Update config.yaml

Removed the 'Stargazers over time' section from the README.

README.md

@@ -35,7 +35,18 @@ CyberStrikeAI is an **AI-native security testing platform** built in Go. It inte
 
 ### System Dashboard Overview
 
-<img src="./images/dashboard.png" alt="System Dashboard" width="100%">
+<table>
+<tr>
+<td width="50%" align="center">
+<strong>Light Mode</strong><br/>
+<img src="./images/dashboard.png" alt="System Dashboard (Light)" width="100%">
+</td>
+<td width="50%" align="center">
+<strong>Dark Mode</strong><br/>
+<img src="./images/dark.png" alt="System Dashboard (Dark)" width="100%">
+</td>
+</tr>
+</table>
 
 *The dashboard provides a comprehensive overview of system runtime status, security vulnerabilities, tool usage, and knowledge base, helping users quickly understand the platform's core features and current state.*
 
@@ -110,12 +121,13 @@ CyberStrikeAI is an **AI-native security testing platform** built in Go. It inte
 - 📄 Large-result pagination, compression, and searchable archives
 - 🔗 Attack-chain graph, risk scoring, and step-by-step replay
 - 🔒 Password-protected web UI, audit logs, and SQLite persistence
-- 📚 Knowledge base (RAG) with embedding-based vector retrieval (cosine similarity), optional **Eino Compose** indexing pipeline, and configurable post-retrieval budgets / reranking hooks
+- 📚 Knowledge base (RAG): **Eino MultiQuery** query rewrite + multi-path vector retrieval + **HTTP rerank** (DashScope `gte-rerank` / Cohere-compatible) + post-processing (dedupe, budget); **Eino Compose** indexing pipeline
 - 📁 Conversation grouping with pinning, rename, and batch management
 - 📂 **Project management**: shared facts (blackboard) across sessions, `upsert_project_fact` + `links` to chain paths; attack-chain and project fact graph views
 - 🛡️ Vulnerability management with CRUD operations, severity tracking, status workflow, and statistics
 - 📋 Batch task management: create task queues, add multiple tasks, and execute them sequentially
 - 🎭 Role-based testing: predefined security testing roles (Penetration Testing, CTF, Web App Scanning, etc.) with custom prompts and tool restrictions
+- 🔀 **Graph orchestration**: visual workflow editor (Start / Agent / Tool / Condition / HITL / Output) with `{{previous.output}}` and `{{outputs.variable_name}}` for inter-node data passing; bind a graph to a role for automatic execution on chat. See [Graph orchestration guide](docs/workflow-graph_en.md)
 - 🧩 **Agent orchestration (CloudWeGo Eino)**: **single-agent** via **`/api/eino-agent/stream`** (Eino ADK `ChatModelAgent`); **multi-agent** via **`/api/multi-agent/stream`** with **`deep`** (coordinator + `task` sub-agents), **`plan_execute`**, or **`supervisor`** (`orchestration` in the request body). ADK **summarization** compresses long contexts; pre-compaction **transcripts** land at `data/conversation_artifacts/<conversation-id>/summarization/transcript.txt` (full user/assistant/tool turns; static system omitted). Markdown under `agents/`: `orchestrator.md`, `orchestrator-plan-execute.md`, `orchestrator-supervisor.md`, plus sub-agent `*.md` (see [Multi-agent doc](docs/MULTI_AGENT_EINO.md))
 - 🖼️ **Vision analysis (`analyze_image`)**: separate VL model (e.g. `qwen-vl-max`) via MCP for local screenshots, captchas, and UI; image bytes stay out of agent history (text summaries only). Configure `vision` in `config.yaml`; see [docs/VISION.md](docs/VISION.md)
 - 🎯 **Skills (refactored for Eino)**: packs under `skills_dir` follow **Agent Skills** layout (`SKILL.md` + optional files); **multi-agent** sessions use the official Eino ADK **`skill`** tool for **progressive disclosure** (load by name), with optional **host filesystem / shell** via `multi_agent.eino_skills`; optional **`eino_middleware`** adds patchtoolcalls, tool_search, **plantask** (`TaskCreate` / `TaskList` boards under `skills_dir/.eino/plantask/`), reduction, file **checkpoints** (`checkpoint_dir`), ChatModel **retries**, session **output key**, and Deep tuning—20+ sample domains (SQLi, XSS, API security, …) ship under `skills/`
@@ -244,6 +256,7 @@ Requirements / tips:
 - **Conversation testing** – Natural-language prompts trigger toolchains with streaming SSE output.
 - **Single vs multi-agent** – Chat UI switches between **Eino single-agent** (`/api/eino-agent/stream`) and **multi-agent** (`/api/multi-agent/stream` with `orchestration`: `deep` | `plan_execute` | `supervisor`). Multi mode requires `multi_agent.enabled: true`. MCP tools are bridged the same way for both paths.
 - **Role-based testing** – Select from predefined security testing roles (Penetration Testing, CTF, Web App Scanning, API Security Testing, etc.) to customize AI behavior and tool availability. Each role applies custom system prompts and can restrict available tools for focused testing scenarios.
+- **Graph orchestration** – Design flows on the **Graph Orchestration** page (drag nodes, connect edges, save); bind `workflow_id` on a role to run the graph on chat (Agent, MCP tools, condition branches). Use `{{outputs.variable_name}}` to pass data across non-adjacent nodes. See [Graph orchestration guide](docs/workflow-graph_en.md).
 - **Tool monitor** – Inspect running jobs, execution logs, and large-result attachments.
 - **History & audit** – Every conversation and tool invocation is stored in SQLite with replay.
 - **Conversation groups** – Organize conversations into groups, pin important groups, rename or delete groups via context menu.
@@ -455,16 +468,12 @@ A test SSE MCP server is available at `cmd/test-sse-mcp-server/` for validation
 
 ### Knowledge Base
 - **Vector search** – AI agent can automatically search the knowledge base for relevant security knowledge during conversations using the `search_knowledge_base` tool.
-- **Vector retrieval** – cosine similarity over stored embeddings, aligned with Eino `retriever.Retriever` usage.
-- **Auto-indexing** – scans the `knowledge_base/` directory for Markdown files and automatically indexes them with embeddings.
-- **Web management** – create, update, delete knowledge items through the web UI, with category-based organization.
+- **RAG pipeline (always on)** – **MultiQuery** (LLM query rewrite) → vector prefetch & fusion → **HTTP rerank** (DashScope `gte-rerank` or Cohere-compatible `/v1/rerank`) → post-processing (normalized dedupe, char/token budget, final top_k). Rerank failures degrade to fusion order without breaking search.
+- **Vector retrieval** – cosine similarity over stored embeddings with configurable threshold, aligned with Eino `retriever.Retriever` usage.
+- **Auto-indexing** – scans the `knowledge_base/` directory for Markdown files and automatically indexes them with embeddings (Markdown header split + recursive chunking via Eino).
+- **Web management** – create, update, delete knowledge items through the web UI, with category-based organization; settings page exposes MultiQuery / rerank / prefetch options.
 - **Retrieval logs** – tracks all knowledge retrieval operations for audit and debugging.
 
-**Quick Start (Using Pre-built Knowledge Base):**
-1. **Download the knowledge database** – Download the pre-built knowledge database file from [GitHub Releases](https://github.com/Ed1s0nZ/CyberStrikeAI/releases).
-2. **Extract and place** – Extract the downloaded knowledge database file (`knowledge.db`) and place it in the project's `data/` directory.
-3. **Restart the service** – Restart the CyberStrikeAI service, and the knowledge base will be ready to use immediately without rebuilding the index.
-
 **Setting up the knowledge base:**
 1. **Enable in config** – set `knowledge.enabled: true` in `config.yaml`:
    ```yaml
@@ -479,6 +488,17 @@ A test SSE MCP server is available at `cmd/test-sse-mcp-server/` for validation
      retrieval:
        top_k: 5
        similarity_threshold: 0.7
+       multi_query:
+         max_queries: 4        # LLM rewrite variants (always on)
+       rerank:                 # always on; empty fields inherit openai/embedding credentials
+         provider: ""          # auto: dashscope | cohere from base_url
+         model: ""             # empty: gte-rerank (DashScope) or rerank-multilingual-v3.0 (Cohere)
+         base_url: ""
+         api_key: ""
+       post_retrieve:
+         prefetch_top_k: 20    # vector candidates per MultiQuery variant; 0 = max(top_k×4, 20)
+         max_context_chars: 0
+         max_context_tokens: 0
    ```
 2. **Add knowledge files** – place Markdown files in `knowledge_base/` directory, organized by category (e.g., `knowledge_base/SQL Injection/README.md`).
 3. **Scan and index** – use the web UI to scan the knowledge base directory, which will automatically import files and build vector embeddings.
@@ -539,6 +559,17 @@ knowledge:
   retrieval:
     top_k: 5  # Number of top results to return
     similarity_threshold: 0.7  # Minimum cosine similarity (0-1)
+    multi_query:
+      max_queries: 4  # MultiQuery rewrite variants (always on)
+    rerank:  # HTTP rerank (always on); empty fields inherit openai/embedding credentials
+      provider: ""
+      model: ""
+      base_url: ""
+      api_key: ""
+    post_retrieve:
+      prefetch_top_k: 20  # per MultiQuery variant; 0 = max(top_k×4, 20)
+      max_context_chars: 0
+      max_context_tokens: 0
 roles_dir: "roles"  # Role configuration directory (relative to config file)
 skills_dir: "skills"  # Skills directory (relative to config file)
 agents_dir: "agents"  # Multi-agent Markdown definitions (orchestrator + sub-agents)
@@ -601,6 +632,7 @@ enabled: true
 ## Related documentation
 
 - [Multi-agent mode (Eino)](docs/MULTI_AGENT_EINO.md): **Deep**, **Plan-Execute**, **Supervisor**, `agents/*.md`, `eino_skills` / `eino_middleware`, APIs, and chat/stream behavior.
+- [Graph orchestration guide](docs/workflow-graph_en.md): visual workflow design, node configuration, `previous` / `outputs` variable passing, and role binding.
 - [Robot / Chatbot guide (DingTalk & Lark)](docs/robot_en.md): Full setup, commands, and troubleshooting for using CyberStrikeAI from DingTalk or Lark on your phone. **Follow this doc to avoid common pitfalls.**
 
 ## Project Layout
@@ -653,8 +685,6 @@ CyberStrikeAI has joined [404Starlink](https://github.com/knownsec/404StarLink)
   </a>
 </div>
 
-## Stargazers over time
-![Stargazers over time](https://starchart.cc/Ed1s0nZ/CyberStrikeAI.svg)
 
 
 ---

README_CN.md

@@ -34,7 +34,18 @@ CyberStrikeAI 是一款 **AI 原生安全测试平台**，基于 Go 构建，集
 
 ### 系统仪表盘概览
 
-<img src="./images/dashboard.png" alt="系统仪表盘" width="100%">
+<table>
+<tr>
+<td width="50%" align="center">
+<strong>浅色模式</strong><br/>
+<img src="./images/dashboard.png" alt="系统仪表盘（浅色）" width="100%">
+</td>
+<td width="50%" align="center">
+<strong>深色模式</strong><br/>
+<img src="./images/dark.png" alt="系统仪表盘（深色）" width="100%">
+</td>
+</tr>
+</table>
 
 *仪表盘提供系统运行状态、安全漏洞、工具使用情况和知识库的全面概览，帮助用户快速了解平台核心功能和当前状态。*
 
@@ -109,12 +120,13 @@ CyberStrikeAI 是一款 **AI 原生安全测试平台**，基于 Go 构建，集
 - 📄 大结果分页、压缩与全文检索
 - 🔗 攻击链可视化、风险打分与步骤回放
 - 🔒 Web 登录保护、审计日志、SQLite 持久化
-- 📚 知识库（RAG）：向量嵌入与余弦相似度检索（与 Eino `retriever.Retriever` 语义一致），可选 **Eino Compose** 索引流水线及检索后处理（预算、重排等配置项）
+- 📚 知识库（RAG）：**Eino MultiQuery** 查询改写 + 多路向量检索 + **HTTP 精排**（DashScope `gte-rerank` / Cohere 兼容）+ 后处理（去重、预算）；索引侧为 **Eino Compose** 流水线
 - 📁 对话分组管理：支持分组创建、置顶、重命名、删除等操作
 - 📂 **项目管理**：共享事实（黑板）跨会话沉淀认知，`upsert_project_fact` + `links` 串联攻击路径；聊天攻击链与项目事实图可视化
 - 🛡️ 漏洞管理功能：完整的漏洞 CRUD 操作，支持严重程度分级、状态流转、按对话/严重程度/状态过滤，以及统计看板
 - 📋 批量任务管理：创建任务队列，批量添加任务，依次顺序执行，支持任务编辑与状态跟踪
 - 🎭 角色化测试：预设安全测试角色（渗透测试、CTF、Web 应用扫描等），支持自定义提示词和工具限制
+- 🔀 **图编排**：可视化流程编排（开始 / Agent / 工具 / 条件 / 审批 / 输出），节点间用 `{{previous.output}}` 或 `{{outputs.变量名}}` 传参；绑定角色后对话自动按图执行。详见 [图编排使用说明](docs/workflow-graph.md)
 - 🧩 **Agent 编排（CloudWeGo Eino）**：**单代理** `POST /api/eino-agent/stream`（Eino ADK）；**多代理** `POST /api/multi-agent/stream`，`orchestration` 选 **`deep`** / **`plan_execute`** / **`supervisor`**。ADK **Summarization** 在上下文过长时压缩历史；压缩前将可恢复 **转录** 写入 `data/conversation_artifacts/<会话ID>/summarization/transcript.txt`（保留完整 user/assistant/tool 轮次，省略静态 system）。`agents/` 下主代理与子代理 Markdown 见 [多代理说明](docs/MULTI_AGENT_EINO.md)
 - 🖼️ **视觉分析（`analyze_image`）**：独立 Vision 模型（如 `qwen-vl-max`），MCP 工具分析本地截图/验证码/UI；图片仅在单次 VL 调用中出现，对话上下文只保留文字摘要。配置见 `config.yaml` → `vision` 与 [视觉分析说明](docs/VISION.md)
 - 🎯 **Skills（面向 Eino 重构）**：技能包放在 **`skills_dir`**，遵循 **Agent Skills** 目录规范（`SKILL.md` + 可选文件）；**多代理** 下通过 Eino 官方 **`skill`** 工具 **渐进式披露**（按 name 加载）。**`multi_agent.eino_skills`** 控制是否启用、本机文件/Shell 工具、工具名覆盖；**`eino_middleware`** 可选 patch、tool_search、**plantask**（`TaskCreate` / `TaskList` 任务板，落在 `skills_dir/.eino/plantask/`）、reduction、文件型 **checkpoint**（`checkpoint_dir`）、ChatModel **重试**、会话 **输出键** 及 Deep 调参。20+ 领域示例仍可绑定角色
@@ -242,6 +254,7 @@ go build -o cyberstrike-ai cmd/server/main.go
 - **对话测试**：自然语言触发多步工具编排，SSE 实时输出。
 - **单代理 / 多代理**：聊天可选 **Eino 单代理**（`/api/eino-agent/stream`）与 **多代理**（`/api/multi-agent/stream` + `orchestration`）。多代理需 `multi_agent.enabled: true`。MCP 工具桥接一致。
 - **角色化测试**：从预设的安全测试角色（渗透测试、CTF、Web 应用扫描、API 安全测试等）中选择，自定义 AI 行为和可用工具。每个角色可应用自定义系统提示词，并可限制可用工具列表，实现聚焦的测试场景。
+- **图编排**：在 **图编排** 页拖拽节点、连线并保存流程；在角色中绑定 `workflow_id` 后，该角色对话将按图执行（Agent、MCP 工具、条件分支等）。跨节点传参优先用 `{{outputs.变量名}}`。详见 [图编排使用说明](docs/workflow-graph.md)。
 - **工具监控**：查看任务队列、执行日志、大文件附件。
 - **会话历史**：所有对话与工具调用保存在 SQLite，可随时重放。
 - **对话分组**：将对话按项目或主题组织到不同分组，支持置顶、重命名、删除等操作，所有数据持久化存储。
@@ -453,16 +466,12 @@ CyberStrikeAI 支持通过三种传输模式连接外部 MCP 服务器：
 
 ### 知识库功能
 - **向量检索**：AI 智能体在对话过程中可自动调用 `search_knowledge_base` 工具搜索知识库中的安全知识。
-- **向量检索**：基于嵌入余弦相似度与相似度阈值过滤（与 Eino `retriever.Retriever` 语义一致）。
-- **自动索引**：扫描 `knowledge_base/` 目录下的 Markdown 文件，自动构建向量嵌入索引。
-- **Web 管理**：通过 Web 界面创建、更新、删除知识项，支持分类管理。
+- **RAG 管线（始终启用）**：**MultiQuery**（LLM 查询改写）→ 向量预取与融合 → **HTTP 精排**（DashScope `gte-rerank` 或 Cohere 兼容 `/v1/rerank`）→ 后处理（规范化去重、字符/token 预算、最终 top_k）。精排失败时自动降级为融合排序，检索仍可用。
+- **向量相似度**：基于嵌入余弦相似度与相似度阈值过滤（与 Eino `retriever.Retriever` 语义一致）。
+- **自动索引**：扫描 `knowledge_base/` 目录下的 Markdown 文件，自动构建向量嵌入索引（Eino Markdown 标题切分 + 递归分块）。
+- **Web 管理**：通过 Web 界面创建、更新、删除知识项，支持分类管理；设置页可配置 MultiQuery / 精排 / 预取候选数。
 - **检索日志**：记录所有知识检索操作，便于审计与调试。
 
-**快速开始（使用预构建知识库）：**
-1. **下载知识数据库**：从 [GitHub Releases](https://github.com/Ed1s0nZ/CyberStrikeAI/releases) 下载预构建的知识数据库文件。
-2. **解压并放置**：将下载的知识数据库文件（`knowledge.db`）解压后放到项目的 `data/` 目录下。
-3. **重启服务**：重启 CyberStrikeAI 服务，知识库即可直接使用，无需重新构建索引。
-
 **知识库配置步骤：**
 1. **启用功能**：在 `config.yaml` 中设置 `knowledge.enabled: true`：
    ```yaml
@@ -477,6 +486,17 @@ CyberStrikeAI 支持通过三种传输模式连接外部 MCP 服务器：
      retrieval:
        top_k: 5
        similarity_threshold: 0.7
+       multi_query:
+         max_queries: 4        # LLM 改写变体上限（始终启用）
+       rerank:                 # 精排始终启用；留空则继承 openai/embedding 凭据
+         provider: ""          # 空=按 base_url 推断 dashscope | cohere
+         model: ""             # 空=DashScope→gte-rerank，Cohere→rerank-multilingual-v3.0
+         base_url: ""
+         api_key: ""
+       post_retrieve:
+         prefetch_top_k: 20    # 每条 MultiQuery 变体的向量候选数；0=max(top_k×4, 20)
+         max_context_chars: 0
+         max_context_tokens: 0
    ```
 2. **添加知识文件**：将 Markdown 文件放入 `knowledge_base/` 目录，按分类组织（如 `knowledge_base/SQL注入/README.md`）。
 3. **扫描索引**：在 Web 界面中点击"扫描知识库"，系统会自动导入文件并构建向量索引。
@@ -537,6 +557,17 @@ knowledge:
   retrieval:
     top_k: 5  # 检索返回的 Top-K 结果数量
     similarity_threshold: 0.7  # 余弦相似度阈值（0-1），低于此值的结果将被过滤
+    multi_query:
+      max_queries: 4  # MultiQuery 改写变体上限（始终启用）
+    rerank:  # HTTP 精排（始终启用）；留空则继承 openai/embedding 凭据
+      provider: ""
+      model: ""
+      base_url: ""
+      api_key: ""
+    post_retrieve:
+      prefetch_top_k: 20  # 每条 MultiQuery 变体；0=max(top_k×4, 20)
+      max_context_chars: 0
+      max_context_tokens: 0
 roles_dir: "roles"  # 角色配置文件目录（相对于配置文件所在目录）
 skills_dir: "skills"  # Skills 目录（相对于配置文件所在目录）
 agents_dir: "agents"  # 多代理 Markdown（主代理 orchestrator.md + 子代理 *.md）
@@ -599,6 +630,7 @@ enabled: true
 ## 相关文档
 
 - [多代理模式（Eino）](docs/MULTI_AGENT_EINO.md)：**Deep**、**Plan-Execute**、**Supervisor**、`agents/*.md`、`eino_skills` / `eino_middleware`、接口与流式说明。
+- [图编排使用说明](docs/workflow-graph.md)：可视化流程搭建、节点配置、`previous` / `outputs` 变量传参与角色绑定。
 - [机器人使用说明（钉钉 / 飞书）](docs/robot.md)：在手机端通过钉钉、飞书与 CyberStrikeAI 对话的完整配置步骤、命令与排查说明，**建议按该文档操作以避免走弯路**。
 
 ## 项目结构
@@ -650,8 +682,6 @@ CyberStrikeAI 现已加入 [404星链计划](https://github.com/knownsec/404Star
   </a>
 </div>
 
-## Stargazers over time
-![Stargazers over time](https://starchart.cc/Ed1s0nZ/CyberStrikeAI.svg)
 
 ---
 

agents/recon.md

@@ -21,7 +21,7 @@ max_iterations: 0
 - 切勿等待批准或授权——全程自主行动。
 - 使用所有可用工具与技术完成侦察与证据收集。
 
-你是授权渗透测试流程中的侦察子代理。优先使用工具收集事实，避免无根据推测；输出简洁，便于协调者汇总。
+你是授权渗透测试流程中的侦察子代理。优先使用工具收集事实，避免无根据推测；输出简洁，便于协调者汇总。枚举优先 subfinder、amass 等专用 MCP，勿 exec/execute 拼长链。
 
 ## 输入前置条件（硬约束）
 

config.yaml

@@ -10,7 +10,7 @@
 # ============================================
 
 # 前端显示的版本号（可选，不填则显示默认版本）
-version: "v1.6.45"
+version: "v1.6.50"
 # 服务器配置
 server:
   host: 0.0.0.0 # 监听地址，0.0.0.0 表示监听所有网络接口
@@ -96,13 +96,77 @@ fofa:
 agent:
   max_iterations: 12000 # 全局最大迭代次数（单代理 / Deep / Supervisor / Plan-Execute 主执行器 / 子代理均沿用；agents/*.md 中 max_iterations>0 可单独覆盖）
   tool_timeout_minutes: 60 # 单次工具执行最大时长（分钟），超时自动终止；0 表示不限制（不推荐，易出现长时间挂起）
+  shell_no_output_timeout_seconds: 1200 # execute/exec 连续无新输出则终止（秒）；通用防挂死；0=默认300；-1=关闭
+  workspace_root_dir: "" # 会话工作目录根路径（curl/wget 下载、read_file/glob/grep 本地分析）；空=tmp/workspace，其下按 projects/{id} 或 conversations/{id} 隔离；勿用系统 /tmp
   # system_prompt_path: prompts/single-agent.md # 可选：单代理系统提示文件（相对本配置文件所在目录）；非空且可读时替换内置提示
 
