunRegistry)
+	return v
+}
+
+// WithMCPConversationID 将对话 ID 注入 ctx，供 CallTool 内与 executionId 关联。
+func WithMCPConversationID(ctx context.Context, conversationID string) context.Context {
+	if ctx == nil {
+		return nil
+	}
+	id := strings.TrimSpace(conversationID)
+	if id == "" {
+		return ctx
+	}
+	return context.WithValue(ctx, mcpConversationIDCtxKey{}, id)
+}
+
+// MCPConversationIDFromContext 读取对话 ID。
+func MCPConversationIDFromContext(ctx context.Context) string {
+	if ctx == nil {
+		return ""
+	}
+	v, _ := ctx.Value(mcpConversationIDCtxKey{}).(string)
+	return v
+}
+
+// WithMCPExecutionID 将当前工具 executionId 注入 ctx，供超长输出落盘文件名对齐。
+func WithMCPExecutionID(ctx context.Context, executionID string) context.Context {
+	if ctx == nil {
+		return nil
+	}
+	id := strings.TrimSpace(executionID)
+	if id == "" {
+		return ctx
+	}
+	return context.WithValue(ctx, mcpExecutionIDCtxKey{}, id)
+}
+
+// MCPExecutionIDFromContext 读取当前工具 executionId。
+func MCPExecutionIDFromContext(ctx context.Context) string {
+	if ctx == nil {
+		return ""
+	}
+	v, _ := ctx.Value(mcpExecutionIDCtxKey{}).(string)
+	return v
+}
+
+// WithMCPProjectID 将项目 ID 注入 ctx，供 reduction/trunc 落盘路径与项目隔离对齐。
+func WithMCPProjectID(ctx context.Context, projectID string) context.Context {
+	if ctx == nil {
+		return nil
+	}
+	id := strings.TrimSpace(projectID)
+	if id == "" {
+		return ctx
+	}
+	return context.WithValue(ctx, mcpProjectIDCtxKey{}, id)
+}
+
+// MCPProjectIDFromContext 读取项目 ID。
+func MCPProjectIDFromContext(ctx context.Context) string {
+	if ctx == nil {
+		return ""
+	}
+	v, _ := ctx.Value(mcpProjectIDCtxKey{}).(string)
+	return v
+}
+
+func notifyToolRunBegin(ctx context.Context, executionID string) {
+	reg := ToolRunRegistryFromContext(ctx)
+	if reg == nil {
+		return
+	}
+	conv := MCPConversationIDFromContext(ctx)
+	if conv == "" || strings.TrimSpace(executionID) == "" {
+		return
+	}
+	reg.RegisterRunningTool(conv, executionID)
+}
+
+func notifyToolRunEnd(ctx context.Context, executionID string) {
+	reg := ToolRunRegistryFromContext(ctx)
+	if reg == nil {
+		return
+	}
+	conv := MCPConversationIDFromContext(ctx)
+	if conv == "" || strings.TrimSpace(executionID) == "" {
+		return
+	}
+	reg.UnregisterRunningTool(conv, executionID)
+}
@@ -0,0 +1,231 @@
+package mcp
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"cyberstrike-ai/internal/authctx"
+
+	"go.uber.org/zap"
+)
+
+func TestToolAuthorizerIsUniversalAndExecutionKeepsOwner(t *testing.T) {
+	server := NewServer(zap.NewNop())
+	server.RegisterTool(Tool{Name: "echo", InputSchema: map[string]interface{}{"type": "object"}}, func(ctx context.Context, args map[string]interface{}) (*ToolResult, error) {
+		return &ToolResult{Content: []Content{{Type: "text", Text: "ok"}}}, nil
+	})
+	server.SetToolAuthorizer(func(ctx context.Context, toolName string, args map[string]interface{}) error {
+		if _, ok := authctx.PrincipalFromContext(ctx); !ok {
+			return errors.New("principal required")
+		}
+		return nil
+	})
+	_, deniedExecutionID, err := server.CallTool(context.Background(), "echo", nil)
+	if err == nil {
+		t.Fatal("tool call without principal was allowed")
+	}
+	if deniedExecutionID == "" {
+		t.Fatal("denied tool call should still return an execution id")
+	}
+	deniedExecution, ok := server.GetExecution(deniedExecutionID)
+	if !ok || deniedExecution == nil {
+		t.Fatalf("missing denied execution %q", deniedExecutionID)
+	}
+	if deniedExecution.Status != ToolExecutionStatusFailed || !strings.Contains(deniedExecution.Error, "principal required") {
+		t.Fatalf("denied execution = %#v, want failed with authorization error", deniedExecution)
+	}