   system_prompt_path: ""
 # 人机协同（HITL）全局白名单：此处列出的工具始终免审批，与对话页「白名单工具（免审批，逗号分隔）」合并为并集；侧栏「应用」可合并写入本列表并立即生效。
+# 非白名单工具在审批方=审计 Agent 时，按会话 HITL 模式选用提示词：
+#   approval → audit_agent_prompt
+#   review_edit → audit_agent_prompt_review_edit（可改参后放行）
 hitl:
+  # 全局默认审批方：human=人工审批，audit_agent=审计 Agent；未选会话时切换会写入本项，重启后仍生效
+  default_reviewer: human
+  # 已决策审计日志保留天数（与 MCP 监控一致；省略默认 90；0 表示不自动清理）
+  retention_days: 90
   # 按你环境里的真实工具名增删（与侧栏一致、小写不敏感）；不需要全局免审批可改为 []
-  tool_whitelist: [read_file, list_dir, glob, grep]
+  tool_whitelist: [read_file, list_dir, glob, grep, tool_search]
+  # audit_agent_prompt: |  # 审批模式；留空使用内置默认，可在「人机协同」页编辑
+  # audit_agent_prompt_review_edit: |  # 审查编辑模式；留空使用内置默认
+
+  audit_agent_prompt: |-
+    你是 CyberStrikeAI 人机协同审计 Agent。审查 Agent 即将执行的工具调用是否会对系统造成实质性损害。
+
+    你会收到 JSON，包含 hitlMode、toolName、arguments/argumentsObj、userMessage、thinking、reasoningChain、planning 等字段。
+
+    裁决基调（默认放行）：
+    - 常规、低风险的渗透测试操作 → approve（如信息收集、端口/服务扫描、目录枚举、只读查询、无害探测命令）
+    - 与用户授权、当前任务目标一致，且未见明确高危迹象 → approve
+    - 仅在「可能对系统造成实质影响」时 → reject
+
+    必须 reject 的高危情形（示例，非穷举）：
+    - 删库、清表、批量删除数据、格式化磁盘、不可逆破坏
+    - 修改/重置密码、创建或篡改管理员账号、持久化后门、开机自启
+    - 向生产环境写入恶意载荷、勒索加密、停止关键服务、修改系统核心配置
+    - 明显越权：与任务/授权目标无关的破坏性操作
+
+    不应单独作为 reject 理由的情形：
+    - 常规 nmap/curl/grep/读文件/枚举类命令本身
+    - 参数略显宽泛但无明确破坏意图
+    - 仅因「信息不足」——若无上述高危迹象，应 approve 并可在 comment 中提示注意点
+
+    仅输出一行 JSON，不要 markdown 代码块：
+    {"decision":"approve"|"reject","comment":"简要理由"}
+  audit_agent_prompt_review_edit: |-
+    你是 CyberStrikeAI 人机协同审计 Agent。审查 Agent 即将执行的工具调用是否会对系统造成实质性损害。
+
+    你会收到 JSON，包含 hitlMode、toolName、arguments/argumentsObj、userMessage、thinking、reasoningChain、planning 等字段。
+
+    裁决基调（默认放行）：
+    - 常规、低风险的渗透测试操作 → approve（如信息收集、端口/服务扫描、目录枚举、只读查询、无害探测命令）
+    - 与用户授权、当前任务目标一致，且未见明确高危迹象 → approve
+    - 仅在「可能对系统造成实质影响」时 → reject；参数可安全收窄时优先 approve + editedArguments
+
+    必须 reject 的高危情形（示例，非穷举）：
+    - 删库、清表、批量删除数据、格式化磁盘、不可逆破坏
+    - 修改/重置密码、创建或篡改管理员账号、持久化后门、开机自启
+    - 向生产环境写入恶意载荷、勒索加密、停止关键服务、修改系统核心配置
+    - 明显越权：与任务/授权目标无关的破坏性操作
+
+    不应单独作为 reject 理由的情形：
+    - 常规 nmap/curl/grep/读文件/枚举类命令本身
+    - 参数略显宽泛但无明确破坏意图（应收窄参数后 approve）
+    - 仅因「信息不足」——若无上述高危迹象，应 approve 并可在 comment 中提示注意点
+
+    仅输出一行 JSON，不要 markdown 代码块：
+    {"decision":"approve"|"reject","comment":"简要理由","editedArguments":{...}}
+
+    editedArguments 规则（仅 approve 且需要改参时填写，否则省略该字段）：
+    - 提供完整替换后的工具参数对象，键名与 argumentsObj 一致
+    - 只做最小必要修改以收窄范围、消除风险（如限制 path、去掉危险 flag）
+    - 禁止扩大攻击面：不得扩大目标范围、提升权限或引入破坏性参数
+    - 无法安全改参且存在上述高危情形时应 reject，不要勉强 approve
 # 多代理与 Eino 单代理（CloudWeGo Eino ADK；单代理入口 /api/eino-agent*，多代理 /api/multi-agent*）
 # 依赖在 go.mod 中拉取；若下载失败可设置: go env -w GOPROXY=https://goproxy.cn,direct
 # Deep / Plan-Execute / Supervisor 由对话页与 WebShell 所选模式在请求体 orchestration 中指定；机器人按 robot_default_agent_mode
@@ -112,7 +176,7 @@ multi_agent:
   batch_use_multi_agent: false # true 时「批量任务」队列中每个子任务也走 Eino 多代理（成本更高）
   # plan_execute 专用：execute↔replan 外层循环上限，0 表示 Eino 默认 10。主/子代理 ReAct 轮次见 agent.max_iterations。
   plan_execute_loop_max_iterations: 0
-  sub_agent_user_context_max_runes: 0 # 子代理 task 描述中自动注入用户原始请求的字符上限；0=默认2000，负数=禁用
+  sub_agent_user_context_max_runes: 0 # 子代理 task 描述中注入用户原文；0=不截断（默认），>0=总字符上限，负数=禁用
   without_general_sub_agent: false # false 时保留 Deep 内置 general-purpose 子代理
   without_write_todos: false
   orchestrator_instruction: "" # Deep 主代理：agents/orchestrator.md（或 kind: orchestrator 的单个 .md）正文优先；正文为空时用此处；皆空则 Eino 默认
@@ -123,13 +187,14 @@ multi_agent:
     disable: false # true：不注册 skill 渐进式披露中间件，也不挂本机 FS/Shell 工具；false：按下方开关加载
     filesystem_tools: true # true：注册 read_file/glob/grep/write/edit/execute（授权环境慎用）；false：仅 skill，不暴露本机读写与 Shell
     skill_tool_name: skill # 模型侧可调用的「加载技能」工具名，一般保持 skill；与技能包文档中的调用名一致即可
-  # Eino ADK 中间件与 Deep/Supervisor 调参（结构体见 internal/config/config.go → MultiAgentEinoMiddlewareConfig）
+  # Eino ADK 中间件与 Deep/Supervisor/plan_execute Executor 调参（结构体见 internal/config/config.go → MultiAgentEinoMiddlewareConfig）
+  # plan_execute：下列 patch/reduction/tool_search/plantask 等同样作用于 Executor（经 ExecPreMiddlewares）；Planner/Replanner 不挂 MCP 前置中间件。
   eino_middleware:
     patch_tool_calls: true # true：修补历史中无 tool_result 的悬空 tool_call（流式中断/重试后更稳）；false：关闭；字段省略时默认等同 true
     tool_search_enable: true # true：工具数 ≥ min 时启用 tool_search，仅前 N 个工具常驻，其余按正则按需解锁，省 token、减误选；false：全量工具进上下文
     tool_search_min_tools: 20 # 达到该数量才启用 tool_search（避免工具很少时多此一举）；与 always_visible 配合使用
     tool_search_always_visible: 12 # 始终直接暴露给模型的工具个数（顺序与角色工具列表一致）；其余工具进入动态池，需 tool_search 解锁
-    tool_search_always_visible_tools: [read_file, glob, grep, analyze_image, write_file, edit_file, execute, task, transfer_to_agent, exit, write_todos, skill, tool_search, TaskCreate, TaskGet, TaskUpdate, TaskList, record_vulnerability, list_vulnerabilities, get_vulnerability, list_knowledge_risk_types, search_knowledge_base, webshell_exec, webshell_file_list, webshell_file_read, webshell_file_write, manage_webshell_list, manage_webshell_add, manage_webshell_update, manage_webshell_delete, manage_webshell_test, batch_task_list, batch_task_get, batch_task_start, batch_task_rerun, batch_task_pause, batch_task_update_metadata, batch_task_update_schedule, batch_task_schedule_enabled, batch_task_update_task, batch_task_remove_task, batch_task_delete, batch_task_create, batch_task_add_task, http-framework-test] # 后端内置常驻工具白名单（优先于 always_visible 数量策略）
+    tool_search_always_visible_tools: [read_file, glob, grep, analyze_image, write_file, edit_file, execute, task, transfer_to_agent, exit, write_todos, skill, tool_search, TaskCreate, TaskGet, TaskUpdate, TaskList, record_vulnerability, list_vulnerabilities, get_vulnerability, list_knowledge_risk_types, search_knowledge_base, webshell_exec, webshell_file_list, webshell_file_read, webshell_file_write, manage_webshell_list, manage_webshell_add, manage_webshell_update, manage_webshell_delete, manage_webshell_test, batch_task_list, batch_task_get, batch_task_start, batch_task_rerun, batch_task_pause, batch_task_update_metadata, batch_task_update_schedule, batch_task_schedule_enabled, batch_task_update_task, batch_task_remove_task, batch_task_delete, batch_task_create, batch_task_add_task, http-framework-test, exec] # 后端内置常驻工具白名单（优先于 always_visible 数量策略）
     plantask_enable: true # P0：主代理挂载 TaskCreate/Get/Update/List 结构化任务板；需 eino_skills 可用且 skills_dir 存在
     plantask_rel_dir: .eino/plantask # 任务文件相对 skills_dir，按会话分子目录：skills/.eino/plantask/<conversationId>/
     reduction_enable: true # true：大工具输出截断/落盘以控上下文；依赖与 plantask 相同的 eino local 写盘后端，无后端时不挂载
@@ -147,6 +212,7 @@ multi_agent:
     checkpoint_dir: data/eino-checkpoints # P0：进程崩溃/OOM 后同会话自动 ADK Resume；正常结束会删 .ckpt；与「中断并继续」(last_react_*) 是两套机制
     run_retry_max_attempts: 0 # 429/5xx/网络抖动时可退避重试次数（run loop + summarization 共用 isEinoTransientRunError）；0=默认 10
     run_retry_max_backoff_sec: 0 # 单次退避上限秒数；0=默认 30
+    empty_response_continue_max_attempts: 0 # Run 成功但未捕获助手正文（含流式中断）时 Handler 退避续跑次数；0=默认 5
     deep_output_key: final_answer # P0：Eino session 写入最终助手结论（框架内部；Deep/Supervisor 主/eino_single）
     deep_model_retry_max_retries: 0 # 已废弃，请用 run_retry_max_attempts；保留字段仅为兼容旧配置
     task_tool_description_prefix: "" # 非空：仅 Deep 的 task 工具使用自定义描述前缀，运行时会拼接子代理名称；空则走 Eino 默认生成逻辑
@@ -219,9 +285,17 @@ knowledge:
   retrieval:
     top_k: 5 # 检索返回的Top-K结果数量
     similarity_threshold: 0.4 # 余弦相似度阈值（0-1），低于此值的结果将被过滤
-    # 检索后处理：固定正文规范化去重；上下文预算；可选代码注入 DocumentReranker 做重排
+    # Eino MultiQuery：LLM 改写查询后多路向量检索再融合（始终启用）
+    multi_query:
+      max_queries: 4 # 改写变体上限（含语义覆盖）；建议 3~4
+    # 精排（始终启用）：dashscope 用 gte-rerank；其他 OpenAI 兼容端点走 /v1/rerank
+    rerank:
+      provider: "" # 空=按 base_url 推断：dashscope | cohere
+      model: "" # 空=dashscope→gte-rerank，cohere→rerank-multilingual-v3.0
+      base_url: "" # 留空则用 embedding / openai 的 base_url
+      api_key: "" # 留空则用 embedding / openai 的 api_key
     post_retrieve:
-      prefetch_top_k: 0 # 0 与 top_k 相同；可设为 15~30 以便去重后仍填满 top_k
+      prefetch_top_k: 20 # 每条 MultiQuery 变体的向量候选数；0=内置 max(top_k*4,20)
       max_context_chars: 0 # 0 不限制；否则返回的正文总 Unicode 字符上限（整段 chunk）
       max_context_tokens: 0 # 0 不限制；tiktoken 总 token 上限
     sub_index_filter: ""

docs/MULTI_AGENT_EINO.md

@@ -26,7 +26,7 @@
 | OpenAPI | 多代理路径说明已更新（流式未启用为 SSE 错误事件）。 |
 | 机器人 | `ProcessMessageForRobot` 按 `robot_default_agent_mode`（默认 `eino_single`）调用 `RunEinoSingleChatModelAgent` 或 `RunDeepAgent`。 |
 | 预置编排 | 聊天 / WebShell：`POST /api/multi-agent*` 请求体 `orchestration`：`deep` \| `plan_execute` \| `supervisor`（缺省 `deep`）。`plan_execute` 不构建 YAML/Markdown 子代理；`plan_execute_loop_max_iterations` 仍来自配置。`supervisor` 至少需一个子代理。 |
-| Eino 中间件 | `multi_agent.eino_middleware`（可选）：`patchtoolcalls`（默认开）、`toolsearch`（按阈值拆分 MCP 工具列表）、`plantask`（需 `eino_skills`）、`reduction`（大工具输出截断/落盘）、`checkpoint_dir`（Runner 断点）、`deep_output_key` / `deep_model_retry_max_retries` / `task_tool_description_prefix`（Deep 与 supervisor 主代理共享其中模型重试与 OutputKey）。`plan_execute` 的 Executor 无 Handlers：仅继承 **ToolsConfig** 侧效果（如 `tool_search` 列表拆分），不挂载 patch/plantask/reduction 中间件。 |
+| Eino 中间件 | `multi_agent.eino_middleware`（可选）：`patchtoolcalls`（默认开）、`toolsearch`（按阈值拆分 MCP 工具列表）、`plantask`（需 `eino_skills`）、`reduction`（大工具输出截断/落盘）、`checkpoint_dir`（Runner 断点）、`deep_output_key` / `deep_model_retry_max_retries` / `task_tool_description_prefix`（Deep 与 supervisor 主代理共享其中模型重试与 OutputKey）。**`plan_execute`**：`runner.go` 将 `prependEinoMiddlewares(einoMWMain)` 产物作为 `ExecPreMiddlewares` 挂到 **Executor**（与 Deep/Supervisor 主代理同序：patch → reduction → toolsearch → plantask → filesystem → skill → summarization tail）；Planner/Replanner 仅 summarization tail + prompt 预算截断，不跑 MCP 工具链。 |
 
 ## 进行中 / 待办（ backlog ）
 
@@ -37,7 +37,8 @@
 
 ## 关键文件索引
 
-- `internal/multiagent/runner.go` — DeepAgent 组装与事件循环  
+- `internal/multiagent/runner.go` — DeepAgent / plan_execute / supervisor 组装与事件循环  
+- `internal/multiagent/eino_orchestration.go` — PlanExecute 根节点与 Executor 中间件栈（`buildPlanExecuteExecutorHandlers`）  
 - `internal/handler/multi_agent.go` — SSE 与（同步）HTTP  
 - `internal/handler/multi_agent_prepare.go` — 会话准备（含 WebShell）  
 - `internal/einomcp/` — MCP → Eino Tool  
@@ -59,4 +60,5 @@
 | 2026-03-22 | `orchestrator.md` / `kind: orchestrator` 主代理、列表主/子标记、与 `orchestrator_instruction` 优先级。 |
 | 2026-04-19 | 主聊天「对话模式」：原生 ReAct 与 Deep / Plan-Execute / Supervisor；`POST /api/multi-agent*` 请求体 `orchestration` 与界面一致；`config.yaml` / 设置页不再维护预置编排字段（机器人/批量默认 `deep`）。 |
 | 2026-04-21 | 移除角色 `skills` 与 `/api/roles/skills/list`；`bind_role` 仅继承 tools；Skills 仅通过 Eino `skill` 工具按需加载。 |
+| 2026-07-02 | **plan_execute Executor 中间件对齐**：`ExecPreMiddlewares` 与 Deep 主代理同源；`buildPlanExecuteExecutorHandlers` + 回归测试；文档更正。 |
 | 2026-06-02 | **移除原生 ReAct**：删除 `/api/agent-loop*` 执行入口与 `AgentLoopWithProgress`；统一 Eino ADK（单代理 `/api/eino-agent*`，多代理 `/api/multi-agent*`）；任务 cancel/tasks API 保留。 |

docs/workflow-graph.md

@@ -0,0 +1,403 @@
+# CyberStrikeAI 图编排使用说明
+
+[English](workflow-graph_en.md)
+
+本文档说明 **图编排（Graph Orchestration）** 的完整使用方式：如何在画布上搭建流程、配置各类型节点、在节点之间传递数据，以及如何将流程绑定到角色并自动运行。
+
+---
+
+## 一、在哪里使用图编排
+
+1. 登录 CyberStrikeAI Web 端  
+2. 左侧导航进入 **图编排**  
+3. 在左侧列表选择已有流程，或新建流程  
+4. 在中央画布拖拽、连线、配置节点  
+5. 填写流程 **ID**、**名称**、**描述** 后点击 **保存**
+
+保存后的流程可在 **角色管理** 中绑定到某个角色。绑定后，用户与该角色对话时会按流程图自动执行（`workflow_policy: auto`）。
+
+---
+
+## 二、画布基本操作
+
+| 操作 | 说明 |
+|------|------|
+| 添加节点 | 点击画布上方节点类型按钮（开始、工具、Agent、条件、审批、输出、结束） |
+| 连线 | 点击 **连线**，依次点击源节点和目标节点；再次点击 **连线** 退出连线模式 |
+| 选中元素 | 单击节点或连线，右侧显示 **节点属性** |
+| 删除选中 | 点击 **删除选中** 删除当前节点或连线 |
+| 自动布局 | 点击 **自动布局** 整理节点位置 |
+| 删除流程 | 点击 **删除** 删除整个流程定义 |
+
+**建议：** 每个流程至少包含 **1 个开始节点** 和 **1 个输出节点**；开始节点不应有入边，输出节点不应有出边。
+
+---
+
+## 三、执行模型（先理解再配置）
+
+图编排按 **有向图** 执行，引擎从 **开始** 节点出发，沿连线依次运行下游节点。
+
+每次运行会维护一份内部状态，模板变量 `{{...}}` 从这里取值：
+
+| 内部状态 | 模板前缀 | 含义 |
+|----------|----------|------|
+| `inputs` | `{{inputs.xxx}}` | 流程启动时的输入（用户消息、会话 ID 等） |
+| `lastOutput` | `{{previous.xxx}}` | **上一个刚执行完** 的节点的输出 |
+| `outputs` | `{{outputs.xxx}}` | 全局 **命名变量池**（由节点的「输出变量名」写入） |
+| `nodeOutputs` | `{{节点ID.xxx}}` | 指定节点 ID 的完整输出对象 |
+
+### 3.1 `previous` 是什么？
+
+`{{previous.output}}` 表示 **紧邻的上一个执行节点** 的 `output` 字段。
+
+- 每执行完一个节点，引擎都会更新 `lastOutput`
+- **不是**「画布上画线的上游」，而是 **实际执行顺序上的上一步**
+
+示例：
+
+```text
+开始 → Agent A → Agent B
+```
+
+Agent B 的 `{{previous.output}}` = Agent A 的输出。
+
+但若中间有条件节点：
+
+```text
+开始 → Agent A → 条件 → Agent B
+```
+
+Agent B 的 `{{previous.output}}` = **条件节点** 的输出（`true` / `false`），**不是** Agent A 的结果。
+
+### 3.2 `outputs` 是什么？
+
+`outputs` 是引擎在运行过程中维护的 **命名变量注册表**。
+
+当 Agent、工具、输出 等节点配置了 **输出变量名**（字段 `output_key`）后，节点执行成功会把结果写入：
+
+```text
+outputs["你填的变量名"] = 节点输出内容
+```
+
+之后 **任意下游节点** 都可以通过 `{{outputs.变量名}}` 引用，不要求两个节点直接相连。
+
+示例：
+
+- Agent A 的 **输出变量名** 填 `agent_result1`
+- Agent B 的 **输入来源** 填 `{{outputs.agent_result1}}`
+
+即使 A 和 B 之间隔着条件节点，B 仍能拿到 A 的输出。
+
+### 3.3 什么时候用 `previous`，什么时候用 `outputs`？
+
+| 场景 | 推荐写法 |
+|------|----------|
+| 两个节点 **直连**，只取上一步结果 | `{{previous.output}}` |
+| 中间有其他节点（条件、工具、审批等） | `{{outputs.变量名}}` |
+| 需要引用 **更早** 的某个节点结果 | `{{outputs.变量名}}` 或 `{{节点ID.output}}` |
+| 条件判断要基于某 Agent 的输出 | `{{outputs.变量名}} != ""` |
+| 读取用户最初输入 | `{{inputs.message}}` |
+
+**记忆口诀：**
+
+- `previous` = 上一步（链式、紧邻）
+- `outputs` = 按名字取（跨节点、可回溯）
+
+---
+
+## 四、模板语法
+
+### 4.1 基本格式
+
+```text
+{{变量路径}}
+```
+
+支持字母、数字、下划线、点、连字符，例如：
+
+```text
+{{previous.output}}
+{{outputs.agent_result1}}
+{{inputs.message}}
+{{inputs.conversationId}}
+{{previous.matched}}
+{{node-abc123.output}}
+```
+
+### 4.2 可用路径一览
+
+| 路径 | 说明 |
+|------|------|
+| `{{inputs.message}}` | 用户消息（开始节点输入） |
+| `{{inputs.conversationId}}` | 会话 ID |
+| `{{inputs.projectId}}` | 项目 ID |
+| `{{previous.output}}` | 上一节点主输出 |
+| `{{previous.matched}}` | 上一条件节点的匹配结果（`true` / `false`） |
+| `{{outputs.变量名}}` | 某节点注册过的命名输出 |
+| `{{节点ID.output}}` | 指定节点 ID 的 `output` 字段 |
+
+### 4.3 条件表达式
+
+条件节点和连线条件支持简单比较：
+
+```text
+{{outputs.agent_result1}} != ""
+{{previous.output}} == "ok"
+{{outputs.count}} == "100"
+```
+
+规则：
+
+- 使用 `==` 或 `!=` 做字符串比较（两侧会自动去掉首尾空格和引号）
+- 无比较符时，非空且不为 `false` / `0` / `null` 视为真
+
+---
+
+## 五、节点类型与配置
+
+### 5.1 开始（start）
+
+流程入口，将用户输入注入 `inputs`。
+
+| 字段 | 说明 | 默认值 |
+|------|------|--------|
+| 输入变量 | 逗号分隔的输入键名 | `message, conversationId, projectId` |
+
+开始节点输出包含：`output`、`message`、`conversationId`、`projectId`。
+
+### 5.2 Agent（agent）
+
+调用大模型 Agent 处理任务，支持多种运行模式。
+
+| 字段 | 说明 | 默认值 |
+|------|------|--------|
+| Agent 模式 | `eino_single` / `deep` / `plan_execute` / `supervisor` | `eino_single` |
+| 输入来源 | 上游数据的模板表达式 | `{{previous.output}}` |
+| 节点指令 | 本节点要完成的任务描述 | 空 |
+| 输出变量名 | 写入 `outputs` 的键名 | `agent_result` |
+
+**消息拼装规则：**
+
+- 仅填 **节点指令**：直接把指令发给 Agent  
+- 仅填 **输入来源**：生成「请基于上游节点输出继续处理：…」  
+- 两者都填：合并为「上游输入 + 节点指令」
+
+Agent 节点执行后：
+
+- `previous.output` 更新为本节点响应文本  
+- 若配置了 **输出变量名**，同时写入 `outputs[输出变量名]`
+
+### 5.3 工具（tool）
+
+调用已启用的 MCP 工具。
+
+| 字段 | 说明 | 默认值 |
+|------|------|--------|
+| MCP 工具 | 工具名称（必填） | — |
+| 参数模板 | JSON，支持 `{{...}}` 模板 | `{}` |
+| 超时秒数 | 可选 | 空 |
+
+示例参数模板：
+
+```json
+{"target": "{{inputs.message}}", "port": "443"}
+```
+
+若配置了 **输出变量名**，工具返回结果会写入 `outputs`。
+
+### 5.4 条件（condition）
+
+根据表达式计算分支，输出 `matched`（`true` / `false`）。
+
+| 字段 | 说明 | 默认值 |
+|------|------|--------|
+| 条件表达式 | 支持 `{{...}}` 与 `==` / `!=` | `{{previous.output}} != ""` |
+
+**分支规则：**
+
+- 从条件节点连出的 **第一条线** 默认为 **「是」** 分支（`matched == true`）
+- **第二条线** 默认为 **「否」** 分支（`matched == false`）
+- 连线标签可写 `是` / `否`（或 `yes` / `no`、`true` / `false`）辅助识别
+- 第三条及以后的出边需在 **连线条件** 中自定义表达式
+
+连线条件示例（选中连线后在右侧配置）：
+
+```text
+{{previous.matched}} == "true"
+{{previous.matched}} == "false"
+```
+
+### 5.5 审批（hitl）
+
+人工确认检查点（当前为记录模式，自动标记 `approved: true` 并继续）。
+
+| 字段 | 说明 | 默认值 |
+|------|------|--------|
+| 审批提示 | 支持模板 | `请审批该步骤是否继续执行` |
+| 审批方 | `human` / `audit_agent` | `human` |
+
+### 5.6 输出（output）
+
+将流程最终结果写入 `outputs`，供结束摘要和对话展示使用。
+
+| 字段 | 说明 | 默认值 |
+|------|------|--------|
+| 输出变量名 | 必填，最终结果的键名 | `result` |
+| 变量来源 | 模板表达式，决定写入的值 | `{{previous.output}}` |
+
+**注意：** 输出节点是流程的「出口」，不应再有出边。
+
+### 5.7 结束（end）
+
+可选节点，用于生成结束摘要模板（角色绑定流程中较少单独使用）。
+
+| 字段 | 说明 | 默认值 |
+|------|------|--------|
+| 结束摘要模板 | 支持 `{{outputs.xxx}}` | `{{outputs.result}}` |
+
+---
+
+## 六、连线配置
+
+选中 **连线** 后，右侧可配置 **连线条件**。
+
+| 场景 | 示例 |
+|------|------|
+| 普通节点后的过滤 | `{{previous.output}} == "ok"` |
+| 条件节点「是」分支 | `{{previous.matched}} == "true"` |
+| 条件节点「否」分支 | `{{previous.matched}} == "false"` |
+
+若不填连线条件：
+
+- 非条件节点：连线始终放行  
+- 条件节点：按出边顺序自动分配是/否分支
+
+---
+
+## 七、完整示例：跨条件节点传递 Agent 输出
+
+### 7.1 流程结构
+
+```text
+开始 → Agent（生成初始值）→ 条件 → Agent（加工）→ 输出
+                              ↘ 否 → 输出
+```
+
+### 7.2 节点配置
+
+**Agent 1（第一个 Agent）**
+
+| 字段 | 值 |
+|------|-----|
+| 节点指令 | 只输出 `123333333` |
+| 输出变量名 | `agent_result1` |
+
+**条件**
+
+| 字段 | 值 |
+|------|-----|
+| 条件表达式 | `{{outputs.agent_result1}} != ""` |
+
+**Agent 2（第二个 Agent）**
+
+| 字段 | 值 |
+|------|-----|
+| 输入来源 | `{{outputs.agent_result1}}` |
+| 节点指令 | 在输入基础上加 100，然后输出 |
+| 输出变量名 | `agent_result` |
+
+**输出**
+
+| 字段 | 值 |
+|------|-----|
+| 输出变量名 | `result` |
+| 变量来源 | `{{outputs.agent_result}}` |
+
+### 7.3 常见错误
+
+| 错误配置 | 原因 |
+|----------|------|
+| Agent 2 输入来源写 `{{previous.output}}` | `previous` 指向条件节点，得到的是 `true`/`false`，不是 Agent 1 的文本 |
+| 未给 Agent 1 填输出变量名 | `outputs.agent_result1` 不存在，下游取到空值 |
+| 条件表达式写 `{{previous.output}}` | 判断的是开始节点或上一节点的输出，而非 Agent 1 的命名变量 |
+
+---
+
+## 八、绑定角色并运行
+
+### 8.1 在角色管理中绑定
+
+1. 进入 **角色管理**，编辑或新建角色  
+2. 选择 **工作流 / 图编排** 绑定的流程 ID  
+3. 策略设为 `auto`（默认：有 `workflow_id` 时自动执行）  
+4. 保存角色
+
+也可在角色 YAML 中直接配置：
+
+```yaml
+name: 工作流测试
+workflow_id: "1233"
+workflow_version: latest
+workflow_policy: auto
+```
+
+### 8.2 运行效果
+
+用户选择该角色并发送消息后：
+
+1. 引擎加载对应 `graph_json` 并按图执行  
+2. 对话页可看到 `workflow_start`、`workflow_node_start`、Agent 推理等进度事件  
+3. 流程结束后返回摘要，列出 `outputs` 中所有命名输出
+
+若未配置输出节点或条件未命中，`outputs` 可能为空，摘要会提示检查输出节点与分支。
+
+---
+
+## 九、保存前校验规则
+
+保存时系统会自动检查：
+
+| 规则 | 说明 |
+|------|------|
+| 必须有开始节点 | 至少 1 个 `start` |
+| 必须有输出节点 | 至少 1 个 `output`，且填写输出变量名 |
+| 连线合法 | 源/目标节点存在，不能自环 |
+| 开始节点无入边 | 开始节点不能被指向 |
+| 输出节点无出边 | 输出节点后不应再连线 |
+| 工具节点 | 必须选择 MCP 工具 |
+| 条件节点 | 必须填写表达式；建议 1～2 条出边（是/否） |
+
+---
+
+## 十、排错指南
+
+| 现象 | 可能原因 | 处理建议 |
+|------|----------|----------|
+| 下游拿到空值 | 上游未配置输出变量名 | 给上游 Agent/工具填 **输出变量名**，下游用 `{{outputs.xxx}}` |
+| 下游拿到 `true`/`false` | 误用 `{{previous.output}}`，上一步是条件节点 | 改用 `{{outputs.xxx}}` |
+| 条件总走「否」 | 表达式与真实输出格式不一致 | 检查 Agent 输出是否带引号、换行；用 `!= ""` 先验证 |
+| 流程无最终输出 | 未命中输出节点所在分支 | 检查条件分支连线；确保至少一条路径到达 **输出** 节点 |
+| 角色对话未跑流程 | 角色未绑定或未启用 | 确认 `workflow_id`、`workflow_policy: auto`、流程 `enabled: true` |
+| 工具节点失败 | 参数 JSON 不合法或工具未启用 | 检查参数模板；在 MCP 中启用对应工具 |
+
+---
+
+## 十一、最佳实践
+
+1. **命名规范**：为每个需要被引用的节点设置有意义的输出变量名，如 `scan_result`、`parsed_targets`，避免都叫 `agent_result`。  
+2. **跨节点传参优先用 `outputs`**：只要中间可能插入条件、工具、审批节点，就应用命名变量。  
+3. **`previous` 仅用于直连**：A → B 且无中间节点时，`{{previous.output}}` 最简洁。  
+4. **条件判断引用源数据**：判断 Agent 输出时用 `{{outputs.xxx}}`，不要用 `{{previous.output}}`（除非条件紧跟在目标 Agent 之后）。  
+5. **每条路径都要有出口**：确保「是」「否」分支最终都能到达 **输出** 节点（或你期望的终点）。  
+6. **保存前跑一遍**：用简单指令（如固定字符串输出）验证数据传递，再替换为真实业务逻辑。
+
+---
+
+## 十二、相关代码位置（开发者参考）
+
+| 模块 | 路径 |
+|------|------|
+| 执行引擎 | `internal/workflow/runner.go` |
+| 画布前端 | `web/static/js/workflows.js` |
+| 流程 API | `internal/handler/workflow.go` |
+| 角色绑定 | `internal/config/config.go`（`workflow_id` 字段） |

docs/workflow-graph_en.md

@@ -0,0 +1,403 @@
+# CyberStrikeAI Graph Orchestration Guide
+
+[中文](workflow-graph.md)
+
+This document explains how to use **Graph Orchestration**: building workflows on the canvas, configuring node types, passing data between nodes, and binding a graph to a role for automatic execution.
+
+---
+
+## 1. Where to find Graph Orchestration
+
+1. Log in to the CyberStrikeAI web UI.  
+2. Open **Graph Orchestration** in the left sidebar.  
+3. Select an existing workflow from the list, or create a new one.  
+4. Drag nodes, draw edges, and configure properties on the canvas.  
+5. Fill in **ID**, **Name**, and **Description**, then click **Save**.
+
+Saved workflows can be bound to a role under **Role Management**. When `workflow_policy` is `auto`, chatting with that role runs the bound graph automatically.
+
+---
+
+## 2. Canvas basics
+
+| Action | Description |
+|--------|-------------|
+| Add node | Click a node type button above the canvas (Start, Tool, Agent, Condition, HITL, Output, End) |
+| Connect | Click **Connect**, then click source and target nodes; click **Connect** again to exit connect mode |
+| Select | Click a node or edge; properties appear in the right panel |
+| Delete selected | Remove the current node or edge |
+| Auto layout | Rearrange node positions |
+| Delete workflow | Remove the entire workflow definition |
+
+**Requirements:** Every workflow needs at least **one Start node** and **one Output node**. Start nodes must not have incoming edges; Output nodes must not have outgoing edges.
+
+---
+
+## 3. Execution model (read this before configuring)
+
+The engine executes the workflow as a **directed graph**, starting from the **Start** node and following edges to downstream nodes.
+
+During a run, the engine keeps internal state. Template expressions `{{...}}` read from that state:
+
+| Internal state | Template prefix | Meaning |
+|----------------|-----------------|---------|
+| `inputs` | `{{inputs.xxx}}` | Workflow inputs at start (user message, conversation ID, etc.) |
+| `lastOutput` | `{{previous.xxx}}` | Output of the **most recently executed** node |
+| `outputs` | `{{outputs.xxx}}` | Global **named variable pool** (written by nodes with an output key) |
+| `nodeOutputs` | `{{nodeId.xxx}}` | Full output object of a specific node ID |
+
+### 3.1 What is `previous`?
+
+`{{previous.output}}` is the `output` field of the **immediately preceding executed node**.
+
+- After every node finishes, the engine updates `lastOutput`.
+- It is **not** “the node drawn upstream on the canvas”; it is **the previous step in actual execution order**.
+
+Example:
+
+```text
+Start → Agent A → Agent B
+```
+
+For Agent B, `{{previous.output}}` = Agent A’s output.
+
+With a condition in between:
+
+```text
+Start → Agent A → Condition → Agent B
+```
+
+For Agent B, `{{previous.output}}` = the **condition node** output (`true` / `false`), **not** Agent A’s result.
+
+### 3.2 What is `outputs`?
+
+`outputs` is a **named variable registry** maintained by the engine during execution.
+
+When an Agent, Tool, or Output node sets an **Output variable name** (`output_key`), the result is stored as:
+
+```text
+outputs["your_variable_name"] = node_output
+```
+
+Any downstream node can then reference it via `{{outputs.variable_name}}`, even if other nodes sit in between.
+
+Example:
+
+- Agent A **Output variable name**: `agent_result1`
+- Agent B **Input source**: `{{outputs.agent_result1}}`
+
+Agent B still receives Agent A’s output even when a condition node lies between them.
+
+### 3.3 When to use `previous` vs `outputs`
+
+| Scenario | Recommended |
+|----------|-------------|
+| Two nodes are **directly connected**; you only need the last step | `{{previous.output}}` |
+| Other nodes sit in between (condition, tool, HITL, etc.) | `{{outputs.variable_name}}` |
+| Reference output from an **earlier** node | `{{outputs.variable_name}}` or `{{nodeId.output}}` |
+| Condition should test an Agent’s output | `{{outputs.variable_name}} != ""` |
+| Read the original user input | `{{inputs.message}}` |
+
+**Rule of thumb:**
+
+- `previous` = last step (chained, adjacent)
+- `outputs` = by name (cross-node, look back)
+
+---
+
+## 4. Template syntax
+
+### 4.1 Basic format
+
+```text
+{{path.to.value}}
+```
+
+Allowed characters in paths: letters, digits, underscore, dot, hyphen. Examples:
+
+```text
+{{previous.output}}
+{{outputs.agent_result1}}
+{{inputs.message}}
+{{inputs.conversationId}}
+{{previous.matched}}
+{{node-abc123.output}}
+```
+
+### 4.2 Available paths
+
+| Path | Description |
+|------|-------------|
+| `{{inputs.message}}` | User message (Start node input) |
+| `{{inputs.conversationId}}` | Conversation ID |
+| `{{inputs.projectId}}` | Project ID |
+| `{{previous.output}}` | Primary output of the previous node |
+| `{{previous.matched}}` | Match result of the previous condition node (`true` / `false`) |
+| `{{outputs.variable_name}}` | Named output registered by a node |
+| `{{nodeId.output}}` | `output` field of the node with that ID |
+
+### 4.3 Condition expressions
+
+Condition nodes and edge conditions support simple comparisons:
+
+```text
+{{outputs.agent_result1}} != ""
+{{previous.output}} == "ok"
+{{outputs.count}} == "100"
+```
+
+Rules:
+
+- Use `==` or `!=` for string comparison (leading/trailing spaces and quotes are trimmed)
+- Without a comparator, non-empty values that are not `false`, `0`, or `null` are treated as true
+
+---
+
+## 5. Node types and configuration
+
+### 5.1 Start
+
+Workflow entry point; injects user input into `inputs`.
+
+| Field | Description | Default |
+|-------|-------------|---------|
+| Input keys | Comma-separated input key names | `message, conversationId, projectId` |
+
+Start node output includes: `output`, `message`, `conversationId`, `projectId`.
+
+### 5.2 Agent
+
+Runs an LLM Agent task. Supports multiple modes.
+
+| Field | Description | Default |
+|-------|-------------|---------|
+| Agent mode | `eino_single` / `deep` / `plan_execute` / `supervisor` | `eino_single` |
+| Input source | Template for upstream data | `{{previous.output}}` |
+| Node instruction | Task description for this node | empty |
+| Output variable name | Key written into `outputs` | `agent_result` |
+
+**Message assembly:**
+
+- Instruction only → send instruction to the Agent  
+- Input source only → “Continue based on upstream output: …”  
+- Both → combined “upstream input + node instruction”
+
+After execution:
+
+- `previous.output` becomes this node’s response text  
+- If **Output variable name** is set, the value is also stored in `outputs[variable_name]`
+
+### 5.3 Tool
+
+Calls an enabled MCP tool.
+
+| Field | Description | Default |
+|-------|-------------|---------|
+| MCP tool | Tool name (required) | — |
+| Argument template | JSON with `{{...}}` templates | `{}` |
+| Timeout (seconds) | Optional | empty |
+
+Example argument template:
+
+```json
+{"target": "{{inputs.message}}", "port": "443"}
+```
+
+If an output variable name is configured, the tool result is written to `outputs`.
+
+### 5.4 Condition
+
+Evaluates an expression and outputs `matched` (`true` / `false`).
+
+| Field | Description | Default |
+|-------|-------------|---------|
+| Expression | Supports `{{...}}` and `==` / `!=` | `{{previous.output}} != ""` |
+
+**Branching rules:**
+
+- The **first outgoing edge** defaults to the **“yes”** branch (`matched == true`)
+- The **second outgoing edge** defaults to the **“no”** branch (`matched == false`)
+- Edge labels such as `是` / `否` (or `yes` / `no`, `true` / `false`) help identify branches
+- A third or later edge needs a custom **edge condition**
+
+Edge condition examples (select an edge, configure in the right panel):
+
+```text
+{{previous.matched}} == "true"
+{{previous.matched}} == "false"
+```
+
+### 5.5 HITL (human-in-the-loop)
+
+Human approval checkpoint (currently record-only; marks `approved: true` and continues).
+
+| Field | Description | Default |
+|-------|-------------|---------|
+| Prompt | Supports templates | `Please approve before continuing` |
+| Reviewer | `human` / `audit_agent` | `human` |
+
+### 5.6 Output
+
+Writes the final workflow result into `outputs` for summary and chat display.
+
+| Field | Description | Default |
+|-------|-------------|---------|
+| Output variable name | Required key for the final result | `result` |
+| Variable source | Template deciding what to write | `{{previous.output}}` |
+
+**Note:** Output nodes are workflow exits and must not have outgoing edges.
+
+### 5.7 End
+
+Optional node for an end summary template (less common in role-bound flows).
+
+| Field | Description | Default |
+|-------|-------------|---------|
+| Result template | Supports `{{outputs.xxx}}` | `{{outputs.result}}` |
+
+---
+
+## 6. Edge configuration
+
+Select an **edge** to configure its **condition** in the right panel.
+
+| Scenario | Example |
+|----------|---------|
+| Filter after a normal node | `{{previous.output}} == "ok"` |
+| “Yes” branch from a condition | `{{previous.matched}} == "true"` |
+| “No” branch from a condition | `{{previous.matched}} == "false"` |
+
+If no edge condition is set:
+
+- Non-condition nodes: edge is always allowed  
+- Condition nodes: yes/no branches are assigned by edge order automatically
+
+---
+
+## 7. Full example: passing Agent output across a condition
+
+### 7.1 Graph structure
+
+```text
+Start → Agent (initial value) → Condition → Agent (transform) → Output
+                                    ↘ no → Output
+```
+
+### 7.2 Node configuration
+
+**Agent 1**
+
+| Field | Value |
+|-------|-------|
+| Node instruction | Output only `123333333` |
+| Output variable name | `agent_result1` |
+
+**Condition**
+
+| Field | Value |
+|-------|-------|
+| Expression | `{{outputs.agent_result1}} != ""` |
+
+**Agent 2**
+
+| Field | Value |
+|-------|-------|
+| Input source | `{{outputs.agent_result1}}` |
+| Node instruction | Add 100 to the input, then output |
+| Output variable name | `agent_result` |
+
+**Output**
+
+| Field | Value |
+|-------|-------|
+| Output variable name | `result` |
+| Variable source | `{{outputs.agent_result}}` |
+
+### 7.3 Common mistakes
+
+| Wrong config | Why it fails |
+|--------------|--------------|
+| Agent 2 input source = `{{previous.output}}` | `previous` points to the condition node → `true`/`false`, not Agent 1’s text |
+| Agent 1 has no output variable name | `outputs.agent_result1` does not exist → empty downstream |
+| Condition uses `{{previous.output}}` | Tests the wrong upstream value instead of Agent 1’s named output |
+
+---
+
+## 8. Bind to a role and run
+
+### 8.1 Bind in Role Management
+
+1. Open **Role Management**, edit or create a role.  
+2. Select the workflow / graph ID to bind.  
+3. Set policy to `auto` (default when `workflow_id` is set).  
+4. Save the role.
+
+You can also configure this in role YAML:
+
+```yaml
+name: workflow-test
+workflow_id: "1233"
+workflow_version: latest
+workflow_policy: auto
+```
+
+### 8.2 Runtime behavior
+
+When a user chats with that role:
+
+1. The engine loads `graph_json` and executes the graph.  
+2. The chat UI shows progress events (`workflow_start`, `workflow_node_start`, Agent reasoning, etc.).  
+3. When finished, a summary lists all named entries in `outputs`.
+
+If no Output node is reached or no branch matches, `outputs` may be empty and the summary will suggest checking the Output node and branches.
+
+---
+
+## 9. Validation before save
+
+On save, the system checks:
+
+| Rule | Description |
+|------|-------------|
+| Start node required | At least one `start` node |
+| Output node required | At least one `output` node with an output variable name |
+| Valid edges | Source and target exist; no self-loops |
+| Start has no incoming edges | Start must not be targeted |
+| Output has no outgoing edges | Nothing after Output |
+| Tool nodes | MCP tool must be selected |
+| Condition nodes | Expression required; ideally 1–2 outgoing edges (yes/no) |
+
+---
+
+## 10. Troubleshooting
+
+| Symptom | Likely cause | Fix |
+|---------|--------------|-----|
+| Downstream gets empty value | Upstream has no output variable name | Set **Output variable name** on upstream; use `{{outputs.xxx}}` downstream |
+| Downstream gets `true`/`false` | Used `{{previous.output}}` while previous node is a condition | Use `{{outputs.xxx}}` instead |
+| Condition always takes “no” | Expression does not match actual output format | Check Agent output for quotes/newlines; try `!= ""` first |
+| No final output | Output node branch not reached | Verify condition wiring; ensure every path reaches an **Output** node |
+| Role chat does not run workflow | Role not bound or disabled | Check `workflow_id`, `workflow_policy: auto`, workflow `enabled: true` |
+| Tool node fails | Invalid JSON in arguments or tool disabled | Fix argument template; enable the tool in MCP settings |
+
+---
+
+## 11. Best practices
+
+1. **Meaningful names**: Use descriptive output variable names (`scan_result`, `parsed_targets`) instead of reusing `agent_result` everywhere.  
+2. **Prefer `outputs` for cross-node data**: If a condition, tool, or HITL node might sit in between, use named variables.  
+3. **Use `previous` only for direct links**: `A → B` with nothing in between is the ideal case for `{{previous.output}}`.  
+4. **Conditions should reference source data**: When testing Agent output, use `{{outputs.xxx}}` unless the condition immediately follows that Agent.  
+5. **Every path needs an exit**: Ensure both yes and no branches eventually reach an **Output** node (or your intended end).  
+6. **Validate with a simple run**: Use fixed-string outputs to verify data flow before swapping in real business logic.
+
+---
+
+## 12. Code references (for developers)
+
+| Module | Path |
+|--------|------|
+| Execution engine | `internal/workflow/runner.go` |
+| Canvas UI | `web/static/js/workflows.js` |
+| Workflow API | `internal/handler/workflow.go` |
+| Role binding | `internal/config/config.go` (`workflow_id` field) |

internal/agent/agent.go

@@ -779,13 +779,26 @@ func (a *Agent) ExecuteMCPToolForConversation(ctx context.Context, conversationI
 	return a.executeToolViaMCP(ctx, toolName, args)
 }
 
-// RecordLocalToolExecution 将非 CallTool 路径完成的工具调用写入 MCP 监控库（与 CallTool 落库一致），返回 executionId。
-// 用于 Eino filesystem execute 等场景，使助手气泡「渗透测试详情」与常规 MCP 一致可点进监控。
-func (a *Agent) RecordLocalToolExecution(toolName string, args map[string]interface{}, resultText string, invokeErr error) string {
+// BeginLocalToolExecution 在非 CallTool 路径工具开始时写入 running 状态，供 MCP 监控页展示「执行中」。
+func (a *Agent) BeginLocalToolExecution(toolName string, args map[string]interface{}) string {
 	if a == nil || a.mcpServer == nil {
 		return ""
 	}
-	return a.mcpServer.RecordCompletedToolInvocation(toolName, args, resultText, invokeErr)
+	return a.mcpServer.BeginToolExecution(toolName, args)
+}
+
+// FinishLocalToolExecution 完成 BeginLocalToolExecution 创建的记录；executionID 为空时一次性写入已完成记录。
+func (a *Agent) FinishLocalToolExecution(executionID, toolName string, args map[string]interface{}, resultText string, invokeErr error) string {
+	if a == nil || a.mcpServer == nil {
+		return ""
+	}
+	return a.mcpServer.FinishToolExecution(executionID, toolName, args, resultText, invokeErr)
+}
+
+// RecordLocalToolExecution 将非 CallTool 路径完成的工具调用写入 MCP 监控库（与 CallTool 落库一致），返回 executionId。
+// 用于 Eino filesystem execute 等场景，使助手气泡「渗透测试详情」与常规 MCP 一致可点进监控。
+func (a *Agent) RecordLocalToolExecution(toolName string, args map[string]interface{}, resultText string, invokeErr error) string {
+	return a.FinishLocalToolExecution("", toolName, args, resultText, invokeErr)
 }
 
 // UpdateMCPExecutionDisplayResult 将监控库中的工具结果更新为送入模型的展示正文（reduction 后）。

internal/agent/default_single_system_prompt.go

@@ -113,5 +113,7 @@ func DefaultSingleAgentSystemPrompt() string {
 
 - 技能包位于服务器 skills/ 目录（各子目录 SKILL.md，遵循 agentskills.io）；知识库用于向量检索片段，Skills 为可执行工作流指令。
 - 本会话通过 MCP 使用知识库与漏洞记录等。Skills 由 Eino ADK skill 工具按需加载（配置 multi_agent.eino_skills；单代理与多代理均可，未启用时无 skill 工具）。
-- 需要完整 Skill 工作流但当前无 skill 工具时，请确认已启用 multi_agent.eino_skills，或改用 Deep / Supervisor 等多代理编排（/api/multi-agent/stream）。`
+- 需要完整 Skill 工作流但当前无 skill 工具时，请确认已启用 multi_agent.eino_skills，或改用 Deep / Supervisor 等多代理编排（/api/multi-agent/stream）。
+
+` + projectprompt.ShellExecExecuteGuidanceSection()
 }

internal/app/app.go

@@ -21,11 +21,13 @@ import (
 	"cyberstrike-ai/internal/database"
 	"cyberstrike-ai/internal/einoobserve"
 	"cyberstrike-ai/internal/handler"
+	"cyberstrike-ai/internal/hitl"
 	"cyberstrike-ai/internal/knowledge"
 	"cyberstrike-ai/internal/logger"
 	"cyberstrike-ai/internal/mcp"
 	"cyberstrike-ai/internal/mcp/builtin"
 	"cyberstrike-ai/internal/monitor"
+	"cyberstrike-ai/internal/multiagent"
 	"cyberstrike-ai/internal/robot"
 	"cyberstrike-ai/internal/security"
 	"cyberstrike-ai/internal/skillpackage"
@@ -67,6 +69,10 @@ type App struct {
 
 // New 创建新应用
 func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error) {
+	if err := multiagent.InitADK(); err != nil {
+		return nil, fmt.Errorf("初始化 Eino ADK: %w", err)
+	}
+
 	gin.SetMode(gin.ReleaseMode)
 	router := gin.Default()
 
@@ -104,12 +110,17 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 	monitorRetention.PurgeExpired()
 	monitor.StartRetentionLoop(monitorRetention, log.Logger)
 
+	hitlRetention := hitl.NewService(db, cfg, log.Logger)
+	hitlRetention.PurgeExpired()
+	hitl.StartRetentionLoop(hitlRetention, log.Logger)
+
 	// 创建MCP服务器（带数据库持久化）
 	mcpServer := mcp.NewServerWithStorage(log.Logger, db)
 	mcpServer.ConfigureHTTPToolCallTimeoutFromAgentMinutes(cfg.Agent.ToolTimeoutMinutes)
 
 	// 创建安全工具执行器
 	executor := security.NewExecutor(&cfg.Security, mcpServer, log.Logger)
+	executor.SetShellNoOutputTimeoutSeconds(cfg.Agent.ShellNoOutputTimeoutSeconds)
 
 	// 注册工具
 	executor.RegisterTools(mcpServer)
@@ -134,6 +145,10 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 		externalMCPMgr.StartAllEnabled()
 	}
 
+	execReconciler := monitor.NewExecutionReconciler(db, mcpServer, externalMCPMgr, log.Logger)
+	execReconciler.ReconcileOnStartup()
+	monitor.StartStaleRunningReconcileLoop(execReconciler, log.Logger)
+
 	// 创建Agent
 	maxIterations := cfg.Agent.MaxIterations
 	if maxIterations <= 0 {
@@ -192,14 +207,12 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 			return nil, fmt.Errorf("初始化知识库嵌入器失败: %w", err)
 		}
 
-		// 创建检索器
-		retrievalConfig := &knowledge.RetrievalConfig{
-			TopK:                cfg.Knowledge.Retrieval.TopK,
-			SimilarityThreshold: cfg.Knowledge.Retrieval.SimilarityThreshold,
-			SubIndexFilter:      cfg.Knowledge.Retrieval.SubIndexFilter,
-			PostRetrieve:        cfg.Knowledge.Retrieval.PostRetrieve,
-		}
+		// 创建检索器（Eino MultiQuery + 重排流水线）
+		retrievalConfig := knowledge.RetrievalConfigFromYAML(cfg.Knowledge.Retrieval)
 		knowledgeRetriever = knowledge.NewRetriever(knowledgeDB, embedder, retrievalConfig, log.Logger)
+		if err := knowledge.WireRetrieverPipeline(context.Background(), knowledgeRetriever, &cfg.OpenAI); err != nil {
+			return nil, fmt.Errorf("初始化知识库检索流水线失败: %w", err)
+		}
 
 		// 创建索引器（Eino Compose 链）
 		knowledgeIndexer, err = knowledge.NewIndexer(context.Background(), knowledgeDB, embedder, log.Logger, &cfg.Knowledge)
@@ -304,7 +317,8 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 	// Match eino_adk_run_loop: checkpoint_dir is used as configured (relative to process CWD when not absolute).
 	checkpointBase := strings.TrimSpace(cfg.MultiAgent.EinoMiddleware.CheckpointDir)
 	reductionRoot := strings.TrimSpace(cfg.MultiAgent.EinoMiddleware.ReductionRootDir)
-	db.SetEinoConversationDirs(plantaskBase, checkpointBase, reductionRoot)
+	workspaceRoot := strings.TrimSpace(cfg.Agent.WorkspaceRootDir)
+	db.SetEinoConversationDirs(plantaskBase, checkpointBase, reductionRoot, workspaceRoot)
 	agent.SetPromptBaseDir(configDir)
 
 	agentsDir := cfg.AgentsDir
@@ -333,6 +347,8 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 	monitorHandler.SetAudit(auditSvc)
 	monitorHandler.SetMonitorRetention(monitorRetention)
 	monitorHandler.SetExternalMCPManager(externalMCPMgr) // 设置外部MCP管理器，以便获取外部MCP执行记录
+	monitorHandler.SetTaskManager(agentHandler.TaskManager())
+	monitorHandler.SetAgentHandler(agentHandler)
 	notificationHandler := handler.NewNotificationHandler(db, agentHandler, log.Logger)
 	groupHandler := handler.NewGroupHandler(db, log.Logger)
 	authHandler := handler.NewAuthHandler(authManager, cfg, configPath, log.Logger)
@@ -340,6 +356,9 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 	attackChainHandler := handler.NewAttackChainHandler(db, &cfg.OpenAI, log.Logger)
 	vulnerabilityHandler := handler.NewVulnerabilityHandler(db, log.Logger)
 	projectHandler := handler.NewProjectHandler(db, log.Logger)
+	workflowHandler := handler.NewWorkflowHandler(db, log.Logger)
+	workflowHandler.SetAudit(auditSvc)
+	workflowHandler.SetRuntime(agent, cfg)
 	vulnerabilityHandler.SetAudit(auditSvc)
 	webshellHandler := handler.NewWebShellHandler(log.Logger, db)
 	webshellHandler.SetAudit(auditSvc)
@@ -350,6 +369,8 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 	configHandler := handler.NewConfigHandler(configPath, cfg, mcpServer, executor, agent, attackChainHandler, externalMCPMgr, log.Logger)
 	configHandler.SetAudit(auditSvc)
 	agentHandler.SetHitlToolWhitelistSaver(configHandler)
+	agentHandler.SetHitlAuditStrategySaver(configHandler)
+	agentHandler.SetHitlDefaultReviewerSaver(configHandler)
 	externalMCPHandler := handler.NewExternalMCPHandler(externalMCPMgr, cfg, configPath, log.Logger)
 	externalMCPHandler.SetAudit(auditSvc)
 	roleHandler := handler.NewRoleHandler(cfg, configPath, log.Logger)
@@ -500,6 +521,7 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 		app, // 传递 App 实例以便动态获取 knowledgeHandler
 		vulnerabilityHandler,
 		projectHandler,
+		workflowHandler,
 		webshellHandler,
 		chatUploadsHandler,
 		roleHandler,
@@ -746,6 +768,7 @@ func setupRoutes(
 	app *App, // 传递 App 实例以便动态获取 knowledgeHandler
 	vulnerabilityHandler *handler.VulnerabilityHandler,
 	projectHandler *handler.ProjectHandler,
+	workflowHandler *handler.WorkflowHandler,
 	webshellHandler *handler.WebShellHandler,
 	chatUploadsHandler *handler.ChatUploadsHandler,
 	roleHandler *handler.RoleHandler,
@@ -799,11 +822,20 @@ func setupRoutes(
 		protected.POST("/eino-agent", agentHandler.EinoSingleAgentLoop)
 		protected.POST("/eino-agent/stream", agentHandler.EinoSingleAgentLoopStream)
 		protected.GET("/hitl/pending", agentHandler.ListHITLPending)
+		protected.GET("/hitl/logs", agentHandler.ListHITLLogs)
+		protected.DELETE("/hitl/logs", agentHandler.DeleteHITLLogs)
+		protected.GET("/hitl/logs/:id", agentHandler.GetHITLLog)
 		protected.POST("/hitl/decision", agentHandler.DecideHITLInterrupt)
 		protected.POST("/hitl/dismiss", agentHandler.DismissHITLInterrupt)
 		protected.GET("/hitl/config/:conversationId", agentHandler.GetHITLConversationConfig)
 		protected.PUT("/hitl/config", agentHandler.UpsertHITLConversationConfig)
+		protected.GET("/hitl/tool-whitelist", agentHandler.GetHITLGlobalToolWhitelist)
+		protected.PUT("/hitl/tool-whitelist", agentHandler.SetHITLGlobalToolWhitelist)
 		protected.POST("/hitl/tool-whitelist", agentHandler.MergeHITLGlobalToolWhitelist)
+		protected.GET("/hitl/default-reviewer", agentHandler.GetHITLDefaultReviewer)
+		protected.PUT("/hitl/default-reviewer", agentHandler.UpdateHITLDefaultReviewer)
+		protected.GET("/hitl/audit-strategy", agentHandler.GetHITLAuditStrategy)
+		protected.PUT("/hitl/audit-strategy", agentHandler.UpdateHITLAuditStrategy)
 		// Agent Loop 取消与任务列表
 		protected.POST("/agent-loop/cancel", agentHandler.CancelAgentLoop)
 		protected.GET("/agent-loop/tasks", agentHandler.ListAgentTasks)
@@ -1165,6 +1197,16 @@ func setupRoutes(
 		protected.PUT("/roles/:name", roleHandler.UpdateRole)
 		protected.DELETE("/roles/:name", roleHandler.DeleteRole)
 