+	ctx := authctx.WithPrincipal(context.Background(), authctx.NewPrincipal("u1", "user", "assigned", map[string]bool{"mcp:execute": true}))
+	_, executionID, err := server.CallTool(ctx, "echo", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	execution, ok := server.GetExecution(executionID)
+	if !ok || execution.OwnerUserID != "u1" {
+		t.Fatalf("execution owner = %#v, want u1", execution)
+	}
+}
+
+func TestServerCallToolBoundedWaitForInternalTool(t *testing.T) {
+	server := NewServer(zap.NewNop())
+	server.toolWaitTimeout = 10 * time.Millisecond
+	release := make(chan struct{})
+	started := make(chan struct{})
+	server.RegisterTool(Tool{Name: "slow", InputSchema: map[string]interface{}{"type": "object"}}, func(ctx context.Context, args map[string]interface{}) (*ToolResult, error) {
+		close(started)
+		select {
+		case <-release:
+			return &ToolResult{Content: []Content{{Type: "text", Text: "internal done"}}}, nil
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	})
+
+	callCtx, callCancel := context.WithCancel(context.Background())
+	result, executionID, err := server.CallTool(callCtx, "slow", nil)
+	if err != nil {
+		t.Fatalf("CallTool returned error: %v", err)
+	}
+	if executionID == "" || result == nil || !result.IsError {
+		t.Fatalf("expected soft timeout with execution id, result=%#v id=%q", result, executionID)
+	}
+	if text := ToolResultPlainText(result); !strings.Contains(text, executionID) || !strings.Contains(text, "wait_tool_execution") {
+		t.Fatalf("timeout result missing execution guidance: %q", text)
+	}
+	select {
+	case <-started:
+	default:
+		t.Fatal("internal worker did not start")
+	}
+	callCancel()
+	close(release)
+
+	snapshot, err := server.executionService.Wait(context.Background(), executionID, time.Second)
+	if err != nil {
+		t.Fatalf("wait internal execution: %v", err)
+	}
+	if snapshot == nil || snapshot.Execution == nil || snapshot.Execution.Status != ToolExecutionStatusCompleted {
+		t.Fatalf("snapshot = %#v, want completed", snapshot)
+	}
+	if got := ToolResultPlainText(snapshot.Execution.Result); got != "internal done" {
+		t.Fatalf("result = %q, want internal done", got)
+	}
+}
+
+func TestWaitToolExecutionWaitsForInternalActiveExecution(t *testing.T) {
+	server := NewServer(zap.NewNop())
+	server.toolWaitTimeout = 10 * time.Millisecond
+	release := make(chan struct{})
+	server.RegisterTool(Tool{Name: "slow", InputSchema: map[string]interface{}{"type": "object"}}, func(ctx context.Context, args map[string]interface{}) (*ToolResult, error) {
+		select {
+		case <-release:
+			return &ToolResult{Content: []Content{{Type: "text", Text: "wait saw completion"}}}, nil
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	})
+	RegisterExecutionControlTools(server, nil)
+
+	result, executionID, err := server.CallTool(context.Background(), "slow", nil)
+	if err != nil {
+		t.Fatalf("CallTool returned error: %v", err)
+	}
+	if result == nil || !result.IsError || executionID == "" {
+		t.Fatalf("expected initial bounded wait timeout, result=%#v id=%q", result, executionID)
+	}
+
+	done := make(chan *ToolResult, 1)
+	errCh := make(chan error, 1)
+	go func() {
+		waitResult, _, waitErr := server.CallTool(context.Background(), "wait_tool_execution", map[string]interface{}{
+			"execution_id":    executionID,
+			"timeout_seconds": 1,
+		})
+		if waitErr != nil {
+			errCh <- waitErr
+			return
+		}
+		done <- waitResult
+	}()
+
+	select {
+	case <-done:
+		t.Fatal("wait_tool_execution returned before target execution completed")
+	case err := <-errCh:
+		t.Fatalf("wait_tool_execution errored before release: %v", err)
+	case <-time.After(50 * time.Millisecond):
+	}
+	close(release)
+
+	select {
+	case err := <-errCh:
+		t.Fatalf("wait_tool_execution returned error: %v", err)