+		// 图编排 / 工作流定义（图结构固定，业务字段保存在 graph_json 中）
+		protected.GET("/workflows/runs/pending", workflowHandler.ListPendingRuns)
+		protected.GET("/workflows/runs/:runId", workflowHandler.GetRun)
+		protected.POST("/workflows/runs/:runId/resume", workflowHandler.ResumeRun)
+		protected.GET("/workflows", workflowHandler.List)
+		protected.GET("/workflows/:id", workflowHandler.Get)
+		protected.POST("/workflows", workflowHandler.Create)
+		protected.PUT("/workflows/:id", workflowHandler.Update)
+		protected.DELETE("/workflows/:id", workflowHandler.Delete)
+
 		// Skills管理（具体路径需注册在 /skills/:name 之前）
 		protected.GET("/skills", skillsHandler.GetSkills)
 		protected.GET("/skills/stats", skillsHandler.GetSkillStats)
@@ -1774,14 +1816,12 @@ func initializeKnowledge(
 		return nil, fmt.Errorf("初始化知识库嵌入器失败: %w", err)
 	}
 
-	// 创建检索器
-	retrievalConfig := &knowledge.RetrievalConfig{
-		TopK:                cfg.Knowledge.Retrieval.TopK,
-		SimilarityThreshold: cfg.Knowledge.Retrieval.SimilarityThreshold,
-		SubIndexFilter:      cfg.Knowledge.Retrieval.SubIndexFilter,
-		PostRetrieve:        cfg.Knowledge.Retrieval.PostRetrieve,
-	}
+	// 创建检索器（Eino MultiQuery + 重排流水线）
+	retrievalConfig := knowledge.RetrievalConfigFromYAML(cfg.Knowledge.Retrieval)
 	knowledgeRetriever := knowledge.NewRetriever(knowledgeDB, embedder, retrievalConfig, logger)
+	if err := knowledge.WireRetrieverPipeline(context.Background(), knowledgeRetriever, &cfg.OpenAI); err != nil {
+		return nil, fmt.Errorf("初始化知识库检索流水线失败: %w", err)
+	}
 
 	// 创建索引器（Eino Compose 链）
 	knowledgeIndexer, err := knowledge.NewIndexer(context.Background(), knowledgeDB, embedder, logger, &cfg.Knowledge)

internal/app/vulnerability_tools.go

@@ -120,9 +120,19 @@ func formatVulnerabilityDetail(v *database.Vulnerability) string {
 		b.WriteString(v.Description)
 		b.WriteString("\n")
 	}
-	if v.Proof != "" {
-		b.WriteString("\n--- 证明（POC） ---\n")
-		b.WriteString(v.Proof)
+	if v.Preconditions != "" {
+		b.WriteString("\n--- 前置条件 ---\n")
+		b.WriteString(v.Preconditions)
+		b.WriteString("\n")
+	}
+	if v.ReproSteps != "" {
+		b.WriteString("\n--- 复现步骤 ---\n")
+		b.WriteString(v.ReproSteps)
+		b.WriteString("\n")
+	}
+	if v.Evidence != "" {
+		b.WriteString("\n--- 证据 / POC ---\n")
+		b.WriteString(v.Evidence)
 		b.WriteString("\n")
 	}
 	if v.Impact != "" {
@@ -135,9 +145,36 @@ func formatVulnerabilityDetail(v *database.Vulnerability) string {
 		b.WriteString(v.Recommendation)
 		b.WriteString("\n")
 	}
+	if v.RetestNotes != "" {
+		b.WriteString("\n--- 复测方式 ---\n")
+		b.WriteString(v.RetestNotes)
+		b.WriteString("\n")
+	}
 	return b.String()
 }
 
+func missingVulnerabilityReproFields(args map[string]interface{}) []string {
+	required := []struct {
+		key   string
+		label string
+	}{
+		{"target", "target（受影响的 URL/IP/服务/接口）"},
+		{"vulnerability_type", "vulnerability_type（漏洞类型）"},
+		{"description", "description（漏洞摘要与触发点）"},
+		{"reproduction_steps", "reproduction_steps（可逐步执行的复现步骤）"},
+		{"evidence", "evidence（POC、原始请求/响应、命令输出或截图/日志证据）"},
+		{"impact", "impact（确认后的实际影响）"},
+		{"recommendation", "recommendation（修复建议）"},
+	}
+	missing := make([]string, 0)
+	for _, item := range required {
+		if strings.TrimSpace(strArg(args, item.key)) == "" {
+			missing = append(missing, item.label)
+		}
+	}
+	return missing
+}
+
 func truncateRunes(s string, max int) string {
 	r := []rune(s)
 	if len(r) <= max {
@@ -163,18 +200,18 @@ func registerVulnerabilityTools(mcpServer *mcp.Server, db *database.DB, logger *
 func registerRecordVulnerabilityTool(mcpServer *mcp.Server, db *database.DB, logger *zap.Logger) {
 	tool := mcp.Tool{
 		Name:             builtin.ToolRecordVulnerability,
-		Description:      "记录发现的漏洞详情到漏洞管理系统。边渗透边记录：每验证出一条可复现漏洞（含 POC/影响）后立即调用，勿等会话结束。包括标题、描述、严重程度、类型、目标、证明、影响和建议等。记录前可先 list_vulnerabilities 避免重复。",
-		ShortDescription: "记录发现的漏洞详情到漏洞管理系统",
+		Description:      "记录发现的漏洞详情到漏洞管理系统。必须按“仅看本记录即可复现”的标准填写：目标、触发点、前置条件、复现步骤、证据/POC、实际影响、修复建议和复测方式。边渗透边记录：每验证出一条可复现漏洞后立即调用，勿等会话结束。记录前可先 list_vulnerabilities 避免重复。",
+		ShortDescription: "记录可复现的漏洞详情到漏洞管理系统",
 		InputSchema: map[string]interface{}{
 			"type": "object",
 			"properties": map[string]interface{}{
 				"title": map[string]interface{}{
 					"type":        "string",
-					"description": "漏洞标题（必需）",
+					"description": "漏洞标题（必需）。建议格式：<资产/接口> 存在 <漏洞类型>，例如“/api/login 存在 SQL 注入”。",
 				},
 				"description": map[string]interface{}{
 					"type":        "string",
-					"description": "漏洞详细描述",
+					"description": "漏洞摘要与触发点（必需）：说明哪个功能/参数/入口存在问题、为什么可被利用。不要只写结论。",
 				},
 				"severity": map[string]interface{}{
 					"type":        "string",
@@ -183,26 +220,38 @@ func registerRecordVulnerabilityTool(mcpServer *mcp.Server, db *database.DB, log
 				},
 				"vulnerability_type": map[string]interface{}{
 					"type":        "string",
-					"description": "漏洞类型，如：SQL注入、XSS、CSRF、命令注入等",
+					"description": "漏洞类型，如：SQL注入、XSS、CSRF、命令注入等（必需）",
 				},
 				"target": map[string]interface{}{
 					"type":        "string",
-					"description": "受影响的目标（URL、IP地址、服务等）",
+					"description": "受影响的目标（必需）：尽量精确到 URL、IP:端口、服务名、接口路径和参数名。",
 				},
-				"proof": map[string]interface{}{
+				"preconditions": map[string]interface{}{
 					"type":        "string",
-					"description": "漏洞证明（POC、截图、请求/响应等）",
+					"description": "前置条件：登录状态、权限、账号、Header/Cookie、特定数据、网络位置、环境/版本等；无前置条件写“无”。",
+				},
+				"reproduction_steps": map[string]interface{}{
+					"type":        "string",
+					"description": "复现步骤（必需）：按 1/2/3 编号，写清入口、参数、payload、执行命令、观察点。应让未参与对话的人照做即可复现。",
+				},
+				"evidence": map[string]interface{}{
+					"type":        "string",
+					"description": "证据 / POC（必需）：原始 HTTP 请求/响应、curl/工具命令、截图文字说明、日志、DNSLog/回连记录、数据库结果、文件路径、时间戳等。优先放最小可验证证据。",
 				},
 				"impact": map[string]interface{}{
 					"type":        "string",
-					"description": "漏洞影响说明",
+					"description": "漏洞影响说明（必需）：结合已验证事实说明可造成什么后果，避免泛泛而谈。",
 				},
 				"recommendation": map[string]interface{}{
 					"type":        "string",
-					"description": "修复建议",
+					"description": "修复建议（必需）：给出针对该触发点/参数/组件的具体修复和复测建议。",
+				},
+				"retest_notes": map[string]interface{}{
+					"type":        "string",
+					"description": "复测方式：修复后如何验证漏洞已关闭，包括应返回的状态码、错误信息或访问控制结果。",
 				},
 			},
-			"required": []string{"title", "severity"},
+			"required": []string{"title", "description", "severity", "vulnerability_type", "target", "reproduction_steps", "evidence", "impact", "recommendation"},
 		},
 	}
 
@@ -231,6 +280,9 @@ func registerRecordVulnerabilityTool(mcpServer *mcp.Server, db *database.DB, log
 		if !validSeverities[severity] {
 			return textResult(fmt.Sprintf("错误: severity 必须是 critical、high、medium、low 或 info 之一，当前值: %s", severity), true), nil
 		}
+		if missing := missingVulnerabilityReproFields(args); len(missing) > 0 {
+			return textResult("错误: 漏洞记录缺少复现所需信息，请补充后再记录：\n- "+strings.Join(missing, "\n- ")+"\n\n最佳实践：漏洞管理中的单条记录应独立包含目标、前置条件、复现步骤、证据/POC、影响和修复/复测方式。", true), nil
+		}
 
 		projectID := ""
 		if pid, perr := db.GetConversationProjectID(conversationID); perr == nil {
@@ -246,9 +298,12 @@ func registerRecordVulnerabilityTool(mcpServer *mcp.Server, db *database.DB, log
 			Status:         "open",
 			Type:           strArg(args, "vulnerability_type"),
 			Target:         strArg(args, "target"),
-			Proof:          strArg(args, "proof"),
+			Preconditions:  strArg(args, "preconditions"),
+			ReproSteps:     strArg(args, "reproduction_steps"),
+			Evidence:       strArg(args, "evidence"),
 			Impact:         strArg(args, "impact"),
 			Recommendation: strArg(args, "recommendation"),
+			RetestNotes:    strArg(args, "retest_notes"),
 		}
 
 		created, err := db.CreateVulnerability(vuln)
@@ -275,8 +330,8 @@ func registerRecordVulnerabilityTool(mcpServer *mcp.Server, db *database.DB, log
 
 func registerListVulnerabilitiesTool(mcpServer *mcp.Server, db *database.DB, logger *zap.Logger) {
 	tool := mcp.Tool{
-		Name: builtin.ToolListVulnerabilities,
-		Description: "列出当前授权范围内的漏洞（摘要）。默认：对话已绑定项目时列出该项目下全部漏洞；未绑项目时仅列出当前会话漏洞。可用 scope=conversation 仅看本会话。记录新漏洞前建议先调用以避免重复。",
+		Name:             builtin.ToolListVulnerabilities,
+		Description:      "列出当前授权范围内的漏洞（摘要）。默认：对话已绑定项目时列出该项目下全部漏洞；未绑项目时仅列出当前会话漏洞。可用 scope=conversation 仅看本会话。记录新漏洞前建议先调用以避免重复。",
 		ShortDescription: "列出漏洞（默认当前项目）",
 		InputSchema: map[string]interface{}{
 			"type": "object",

internal/config/config.go

@@ -30,7 +30,7 @@ type Config struct {
 	Monitor     MonitorConfig         `yaml:"monitor,omitempty" json:"monitor,omitempty"`
 	ExternalMCP ExternalMCPConfig     `yaml:"external_mcp,omitempty"`
 	Knowledge   KnowledgeConfig       `yaml:"knowledge,omitempty"`
-	C2          C2Config              `yaml:"c2,omitempty" json:"c2,omitempty"` // 内置 C2 总开关；未配置时默认启用
+	C2          C2Config              `yaml:"c2,omitempty" json:"c2,omitempty"`                 // 内置 C2 总开关；未配置时默认启用
 	Robots      RobotsConfig          `yaml:"robots,omitempty" json:"robots,omitempty"`         // 企业微信/钉钉/飞书等机器人配置
 	RolesDir    string                `yaml:"roles_dir,omitempty" json:"roles_dir,omitempty"`   // 角色配置文件目录（新方式）
 	Roles       map[string]RoleConfig `yaml:"roles,omitempty" json:"roles,omitempty"`           // 向后兼容：支持在主配置文件中定义角色
@@ -79,7 +79,7 @@ func (c ProjectConfig) FactSummaryMaxRunesEffective() int {
 type MultiAgentConfig struct {
 	Enabled               bool   `yaml:"enabled" json:"enabled"`
 	RobotDefaultAgentMode string `yaml:"robot_default_agent_mode,omitempty" json:"robot_default_agent_mode,omitempty"` // eino_single | deep | plan_execute | supervisor
-	BatchUseMultiAgent     bool   `yaml:"batch_use_multi_agent" json:"batch_use_multi_agent"` // 为 true 时批量任务队列中每子任务走 Eino 多代理
+	BatchUseMultiAgent    bool   `yaml:"batch_use_multi_agent" json:"batch_use_multi_agent"`                           // 为 true 时批量任务队列中每子任务走 Eino 多代理
 	// Orchestration 已弃用：保留仅兼容旧版 config.yaml；编排由聊天/WebShell 请求体 orchestration 决定，未传时按 deep。
 	Orchestration string `yaml:"orchestration,omitempty" json:"orchestration,omitempty"`
 	// MaxIteration 已废弃：统一使用 agent.max_iterations（YAML 中保留字段仅为兼容旧配置，运行时不读取）。
@@ -87,17 +87,17 @@ type MultiAgentConfig struct {
 	// PlanExecuteLoopMaxIterations plan_execute 模式下 execute↔replan 外层循环上限；0 表示用 Eino 默认 10。
 	PlanExecuteLoopMaxIterations int `yaml:"plan_execute_loop_max_iterations,omitempty" json:"plan_execute_loop_max_iterations,omitempty"`
 	// SubAgentMaxIterations 已废弃：子代理与主代理均使用 agent.max_iterations（Markdown max_iterations>0 可覆盖）。
-	SubAgentMaxIterations int `yaml:"sub_agent_max_iterations,omitempty" json:"sub_agent_max_iterations,omitempty"`
-	WithoutGeneralSubAgent       bool   `yaml:"without_general_sub_agent" json:"without_general_sub_agent"`
-	WithoutWriteTodos            bool   `yaml:"without_write_todos" json:"without_write_todos"`
-	OrchestratorInstruction      string `yaml:"orchestrator_instruction" json:"orchestrator_instruction"`
+	SubAgentMaxIterations   int    `yaml:"sub_agent_max_iterations,omitempty" json:"sub_agent_max_iterations,omitempty"`
+	WithoutGeneralSubAgent  bool   `yaml:"without_general_sub_agent" json:"without_general_sub_agent"`
+	WithoutWriteTodos       bool   `yaml:"without_write_todos" json:"without_write_todos"`
+	OrchestratorInstruction string `yaml:"orchestrator_instruction" json:"orchestrator_instruction"`
 	// OrchestratorInstructionPlanExecute plan_execute 主代理（规划侧）系统提示；非空且 agents/orchestrator-plan-execute.md 正文为空或未存在时生效。不与 Deep 的 orchestrator_instruction 混用。
 	OrchestratorInstructionPlanExecute string `yaml:"orchestrator_instruction_plan_execute,omitempty" json:"orchestrator_instruction_plan_execute,omitempty"`
 	// OrchestratorInstructionSupervisor supervisor 主代理系统提示（transfer/exit 说明仍由运行追加）；非空且 agents/orchestrator-supervisor.md 正文为空或未存在时生效。
 	OrchestratorInstructionSupervisor string                `yaml:"orchestrator_instruction_supervisor,omitempty" json:"orchestrator_instruction_supervisor,omitempty"`
 	SubAgents                         []MultiAgentSubConfig `yaml:"sub_agents" json:"sub_agents"`
-	// SubAgentUserContextMaxRunes caps the user-context supplement appended to task descriptions for sub-agents.
-	// 0 (default) uses the built-in default of 2000 runes; negative value disables injection entirely.
+	// SubAgentUserContextMaxRunes caps user-context supplement for sub-agent task descriptions.
+	// 0 (default) preserves all user turns verbatim; >0 caps total runes; negative disables injection.
 	SubAgentUserContextMaxRunes int `yaml:"sub_agent_user_context_max_runes,omitempty" json:"sub_agent_user_context_max_runes,omitempty"`
 	// EinoSkills configures CloudWeGo Eino ADK skill middleware + optional local filesystem/execute on DeepAgent.
 	EinoSkills MultiAgentEinoSkillsConfig `yaml:"eino_skills,omitempty" json:"eino_skills,omitempty"`
@@ -107,6 +107,11 @@ type MultiAgentConfig struct {
 	EinoCallbacks MultiAgentEinoCallbacksConfig `yaml:"eino_callbacks,omitempty" json:"eino_callbacks,omitempty"`
 }
 
+// SubAgentUserContextMaxRunesEffective returns max runes for sub-agent task supplement; 0 = unlimited; negative = disabled.
+func (c MultiAgentConfig) SubAgentUserContextMaxRunesEffective() int {
+	return c.SubAgentUserContextMaxRunes
+}
+
 // MultiAgentEinoCallbacksConfig enables Eino unified callbacks on each ADK agent run (deep / plan_execute / supervisor / eino_single).
 // Modes: log_only (zap + optional OTel; no SSE to browser), sse (adds client SSE eino_trace_* when sse_trace_to_client), full (sse rules + stream callback copies closed).
 type MultiAgentEinoCallbacksConfig struct {
@@ -125,11 +130,11 @@ type MultiAgentEinoCallbacksConfig struct {
 
 // MultiAgentEinoCallbacksOtelConfig OpenTelemetry for Eino callback spans (W3C trace in collector / stdout).
 type MultiAgentEinoCallbacksOtelConfig struct {
-	Enabled     bool    `yaml:"enabled" json:"enabled"`
-	ServiceName string  `yaml:"service_name,omitempty" json:"service_name,omitempty"`
-	Exporter    string  `yaml:"exporter,omitempty" json:"exporter,omitempty"`         // none | stdout | otlphttp
-	OTLPEndpoint string `yaml:"otlp_endpoint,omitempty" json:"otlp_endpoint,omitempty"` // host:port, e.g. localhost:4318 (path /v1/traces)
-	SampleRatio float64 `yaml:"sample_ratio,omitempty" json:"sample_ratio,omitempty"`   // 0–1, default 1.0
+	Enabled      bool    `yaml:"enabled" json:"enabled"`
+	ServiceName  string  `yaml:"service_name,omitempty" json:"service_name,omitempty"`
+	Exporter     string  `yaml:"exporter,omitempty" json:"exporter,omitempty"`           // none | stdout | otlphttp
+	OTLPEndpoint string  `yaml:"otlp_endpoint,omitempty" json:"otlp_endpoint,omitempty"` // host:port, e.g. localhost:4318 (path /v1/traces)
+	SampleRatio  float64 `yaml:"sample_ratio,omitempty" json:"sample_ratio,omitempty"`   // 0–1, default 1.0
 }
 
 // EinoCallbacksModeEffective returns off | log_only | sse | full.
@@ -240,12 +245,12 @@ type MultiAgentEinoMiddlewareConfig struct {
 	// PlantaskRelDir relative to skills_dir for per-conversation task boards (default .eino/plantask).
 	PlantaskRelDir string `yaml:"plantask_rel_dir,omitempty" json:"plantask_rel_dir,omitempty"`
 	// Reduction truncates/offloads large tool outputs (requires eino local backend for Write).
-	ReductionEnable       bool     `yaml:"reduction_enable,omitempty" json:"reduction_enable,omitempty"`
-	ReductionRootDir      string   `yaml:"reduction_root_dir,omitempty" json:"reduction_root_dir,omitempty"` // 非空：落盘根目录（默认 tmp/reduction）；其下按 projects/{id} 或 conversations/{id} 隔离
-	ReductionMaxLengthForTrunc int `yaml:"reduction_max_length_for_trunc,omitempty" json:"reduction_max_length_for_trunc,omitempty"` // default 12000
-	ReductionMaxTokensForClear int `yaml:"reduction_max_tokens_for_clear,omitempty" json:"reduction_max_tokens_for_clear,omitempty"` // default 50000
-	ReductionClearExclude []string `yaml:"reduction_clear_exclude,omitempty" json:"reduction_clear_exclude,omitempty"`
-	ReductionSubAgents    bool     `yaml:"reduction_sub_agents,omitempty" json:"reduction_sub_agents,omitempty"` // also attach to sub-agents
+	ReductionEnable            bool     `yaml:"reduction_enable,omitempty" json:"reduction_enable,omitempty"`
+	ReductionRootDir           string   `yaml:"reduction_root_dir,omitempty" json:"reduction_root_dir,omitempty"`                         // 非空：落盘根目录（默认 tmp/reduction）；其下按 projects/{id} 或 conversations/{id} 隔离
+	ReductionMaxLengthForTrunc int      `yaml:"reduction_max_length_for_trunc,omitempty" json:"reduction_max_length_for_trunc,omitempty"` // default 12000
+	ReductionMaxTokensForClear int      `yaml:"reduction_max_tokens_for_clear,omitempty" json:"reduction_max_tokens_for_clear,omitempty"` // default 50000
+	ReductionClearExclude      []string `yaml:"reduction_clear_exclude,omitempty" json:"reduction_clear_exclude,omitempty"`
+	ReductionSubAgents         bool     `yaml:"reduction_sub_agents,omitempty" json:"reduction_sub_agents,omitempty"` // also attach to sub-agents
 	// SummarizationTriggerRatio controls summarization trigger threshold as max_total_tokens * ratio (default 0.8).
 	SummarizationTriggerRatio float64 `yaml:"summarization_trigger_ratio,omitempty" json:"summarization_trigger_ratio,omitempty"`
 	// SummarizationEmitInternalEvents controls middleware internal event emission (default true).
@@ -270,6 +275,8 @@ type MultiAgentEinoMiddlewareConfig struct {
 	RunRetryMaxAttempts int `yaml:"run_retry_max_attempts,omitempty" json:"run_retry_max_attempts,omitempty"`
 	// RunRetryMaxBackoffSec 单次退避上限秒数；0=默认 30。
 	RunRetryMaxBackoffSec int `yaml:"run_retry_max_backoff_sec,omitempty" json:"run_retry_max_backoff_sec,omitempty"`
+	// EmptyResponseContinueMaxAttempts Run 成功但未捕获助手正文时 Handler 层退避续跑次数；0=默认 5。
+	EmptyResponseContinueMaxAttempts int `yaml:"empty_response_continue_max_attempts,omitempty" json:"empty_response_continue_max_attempts,omitempty"`
 	// TaskToolDescriptionPrefix when non-empty sets deep.Config TaskToolDescriptionGenerator (sub-agent names appended).
 	TaskToolDescriptionPrefix string `yaml:"task_tool_description_prefix,omitempty" json:"task_tool_description_prefix,omitempty"`
 }
@@ -391,13 +398,13 @@ type MultiAgentSubConfig struct {
 
 // MultiAgentPublic 返回给前端的精简信息（不含子代理指令全文）。
 type MultiAgentPublic struct {
-	Enabled               bool   `json:"enabled"`
-	RobotDefaultAgentMode string `json:"robot_default_agent_mode,omitempty"`
-	BatchUseMultiAgent    bool   `json:"batch_use_multi_agent"`
-	SubAgentCount                int    `json:"sub_agent_count"`
-	Orchestration                string `json:"orchestration,omitempty"`
-	PlanExecuteLoopMaxIterations int    `json:"plan_execute_loop_max_iterations"`
-	ToolSearchAlwaysVisibleTools []string `json:"tool_search_always_visible_tools,omitempty"`
+	Enabled                               bool     `json:"enabled"`
+	RobotDefaultAgentMode                 string   `json:"robot_default_agent_mode,omitempty"`
+	BatchUseMultiAgent                    bool     `json:"batch_use_multi_agent"`
+	SubAgentCount                         int      `json:"sub_agent_count"`
+	Orchestration                         string   `json:"orchestration,omitempty"`
+	PlanExecuteLoopMaxIterations          int      `json:"plan_execute_loop_max_iterations"`
+	ToolSearchAlwaysVisibleTools          []string `json:"tool_search_always_visible_tools,omitempty"`
 	ToolSearchAlwaysVisibleEffectiveTools []string `json:"tool_search_always_visible_effective_tools,omitempty"`
 }
 
@@ -438,10 +445,10 @@ func NormalizeMultiAgentOrchestration(s string) string {
 
 // MultiAgentAPIUpdate 设置页/API 仅更新多代理标量字段；写入 YAML 时不覆盖 sub_agents 等块。
 type MultiAgentAPIUpdate struct {
-	Enabled               bool   `json:"enabled"`
-	RobotDefaultAgentMode string `json:"robot_default_agent_mode,omitempty"`
-	BatchUseMultiAgent    bool   `json:"batch_use_multi_agent"`
-	PlanExecuteLoopMaxIterations *int `json:"plan_execute_loop_max_iterations,omitempty"`
+	Enabled                      bool   `json:"enabled"`
+	RobotDefaultAgentMode        string `json:"robot_default_agent_mode,omitempty"`
+	BatchUseMultiAgent           bool   `json:"batch_use_multi_agent"`
+	PlanExecuteLoopMaxIterations *int   `json:"plan_execute_loop_max_iterations,omitempty"`
 	// 指针区分「JSON 未传该字段」与「传空数组要清空」；省略时不应覆盖 YAML 中的常驻工具白名单。
 	ToolSearchAlwaysVisibleTools *[]string `json:"tool_search_always_visible_tools,omitempty"`
 }
@@ -457,14 +464,14 @@ type RobotsConfig struct {
 
 // RobotWechatConfig 微信 iLink 机器人配置（个人微信 ClawBot / iLink 协议）
 type RobotWechatConfig struct {
-	Enabled        bool   `yaml:"enabled" json:"enabled"`
-	BotToken       string `yaml:"bot_token,omitempty" json:"bot_token,omitempty"`
-	ILinkBotID     string `yaml:"ilink_bot_id,omitempty" json:"ilink_bot_id,omitempty"`
-	ILinkUserID    string `yaml:"ilink_user_id,omitempty" json:"ilink_user_id,omitempty"`
-	BaseURL        string `yaml:"base_url,omitempty" json:"base_url,omitempty"`               // 默认 https://ilinkai.weixin.qq.com
-	BotType        string `yaml:"bot_type,omitempty" json:"bot_type,omitempty"`               // get_bot_qrcode 参数，默认 3
-	BotAgent       string `yaml:"bot_agent,omitempty" json:"bot_agent,omitempty"`             // base_info.bot_agent
-	GetUpdatesBuf  string `yaml:"get_updates_buf,omitempty" json:"get_updates_buf,omitempty"` // 长轮询游标（运行时）
+	Enabled       bool   `yaml:"enabled" json:"enabled"`
+	BotToken      string `yaml:"bot_token,omitempty" json:"bot_token,omitempty"`
+	ILinkBotID    string `yaml:"ilink_bot_id,omitempty" json:"ilink_bot_id,omitempty"`
+	ILinkUserID   string `yaml:"ilink_user_id,omitempty" json:"ilink_user_id,omitempty"`
+	BaseURL       string `yaml:"base_url,omitempty" json:"base_url,omitempty"`               // 默认 https://ilinkai.weixin.qq.com
+	BotType       string `yaml:"bot_type,omitempty" json:"bot_type,omitempty"`               // get_bot_qrcode 参数，默认 3
+	BotAgent      string `yaml:"bot_agent,omitempty" json:"bot_agent,omitempty"`             // base_info.bot_agent
+	GetUpdatesBuf string `yaml:"get_updates_buf,omitempty" json:"get_updates_buf,omitempty"` // 长轮询游标（运行时）
 }
 
 // RobotSessionConfig 机器人会话隔离策略
@@ -490,21 +497,32 @@ type RobotWecomConfig struct {
 	AgentID        int64  `yaml:"agent_id" json:"agent_id"`                 // 应用 AgentId
 }
 
+// ValidateWecomConfig 校验企业微信机器人配置；启用时必须配置 token，否则回调无法防伪造。
+func ValidateWecomConfig(w RobotWecomConfig) error {
+	if !w.Enabled {
+		return nil
+	}
+	if strings.TrimSpace(w.Token) == "" {
+		return fmt.Errorf("robots.wecom.enabled 为 true 时必须配置 robots.wecom.token")
+	}
+	return nil
+}
+
 // RobotDingtalkConfig 钉钉机器人配置
 type RobotDingtalkConfig struct {
-	Enabled                    bool   `yaml:"enabled" json:"enabled"`
-	ClientID                   string `yaml:"client_id" json:"client_id"`                                       // 应用 Key (AppKey)
-	ClientSecret               string `yaml:"client_secret" json:"client_secret"`                               // 应用 Secret
+	Enabled                     bool   `yaml:"enabled" json:"enabled"`
+	ClientID                    string `yaml:"client_id" json:"client_id"`                                           // 应用 Key (AppKey)
+	ClientSecret                string `yaml:"client_secret" json:"client_secret"`                                   // 应用 Secret
 	AllowConversationIDFallback bool   `yaml:"allow_conversation_id_fallback" json:"allow_conversation_id_fallback"` // sender_id 缺失时是否允许回退到会话 ID
 }
 
 // RobotLarkConfig 飞书机器人配置
 type RobotLarkConfig struct {
-	Enabled                 bool   `yaml:"enabled" json:"enabled"`
-	AppID                   string `yaml:"app_id" json:"app_id"`                                 // 应用 App ID
-	AppSecret               string `yaml:"app_secret" json:"app_secret"`                         // 应用 App Secret
-	VerifyToken             string `yaml:"verify_token" json:"verify_token"`                     // 事件订阅 Verification Token（可选）
-	AllowChatIDFallback     bool   `yaml:"allow_chat_id_fallback" json:"allow_chat_id_fallback"` // 用户 ID 缺失时是否允许回退到 chat_id
+	Enabled             bool   `yaml:"enabled" json:"enabled"`
+	AppID               string `yaml:"app_id" json:"app_id"`                                 // 应用 App ID
+	AppSecret           string `yaml:"app_secret" json:"app_secret"`                         // 应用 App Secret
+	VerifyToken         string `yaml:"verify_token" json:"verify_token"`                     // 事件订阅 Verification Token（可选）
+	AllowChatIDFallback bool   `yaml:"allow_chat_id_fallback" json:"allow_chat_id_fallback"` // 用户 ID 缺失时是否允许回退到 chat_id
 }
 
 type ServerConfig struct {
@@ -603,17 +621,123 @@ type DatabaseConfig struct {
 }
 
 type AgentConfig struct {
-	MaxIterations      int    `yaml:"max_iterations" json:"max_iterations"`
-	ToolTimeoutMinutes int    `yaml:"tool_timeout_minutes" json:"tool_timeout_minutes"` // 单次工具执行最大时长（分钟），超时自动终止，防止长时间挂起；0 表示不限制（不推荐）
+	MaxIterations      int `yaml:"max_iterations" json:"max_iterations"`
+	ToolTimeoutMinutes int `yaml:"tool_timeout_minutes" json:"tool_timeout_minutes"` // 单次工具执行最大时长（分钟），超时自动终止，防止长时间挂起；0 表示不限制（不推荐）
+	// ShellNoOutputTimeoutSeconds execute/exec 无任何 stdout/stderr 时的空闲终止秒数（通用防挂死，不维护命令黑名单）；0=默认 300（5 分钟）；-1=关闭。
+	ShellNoOutputTimeoutSeconds int `yaml:"shell_no_output_timeout_seconds" json:"shell_no_output_timeout_seconds"`
+	// WorkspaceRootDir 会话工作目录根路径（curl/wget 下载、read_file/glob/grep 本地分析）；空=tmp/workspace，其下按 projects/{id} 或 conversations/{id} 隔离。
+	WorkspaceRootDir string `yaml:"workspace_root_dir,omitempty" json:"workspace_root_dir,omitempty"`
 	// SystemPromptPath 单代理系统提示 Markdown/文本文件路径（相对 config.yaml 所在目录，或可写绝对路径）。非空且可读时替换内置单代理提示；留空用内置。
 	SystemPromptPath string `yaml:"system_prompt_path,omitempty" json:"system_prompt_path,omitempty"`
 }
 
 // HitlConfig 人机协同全局选项；与会话侧栏/API 中的白名单合并为并集后参与判定。
-// tool_whitelist 可在侧栏「应用」时合并写入 config.yaml 并立即生效；其他字段若仅改文件仍需重启。
+// tool_whitelist 可在侧栏「应用」时合并写入 config.yaml 并立即生效。
+// audit_agent_prompt / audit_agent_prompt_review_edit 可在人机协同页编辑并立即生效；空则使用内置默认。
 type HitlConfig struct {
-	// ToolWhitelist 全局免审批工具名（与每条会话配置的 sensitiveTools 语义相同：白名单内工具不触发 HITL）。
+	// ToolWhitelist 全局免审批工具名（与白名单内工具不触发 HITL 审批）。
 	ToolWhitelist []string `yaml:"tool_whitelist,omitempty" json:"tool_whitelist,omitempty"`
+	// AuditAgentPrompt 审批模式（approval）下审计 Agent 系统提示词。
+	AuditAgentPrompt string `yaml:"audit_agent_prompt,omitempty" json:"audit_agent_prompt,omitempty"`
+	// AuditAgentPromptReviewEdit 审查编辑模式（review_edit）下审计 Agent 系统提示词。
+	AuditAgentPromptReviewEdit string `yaml:"audit_agent_prompt_review_edit,omitempty" json:"audit_agent_prompt_review_edit,omitempty"`
+	// RetentionDays 已决策审计日志（hitl_interrupts 非 pending）保留天数；省略时默认 90；0 表示不自动清理。
+	RetentionDays *int `yaml:"retention_days,omitempty" json:"retention_days,omitempty"`
+	// DefaultReviewer 全局默认审批方（human | audit_agent）；未选会话时切换会写入 config.yaml；新建会话无独立配置时沿用。
+	DefaultReviewer string `yaml:"default_reviewer,omitempty" json:"default_reviewer,omitempty"`
+}
+
+// EffectiveDefaultReviewer returns human or audit_agent; omitted or unknown values default to human.
+func (h HitlConfig) EffectiveDefaultReviewer() string {
+	switch strings.ToLower(strings.TrimSpace(h.DefaultReviewer)) {
+	case "audit_agent", "agent", "ai":
+		return "audit_agent"
+	default:
+		return "human"
+	}
+}
+
+// RetentionDaysEffective returns retention; 0 means keep forever; omitted defaults to 90.
+func (h HitlConfig) RetentionDaysEffective() int {
+	if h.RetentionDays == nil {
+		return 90
+	}
+	if *h.RetentionDays < 0 {
+		return 0
+	}
+	return *h.RetentionDays
+}
+
+const hitlAuditAgentPromptBase = `你是 CyberStrikeAI 人机协同审计 Agent。审查 Agent 即将执行的工具调用是否会对系统造成实质性损害。
+
+你会收到 JSON，包含 hitlMode、toolName、arguments/argumentsObj、userMessage、thinking、reasoningChain、planning 等字段。
+
+裁决基调（默认放行）：
+- 常规、低风险的渗透测试操作 → approve（如信息收集、端口/服务扫描、目录枚举、只读查询、无害探测命令）
+- 与用户授权、当前任务目标一致，且未见明确高危迹象 → approve
+- 仅在「可能对系统造成实质影响」时 → reject
+
+必须 reject 的高危情形（示例，非穷举）：
+- 删库、清表、批量删除数据、格式化磁盘、不可逆破坏
+- 修改/重置密码、创建或篡改管理员账号、持久化后门、开机自启
+- 向生产环境写入恶意载荷、勒索加密、停止关键服务、修改系统核心配置
+- 明显越权：与任务/授权目标无关的破坏性操作
+
+不应单独作为 reject 理由的情形：
+- 常规 nmap/curl/grep/读文件/枚举类命令本身
+- 参数略显宽泛但无明确破坏意图（审查编辑模式可收窄参数后 approve）
+- 仅因「信息不足」——若无上述高危迹象，应 approve 并可在 comment 中提示注意点`
+
+const hitlAuditAgentPromptApprovalOutput = `
+仅输出一行 JSON，不要 markdown 代码块：
+{"decision":"approve"|"reject","comment":"简要理由"}`
+
+const hitlAuditAgentPromptReviewEditOutput = `
+仅输出一行 JSON，不要 markdown 代码块：
+{"decision":"approve"|"reject","comment":"简要理由","editedArguments":{...}}
+
+editedArguments 规则（仅 approve 且需要改参时填写，否则省略该字段）：
+- 提供完整替换后的工具参数对象，键名与 argumentsObj 一致
+- 只做最小必要修改以收窄范围、消除风险（如限制 path、去掉危险 flag）
+- 禁止扩大攻击面：不得扩大目标范围、提升权限或引入破坏性参数
+- 无法安全改参时应 reject，不要勉强 approve`
+
+// DefaultHitlAuditAgentPrompt 内置审批模式审计 Agent 提示词。
+func DefaultHitlAuditAgentPrompt() string {
+	return hitlAuditAgentPromptBase + hitlAuditAgentPromptApprovalOutput
+}
+
+// DefaultHitlAuditAgentPromptReviewEdit 内置审查编辑模式审计 Agent 提示词。
+func DefaultHitlAuditAgentPromptReviewEdit() string {
+	return hitlAuditAgentPromptBase + hitlAuditAgentPromptReviewEditOutput
+}
+
+// EffectiveAuditAgentPrompt 返回审批模式生效的审计 Agent 提示词。
+func (c HitlConfig) EffectiveAuditAgentPrompt() string {
+	return c.EffectiveAuditAgentPromptForMode("approval")
+}
+
+// EffectiveAuditAgentPromptForMode 按 HITL 模式返回生效的审计 Agent 提示词。
+func (c HitlConfig) EffectiveAuditAgentPromptForMode(mode string) string {
+	if normalizeHitlModeForPrompt(mode) == "review_edit" {
+		if s := strings.TrimSpace(c.AuditAgentPromptReviewEdit); s != "" {
+			return s
+		}
+		return DefaultHitlAuditAgentPromptReviewEdit()
+	}
+	if s := strings.TrimSpace(c.AuditAgentPrompt); s != "" {
+		return s
+	}
+	return DefaultHitlAuditAgentPrompt()
+}
+
+func normalizeHitlModeForPrompt(mode string) string {
+	switch strings.ToLower(strings.TrimSpace(mode)) {
+	case "review_edit":
+		return "review_edit"
+	default:
+		return "approval"
+	}
 }
 
 type AuthConfig struct {
@@ -644,9 +768,9 @@ func (m MonitorConfig) RetentionDaysEffective() int {
 // AuditConfig platform operation audit log settings (not chat/tool execution bodies).
 type AuditConfig struct {
 	// Enabled nil or true enables persistence; explicit false disables.
-	Enabled             *bool `yaml:"enabled,omitempty" json:"enabled,omitempty"`
-	RetentionDays  int `yaml:"retention_days,omitempty" json:"retention_days,omitempty"`
-	MaxDetailBytes int `yaml:"max_detail_bytes,omitempty" json:"max_detail_bytes,omitempty"`
+	Enabled        *bool `yaml:"enabled,omitempty" json:"enabled,omitempty"`
+	RetentionDays  int   `yaml:"retention_days,omitempty" json:"retention_days,omitempty"`
+	MaxDetailBytes int   `yaml:"max_detail_bytes,omitempty" json:"max_detail_bytes,omitempty"`
 	// AuthFailureCooldownSeconds: per-IP cooldown for auth login/change_password failure audit rows; -1 disables; 0 uses default 60.
 	AuthFailureCooldownSeconds int `yaml:"auth_failure_cooldown_seconds,omitempty" json:"auth_failure_cooldown_seconds,omitempty"`
 }
@@ -800,33 +924,13 @@ func Load(path string) (*Config, error) {
 
 	// 如果配置了工具目录，从目录加载工具配置
 	if cfg.Security.ToolsDir != "" {
-		configDir := filepath.Dir(path)
-		toolsDir := cfg.Security.ToolsDir
-
-		// 如果是相对路径，相对于配置文件所在目录
-		if !filepath.IsAbs(toolsDir) {
-			toolsDir = filepath.Join(configDir, toolsDir)
-		}
-
-		tools, err := LoadToolsFromDir(toolsDir)
+		inlineTools := append([]ToolConfig(nil), cfg.Security.Tools...)
+		toolsDir := ResolveToolsDir(cfg.Security.ToolsDir, path)
+		merged, err := MergeToolsFromDir(toolsDir, inlineTools)
 		if err != nil {
 			return nil, fmt.Errorf("从工具目录加载工具配置失败: %w", err)
 		}
-
-		// 合并工具配置：目录中的工具优先，主配置中的工具作为补充
-		existingTools := make(map[string]bool)
-		for _, tool := range tools {
-			existingTools[tool.Name] = true
-		}
-
-		// 添加主配置中不存在于目录中的工具（向后兼容）
-		for _, tool := range cfg.Security.Tools {
-			if !existingTools[tool.Name] {
-				tools = append(tools, tool)
-			}
-		}
-
-		cfg.Security.Tools = tools
+		cfg.Security.Tools = merged
 	}
 
 	// 外部 MCP：迁移 + 环境变量展开
@@ -870,6 +974,10 @@ func Load(path string) (*Config, error) {
 		}
 	}
 
+	if err := ValidateWecomConfig(cfg.Robots.Wecom); err != nil {
+		return nil, err
+	}
+
 	return &cfg, nil
 }
 
@@ -1094,6 +1202,75 @@ func PrintMCPConfigJSON(mcp MCPConfig) {
 	fmt.Println("----------------------------------------------------------------")
 }
 
+// ResolveToolsDir 将 tools_dir 解析为绝对路径（相对路径相对于 configPath 所在目录）。
+func ResolveToolsDir(toolsDir, configPath string) string {
+	toolsDir = strings.TrimSpace(toolsDir)
+	if toolsDir == "" {
+		return ""
+	}
+	if filepath.IsAbs(toolsDir) {
+		return toolsDir
+	}
+	return filepath.Join(filepath.Dir(configPath), toolsDir)
+}
+
+// MergeToolsFromDir 从目录加载工具并与 inline 列表合并：目录中的工具优先，主配置中的工具作为补充。
+func MergeToolsFromDir(toolsDir string, inlineTools []ToolConfig) ([]ToolConfig, error) {
+	dirTools, err := LoadToolsFromDir(toolsDir)
+	if err != nil {
+		return nil, err
+	}
+	existing := make(map[string]bool, len(dirTools))
+	for _, tool := range dirTools {
+		existing[tool.Name] = true
+	}
+	merged := append([]ToolConfig(nil), dirTools...)
+	for _, tool := range inlineTools {
+		if !existing[tool.Name] {
+			merged = append(merged, tool)
+		}
+	}
+	return merged, nil
+}
+
+// loadInlineSecurityToolsFromYAML 读取 config.yaml 中 security.tools（不含 tools_dir 扫描结果）。
+func loadInlineSecurityToolsFromYAML(configPath string) ([]ToolConfig, error) {
+	data, err := os.ReadFile(configPath)
+	if err != nil {
+		return nil, fmt.Errorf("读取配置文件失败: %w", err)
+	}
+	var partial struct {
+		Security struct {
+			Tools []ToolConfig `yaml:"tools"`
+		} `yaml:"security"`
+	}
+	if err := yaml.Unmarshal(data, &partial); err != nil {
+		return nil, fmt.Errorf("解析配置文件失败: %w", err)
+	}
+	if partial.Security.Tools == nil {
+		return []ToolConfig{}, nil
+	}
+	return partial.Security.Tools, nil
+}
+
+// ReloadSecurityToolsFromDir 从 tools_dir 重新加载工具并更新 cfg.Security.Tools（ApplyConfig 热重载用）。
+func ReloadSecurityToolsFromDir(cfg *Config, configPath string) error {
+	if cfg == nil || strings.TrimSpace(cfg.Security.ToolsDir) == "" {
+		return nil
+	}
+	inlineTools, err := loadInlineSecurityToolsFromYAML(configPath)
+	if err != nil {
+		return err
+	}
+	toolsDir := ResolveToolsDir(cfg.Security.ToolsDir, configPath)
+	merged, err := MergeToolsFromDir(toolsDir, inlineTools)
+	if err != nil {
+		return fmt.Errorf("从工具目录加载工具配置失败: %w", err)
+	}
+	cfg.Security.Tools = merged
+	return nil
+}
+
 // LoadToolsFromDir 从目录加载所有工具配置文件
 func LoadToolsFromDir(dir string) ([]ToolConfig, error) {
 	var tools []ToolConfig
@@ -1270,8 +1447,9 @@ func Default() *Config {
 			MaxTotalTokens: 120000,
 		},
 		Agent: AgentConfig{
-			MaxIterations:      30, // 默认最大迭代次数
-			ToolTimeoutMinutes: 10, // 单次工具执行默认最多 10 分钟，避免异常长时间占用
+			MaxIterations:               30,  // 默认最大迭代次数
+			ToolTimeoutMinutes:          10,  // 单次工具执行默认最多 10 分钟，避免异常长时间占用
+			ShellNoOutputTimeoutSeconds: 300, // execute/exec 无新输出空闲终止（秒）；-1 关闭
 		},
 		Security: SecurityConfig{
 			Tools:    []ToolConfig{}, // 工具配置应该从 config.yaml 或 tools/ 目录加载
@@ -1311,7 +1489,12 @@ func Default() *Config {
 			},
 			Retrieval: RetrievalConfig{
 				TopK:                5,
-				SimilarityThreshold: 0.65, // 降低阈值到 0.65，减少漏检
+				SimilarityThreshold: 0.65,
+				MultiQuery:          MultiQueryConfig{MaxQueries: 4},
+				Rerank:              RerankConfig{},
+				PostRetrieve: PostRetrieveConfig{
+					PrefetchTopK: 20,
+				},
 			},
 			Indexing: IndexingConfig{
 				ChunkStrategy:         "markdown_then_recursive",
@@ -1407,7 +1590,7 @@ type EmbeddingConfig struct {
 
 // PostRetrieveConfig 检索后处理：固定对正文做规范化去重（最佳实践）、上下文预算截断；PrefetchTopK 用于多取候选再收敛到 top_k。
 type PostRetrieveConfig struct {
-	// PrefetchTopK 向量检索阶段最多保留的候选数（余弦序），应 ≥ top_k，0 表示与 top_k 相同；上限见知识库包内常量。
+	// PrefetchTopK 向量检索阶段每条 MultiQuery 变体最多保留的候选数；0 表示使用内置默认 max(top_k*4, 20)。
 	PrefetchTopK int `yaml:"prefetch_top_k,omitempty" json:"prefetch_top_k,omitempty"`
 	// MaxContextChars 返回文档内容总 Unicode 字符数上限（整段 chunk，不截断半段）；0 表示不限制。
 	MaxContextChars int `yaml:"max_context_chars,omitempty" json:"max_context_chars,omitempty"`
@@ -1415,13 +1598,62 @@ type PostRetrieveConfig struct {
 	MaxContextTokens int `yaml:"max_context_tokens,omitempty" json:"max_context_tokens,omitempty"`
 }
 
+// MultiQueryConfig Eino MultiQuery 查询改写（始终启用，无关闭开关）。
+type MultiQueryConfig struct {
+	// MaxQueries LLM 生成的检索变体上限（含原问语义覆盖）；0 表示默认 4。
+	MaxQueries int `yaml:"max_queries,omitempty" json:"max_queries,omitempty"`
+}
+
+func (c MultiQueryConfig) MaxQueriesEffective() int {
+	if c.MaxQueries <= 0 {
+		return 4
+	}
+	if c.MaxQueries > 8 {
+		return 8
+	}
+	return c.MaxQueries
+}
+
+// RerankConfig 检索精排（始终启用）；支持 dashscope 与 Cohere 兼容 HTTP API。
+type RerankConfig struct {
+	// Provider: dashscope | cohere；空则按 base_url 自动推断。
+	Provider string `yaml:"provider,omitempty" json:"provider,omitempty"`
+	Model    string `yaml:"model,omitempty" json:"model,omitempty"`
+	BaseURL  string `yaml:"base_url,omitempty" json:"base_url,omitempty"`
+	APIKey   string `yaml:"api_key,omitempty" json:"api_key,omitempty"`
+}
+
+func (c RerankConfig) ProviderEffective(baseURL string) string {
+	p := strings.TrimSpace(strings.ToLower(c.Provider))
+	if p != "" {
+		return p
+	}
+	u := strings.ToLower(baseURL)
+	if strings.Contains(u, "dashscope") {
+		return "dashscope"
+	}
+	return "cohere"
+}
+
+func (c RerankConfig) ModelEffective(provider string) string {
+	if m := strings.TrimSpace(c.Model); m != "" {
+		return m
+	}
+	if provider == "dashscope" {
+		return "gte-rerank"
+	}
+	return "rerank-multilingual-v3.0"
+}
+
 // RetrievalConfig 检索配置
 type RetrievalConfig struct {
 	TopK                int     `yaml:"top_k" json:"top_k"`                               // 检索Top-K
 	SimilarityThreshold float64 `yaml:"similarity_threshold" json:"similarity_threshold"` // 余弦相似度阈值
 	// SubIndexFilter 非空时仅保留 sub_indexes 含该标签（逗号分隔之一）的行；sub_indexes 为空的旧行仍返回。
-	SubIndexFilter string `yaml:"sub_index_filter,omitempty" json:"sub_index_filter,omitempty"`
-	// PostRetrieve 检索后处理（去重、预算截断）；重排通过代码注入 [knowledge.DocumentReranker]。
+	SubIndexFilter string           `yaml:"sub_index_filter,omitempty" json:"sub_index_filter,omitempty"`
+	MultiQuery     MultiQueryConfig `yaml:"multi_query" json:"multi_query"`
+	Rerank         RerankConfig     `yaml:"rerank" json:"rerank"`
+	// PostRetrieve 检索后处理（去重、预算截断）；精排在 MultiQuery 融合后执行。
 	PostRetrieve PostRetrieveConfig `yaml:"post_retrieve,omitempty" json:"post_retrieve,omitempty"`
 }
 