+	case waitResult := <-done:
+		if waitResult == nil || waitResult.IsError {
+			t.Fatalf("expected successful wait result, got %#v", waitResult)
+		}
+		if body := ToolResultPlainText(waitResult); !strings.Contains(body, "wait saw completion") || !strings.Contains(body, `"status": "completed"`) {
+			t.Fatalf("wait result missing completed target: %s", body)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("wait_tool_execution did not return after target completion")
+	}
+}
+
+func TestWaitToolExecutionTimeoutIsObservationNotFailure(t *testing.T) {
+	server := NewServer(zap.NewNop())
+	server.toolWaitTimeout = 10 * time.Millisecond
+	release := make(chan struct{})
+	server.RegisterTool(Tool{Name: "slow_observed", InputSchema: map[string]interface{}{"type": "object"}}, func(ctx context.Context, args map[string]interface{}) (*ToolResult, error) {
+		<-release
+		return &ToolResult{Content: []Content{{Type: "text", Text: "done"}}}, nil
+	})
+	RegisterExecutionControlTools(server, nil)
+
+	result, executionID, err := server.CallTool(context.Background(), "slow_observed", nil)
+	if err != nil {
+		t.Fatalf("CallTool returned error: %v", err)
+	}
+	if result == nil || !result.IsError || executionID == "" {
+		t.Fatalf("expected initial bounded wait timeout, result=%#v id=%q", result, executionID)
+	}
+
+	waitResult, _, err := server.CallTool(context.Background(), "wait_tool_execution", map[string]interface{}{
+		"execution_id":    executionID,
+		"timeout_seconds": 0.01,
+	})
+	if err != nil {
+		t.Fatalf("wait_tool_execution returned error: %v", err)
+	}
+	if waitResult == nil {
+		t.Fatal("missing wait result")
+	}
+	if waitResult.IsError {
+		t.Fatalf("wait timeout should be a successful observation, got %#v", waitResult)
+	}
+	body := ToolResultPlainText(waitResult)
+	if !strings.Contains(body, `"status": "running"`) || !strings.Contains(body, "本次等待已到达") {
+		t.Fatalf("wait timeout body missing running status/guidance: %s", body)
+	}
+	close(release)
+}
+
+func TestGetToolExecutionIncludesBoundedPartialOutput(t *testing.T) {
+	server := NewServer(zap.NewNop())
+	RegisterExecutionControlTools(server, nil)
+
+	executionID := server.BeginToolExecution(context.Background(), "execute", map[string]interface{}{"command": "demo"})
+	if executionID == "" {
+		t.Fatal("missing execution id")
+	}
+	server.AppendToolExecutionPartialOutput(executionID, "first\n")
+	server.AppendToolExecutionPartialOutput(executionID, strings.Repeat("x", 32))
+
+	result, _, err := server.CallTool(context.Background(), "get_tool_execution", map[string]interface{}{
+		"execution_id":             executionID,
+		"partial_output_max_bytes": 8,
+	})
+	if err != nil {
+		t.Fatalf("get_tool_execution: %v", err)
+	}
+	body := ToolResultPlainText(result)
+	if !strings.Contains(body, `"partial_output": "xxxxxxxx"`) {
+		t.Fatalf("missing bounded partial output: %s", body)
+	}
+	if !strings.Contains(body, `"partial_output_bytes": 38`) {
+		t.Fatalf("missing partial byte count: %s", body)
+	}
+
+	result, _, err = server.CallTool(context.Background(), "get_tool_execution", map[string]interface{}{
+		"execution_id":           executionID,
+		"include_partial_output": false,
+	})
+	if err != nil {
+		t.Fatalf("get_tool_execution without partial: %v", err)
+	}
+	if body := ToolResultPlainText(result); strings.Contains(body, "partial_output") {
+		t.Fatalf("partial output should be omitted: %s", body)
+	}
+}
@@ -0,0 +1,65 @@
+package mcp
+
+import "cyberstrike-ai/internal/tooloutput"
+
+const DefaultToolResultMaxBytes = 12000
+
+// ToolResultSpillConfig controls where oversized tool results are written on disk
+// before the in-memory/DB/agent-facing payload is truncated.