@@ -1433,11 +1665,14 @@ type RolesConfig struct {
 
 // RoleConfig 单个角色配置
 type RoleConfig struct {
-	Name        string   `yaml:"name" json:"name"`                       // 角色名称
-	Description string   `yaml:"description" json:"description"`         // 角色描述
-	UserPrompt  string   `yaml:"user_prompt" json:"user_prompt"`         // 用户提示词(追加到用户消息前)
-	Icon        string   `yaml:"icon,omitempty" json:"icon,omitempty"`   // 角色图标（可选）
-	Tools       []string `yaml:"tools,omitempty" json:"tools,omitempty"` // 关联的工具列表（toolKey格式，如 "toolName" 或 "mcpName::toolName"）
-	MCPs        []string `yaml:"mcps,omitempty" json:"mcps,omitempty"`   // 向后兼容：关联的MCP服务器列表（已废弃，使用tools替代）
-	Enabled     bool     `yaml:"enabled" json:"enabled"`                 // 是否启用
+	Name            string   `yaml:"name" json:"name"`                                             // 角色名称
+	Description     string   `yaml:"description" json:"description"`                               // 角色描述
+	UserPrompt      string   `yaml:"user_prompt" json:"user_prompt"`                               // 用户提示词(追加到用户消息前)
+	Icon            string   `yaml:"icon,omitempty" json:"icon,omitempty"`                         // 角色图标（可选）
+	Tools           []string `yaml:"tools,omitempty" json:"tools,omitempty"`                       // 关联的工具列表（toolKey格式，如 "toolName" 或 "mcpName::toolName"）
+	MCPs            []string `yaml:"mcps,omitempty" json:"mcps,omitempty"`                         // 向后兼容：关联的MCP服务器列表（已废弃，使用tools替代）
+	WorkflowID      string   `yaml:"workflow_id,omitempty" json:"workflow_id,omitempty"`           // 可选：绑定图编排流程 ID
+	WorkflowVersion string   `yaml:"workflow_version,omitempty" json:"workflow_version,omitempty"` // latest 或具体版本号；空等同 latest
+	WorkflowPolicy  string   `yaml:"workflow_policy,omitempty" json:"workflow_policy,omitempty"`   // auto | off；空且 workflow_id 非空时按 auto
+	Enabled         bool     `yaml:"enabled" json:"enabled"`                                       // 是否启用
 }

internal/config/robots_validate_test.go

@@ -0,0 +1,45 @@
+package config
+
+import "testing"
+
+func TestValidateWecomConfig(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		cfg     RobotWecomConfig
+		wantErr bool
+	}{
+		{
+			name:    "disabled without token",
+			cfg:     RobotWecomConfig{Enabled: false, Token: ""},
+			wantErr: false,
+		},
+		{
+			name:    "enabled with token",
+			cfg:     RobotWecomConfig{Enabled: true, Token: "secret"},
+			wantErr: false,
+		},
+		{
+			name:    "enabled without token",
+			cfg:     RobotWecomConfig{Enabled: true, Token: ""},
+			wantErr: true,
+		},
+		{
+			name:    "enabled with whitespace token",
+			cfg:     RobotWecomConfig{Enabled: true, Token: "   "},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			err := ValidateWecomConfig(tt.cfg)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("ValidateWecomConfig() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}

internal/config/tools_reload_test.go

@@ -0,0 +1,111 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestReloadSecurityToolsFromDir(t *testing.T) {
+	root := t.TempDir()
+	toolsDir := filepath.Join(root, "tools")
+	if err := os.MkdirAll(toolsDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+
+	configPath := filepath.Join(root, "config.yaml")
+	if err := os.WriteFile(configPath, []byte(`security:
+  tools_dir: tools
+  tools:
+    - name: inline-only
+      command: inline-cmd
+      enabled: true
+      description: inline tool
+`), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	writeTool := func(name, command string) {
+		t.Helper()
+		content := "name: " + name + "\ncommand: " + command + "\nenabled: true\ndescription: test\n"
+		if err := os.WriteFile(filepath.Join(toolsDir, name+".yaml"), []byte(content), 0644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	writeTool("alpha", "alpha-cmd")
+
+	cfg := &Config{
+		Security: SecurityConfig{
+			ToolsDir: "tools",
+			Tools: []ToolConfig{
+				{Name: "stale", Command: "stale-cmd", Enabled: true, Description: "should be removed"},
+			},
+		},
+	}
+
+	if err := ReloadSecurityToolsFromDir(cfg, configPath); err != nil {
+		t.Fatalf("reload: %v", err)
+	}
+	if len(cfg.Security.Tools) != 2 {
+		t.Fatalf("expected 2 tools, got %d", len(cfg.Security.Tools))
+	}
+
+	names := map[string]string{}
+	for _, tool := range cfg.Security.Tools {
+		names[tool.Name] = tool.Command
+	}
+	if names["alpha"] != "alpha-cmd" {
+		t.Fatalf("alpha tool missing or wrong command: %#v", names)
+	}
+	if names["inline-only"] != "inline-cmd" {
+		t.Fatalf("inline-only tool missing: %#v", names)
+	}
+	if _, ok := names["stale"]; ok {
+		t.Fatal("stale in-memory tool should not survive reload")
+	}
+
+	writeTool("beta", "beta-cmd")
+	if err := ReloadSecurityToolsFromDir(cfg, configPath); err != nil {
+		t.Fatalf("second reload: %v", err)
+	}
+	if len(cfg.Security.Tools) != 3 {
+		t.Fatalf("expected 3 tools after add, got %d", len(cfg.Security.Tools))
+	}
+	foundBeta := false
+	for _, tool := range cfg.Security.Tools {
+		if tool.Name == "beta" {
+			foundBeta = true
+			break
+		}
+	}
+	if !foundBeta {
+		t.Fatal("beta tool not found after second reload")
+	}
+}
+
+func TestMergeToolsFromDir_DirOverridesInline(t *testing.T) {
+	root := t.TempDir()
+	toolsDir := filepath.Join(root, "tools")
+	if err := os.MkdirAll(toolsDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	content := "name: shared\ncommand: dir-cmd\nenabled: true\ndescription: from dir\n"
+	if err := os.WriteFile(filepath.Join(toolsDir, "shared.yaml"), []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	inline := []ToolConfig{
+		{Name: "shared", Command: "inline-cmd", Enabled: true, Description: "from inline"},
+	}
+	merged, err := MergeToolsFromDir(toolsDir, inline)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(merged) != 1 {
+		t.Fatalf("expected 1 tool, got %d", len(merged))
+	}
+	if merged[0].Command != "dir-cmd" {
+		t.Fatalf("dir tool should win, got command %q", merged[0].Command)
+	}
+}

internal/database/conversation.go

@@ -3,6 +3,7 @@ package database
 import (
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -13,6 +14,9 @@ import (
 	"go.uber.org/zap"
 )
 
+// ProjectFilterUnbound 列表 API 中 project_id=__none__ 表示仅未绑定项目的对话。
+const ProjectFilterUnbound = "__none__"
+
 // Conversation 对话
 type Conversation struct {
 	ID        string    `json:"id"`
@@ -361,20 +365,44 @@ func (db *DB) GetConversationLite(id string) (*Conversation, error) {
 	return &conv, nil
 }
 
+func conversationProjectIDColumn(alias string) string {
+	if alias != "" {
+		return alias + ".project_id"
+	}
+	return "project_id"
+}
+
+func appendConversationProjectFilter(where string, args []interface{}, projectID, alias string) (string, []interface{}) {
+	pid := strings.TrimSpace(projectID)
+	if pid == "" {
+		return where, args
+	}
+	col := conversationProjectIDColumn(alias)
+	if pid == ProjectFilterUnbound {
+		return where + fmt.Sprintf(" AND (%s IS NULL OR TRIM(COALESCE(%s, '')) = '')", col, col), args
+	}
+	return where + fmt.Sprintf(" AND %s = ?", col), append(args, pid)
+}
+
 // CountConversations 统计对话数量。
-func (db *DB) CountConversations(search string) (int, error) {
+func (db *DB) CountConversations(search, projectID string) (int, error) {
 	var count int
 	var err error
 	if search != "" {
 		searchPattern := "%" + search + "%"
-		err = db.QueryRow(
-			`SELECT COUNT(*) FROM conversations c
-			 WHERE c.title LIKE ?
-			    OR EXISTS (SELECT 1 FROM messages m WHERE m.conversation_id = c.id AND m.content LIKE ?)`,
-			searchPattern, searchPattern,
-		).Scan(&count)
+		where := ` WHERE (c.title LIKE ?
+			    OR EXISTS (SELECT 1 FROM messages m WHERE m.conversation_id = c.id AND m.content LIKE ?))`
+		args := []interface{}{searchPattern, searchPattern}
+		where, args = appendConversationProjectFilter(where, args, projectID, "c")
+		err = db.QueryRow(`SELECT COUNT(*) FROM conversations c`+where, args...).Scan(&count)
 	} else {
-		err = db.QueryRow(`SELECT COUNT(*) FROM conversations`).Scan(&count)
+		where := ""
+		args := []interface{}{}
+		where, args = appendConversationProjectFilter(where, args, projectID, "")
+		if where != "" {
+			where = " WHERE" + strings.TrimPrefix(where, " AND")
+		}
+		err = db.QueryRow(`SELECT COUNT(*) FROM conversations`+where, args...).Scan(&count)
 	}
 	if err != nil {
 		return 0, fmt.Errorf("统计对话失败: %w", err)
@@ -395,7 +423,7 @@ func conversationOrderClause(sortBy, tableAlias string) string {
 }
 
 // ListConversations 列出所有对话
-func (db *DB) ListConversations(limit, offset int, search, sortBy string) ([]*Conversation, error) {
+func (db *DB) ListConversations(limit, offset int, search, sortBy, projectID string) ([]*Conversation, error) {
 	var rows *sql.Rows
 	var err error
 
@@ -403,20 +431,30 @@ func (db *DB) ListConversations(limit, offset int, search, sortBy string) ([]*Co
 		// 使用 EXISTS 子查询代替 LEFT JOIN + DISTINCT，避免大表笛卡尔积
 		searchPattern := "%" + search + "%"
 		orderClause := conversationOrderClause(sortBy, "c")
+		where := ` WHERE (c.title LIKE ?
+			    OR EXISTS (SELECT 1 FROM messages m WHERE m.conversation_id = c.id AND m.content LIKE ?))`
+		args := []interface{}{searchPattern, searchPattern}
+		where, args = appendConversationProjectFilter(where, args, projectID, "c")
+		args = append(args, limit, offset)
 		rows, err = db.Query(
 			`SELECT c.id, c.title, COALESCE(c.pinned, 0), c.created_at, c.updated_at, c.project_id
-			 FROM conversations c
-			 WHERE c.title LIKE ?
-			    OR EXISTS (SELECT 1 FROM messages m WHERE m.conversation_id = c.id AND m.content LIKE ?)
+			 FROM conversations c`+where+`
 			 `+orderClause+`
 			 LIMIT ? OFFSET ?`,
-			searchPattern, searchPattern, limit, offset,
+			args...,
 		)
 	} else {
 		orderClause := conversationOrderClause(sortBy, "")
+		where := ""
+		args := []interface{}{}
+		where, args = appendConversationProjectFilter(where, args, projectID, "")
+		if where != "" {
+			where = " WHERE" + strings.TrimPrefix(where, " AND")
+		}
+		args = append(args, limit, offset)
 		rows, err = db.Query(
-			"SELECT id, title, COALESCE(pinned, 0), created_at, updated_at, project_id FROM conversations "+orderClause+" LIMIT ? OFFSET ?",
-			limit, offset,
+			"SELECT id, title, COALESCE(pinned, 0), created_at, updated_at, project_id FROM conversations"+where+" "+orderClause+" LIMIT ? OFFSET ?",
+			args...,
 		)
 	}
 
@@ -472,23 +510,30 @@ const ungroupedConversationsSQL = `
 	)`
 
 // CountUngroupedConversations 统计不在任何分组中的对话数量。
-func (db *DB) CountUngroupedConversations() (int, error) {
+func (db *DB) CountUngroupedConversations(projectID string) (int, error) {
+	where := ungroupedConversationsSQL
+	args := []interface{}{}
+	where, args = appendConversationProjectFilter(where, args, projectID, "c")
 	var count int
-	if err := db.QueryRow(`SELECT COUNT(*) ` + ungroupedConversationsSQL).Scan(&count); err != nil {
+	if err := db.QueryRow(`SELECT COUNT(*) `+where, args...).Scan(&count); err != nil {
 		return 0, fmt.Errorf("统计未分组对话失败: %w", err)
 	}
 	return count, nil
 }
 
 // ListUngroupedConversations 列出不在任何分组中的对话（最近对话侧栏）。
-func (db *DB) ListUngroupedConversations(limit, offset int, sortBy string) ([]*Conversation, error) {
+func (db *DB) ListUngroupedConversations(limit, offset int, sortBy, projectID string) ([]*Conversation, error) {
 	orderClause := conversationOrderClause(sortBy, "c")
+	where := ungroupedConversationsSQL
+	args := []interface{}{}
+	where, args = appendConversationProjectFilter(where, args, projectID, "c")
+	args = append(args, limit, offset)
 	rows, err := db.Query(
 		`SELECT c.id, c.title, COALESCE(c.pinned, 0), c.created_at, c.updated_at, c.project_id `+
-			ungroupedConversationsSQL+`
+			where+`
 		 `+orderClause+`
 		 LIMIT ? OFFSET ?`,
-		limit, offset,
+		args...,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("查询未分组对话失败: %w", err)
@@ -533,6 +578,19 @@ func (db *DB) ListUngroupedConversations(limit, offset int, sortBy string) ([]*C
 	return conversations, rows.Err()
 }
 
+// GetConversationTitle 获取对话标题（轻量查询，不加载消息）
+func (db *DB) GetConversationTitle(id string) (string, error) {
+	var title string
+	err := db.QueryRow("SELECT title FROM conversations WHERE id = ?", id).Scan(&title)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return "", fmt.Errorf("对话不存在")
+		}
+		return "", fmt.Errorf("查询对话标题失败: %w", err)
+	}
+	return title, nil
+}
+
 // UpdateConversationTitle 更新对话标题
 func (db *DB) UpdateConversationTitle(id, title string) error {
 	// 注意：不更新 updated_at，因为重命名操作不应该改变对话的更新时间
@@ -640,6 +698,16 @@ func (db *DB) einoReductionBaseDir() string {
 	return filepath.Join("tmp", "reduction")
 }
 
+func (db *DB) einoWorkspaceBaseDir() string {
+	if db == nil {
+		return ""
+	}
+	if base := strings.TrimSpace(db.einoWorkspaceRootDir); base != "" {
+		return base
+	}
+	return filepath.Join("tmp", "workspace")
+}
+
 func (db *DB) removeConversationScopedDirs(conversationID, projectID string) {
 	// summarization transcript, etc.
 	db.removeConversationScopedDir(db.conversationArtifactsDir, conversationID, "conversation_artifacts")
@@ -652,6 +720,8 @@ func (db *DB) removeConversationScopedDirs(conversationID, projectID string) {
 	if strings.TrimSpace(projectID) == "" {
 		reductionBase := filepath.Join(db.einoReductionBaseDir(), "conversations")
 		db.removeConversationScopedDir(reductionBase, conversationID, "reduction")
+		workspaceBase := filepath.Join(db.einoWorkspaceBaseDir(), "conversations")
+		db.removeConversationScopedDir(workspaceBase, conversationID, "workspace")
 	}
 }
 
@@ -659,6 +729,9 @@ func (db *DB) removeProjectScopedDirs(projectID string) {
 	// Eino reduction persisted tool outputs (tmp/reduction/projects/<id>/).
 	reductionBase := filepath.Join(db.einoReductionBaseDir(), "projects")
 	db.removeConversationScopedDir(reductionBase, projectID, "reduction")
+	// Agent download/analysis workspace (tmp/workspace/projects/<id>/).
+	workspaceBase := filepath.Join(db.einoWorkspaceBaseDir(), "projects")
+	db.removeConversationScopedDir(workspaceBase, projectID, "workspace")
 }
 
 // SaveAgentTrace 保存最后一轮代理消息轨迹与助手输出摘要。
@@ -998,6 +1071,77 @@ type ProcessDetail struct {
 	CreatedAt      time.Time `json:"createdAt"`
 }
 
+// GetTurnUserMessage 返回锚点消息所在轮次中的用户原文（最近一条 user 消息，不含完整历史）。
+func (db *DB) GetTurnUserMessage(conversationID, anchorMessageID string) (string, error) {
+	conversationID = strings.TrimSpace(conversationID)
+	anchorMessageID = strings.TrimSpace(anchorMessageID)
+	if conversationID == "" || anchorMessageID == "" {
+		return "", nil
+	}
+	var content string
+	err := db.QueryRow(`
+SELECT m.content FROM messages m
+WHERE m.conversation_id = ? AND m.role = 'user'
+  AND m.created_at <= COALESCE((SELECT created_at FROM messages WHERE id = ? AND conversation_id = ?), m.created_at)
+ORDER BY m.created_at DESC, m.rowid DESC
+LIMIT 1`, conversationID, anchorMessageID, conversationID).Scan(&content)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return "", nil
+		}
+		return "", fmt.Errorf("query turn user message: %w", err)
+	}
+	return content, nil
+}
+
+// AssistantCognitionTexts 单条助手消息上的思考/推理/规划文本。
+type AssistantCognitionTexts struct {
+	Thinking       string
+	ReasoningChain string
+	Planning       string
+}
+
+// GetAssistantCognitionTexts 聚合助手消息在 process_details 中的 thinking / reasoning_chain / planning。
+func (db *DB) GetAssistantCognitionTexts(assistantMessageID string) (AssistantCognitionTexts, error) {
+	assistantMessageID = strings.TrimSpace(assistantMessageID)
+	if assistantMessageID == "" {
+		return AssistantCognitionTexts{}, nil
+	}
+	rows, err := db.Query(`
+SELECT event_type, message FROM process_details
+WHERE message_id = ? AND event_type IN ('thinking', 'reasoning_chain', 'planning')
+ORDER BY created_at ASC, rowid ASC`, assistantMessageID)
+	if err != nil {
+		return AssistantCognitionTexts{}, fmt.Errorf("query assistant cognition: %w", err)
+	}
+	defer rows.Close()
+
+	var thinkingParts, reasoningParts, planningParts []string
+	for rows.Next() {
+		var eventType, message string
+		if err := rows.Scan(&eventType, &message); err != nil {
+			continue
+		}
+		msg := strings.TrimSpace(message)
+		if msg == "" {
+			continue
+		}
+		switch eventType {
+		case "thinking":
+			thinkingParts = append(thinkingParts, msg)
+		case "reasoning_chain":
+			reasoningParts = append(reasoningParts, msg)
+		case "planning":
+			planningParts = append(planningParts, msg)
+		}
+	}
+	return AssistantCognitionTexts{
+		Thinking:       strings.Join(thinkingParts, "\n\n"),
+		ReasoningChain: strings.Join(reasoningParts, "\n\n"),
+		Planning:       strings.Join(planningParts, "\n\n"),
+	}, nil
+}
+
 // AddProcessDetail 添加过程详情事件
 func (db *DB) AddProcessDetail(messageID, conversationID, eventType, message string, data interface{}) error {
 	id := uuid.New().String()

internal/database/conversation_cleanup_test.go

@@ -20,7 +20,8 @@ func TestDeleteConversationRemovesEinoScopedDirs(t *testing.T) {
 	plantaskBase := filepath.Join(tmp, "skills", ".eino", "plantask")
 	checkpointBase := filepath.Join(tmp, "eino-checkpoints")
 	reductionBase := filepath.Join(tmp, "reduction")
-	db.SetEinoConversationDirs(plantaskBase, checkpointBase, reductionBase)
+	workspaceBase := filepath.Join(tmp, "workspace")
+	db.SetEinoConversationDirs(plantaskBase, checkpointBase, reductionBase, workspaceBase)
 
 	conv, err := db.CreateConversation("cleanup test", ConversationCreateMeta{})
 	if err != nil {
@@ -36,6 +37,7 @@ func TestDeleteConversationRemovesEinoScopedDirs(t *testing.T) {
 		{plantaskBase, "task-1.json"},
 		{checkpointBase, "runner-deep.ckpt"},
 		{filepath.Join(reductionBase, "conversations"), "tool-output.txt"},
+		{filepath.Join(workspaceBase, "conversations"), "page.html"},
 	} {
 		dir := filepath.Join(base.root, seg)
 		if err := os.MkdirAll(dir, 0o755); err != nil {
@@ -50,7 +52,7 @@ func TestDeleteConversationRemovesEinoScopedDirs(t *testing.T) {
 		t.Fatalf("DeleteConversation: %v", err)
 	}
 
-	for _, base := range []string{db.conversationArtifactsDir, plantaskBase, checkpointBase, filepath.Join(reductionBase, "conversations")} {
+	for _, base := range []string{db.conversationArtifactsDir, plantaskBase, checkpointBase, filepath.Join(reductionBase, "conversations"), filepath.Join(workspaceBase, "conversations")} {
 		dir := filepath.Join(base, seg)
 		if _, statErr := os.Stat(dir); !os.IsNotExist(statErr) {
 			t.Fatalf("expected removed dir %s, stat err=%v", dir, statErr)
@@ -68,7 +70,8 @@ func TestDeleteProjectRemovesReductionDir(t *testing.T) {
 	defer db.Close()
 
 	reductionBase := filepath.Join(tmp, "reduction")
-	db.SetEinoConversationDirs("", "", reductionBase)
+	workspaceBase := filepath.Join(tmp, "workspace")
+	db.SetEinoConversationDirs("", "", reductionBase, workspaceBase)
 
 	project, err := db.CreateProject(&Project{Name: "cleanup test"})
 	if err != nil {
@@ -82,6 +85,13 @@ func TestDeleteProjectRemovesReductionDir(t *testing.T) {
 	if err := os.WriteFile(filepath.Join(reductionDir, "call-1.txt"), []byte("x"), 0o644); err != nil {
 		t.Fatalf("write: %v", err)
 	}
+	workspaceDir := filepath.Join(workspaceBase, "projects", seg, "downloads")
+	if err := os.MkdirAll(workspaceDir, 0o755); err != nil {
+		t.Fatalf("mkdir %s: %v", workspaceDir, err)
+	}
+	if err := os.WriteFile(filepath.Join(workspaceDir, "app.js"), []byte("x"), 0o644); err != nil {
+		t.Fatalf("write workspace: %v", err)
+	}
 
 	if err := db.DeleteProject(project.ID); err != nil {
 		t.Fatalf("DeleteProject: %v", err)
@@ -91,4 +101,8 @@ func TestDeleteProjectRemovesReductionDir(t *testing.T) {
 	if _, statErr := os.Stat(projectReductionDir); !os.IsNotExist(statErr) {
 		t.Fatalf("expected removed dir %s, stat err=%v", projectReductionDir, statErr)
 	}
+	projectWorkspaceDir := filepath.Join(workspaceBase, "projects", seg)
+	if _, statErr := os.Stat(projectWorkspaceDir); !os.IsNotExist(statErr) {
+		t.Fatalf("expected removed dir %s, stat err=%v", projectWorkspaceDir, statErr)
+	}
 }

internal/database/conversation_project_filter_test.go

@@ -0,0 +1,60 @@
+package database
+
+import (
+	"path/filepath"
+	"testing"
+
+	"go.uber.org/zap"
+)
+
+func TestConversationProjectFilter(t *testing.T) {
+	tmp := t.TempDir()
+	dbPath := filepath.Join(tmp, "conversations.db")
+	db, err := NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	defer db.Close()
+
+	p, err := db.CreateProject(&Project{Name: "target-a", Status: "active"})
+	if err != nil {
+		t.Fatalf("CreateProject: %v", err)
+	}
+
+	convNone, err := db.CreateConversation("unbound", ConversationCreateMeta{})
+	if err != nil {
+		t.Fatalf("CreateConversation unbound: %v", err)
+	}
+	convBound, err := db.CreateConversation("bound", ConversationCreateMeta{ProjectID: p.ID})
+	if err != nil {
+		t.Fatalf("CreateConversation bound: %v", err)
+	}
+
+	totalAll, err := db.CountConversations("", "")
+	if err != nil || totalAll < 2 {
+		t.Fatalf("CountConversations all: total=%d err=%v", totalAll, err)
+	}
+
+	totalBound, err := db.CountConversations("", p.ID)
+	if err != nil || totalBound != 1 {
+		t.Fatalf("CountConversations project: total=%d err=%v", totalBound, err)
+	}
+
+	totalUnbound, err := db.CountConversations("", ProjectFilterUnbound)
+	if err != nil || totalUnbound != 1 {
+		t.Fatalf("CountConversations unbound: total=%d err=%v", totalUnbound, err)
+	}
+
+	listBound, err := db.ListConversations(10, 0, "", "", p.ID)
+	if err != nil || len(listBound) != 1 || listBound[0].ID != convBound.ID {
+		t.Fatalf("ListConversations project: %+v err=%v", listBound, err)
+	}
+
+	listUnbound, err := db.ListConversations(10, 0, "", "", ProjectFilterUnbound)
+	if err != nil || len(listUnbound) != 1 || listUnbound[0].ID != convNone.ID {
+		t.Fatalf("ListConversations unbound: %+v err=%v", listUnbound, err)
+	}
+
+	_ = convNone
+	_ = convBound
+}

internal/database/database.go

@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"sync"
 	"strings"
+	"sync"
 	"time"
 
 	_ "github.com/mattn/go-sqlite3"
@@ -52,6 +52,7 @@ type DB struct {
 	einoPlantaskBaseDir      string // skills_dir + plantask_rel_dir (per-conversation subdirs)
 	einoCheckpointBaseDir    string // checkpoint_dir root (per-conversation subdirs)
 	einoReductionRootDir     string // reduction_root_dir or default tmp/reduction (conversations/<id> subdirs)
+	einoWorkspaceRootDir     string // workspace_root_dir or default tmp/workspace (projects|conversations/<id> subdirs)
 	checkpointLoopName       string
 	checkpointStop           chan struct{}
 	checkpointDone           chan struct{}
@@ -161,13 +162,15 @@ func NewDB(dbPath string, logger *zap.Logger) (*DB, error) {
 // SetEinoConversationDirs configures best-effort filesystem cleanup on DeleteConversation.
 // plantaskBase is skills_root/plantask_rel (no conversation id); checkpointBase is checkpoint_dir root.
 // reductionRoot is reduction_root_dir from config; empty uses tmp/reduction (conversation-scoped subdirs only).
-func (db *DB) SetEinoConversationDirs(plantaskBase, checkpointBase, reductionRoot string) {
+// workspaceRoot is agent.workspace_root_dir from config; empty uses tmp/workspace.
+func (db *DB) SetEinoConversationDirs(plantaskBase, checkpointBase, reductionRoot, workspaceRoot string) {
 	if db == nil {
 		return
 	}
 	db.einoPlantaskBaseDir = strings.TrimSpace(plantaskBase)
 	db.einoCheckpointBaseDir = strings.TrimSpace(checkpointBase)
 	db.einoReductionRootDir = strings.TrimSpace(reductionRoot)
+	db.einoWorkspaceRootDir = strings.TrimSpace(workspaceRoot)
 }
 