+type ToolResultSpillConfig struct {
+	RootDir        string
+	ProjectID      string
+	ConversationID string
+	ExecutionID    string
+}
+
+// NormalizeToolResultForStorage returns the canonical result used by both the
+// agent-facing response and monitor persistence. When maxBytes is exceeded the
+// full text is spilled under the reduction cache tree and replaced with a
+// <persisted-output> notice that includes the file path.
+func NormalizeToolResultForStorage(result *ToolResult, maxBytes int) *ToolResult {
+	return NormalizeToolResultForStorageWithSpill(result, maxBytes, ToolResultSpillConfig{})
+}
+
+// NormalizeToolResultForStorageWithSpill is NormalizeToolResultForStorage with
+// an explicit spill location (conversation/execution scoped).
+func NormalizeToolResultForStorageWithSpill(result *ToolResult, maxBytes int, spill ToolResultSpillConfig) *ToolResult {
+	if result == nil {
+		return nil
+	}
+	out := cloneToolResult(result)
+	if maxBytes <= 0 {
+		return out
+	}
+
+	total := 0
+	for _, c := range out.Content {
+		if c.Type == "text" {
+			total += len(c.Text)
+		}
+	}
+	if total <= maxBytes {
+		return out
+	}
+
+	full := ToolResultPlainText(out)
+	bound := tooloutput.BoundWithSpill(full, maxBytes, tooloutput.SpillOpts{
+		RootDir:        spill.RootDir,
+		ProjectID:      spill.ProjectID,
+		ConversationID: spill.ConversationID,
+		ExecutionID:    spill.ExecutionID,
+	})
+	out.Content = []Content{{Type: "text", Text: bound}}
+	return out
+}
+
+func cloneToolResult(in *ToolResult) *ToolResult {
+	if in == nil {
+		return nil
+	}
+	out := *in
+	if in.Content != nil {
+		out.Content = append([]Content(nil), in.Content...)
+	}
+	return &out
+}
@@ -0,0 +1,158 @@
+package mcp
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"go.uber.org/zap"
+)
+
+type inMemoryMonitorStorage struct {
+	executions map[string]*ToolExecution
+}
+
+func newInMemoryMonitorStorage() *inMemoryMonitorStorage {
+	return &inMemoryMonitorStorage{executions: map[string]*ToolExecution{}}
+}
+
+func (s *inMemoryMonitorStorage) SaveToolExecution(exec *ToolExecution) error {
+	if exec != nil {
+		s.executions[exec.ID] = cloneToolExecution(exec)
+	}
+	return nil
+}
+
+func (s *inMemoryMonitorStorage) UpdateToolExecutionResult(id string, result *ToolResult) error {
+	exec := s.executions[id]
+	if exec == nil {
+		exec = &ToolExecution{ID: id}
+		s.executions[id] = exec
+	}
+	exec.Result = cloneToolResult(result)
+	return nil
+}
+
+func (s *inMemoryMonitorStorage) LoadToolExecutions() ([]*ToolExecution, error) {
+	out := make([]*ToolExecution, 0, len(s.executions))
+	for _, exec := range s.executions {
+		out = append(out, cloneToolExecution(exec))
+	}
+	return out, nil
+}
+
+func (s *inMemoryMonitorStorage) GetToolExecution(id string) (*ToolExecution, error) {
+	if exec := s.executions[id]; exec != nil {
+		return cloneToolExecution(exec), nil
+	}
+	return nil, nil
+}
+
+func (s *inMemoryMonitorStorage) SaveToolStats(string, *ToolStats) error { return nil }
+
+func (s *inMemoryMonitorStorage) LoadToolStats() (map[string]*ToolStats, error) {
+	return map[string]*ToolStats{}, nil
+}
+
+func (s *inMemoryMonitorStorage) UpdateToolStats(string, int, int, int, *time.Time) error {
+	return nil
+}
+
+func TestServerCallToolStoresAndReturnsSameGuardedResult(t *testing.T) {
+	storage := newInMemoryMonitorStorage()
+	server := NewServerWithStorage(zap.NewNop(), storage)
+	server.ConfigureToolWaitTimeoutSeconds(0)
+	server.ConfigureToolResultMaxBytes(400)
+	spillRoot := t.TempDir()
+	server.ConfigureToolResultSpillRoot(spillRoot)
+	server.RegisterTool(Tool{Name: "big", InputSchema: map[string]interface{}{"type": "object"}}, func(ctx context.Context, args map[string]interface{}) (*ToolResult, error) {
+		return &ToolResult{Content: []Content{{Type: "text", Text: strings.Repeat("x", 800)}}}, nil
+	})
+
+	ctx := WithMCPConversationID(context.Background(), "conv-spill")
+	result, executionID, err := server.CallTool(ctx, "big", nil)
+	if err != nil {
+		t.Fatalf("CallTool: %v", err)
+	}
+	if executionID == "" {
+		t.Fatal("missing execution id")
+	}
+	returned := ToolResultPlainText(result)
+	if !strings.Contains(returned, "<persisted-output>") || !strings.Contains(returned, "Full output saved to:") {
+		t.Fatalf("returned result was not spilled: %q", returned)
+	}
+	if len(returned) > 400 {
+		t.Fatalf("returned result exceeded hard limit: len=%d text=%q", len(returned), returned)
+	}
+
+	spillPath := filepath.Join(spillRoot, "conversations", "conv-spill", "trunc", executionID)
+	abs, err := filepath.Abs(spillPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(returned, abs) {
+		t.Fatalf("missing spill path %q in %q", abs, returned)
+	}
+	body, err := os.ReadFile(abs)
+	if err != nil {
+		t.Fatalf("read spill file: %v", err)
+	}
+	if string(body) != strings.Repeat("x", 800) {
+		t.Fatalf("spill body mismatch: len=%d", len(body))
+	}
+
+	inMem, ok := server.GetExecution(executionID)
+	if !ok || inMem == nil || inMem.Result == nil {
+		t.Fatalf("missing in-memory execution: %#v", inMem)
+	}
+	stored := storage.executions[executionID]
+	if stored == nil || stored.Result == nil {
+		t.Fatalf("missing stored execution: %#v", stored)
+	}
+	if ToolResultPlainText(inMem.Result) != returned {
+		t.Fatalf("in-memory result != returned\nmem=%q\nret=%q", ToolResultPlainText(inMem.Result), returned)
+	}
+	if ToolResultPlainText(stored.Result) != returned {
+		t.Fatalf("stored result != returned\nstored=%q\nret=%q", ToolResultPlainText(stored.Result), returned)
+	}
+}
+
+func TestExecutionServiceStoresGuardedResult(t *testing.T) {
+	service := NewExecutionService(nil, zap.NewNop())
+	service.ConfigureToolResultMaxBytes(400)
+	spillRoot := t.TempDir()
+	service.ConfigureToolResultSpillRoot(spillRoot)
+	handle, err := service.Submit(context.Background(), ExecutionRequest{
+		ToolName:       "big",
+		ConversationID: "svc-conv",
+		Run: func(context.Context) (*ToolResult, error) {
+			return &ToolResult{Content: []Content{{Type: "text", Text: strings.Repeat("a", 800)}}}, nil
+		},
+	})
+	if err != nil {
+		t.Fatalf("Submit: %v", err)
+	}
+	snap, err := service.Wait(context.Background(), handle.ID, time.Second)