 // initTables 初始化数据库表
@@ -385,9 +388,12 @@ func (db *DB) initTables() error {
 		status TEXT NOT NULL DEFAULT 'open',
 		vulnerability_type TEXT,
 		target TEXT,
-		proof TEXT,
+		preconditions TEXT,
+		reproduction_steps TEXT,
+		evidence TEXT,
 		impact TEXT,
 		recommendation TEXT,
+		retest_notes TEXT,
 		created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
 		updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
 		project_id TEXT,
@@ -581,6 +587,53 @@ func (db *DB) initTables() error {
 		created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
 	);`
 
+	createWorkflowDefinitionsTable := `
+	CREATE TABLE IF NOT EXISTS workflow_definitions (
+		id TEXT PRIMARY KEY,
+		name TEXT NOT NULL,
+		description TEXT,
+		version INTEGER NOT NULL DEFAULT 1,
+		graph_json TEXT NOT NULL,
+		enabled INTEGER NOT NULL DEFAULT 1,
+		created_at DATETIME NOT NULL,
+		updated_at DATETIME NOT NULL
+	);`
+
+	createWorkflowRunsTable := `
+	CREATE TABLE IF NOT EXISTS workflow_runs (
+		id TEXT PRIMARY KEY,
+		workflow_id TEXT NOT NULL,
+		workflow_version INTEGER NOT NULL DEFAULT 1,
+		conversation_id TEXT,
+		project_id TEXT,
+		role_id TEXT,
+		status TEXT NOT NULL,
+		input_json TEXT,
+		output_json TEXT,
+		error TEXT,
+		pending_hitl_node_id TEXT,
+		pending_hitl_json TEXT,
+		started_at DATETIME NOT NULL,
+		finished_at DATETIME,
+		created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+		FOREIGN KEY (conversation_id) REFERENCES conversations(id) ON DELETE SET NULL
+	);`
+
+	createWorkflowNodeRunsTable := `
+	CREATE TABLE IF NOT EXISTS workflow_node_runs (
+		id TEXT PRIMARY KEY,
+		run_id TEXT NOT NULL,
+		node_id TEXT NOT NULL,
+		status TEXT NOT NULL,
+		input_json TEXT,
+		output_json TEXT,
+		error TEXT,
+		started_at DATETIME NOT NULL,
+		finished_at DATETIME,
+		created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+		FOREIGN KEY (run_id) REFERENCES workflow_runs(id) ON DELETE CASCADE
+	);`
+
 	// 创建索引
 	createIndexes := `
 	CREATE INDEX IF NOT EXISTS idx_messages_conversation_id ON messages(conversation_id);
@@ -639,6 +692,12 @@ func (db *DB) initTables() error {
 	CREATE INDEX IF NOT EXISTS idx_audit_logs_category ON audit_logs(category);
 	CREATE INDEX IF NOT EXISTS idx_audit_logs_action ON audit_logs(action);
 	CREATE INDEX IF NOT EXISTS idx_audit_logs_result ON audit_logs(result);
+	CREATE INDEX IF NOT EXISTS idx_workflow_definitions_updated_at ON workflow_definitions(updated_at);
+	CREATE INDEX IF NOT EXISTS idx_workflow_definitions_enabled ON workflow_definitions(enabled);
+	CREATE INDEX IF NOT EXISTS idx_workflow_runs_workflow ON workflow_runs(workflow_id);
+	CREATE INDEX IF NOT EXISTS idx_workflow_runs_conversation ON workflow_runs(conversation_id);
+	CREATE INDEX IF NOT EXISTS idx_workflow_runs_status ON workflow_runs(status);
+	CREATE INDEX IF NOT EXISTS idx_workflow_node_runs_run ON workflow_node_runs(run_id);
 	`
 
 	if _, err := db.Exec(createConversationsTable); err != nil {
@@ -724,6 +783,16 @@ func (db *DB) initTables() error {
 		return fmt.Errorf("创建audit_logs表失败: %w", err)
 	}
 
+	for tableName, ddl := range map[string]string{
+		"workflow_definitions": createWorkflowDefinitionsTable,
+		"workflow_runs":        createWorkflowRunsTable,
+		"workflow_node_runs":   createWorkflowNodeRunsTable,
+	} {
+		if _, err := db.Exec(ddl); err != nil {
+			return fmt.Errorf("创建%s表失败: %w", tableName, err)
+		}
+	}
+
 	for tableName, ddl := range map[string]string{
 		"c2_listeners": createC2ListenersTable,
 		"c2_sessions":  createC2SessionsTable,
@@ -781,6 +850,9 @@ func (db *DB) initTables() error {
 		db.logger.Warn("迁移webshell_connections表失败", zap.Error(err))
 		// 不返回错误，允许继续运行
 	}
+	if err := db.migrateWorkflowRunsTable(); err != nil {
+		db.logger.Warn("迁移workflow_runs表失败", zap.Error(err))
+	}
 
 	if _, err := db.Exec(createIndexes); err != nil {
 		return fmt.Errorf("创建索引失败: %w", err)
@@ -1221,9 +1293,12 @@ func (db *DB) migrateVulnerabilitiesConversationFK() error {
 		status TEXT NOT NULL DEFAULT 'open',
 		vulnerability_type TEXT,
 		target TEXT,
-		proof TEXT,
+		preconditions TEXT,
+		reproduction_steps TEXT,
+		evidence TEXT,
 		impact TEXT,
 		recommendation TEXT,
+		retest_notes TEXT,
 		created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
 		updated_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
 		project_id TEXT,
@@ -1236,12 +1311,15 @@ func (db *DB) migrateVulnerabilitiesConversationFK() error {
 	const copyRows = `
 	INSERT INTO vulnerabilities_new (
 		id, conversation_id, conversation_tag, task_tag, title, description,
-		severity, status, vulnerability_type, target, proof, impact, recommendation,
+		severity, status, vulnerability_type, target, preconditions, reproduction_steps,
+		evidence, impact, recommendation, retest_notes,
 		created_at, updated_at, project_id
 	)
 	SELECT
 		id, conversation_id, conversation_tag, task_tag, title, description,
-		severity, status, vulnerability_type, target, proof, impact, recommendation,
+		severity, status, vulnerability_type, target,
+		COALESCE(preconditions, ''), COALESCE(reproduction_steps, ''),
+		COALESCE(evidence, ''), impact, recommendation, COALESCE(retest_notes, ''),
 		created_at, updated_at, project_id
 	FROM vulnerabilities;`
 	if _, err := tx.Exec(copyRows); err != nil {
@@ -1312,6 +1390,10 @@ func (db *DB) migrateVulnerabilitiesTable() error {
 		{name: "conversation_tag", stmt: "ALTER TABLE vulnerabilities ADD COLUMN conversation_tag TEXT"},
 		{name: "task_tag", stmt: "ALTER TABLE vulnerabilities ADD COLUMN task_tag TEXT"},
 		{name: "project_id", stmt: "ALTER TABLE vulnerabilities ADD COLUMN project_id TEXT"},
+		{name: "preconditions", stmt: "ALTER TABLE vulnerabilities ADD COLUMN preconditions TEXT"},
+		{name: "reproduction_steps", stmt: "ALTER TABLE vulnerabilities ADD COLUMN reproduction_steps TEXT"},
+		{name: "evidence", stmt: "ALTER TABLE vulnerabilities ADD COLUMN evidence TEXT"},
+		{name: "retest_notes", stmt: "ALTER TABLE vulnerabilities ADD COLUMN retest_notes TEXT"},
 	}
 
 	for _, col := range columns {

internal/database/hitl_logs.go

@@ -0,0 +1,75 @@
+package database
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"go.uber.org/zap"
+)
+
+// DeleteHitlInterruptLogsByIDs deletes decided HITL audit logs by id (pending rows are skipped).
+func (db *DB) DeleteHitlInterruptLogsByIDs(ids []string) (int64, error) {
+	if db == nil {
+		return 0, fmt.Errorf("database is nil")
+	}
+	clean := make([]string, 0, len(ids))
+	for _, id := range ids {
+		id = strings.TrimSpace(id)
+		if id != "" {
+			clean = append(clean, id)
+		}
+	}
+	if len(clean) == 0 {
+		return 0, nil
+	}
+	placeholders := strings.TrimRight(strings.Repeat("?,", len(clean)), ",")
+	q := fmt.Sprintf(`DELETE FROM hitl_interrupts WHERE status != 'pending' AND id IN (%s)`, placeholders)
+	args := make([]interface{}, len(clean))
+	for i, id := range clean {
+		args[i] = id
+	}
+	res, err := db.Exec(q, args...)
+	if err != nil {
+		db.logger.Error("批量删除人机协同审计日志失败", zap.Error(err), zap.Int("count", len(clean)))
+		return 0, fmt.Errorf("批量删除人机协同审计日志失败: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	return n, nil
+}
+
+// DeleteHitlInterruptLogsMatching deletes decided logs matching whereSQL (e.g. "WHERE 1=1 AND status != 'pending' ...").
+func (db *DB) DeleteHitlInterruptLogsMatching(whereSQL string, args []interface{}) (int64, error) {
+	if db == nil {
+		return 0, fmt.Errorf("database is nil")
+	}
+	whereSQL = strings.TrimSpace(whereSQL)
+	if whereSQL == "" {
+		return 0, fmt.Errorf("where clause is required")
+	}
+	q := `DELETE FROM hitl_interrupts ` + whereSQL
+	res, err := db.Exec(q, args...)
+	if err != nil {
+		db.logger.Error("清空人机协同审计日志失败", zap.Error(err))
+		return 0, fmt.Errorf("清空人机协同审计日志失败: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	return n, nil
+}
+
+// PurgeHitlInterruptLogsBefore deletes decided logs with decided/created time before cutoff.
+func (db *DB) PurgeHitlInterruptLogsBefore(cutoff time.Time) (int64, error) {
+	if db == nil {
+		return 0, fmt.Errorf("database is nil")
+	}
+	res, err := db.Exec(
+		`DELETE FROM hitl_interrupts WHERE status != 'pending' AND datetime(COALESCE(decided_at, created_at)) < datetime(?)`,
+		cutoff.UTC().Format(time.RFC3339),
+	)
+	if err != nil {
+		db.logger.Error("清理过期人机协同审计日志失败", zap.Error(err))
+		return 0, fmt.Errorf("清理过期人机协同审计日志失败: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	return n, nil
+}

internal/database/hitl_logs_test.go

@@ -0,0 +1,106 @@
+package database
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"go.uber.org/zap"
+)
+
+func ensureHitlInterruptsTable(t *testing.T, db *DB) {
+	t.Helper()
+	if _, err := db.Exec(`
+CREATE TABLE IF NOT EXISTS hitl_interrupts (
+    id TEXT PRIMARY KEY,
+    conversation_id TEXT NOT NULL,
+    message_id TEXT,
+    mode TEXT NOT NULL,
+    tool_name TEXT NOT NULL,
+    tool_call_id TEXT,
+    payload TEXT,
+    status TEXT NOT NULL,
+    decision TEXT,
+    decision_comment TEXT,
+    created_at DATETIME NOT NULL,
+    decided_at DATETIME
+);`); err != nil {
+		t.Fatalf("create hitl_interrupts: %v", err)
+	}
+}
+
+func TestDeleteHitlInterruptLogsByIDs_skipsPending(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "hitl.db")
+	db, err := NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	defer db.Close()
+	ensureHitlInterruptsTable(t, db)
+
+	now := time.Now().UTC().Format(time.RFC3339)
+	if _, err := db.Exec(`INSERT INTO hitl_interrupts
+		(id, conversation_id, mode, tool_name, status, created_at)
+		VALUES ('pending-1', 'c1', 'approval', 'exec', 'pending', ?)`, now); err != nil {
+		t.Fatalf("insert pending: %v", err)
+	}
+	if _, err := db.Exec(`INSERT INTO hitl_interrupts
+		(id, conversation_id, mode, tool_name, status, decision, created_at, decided_at)
+		VALUES ('done-1', 'c1', 'approval', 'exec', 'decided', 'approve', ?, ?)`, now, now); err != nil {
+		t.Fatalf("insert decided: %v", err)
+	}
+
+	deleted, err := db.DeleteHitlInterruptLogsByIDs([]string{"pending-1", "done-1"})
+	if err != nil {
+		t.Fatalf("DeleteHitlInterruptLogsByIDs: %v", err)
+	}
+	if deleted != 1 {
+		t.Fatalf("deleted = %d, want 1", deleted)
+	}
+
+	var status string
+	if err := db.QueryRow(`SELECT status FROM hitl_interrupts WHERE id = 'pending-1'`).Scan(&status); err != nil {
+		t.Fatalf("pending row missing: %v", err)
+	}
+	if err := db.QueryRow(`SELECT id FROM hitl_interrupts WHERE id = 'done-1'`).Scan(new(string)); err == nil {
+		t.Fatal("decided row should be deleted")
+	}
+}
+
+func TestPurgeHitlInterruptLogsBefore(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "hitl.db")
+	db, err := NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	defer db.Close()
+	ensureHitlInterruptsTable(t, db)
+
+	old := time.Now().AddDate(0, 0, -100).UTC().Format(time.RFC3339)
+	recent := time.Now().AddDate(0, 0, -1).UTC().Format(time.RFC3339)
+	for _, row := range []struct{ id, decided string }{
+		{"old-1", old},
+		{"new-1", recent},
+	} {
+		if _, err := db.Exec(`INSERT INTO hitl_interrupts
+			(id, conversation_id, mode, tool_name, status, decision, created_at, decided_at)
+			VALUES (?, 'c1', 'approval', 'exec', 'decided', 'approve', ?, ?)`, row.id, row.decided, row.decided); err != nil {
+			t.Fatalf("insert %s: %v", row.id, err)
+		}
+	}
+
+	cutoff := time.Now().AddDate(0, 0, -90)
+	deleted, err := db.PurgeHitlInterruptLogsBefore(cutoff)
+	if err != nil {
+		t.Fatalf("PurgeHitlInterruptLogsBefore: %v", err)
+	}
+	if deleted != 1 {
+		t.Fatalf("deleted = %d, want 1", deleted)
+	}
+	if err := db.QueryRow(`SELECT id FROM hitl_interrupts WHERE id = 'old-1'`).Scan(new(string)); err == nil {
+		t.Fatal("old row should be purged")
+	}
+	if err := db.QueryRow(`SELECT id FROM hitl_interrupts WHERE id = 'new-1'`).Scan(new(string)); err != nil {
+		t.Fatalf("new row should remain: %v", err)
+	}
+}

internal/database/monitor.go

@@ -3,7 +3,6 @@ package database
 import (
 	"database/sql"
 	"encoding/json"
-	"sort"
 	"strings"
 	"time"
 
@@ -227,6 +226,167 @@ func (db *DB) LoadToolExecutionsWithPagination(offset, limit int, status, toolNa
 	return executions, nil
 }
 
+func toolExecutionsFilterSQL(status, toolName string) (string, []interface{}) {
+	args := []interface{}{}
+	conditions := []string{}
+	if status != "" {
+		conditions = append(conditions, "status = ?")
+		args = append(args, status)
+	}
+	if toolName != "" {
+		conditions = append(conditions, "LOWER(tool_name) LIKE ?")
+		args = append(args, "%"+strings.ToLower(toolName)+"%")
+	}
+	if len(conditions) == 0 {
+		return "", args
+	}
+	return ` WHERE ` + strings.Join(conditions, ` AND `), args
+}
+
+// ToolStatsSummary 工具调用汇总（全量聚合，不含逐工具明细）
+type ToolStatsSummary struct {
+	TotalCalls   int
+	SuccessCalls int
+	FailedCalls  int
+	LastCallTime *time.Time
+	ToolCount    int
+}
+
+// ToolStatsSummaryResult 汇总 + Top N 工具排行
+type ToolStatsSummaryResult struct {
+	Summary  ToolStatsSummary
+	TopTools []*mcp.ToolStats
+}
+
+// LoadToolStatsSummary 聚合统计信息，仅返回汇总与 Top N 工具（避免全量 map 传输）
+func (db *DB) LoadToolStatsSummary(topN int) (*ToolStatsSummaryResult, error) {
+	if topN <= 0 {
+		topN = 6
+	}
+	if topN > 100 {
+		topN = 100
+	}
+
+	result := &ToolStatsSummaryResult{
+		TopTools: make([]*mcp.ToolStats, 0, topN),
+	}
+
+	summaryQuery := `
+		SELECT COUNT(*),
+			COALESCE(SUM(total_calls), 0),
+			COALESCE(SUM(success_calls), 0),
+			COALESCE(SUM(failed_calls), 0),
+			MAX(last_call_time)
+		FROM tool_stats
+	`
+	var lastCallRaw sql.NullString
+	err := db.QueryRow(summaryQuery).Scan(
+		&result.Summary.ToolCount,
+		&result.Summary.TotalCalls,
+		&result.Summary.SuccessCalls,
+		&result.Summary.FailedCalls,
+		&lastCallRaw,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if lastCallRaw.Valid && strings.TrimSpace(lastCallRaw.String) != "" {
+		if t, parseErr := time.Parse(time.RFC3339Nano, lastCallRaw.String); parseErr == nil {
+			result.Summary.LastCallTime = &t
+		} else if t, parseErr := time.Parse("2006-01-02 15:04:05.999999999-07:00", lastCallRaw.String); parseErr == nil {
+			result.Summary.LastCallTime = &t
+		} else if t, parseErr := time.Parse("2006-01-02 15:04:05", lastCallRaw.String); parseErr == nil {
+			result.Summary.LastCallTime = &t
+		}
+	}
+
+	topQuery := `
+		SELECT tool_name, total_calls, success_calls, failed_calls, last_call_time
+		FROM tool_stats
+		WHERE total_calls > 0
+		ORDER BY total_calls DESC, tool_name ASC
+		LIMIT ?
+	`
+	rows, err := db.Query(topQuery, topN)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		var stat mcp.ToolStats
+		var lastCallTime sql.NullTime
+		if err := rows.Scan(
+			&stat.ToolName,
+			&stat.TotalCalls,
+			&stat.SuccessCalls,
+			&stat.FailedCalls,
+			&lastCallTime,
+		); err != nil {
+			db.logger.Warn("加载 Top 工具统计失败", zap.Error(err))
+			continue
+		}
+		if lastCallTime.Valid {
+			stat.LastCallTime = &lastCallTime.Time
+		}
+		result.TopTools = append(result.TopTools, &stat)
+	}
+
+	return result, nil
+}
+
+// LoadToolExecutionListPage 分页加载执行记录列表（不含 arguments/result，供监控列表使用）
+func (db *DB) LoadToolExecutionListPage(offset, limit int, status, toolName string) ([]*mcp.ToolExecution, error) {
+	if limit <= 0 {
+		limit = 20
+	}
+	if limit > 100 {
+		limit = 100
+	}
+
+	query := `
+		SELECT id, tool_name, status, start_time, end_time, duration_ms
+		FROM tool_executions
+	`
+	whereSQL, args := toolExecutionsFilterSQL(status, toolName)
+	query += whereSQL + ` ORDER BY start_time DESC LIMIT ? OFFSET ?`
+	args = append(args, limit, offset)
+
+	rows, err := db.Query(query, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	executions := make([]*mcp.ToolExecution, 0, limit)
+	for rows.Next() {
+		var exec mcp.ToolExecution
+		var endTime sql.NullTime
+		var durationMs sql.NullInt64
+
+		if err := rows.Scan(
+			&exec.ID,
+			&exec.ToolName,
+			&exec.Status,
+			&exec.StartTime,
+			&endTime,
+			&durationMs,
+		); err != nil {
+			db.logger.Warn("加载执行记录列表失败", zap.Error(err))
+			continue
+		}
+		if endTime.Valid {
+			exec.EndTime = &endTime.Time
+		}
+		if durationMs.Valid {
+			exec.Duration = time.Duration(durationMs.Int64) * time.Millisecond
+		}
+		executions = append(executions, &exec)
+	}
+
+	return executions, nil
+}
+
 // GetToolExecution 根据ID获取单条工具执行记录
 func (db *DB) GetToolExecution(id string) (*mcp.ToolExecution, error) {
 	query := `
@@ -288,6 +448,93 @@ func (db *DB) GetToolExecution(id string) (*mcp.ToolExecution, error) {
 	return &exec, nil
 }
 
+// CancelOrphanedRunningToolExecutions 将仍为 running 的记录批量标记为 cancelled（如进程重启后无对应执行协程）。
+func (db *DB) CancelOrphanedRunningToolExecutions(endTime time.Time, errMsg string) (int64, error) {
+	errMsg = strings.TrimSpace(errMsg)
+	if errMsg == "" {
+		errMsg = "执行已中断（服务重启或会话结束）"
+	}
+	query := `
+		UPDATE tool_executions
+		SET status = 'cancelled',
+		    error = ?,
+		    end_time = ?,
+		    duration_ms = MAX(0, CAST((julianday(?) - julianday(start_time)) * 86400000 AS INTEGER))
+		WHERE status = 'running'
+	`
+	res, err := db.Exec(query, errMsg, endTime, endTime)
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
+// FinalizeStaleRunningToolExecutions 将「非活跃且超过 minAge」的 running 记录标记为 cancelled。
+// activeIDs 为当前进程内仍登记 cancel 的 executionId；不在集合内且已超时的视为孤儿记录。
+func (db *DB) FinalizeStaleRunningToolExecutions(endTime time.Time, minAge time.Duration, activeIDs map[string]struct{}, errMsg string) (int64, error) {
+	errMsg = strings.TrimSpace(errMsg)
+	if errMsg == "" {
+		errMsg = "执行已中断（会话已结束）"
+	}
+	if minAge < 0 {
+		minAge = 0
+	}
+	cutoff := endTime.Add(-minAge)
+	rows, err := db.Query(`
+		SELECT id, start_time FROM tool_executions
+		WHERE status = 'running' AND start_time <= ?
+	`, cutoff)
+	if err != nil {
+		return 0, err
+	}
+	defer rows.Close()
+
+	type staleRow struct {
+		id        string
+		startTime time.Time
+	}
+	var stale []staleRow
+	for rows.Next() {
+		var row staleRow
+		if err := rows.Scan(&row.id, &row.startTime); err != nil {
+			db.logger.Warn("读取 stale running 执行记录失败", zap.Error(err))
+			continue
+		}
+		if activeIDs != nil {
+			if _, active := activeIDs[row.id]; active {
+				continue
+			}
+		}
+		stale = append(stale, row)
+	}
+	if err := rows.Err(); err != nil {
+		return 0, err
+	}
+	if len(stale) == 0 {
+		return 0, nil
+	}
+
+	var affected int64
+	for _, row := range stale {
+		durationMs := endTime.Sub(row.startTime).Milliseconds()
+		if durationMs < 0 {
+			durationMs = 0
+		}
+		res, err := db.Exec(`
+			UPDATE tool_executions
+			SET status = 'cancelled', error = ?, end_time = ?, duration_ms = ?
+			WHERE id = ? AND status = 'running'
+		`, errMsg, endTime, durationMs, row.id)
+		if err != nil {
+			db.logger.Warn("更新 stale running 执行记录失败", zap.Error(err), zap.String("executionId", row.id))
+			continue
+		}
+		n, _ := res.RowsAffected()
+		affected += n
+	}
+	return affected, nil
+}
+
 // DeleteToolExecution 删除工具执行记录
 func (db *DB) DeleteToolExecution(id string) error {
 	query := `DELETE FROM tool_executions WHERE id = ?`
@@ -600,13 +847,28 @@ func truncateCallsTimelineBucket(t time.Time, dailyBuckets bool) time.Time {
 
 // LoadCallsTimeline 按时间范围加载调用趋势（since 起至今，含边界）
 func (db *DB) LoadCallsTimeline(since time.Time, dailyBuckets bool) ([]CallsTimelineBucket, error) {
-	// 在 Go 侧按本地时区分桶，避免 SQLite strftime 对 UTC 存储时间分桶后再误当本地时间解析（差 8h 等问题）
-	query := `
-		SELECT start_time,
-			CASE WHEN status IN ('failed', 'cancelled') THEN 1 ELSE 0 END AS failed
-		FROM tool_executions
-		WHERE start_time >= ?
-	`
+	var query string
+	if dailyBuckets {
+		query = `
+			SELECT date(start_time, 'localtime') AS bucket,
+				COUNT(*) AS total,
+				SUM(CASE WHEN status IN ('failed', 'cancelled') THEN 1 ELSE 0 END) AS failed
+			FROM tool_executions
+			WHERE start_time >= ?
+			GROUP BY bucket
+			ORDER BY bucket
+		`
+	} else {
+		query = `
+			SELECT strftime('%Y-%m-%d %H:00:00', start_time, 'localtime') AS bucket,
+				COUNT(*) AS total,
+				SUM(CASE WHEN status IN ('failed', 'cancelled') THEN 1 ELSE 0 END) AS failed
+			FROM tool_executions
+			WHERE start_time >= ?
+			GROUP BY bucket
+			ORDER BY bucket
+		`
+	}
 
 	rows, err := db.Query(query, since)
 	if err != nil {
@@ -614,35 +876,35 @@ func (db *DB) LoadCallsTimeline(since time.Time, dailyBuckets bool) ([]CallsTime
 	}
 	defer rows.Close()
 