+	if err != nil {
+		t.Fatalf("Wait: %v", err)
+	}
+	got := ToolResultPlainText(snap.Execution.Result)
+	if !strings.Contains(got, "<persisted-output>") {
+		t.Fatalf("service result was not spilled: %q", got)
+	}
+	if len(got) > 400 {
+		t.Fatalf("service result exceeded hard limit: len=%d text=%q", len(got), got)
+	}
+	path := filepath.Join(spillRoot, "conversations", "svc-conv", "trunc", handle.ID)
+	abs, _ := filepath.Abs(path)
+	body, err := os.ReadFile(abs)
+	if err != nil {
+		t.Fatalf("read spill: %v", err)
+	}
+	if string(body) != strings.Repeat("a", 800) {
+		t.Fatalf("unexpected spill body len=%d", len(body))
+	}
+}
@@ -0,0 +1,338 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+)
+
+// ExternalMCPClient 外部 MCP 客户端接口（由 client_sdk.go 基于官方 SDK 实现）
+type ExternalMCPClient interface {
+	Initialize(ctx context.Context) error
+	ListTools(ctx context.Context) ([]Tool, error)
+	CallTool(ctx context.Context, name string, args map[string]interface{}) (*ToolResult, error)
+	Close() error
+	IsConnected() bool
+	GetStatus() string
+}
+
+// MCP消息类型
+const (
+	MessageTypeRequest  = "request"
+	MessageTypeResponse = "response"
+	MessageTypeError    = "error"
+	MessageTypeNotify   = "notify"
+)
+
+// MCP协议版本
+const ProtocolVersion = "2024-11-05"
+
+// MessageID 表示JSON-RPC 2.0的id字段，可以是字符串、数字或null
+type MessageID struct {
+	value interface{}
+}
+
+// UnmarshalJSON 自定义反序列化，支持字符串、数字和null
+func (m *MessageID) UnmarshalJSON(data []byte) error {
+	// 尝试解析为null
+	if string(data) == "null" {
+		m.value = nil
+		return nil
+	}
+
+	// 尝试解析为字符串
+	var str string
+	if err := json.Unmarshal(data, &str); err == nil {
+		m.value = str
+		return nil
+	}
+
+	// 尝试解析为数字
+	var num json.Number
+	if err := json.Unmarshal(data, &num); err == nil {
+		m.value = num
+		return nil
+	}
+
+	return fmt.Errorf("invalid id type")
+}
+
+// MarshalJSON 自定义序列化
+func (m MessageID) MarshalJSON() ([]byte, error) {
+	if m.value == nil {
+		return []byte("null"), nil
+	}
+	return json.Marshal(m.value)
+}
+
+// String 返回字符串表示
+func (m MessageID) String() string {
+	if m.value == nil {
+		return ""
+	}
+	return fmt.Sprintf("%v", m.value)
+}
+
+// Value 返回原始值
+func (m MessageID) Value() interface{} {
+	return m.value
+}
+
+// Message 表示MCP消息（符合JSON-RPC 2.0规范）
+type Message struct {
+	ID      MessageID       `json:"id,omitempty"`
+	Type    string          `json:"-"` // 内部使用，不序列化到JSON
+	Method  string          `json:"method,omitempty"`
+	Params  json.RawMessage `json:"params,omitempty"`
+	Result  json.RawMessage `json:"result,omitempty"`
+	Error   *Error          `json:"error,omitempty"`
+	Version string          `json:"jsonrpc,omitempty"` // JSON-RPC 2.0 版本标识
+}
+
+// Error 表示MCP错误
+type Error struct {
+	Code    int         `json:"code"`
+	Message string      `json:"message"`
+	Data    interface{} `json:"data,omitempty"`
+}
+
+// Tool 表示MCP工具定义
+type Tool struct {
+	Name             string                 `json:"name"`
+	Description      string                 `json:"description"`                // 详细描述
+	ShortDescription string                 `json:"shortDescription,omitempty"` // 简短描述（用于工具列表，减少token消耗）
+	InputSchema      map[string]interface{} `json:"inputSchema"`
+}
+
+// ToolCall 表示工具调用
+type ToolCall struct {
+	Name      string                 `json:"name"`
+	Arguments map[string]interface{} `json:"arguments"`
+}
+
+// ToolResult 表示工具执行结果
+type ToolResult struct {
+	Content []Content `json:"content"`
+	IsError bool      `json:"isError,omitempty"`
+}
+
+// Content 表示内容
+type Content struct {
+	Type string `json:"type"`
+	Text string `json:"text"`
+}
+
+// InitializeRequest 初始化请求
+type InitializeRequest struct {
+	ProtocolVersion string                 `json:"protocolVersion"`
+	Capabilities    map[string]interface{} `json:"capabilities"`
+	ClientInfo      ClientInfo             `json:"clientInfo"`
+}
+
+// ClientInfo 客户端信息
+type ClientInfo struct {
+	Name    string `json:"name"`
+	Version string `json:"version"`
+}
+
+// InitializeResponse 初始化响应
+type InitializeResponse struct {
+	ProtocolVersion string             `json:"protocolVersion"`
+	Capabilities    ServerCapabilities `json:"capabilities"`
+	ServerInfo      ServerInfo         `json:"serverInfo"`
+}
+
+// ServerCapabilities 服务器能力
+type ServerCapabilities struct {
+	Tools     map[string]interface{} `json:"tools,omitempty"`
+	Prompts   map[string]interface{} `json:"prompts,omitempty"`
+	Resources map[string]interface{} `json:"resources,omitempty"`
+	Sampling  map[string]interface{} `json:"sampling,omitempty"`
+}
+
+// ServerInfo 服务器信息
+type ServerInfo struct {
+	Name    string `json:"name"`
+	Version string `json:"version"`
+}
+
+// ListToolsRequest 列出工具请求
+type ListToolsRequest struct{}
+
+// ListToolsResponse 列出工具响应
+type ListToolsResponse struct {
+	Tools []Tool `json:"tools"`
+}
+
+// ListPromptsResponse 列出提示词响应
+type ListPromptsResponse struct {
+	Prompts []Prompt `json:"prompts"`
+}
+
+// ListResourcesResponse 列出资源响应
+type ListResourcesResponse struct {
+	Resources []Resource `json:"resources"`
+}
+
+// CallToolRequest 调用工具请求
+type CallToolRequest struct {
+	Name      string                 `json:"name"`
+	Arguments map[string]interface{} `json:"arguments"`
+}
+
+// CallToolResponse 调用工具响应
+type CallToolResponse struct {
+	Content []Content `json:"content"`
+	IsError bool      `json:"isError,omitempty"`
+}
+
+// ToolExecution 工具执行记录
+type ToolExecution struct {
+	ID        string                 `json:"id"`
+	ToolName  string                 `json:"toolName"`
+	Arguments map[string]interface{} `json:"arguments"`
+	Status    string                 `json:"status"` // pending, running, completed, failed, cancelled
+	Result    *ToolResult            `json:"result,omitempty"`
+	Error     string                 `json:"error,omitempty"`
+	StartTime time.Time              `json:"startTime"`
+	EndTime   *time.Time             `json:"endTime,omitempty"`
+	Duration  time.Duration          `json:"duration,omitempty"`
+	// PartialOutput is a bounded tail preview of output produced by a running tool.
+	// It is intentionally separate from Result, which remains the final canonical tool result.
+	PartialOutput          string     `json:"partialOutput,omitempty"`
+	PartialOutputBytes     int64      `json:"partialOutputBytes,omitempty"`
+	PartialOutputTruncated bool       `json:"partialOutputTruncated,omitempty"`
+	PartialOutputUpdatedAt *time.Time `json:"partialOutputUpdatedAt,omitempty"`
+	// ConversationID 仅 API 展示用（进行中的 Agent 任务），不写入 tool_executions 表。
+	ConversationID string `json:"conversationId,omitempty"`
+	OwnerUserID    string `json:"-"`
+}
+
+// ToolStats 工具统计信息
+type ToolStats struct {
+	ToolName     string     `json:"toolName"`
+	TotalCalls   int        `json:"totalCalls"`
+	SuccessCalls int        `json:"successCalls"`
+	FailedCalls  int        `json:"failedCalls"`
+	LastCallTime *time.Time `json:"lastCallTime,omitempty"`
+}
+
+// Prompt 提示词模板
+type Prompt struct {
+	Name        string           `json:"name"`
+	Description string           `json:"description,omitempty"`
+	Arguments   []PromptArgument `json:"arguments,omitempty"`
+}
+
+// PromptArgument 提示词参数
+type PromptArgument struct {
+	Name        string `json:"name"`
+	Description string `json:"description,omitempty"`
+	Required    bool   `json:"required,omitempty"`
+}
+
+// GetPromptRequest 获取提示词请求
+type GetPromptRequest struct {
+	Name      string                 `json:"name"`
+	Arguments map[string]interface{} `json:"arguments,omitempty"`
+}
+
+// GetPromptResponse 获取提示词响应
+type GetPromptResponse struct {
+	Messages []PromptMessage `json:"messages"`
+}
+
+// PromptMessage 提示词消息
+type PromptMessage struct {
+	Role    string `json:"role"`
+	Content string `json:"content"`
+}
+
+// Resource 资源
+type Resource struct {
+	URI         string `json:"uri"`
+	Name        string `json:"name"`
+	Description string `json:"description,omitempty"`
+	MimeType    string `json:"mimeType,omitempty"`
+}
+
+// ReadResourceRequest 读取资源请求
+type ReadResourceRequest struct {
+	URI string `json:"uri"`
+}
+
+// ReadResourceResponse 读取资源响应
+type ReadResourceResponse struct {
+	Contents []ResourceContent `json:"contents"`
+}
+
+// ResourceContent 资源内容
+type ResourceContent struct {
+	URI      string `json:"uri"`
+	MimeType string `json:"mimeType,omitempty"`
+	Text     string `json:"text,omitempty"`
+	Blob     string `json:"blob,omitempty"`
+}
+
+// SamplingRequest 采样请求
+type SamplingRequest struct {
+	Messages    []SamplingMessage `json:"messages"`
+	Model       string            `json:"model,omitempty"`
+	MaxTokens   int               `json:"maxTokens,omitempty"`
+	Temperature float64           `json:"temperature,omitempty"`
+	TopP        float64           `json:"topP,omitempty"`
+}
+
+// SamplingMessage 采样消息
+type SamplingMessage struct {
+	Role    string `json:"role"`
+	Content string `json:"content"`
+}
+
+// SamplingResponse 采样响应
+type SamplingResponse struct {
+	Content    []SamplingContent `json:"content"`
+	Model      string            `json:"model,omitempty"`
+	StopReason string            `json:"stopReason,omitempty"`
+}
+
+// SamplingContent 采样内容
+type SamplingContent struct {
+	Type string `json:"type"`
+	Text string `json:"text,omitempty"`
+}
+
+// ToolResultPlainText 拼接工具结果中的文本（手动终止时作为「工具原始输出」）。
+func ToolResultPlainText(r *ToolResult) string {
+	if r == nil || len(r.Content) == 0 {
+		return ""
+	}
+	var b strings.Builder
+	for _, c := range r.Content {
+		b.WriteString(c.Text)
+	}
+	return strings.TrimSpace(b.String())
+}
+
+// AbortNoteBannerForModel 标出后续文本来自「用户手动终止工具时在弹窗中填写」，避免与 stdout/stderr 混淆。
+const AbortNoteBannerForModel = "---\n" +
+	"【用户终止说明｜USER INTERRUPT NOTE】\n" +
+	"（以下由操作者填写，用于指示模型如何继续；不是工具原始输出。）\n" +
+	"（Written by the operator when stopping this tool; not raw tool output.）\n" +
+	"---"
+
+// MergePartialToolOutputAndAbortNote 格式：工具原始输出 + 醒目标题 + 用户终止说明（无说明则原样返回 partial）。
+func MergePartialToolOutputAndAbortNote(partial, userNote string) string {
+	partial = strings.TrimSpace(partial)
+	userNote = strings.TrimSpace(userNote)
+	if userNote == "" {
+		return partial
+	}
+	section := AbortNoteBannerForModel + "\n" + userNote
+	if partial == "" {
+		return section
+	}
+	return partial + "\n\n" + section
+}