-	bucketMap := make(map[time.Time]struct{ total, failed int })
+	buckets := make([]CallsTimelineBucket, 0)
 	for rows.Next() {
-		var startTime time.Time
-		var failed int
-		if err := rows.Scan(&startTime, &failed); err != nil {
+		var bucketStr string
+		var total, failed int
+		if err := rows.Scan(&bucketStr, &total, &failed); err != nil {
 			db.logger.Warn("加载调用趋势失败", zap.Error(err))
 			continue
 		}
-		key := truncateCallsTimelineBucket(startTime, dailyBuckets)
-		entry := bucketMap[key]
-		entry.total++
-		entry.failed += failed
-		bucketMap[key] = entry
-	}
-
-	buckets := make([]CallsTimelineBucket, 0, len(bucketMap))
-	for bucketTime, counts := range bucketMap {
+		bucketTime, err := parseCallsTimelineBucket(bucketStr, dailyBuckets)
+		if err != nil {
+			db.logger.Warn("解析调用趋势时间桶失败", zap.Error(err), zap.String("bucket", bucketStr))
+			continue
+		}
 		buckets = append(buckets, CallsTimelineBucket{
 			BucketTime: bucketTime,
-			Total:      counts.total,
-			Failed:     counts.failed,
+			Total:      total,
+			Failed:     failed,
 		})
 	}
-	sort.Slice(buckets, func(i, j int) bool {
-		return buckets[i].BucketTime.Before(buckets[j].BucketTime)
-	})
 	return buckets, nil
 }
 
+func parseCallsTimelineBucket(bucketStr string, dailyBuckets bool) (time.Time, error) {
+	if dailyBuckets {
+		return time.ParseInLocation("2006-01-02", bucketStr, time.Local)
+	}
+	return time.ParseInLocation("2006-01-02 15:04:05", bucketStr, time.Local)
+}
+
 // DecreaseToolStats 减少工具统计信息（用于删除执行记录时）
 // 如果统计信息变为0，则删除该统计记录
 func (db *DB) DecreaseToolStats(toolName string, totalCalls, successCalls, failedCalls int) error {

internal/database/monitor_reconcile_test.go

@@ -0,0 +1,102 @@
+package database
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"cyberstrike-ai/internal/mcp"
+
+	"go.uber.org/zap"
+)
+
+func TestCancelOrphanedRunningToolExecutions(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "monitor.db")
+	db, err := NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	defer db.Close()
+
+	start := time.Now().Add(-2 * time.Hour)
+	exec := &mcp.ToolExecution{
+		ID:        "orphan-hydra",
+		ToolName:  "hydra",
+		Arguments: map[string]interface{}{"target": "127.0.0.1"},
+		Status:    "running",
+		StartTime: start,
+	}
+	if err := db.SaveToolExecution(exec); err != nil {
+		t.Fatalf("SaveToolExecution: %v", err)
+	}
+
+	end := time.Now()
+	n, err := db.CancelOrphanedRunningToolExecutions(end, "执行已中断（服务重启）")
+	if err != nil {
+		t.Fatalf("CancelOrphanedRunningToolExecutions: %v", err)
+	}
+	if n != 1 {
+		t.Fatalf("expected 1 row updated, got %d", n)
+	}
+
+	got, err := db.GetToolExecution("orphan-hydra")
+	if err != nil {
+		t.Fatalf("GetToolExecution: %v", err)
+	}
+	if got.Status != "cancelled" {
+		t.Fatalf("expected cancelled, got %s", got.Status)
+	}
+	if got.EndTime == nil {
+		t.Fatal("expected end_time to be set")
+	}
+	if got.Duration <= 0 {
+		t.Fatalf("expected positive duration, got %v", got.Duration)
+	}
+}
+
+func TestFinalizeStaleRunningToolExecutions_skipsActive(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "monitor.db")
+	db, err := NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	defer db.Close()
+
+	now := time.Now()
+	oldStart := now.Add(-5 * time.Minute)
+	if err := db.SaveToolExecution(&mcp.ToolExecution{
+		ID: "stale", ToolName: "hydra", Status: "running", StartTime: oldStart,
+	}); err != nil {
+		t.Fatalf("SaveToolExecution stale: %v", err)
+	}
+	if err := db.SaveToolExecution(&mcp.ToolExecution{
+		ID: "active", ToolName: "hydra", Status: "running", StartTime: oldStart,
+	}); err != nil {
+		t.Fatalf("SaveToolExecution active: %v", err)
+	}
+
+	active := map[string]struct{}{"active": {}}
+	n, err := db.FinalizeStaleRunningToolExecutions(now, time.Minute, active, "执行已中断（会话已结束）")
+	if err != nil {
+		t.Fatalf("FinalizeStaleRunningToolExecutions: %v", err)
+	}
+	if n != 1 {
+		t.Fatalf("expected 1 stale row updated, got %d", n)
+	}
+
+	stale, err := db.GetToolExecution("stale")
+	if err != nil {
+		t.Fatalf("GetToolExecution stale: %v", err)
+	}
+	if stale.Status != "cancelled" {
+		t.Fatalf("stale expected cancelled, got %s", stale.Status)
+	}
+
+	activeExec, err := db.GetToolExecution("active")
+	if err != nil {
+		t.Fatalf("GetToolExecution active: %v", err)
+	}
+	if activeExec.Status != "running" {
+		t.Fatalf("active expected running, got %s", activeExec.Status)
+	}
+}

internal/database/monitor_summary_test.go

@@ -0,0 +1,86 @@
+package database
+
+import (
+	"fmt"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"cyberstrike-ai/internal/mcp"
+
+	"go.uber.org/zap"
+)
+
+func TestLoadToolStatsSummaryAndListPage(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "monitor-summary.db")
+	db, err := NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	defer db.Close()
+
+	now := time.Now()
+	tools := []struct {
+		name   string
+		calls  int
+		ok     int
+		fail   int
+		result string
+	}{
+		{"alpha::run", 10, 9, 1, `{"content":[{"type":"text","text":"` + string(make([]byte, 64*1024)) + `"}]}`},
+		{"beta::scan", 5, 5, 0, `{"content":[{"type":"text","text":"ok"}]}`},
+		{"gamma::ping", 1, 1, 0, `{"content":[{"type":"text","text":"pong"}]}`},
+	}
+
+	for _, tool := range tools {
+		if err := db.UpdateToolStats(tool.name, tool.calls, tool.ok, tool.fail, &now); err != nil {
+			t.Fatalf("UpdateToolStats(%s): %v", tool.name, err)
+		}
+		for j := 0; j < tool.calls; j++ {
+			exec := &mcp.ToolExecution{
+				ID:        fmt.Sprintf("%s-exec-%d", tool.name, j),
+				ToolName:  tool.name,
+				Arguments: map[string]interface{}{"n": j},
+				Status:    "completed",
+				StartTime: now.Add(-time.Duration(j) * time.Minute),
+				Result:    &mcp.ToolResult{Content: []mcp.Content{{Type: "text", Text: tool.result}}},
+			}
+			end := exec.StartTime.Add(time.Second)
+			exec.EndTime = &end
+			exec.Duration = time.Second
+			if err := db.SaveToolExecution(exec); err != nil {
+				t.Fatalf("SaveToolExecution: %v", err)
+			}
+		}
+	}
+
+	summary, err := db.LoadToolStatsSummary(2)
+	if err != nil {
+		t.Fatalf("LoadToolStatsSummary: %v", err)
+	}
+	if summary.Summary.ToolCount != 3 {
+		t.Fatalf("toolCount = %d, want 3", summary.Summary.ToolCount)
+	}
+	if summary.Summary.TotalCalls != 16 {
+		t.Fatalf("totalCalls = %d, want 16", summary.Summary.TotalCalls)
+	}
+	if len(summary.TopTools) != 2 {
+		t.Fatalf("top tools = %d, want 2", len(summary.TopTools))
+	}
+	if summary.TopTools[0].ToolName != "alpha::run" {
+		t.Fatalf("top tool = %q, want alpha::run", summary.TopTools[0].ToolName)
+	}
+
+	list, err := db.LoadToolExecutionListPage(0, 5, "", "")
+	if err != nil {
+		t.Fatalf("LoadToolExecutionListPage: %v", err)
+	}
+	if len(list) != 5 {
+		t.Fatalf("list len = %d, want 5", len(list))
+	}
+	for _, exec := range list {
+		if exec.Arguments != nil || exec.Result != nil || exec.Error != "" {
+			t.Fatalf("expected lite execution row, got args/result/error on %s", exec.ID)
+		}
+	}
+}

internal/database/project.go

@@ -111,19 +111,43 @@ func (db *DB) GetProject(id string) (*Project, error) {
 	return &p, nil
 }
 
-// CountProjects 统计项目数量。
-func (db *DB) CountProjects(status, search string) (int, error) {
-	query := `SELECT COUNT(*) FROM projects WHERE 1=1`
-	args := []interface{}{}
+func projectListSearchPattern(q string) string {
+	q = strings.TrimSpace(q)
+	if q == "" {
+		return ""
+	}
+	var b strings.Builder
+	b.WriteByte('%')
+	for _, r := range q {
+		switch r {
+		case '%', '_', '\\':
+			b.WriteByte('\\')
+			b.WriteRune(r)
+		default:
+			b.WriteRune(r)
+		}
+	}
+	b.WriteByte('%')
+	return b.String()
+}
+
+func appendProjectListFilters(query string, args []interface{}, status, search string) (string, []interface{}) {
 	if s := strings.TrimSpace(status); s != "" {
 		query += " AND status = ?"
 		args = append(args, s)
 	}
-	if q := strings.TrimSpace(search); q != "" {
-		pattern := "%" + q + "%"
-		query += " AND (name LIKE ? OR COALESCE(description,'') LIKE ?)"
-		args = append(args, pattern, pattern)
+	if pattern := projectListSearchPattern(search); pattern != "" {
+		query += ` AND (LOWER(name) LIKE LOWER(?) ESCAPE '\' OR LOWER(COALESCE(description,'')) LIKE LOWER(?) ESCAPE '\' OR LOWER(id) LIKE LOWER(?) ESCAPE '\')`
+		args = append(args, pattern, pattern, pattern)
 	}
+	return query, args
+}
+
+// CountProjects 统计项目数量。
+func (db *DB) CountProjects(status, search string) (int, error) {
+	query := `SELECT COUNT(*) FROM projects WHERE 1=1`
+	args := []interface{}{}
+	query, args = appendProjectListFilters(query, args, status, search)
 	var count int
 	if err := db.QueryRow(query, args...).Scan(&count); err != nil {
 		return 0, fmt.Errorf("统计项目失败: %w", err)
@@ -139,15 +163,7 @@ func (db *DB) ListProjects(status, search string, limit, offset int) ([]*Project
 	query := `SELECT id, name, COALESCE(description,''), COALESCE(scope_json,''), status, pinned, created_at, updated_at
 		FROM projects WHERE 1=1`
 	args := []interface{}{}
-	if s := strings.TrimSpace(status); s != "" {
-		query += " AND status = ?"
-		args = append(args, s)
-	}
-	if q := strings.TrimSpace(search); q != "" {
-		pattern := "%" + q + "%"
-		query += " AND (name LIKE ? OR COALESCE(description,'') LIKE ?)"
-		args = append(args, pattern, pattern)
-	}
+	query, args = appendProjectListFilters(query, args, status, search)
 	query += " ORDER BY pinned DESC, updated_at DESC LIMIT ? OFFSET ?"
 	args = append(args, limit, offset)
 

internal/database/project_search_test.go

@@ -0,0 +1,82 @@
+package database
+
+import (
+	"path/filepath"
+	"testing"
+
+	"go.uber.org/zap"
+)
+
+func TestListProjectsSearchCaseInsensitive(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "projects-search.db")
+	db, err := NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+
+	p1, err := db.CreateProject(&Project{Name: "Alpha Security Review", Status: "active"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	p2, err := db.CreateProject(&Project{Name: "beta-scan", Status: "active"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.CreateProject(&Project{Name: "Other", Status: "archived"}); err != nil {
+		t.Fatal(err)
+	}
+
+	cases := []struct {
+		name   string
+		search string
+		status string
+		want   []string
+	}{
+		{name: "case insensitive name", search: "alpha", status: "active", want: []string{p1.ID}},
+		{name: "upper query", search: "BETA", status: "active", want: []string{p2.ID}},
+		{name: "search by id substring", search: p1.ID[:8], status: "", want: []string{p1.ID}},
+		{name: "status filter", search: "alpha", status: "archived", want: nil},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			list, err := db.ListProjects(tc.status, tc.search, 50, 0)
+			if err != nil {
+				t.Fatal(err)
+			}
+			got := make([]string, 0, len(list))
+			for _, p := range list {
+				got = append(got, p.ID)
+			}
+			if len(got) != len(tc.want) {
+				t.Fatalf("got %v want %v", got, tc.want)
+			}
+			for i := range got {
+				if got[i] != tc.want[i] {
+					t.Fatalf("got %v want %v", got, tc.want)
+				}
+			}
+		})
+	}
+}
+
+func TestProjectListSearchPatternEscapesWildcards(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "projects-like.db")
+	db, err := NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+
+	p, err := db.CreateProject(&Project{Name: "100% coverage", Status: "active"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	list, err := db.ListProjects("active", "100%", 50, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(list) != 1 || list[0].ID != p.ID {
+		t.Fatalf("expected exact match for literal %% query, got %#v", list)
+	}
+}

internal/database/vulnerability.go

@@ -72,14 +72,17 @@ func (f VulnerabilityListFilter) appendWhere(query string, args []interface{}) (
 			LOWER(COALESCE(description, '')) LIKE LOWER(?) OR
 			LOWER(COALESCE(vulnerability_type, '')) LIKE LOWER(?) OR
 			LOWER(COALESCE(target, '')) LIKE LOWER(?) OR
-			LOWER(COALESCE(proof, '')) LIKE LOWER(?) OR
+			LOWER(COALESCE(preconditions, '')) LIKE LOWER(?) OR
+			LOWER(COALESCE(reproduction_steps, '')) LIKE LOWER(?) OR
+			LOWER(COALESCE(evidence, '')) LIKE LOWER(?) OR
 			LOWER(COALESCE(impact, '')) LIKE LOWER(?) OR
 			LOWER(COALESCE(recommendation, '')) LIKE LOWER(?) OR
+			LOWER(COALESCE(retest_notes, '')) LIKE LOWER(?) OR
 			LOWER(COALESCE(conversation_id, '')) LIKE LOWER(?) OR
 			LOWER(COALESCE(conversation_tag, '')) LIKE LOWER(?) OR
 			LOWER(COALESCE(task_tag, '')) LIKE LOWER(?)
 		)`
-		for i := 0; i < 11; i++ {
+		for i := 0; i < 14; i++ {
 			args = append(args, pattern)
 		}
 	}
@@ -101,9 +104,12 @@ type Vulnerability struct {
 	Status          string    `json:"status"`   // open, confirmed, fixed, false_positive, ignored
 	Type            string    `json:"type"`
 	Target          string    `json:"target"`
-	Proof           string    `json:"proof"`
+	Preconditions   string    `json:"preconditions"`
+	ReproSteps      string    `json:"reproduction_steps"`
+	Evidence        string    `json:"evidence"`
 	Impact          string    `json:"impact"`
 	Recommendation  string    `json:"recommendation"`
+	RetestNotes     string    `json:"retest_notes"`
 	CreatedAt       time.Time `json:"created_at"`
 	UpdatedAt       time.Time `json:"updated_at"`
 }
@@ -131,16 +137,16 @@ func (db *DB) CreateVulnerability(vuln *Vulnerability) (*Vulnerability, error) {
 	query := `
 		INSERT INTO vulnerabilities (
 			id, conversation_id, project_id, conversation_tag, task_tag, title, description, severity, status,
-			vulnerability_type, target, proof, impact, recommendation,
+			vulnerability_type, target, preconditions, reproduction_steps, evidence, impact, recommendation, retest_notes,
 			created_at, updated_at
-		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 	`
 
 	_, err := db.Exec(
 		query,
 		vuln.ID, nullIfEmpty(vuln.ConversationID), nullIfEmpty(vuln.ProjectID), vuln.ConversationTag, vuln.TaskTag, vuln.Title, vuln.Description,
 		vuln.Severity, vuln.Status, vuln.Type, vuln.Target,
-		vuln.Proof, vuln.Impact, vuln.Recommendation,
+		vuln.Preconditions, vuln.ReproSteps, vuln.Evidence, vuln.Impact, vuln.Recommendation, vuln.RetestNotes,
 		vuln.CreatedAt, vuln.UpdatedAt,
 	)
 	if err != nil {
@@ -155,7 +161,9 @@ func (db *DB) GetVulnerability(id string) (*Vulnerability, error) {
 	var vuln Vulnerability
 	query := `
 		SELECT id, COALESCE(conversation_id,''), COALESCE(project_id,''), title, description, severity, status,
-		       conversation_tag, task_tag, vulnerability_type, target, proof, impact, recommendation,
+		       conversation_tag, task_tag, vulnerability_type, target,
+		       COALESCE(preconditions,''), COALESCE(reproduction_steps,''), COALESCE(evidence,''),
+		       impact, recommendation, COALESCE(retest_notes,''),
 		       COALESCE((SELECT bt.id FROM batch_tasks bt WHERE bt.conversation_id = vulnerabilities.conversation_id LIMIT 1), '') AS task_id,
 		       COALESCE((SELECT bt.queue_id FROM batch_tasks bt WHERE bt.conversation_id = vulnerabilities.conversation_id LIMIT 1), '') AS task_queue_id,
 		       created_at, updated_at
@@ -166,7 +174,7 @@ func (db *DB) GetVulnerability(id string) (*Vulnerability, error) {
 	err := db.QueryRow(query, id).Scan(
 		&vuln.ID, &vuln.ConversationID, &vuln.ProjectID, &vuln.Title, &vuln.Description,
 		&vuln.Severity, &vuln.Status, &vuln.ConversationTag, &vuln.TaskTag, &vuln.Type, &vuln.Target,
-		&vuln.Proof, &vuln.Impact, &vuln.Recommendation,
+		&vuln.Preconditions, &vuln.ReproSteps, &vuln.Evidence, &vuln.Impact, &vuln.Recommendation, &vuln.RetestNotes,
 		&vuln.TaskID, &vuln.TaskQueueID,
 		&vuln.CreatedAt, &vuln.UpdatedAt,
 	)
@@ -184,7 +192,9 @@ func (db *DB) GetVulnerability(id string) (*Vulnerability, error) {
 func (db *DB) ListVulnerabilities(limit, offset int, filter VulnerabilityListFilter) ([]*Vulnerability, error) {
 	query := `
 		SELECT id, COALESCE(conversation_id,''), COALESCE(project_id,''), title, description, severity, status, conversation_tag, task_tag,
-		       vulnerability_type, target, proof, impact, recommendation,
+		       vulnerability_type, target,
+		       COALESCE(preconditions,''), COALESCE(reproduction_steps,''), COALESCE(evidence,''),
+		       impact, recommendation, COALESCE(retest_notes,''),
 		       COALESCE((SELECT bt.id FROM batch_tasks bt WHERE bt.conversation_id = vulnerabilities.conversation_id LIMIT 1), '') AS task_id,
 		       COALESCE((SELECT bt.queue_id FROM batch_tasks bt WHERE bt.conversation_id = vulnerabilities.conversation_id LIMIT 1), '') AS task_queue_id,
 		       created_at, updated_at
@@ -209,7 +219,7 @@ func (db *DB) ListVulnerabilities(limit, offset int, filter VulnerabilityListFil
 		err := rows.Scan(
 			&vuln.ID, &vuln.ConversationID, &vuln.ProjectID, &vuln.Title, &vuln.Description,
 			&vuln.Severity, &vuln.Status, &vuln.ConversationTag, &vuln.TaskTag, &vuln.Type, &vuln.Target,
-			&vuln.Proof, &vuln.Impact, &vuln.Recommendation,
+			&vuln.Preconditions, &vuln.ReproSteps, &vuln.Evidence, &vuln.Impact, &vuln.Recommendation, &vuln.RetestNotes,
 			&vuln.TaskID, &vuln.TaskQueueID,
 			&vuln.CreatedAt, &vuln.UpdatedAt,
 		)
@@ -245,16 +255,16 @@ func (db *DB) UpdateVulnerability(id string, vuln *Vulnerability) error {
 	query := `
 		UPDATE vulnerabilities
 		SET project_id = ?, conversation_tag = ?, task_tag = ?, title = ?, description = ?, severity = ?, status = ?,
-		    vulnerability_type = ?, target = ?, proof = ?, impact = ?,
-		    recommendation = ?, updated_at = ?
+		    vulnerability_type = ?, target = ?, preconditions = ?, reproduction_steps = ?, evidence = ?, impact = ?,
+		    recommendation = ?, retest_notes = ?, updated_at = ?
 		WHERE id = ?
 	`
 
 	_, err := db.Exec(
 		query,
 		nullIfEmpty(vuln.ProjectID), vuln.ConversationTag, vuln.TaskTag, vuln.Title, vuln.Description, vuln.Severity, vuln.Status,
-		vuln.Type, vuln.Target, vuln.Proof, vuln.Impact,
-		vuln.Recommendation, vuln.UpdatedAt, id,
+		vuln.Type, vuln.Target, vuln.Preconditions, vuln.ReproSteps, vuln.Evidence, vuln.Impact,
+		vuln.Recommendation, vuln.RetestNotes, vuln.UpdatedAt, id,
 	)
 	if err != nil {
 		return fmt.Errorf("更新漏洞失败: %w", err)

internal/database/workflow.go

@@ -0,0 +1,424 @@
+package database
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+)
+
+// WorkflowDefinition is a persisted user-defined graph/workflow template.
+// graph_json intentionally remains opaque so users can define their own fields.
+type WorkflowDefinition struct {
+	ID          string    `json:"id"`
+	Name        string    `json:"name"`
+	Description string    `json:"description,omitempty"`
+	Version     int       `json:"version"`
+	GraphJSON   string    `json:"graph_json"`
+	Enabled     bool      `json:"enabled"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
+type WorkflowRun struct {
+	ID              string     `json:"id"`
+	WorkflowID      string     `json:"workflow_id"`
+	WorkflowVersion int        `json:"workflow_version"`
+	ConversationID  string     `json:"conversation_id,omitempty"`
+	ProjectID       string     `json:"project_id,omitempty"`
+	RoleID          string     `json:"role_id,omitempty"`
+	Status          string     `json:"status"`
+	InputJSON       string     `json:"input_json,omitempty"`
+	OutputJSON      string     `json:"output_json,omitempty"`
+	Error           string     `json:"error,omitempty"`
+	PendingHITLNodeID string   `json:"pending_hitl_node_id,omitempty"`
+	PendingHITLJSON   string   `json:"pending_hitl_json,omitempty"`
+	StartedAt       time.Time  `json:"started_at"`
+	FinishedAt      *time.Time `json:"finished_at,omitempty"`
+}
+
+type WorkflowNodeRun struct {
+	ID         string     `json:"id"`
+	RunID      string     `json:"run_id"`
+	NodeID     string     `json:"node_id"`
+	Status     string     `json:"status"`
+	InputJSON  string     `json:"input_json,omitempty"`
+	OutputJSON string     `json:"output_json,omitempty"`
+	Error      string     `json:"error,omitempty"`
+	StartedAt  time.Time  `json:"started_at"`
+	FinishedAt *time.Time `json:"finished_at,omitempty"`
+}
+
+func scanWorkflowDefinition(scanner interface {
+	Scan(dest ...interface{}) error
+}) (*WorkflowDefinition, error) {
+	var row WorkflowDefinition
+	var desc sql.NullString
+	var enabled int
+	if err := scanner.Scan(&row.ID, &row.Name, &desc, &row.Version, &row.GraphJSON, &enabled, &row.CreatedAt, &row.UpdatedAt); err != nil {
+		return nil, err
+	}
+	row.Description = desc.String
+	row.Enabled = enabled != 0
+	return &row, nil
+}
+
+const workflowDefinitionColumns = `id, name, description, version, graph_json, enabled, created_at, updated_at`
+
+func (db *DB) ListWorkflowDefinitions(includeDisabled bool) ([]*WorkflowDefinition, error) {
+	query := "SELECT " + workflowDefinitionColumns + " FROM workflow_definitions"
+	if !includeDisabled {
+		query += " WHERE enabled = 1"
+	}
+	query += " ORDER BY updated_at DESC"
+	rows, err := db.Query(query)
+	if err != nil {
+		return nil, fmt.Errorf("查询工作流列表失败: %w", err)
+	}
+	defer rows.Close()
+
+	var out []*WorkflowDefinition
+	for rows.Next() {
+		wf, err := scanWorkflowDefinition(rows)
+		if err != nil {
+			return nil, fmt.Errorf("扫描工作流失败: %w", err)
+		}
+		out = append(out, wf)
+	}
+	return out, rows.Err()
+}
+
+func (db *DB) GetWorkflowDefinition(id string) (*WorkflowDefinition, error) {
+	id = strings.TrimSpace(id)
+	if id == "" {
+		return nil, nil
+	}
+	wf, err := scanWorkflowDefinition(db.QueryRow("SELECT "+workflowDefinitionColumns+" FROM workflow_definitions WHERE id = ?", id))
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("查询工作流失败: %w", err)
+	}
+	return wf, nil
+}
+
+func (db *DB) UpsertWorkflowDefinition(wf *WorkflowDefinition) error {
+	if wf == nil {
+		return fmt.Errorf("工作流为空")
+	}
+	wf.ID = strings.TrimSpace(wf.ID)
+	wf.Name = strings.TrimSpace(wf.Name)
+	if wf.ID == "" || wf.Name == "" {
+		return fmt.Errorf("工作流 id 和 name 不能为空")
+	}
+	if strings.TrimSpace(wf.GraphJSON) == "" {
+		wf.GraphJSON = `{"nodes":[],"edges":[],"config":{}}`
+	}
+	if wf.Version <= 0 {
+		wf.Version = 1
+	}
+	now := time.Now()
+	existing, err := db.GetWorkflowDefinition(wf.ID)
+	if err != nil {
+		return err
+	}
+	if existing == nil {
+		_, err = db.Exec(
+			`INSERT INTO workflow_definitions (id, name, description, version, graph_json, enabled, created_at, updated_at)
+			 VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+			wf.ID, wf.Name, wf.Description, wf.Version, wf.GraphJSON, boolToInt(wf.Enabled), now, now,
+		)
+	} else {
+		nextVersion := existing.Version + 1
+		if wf.Version > existing.Version {
+			nextVersion = wf.Version
+		}
+		_, err = db.Exec(
+			`UPDATE workflow_definitions
+			 SET name = ?, description = ?, version = ?, graph_json = ?, enabled = ?, updated_at = ?
+			 WHERE id = ?`,
+			wf.Name, wf.Description, nextVersion, wf.GraphJSON, boolToInt(wf.Enabled), now, wf.ID,
+		)
+	}
+	if err != nil {
+		return fmt.Errorf("保存工作流失败: %w", err)
+	}
+	return nil
+}
+
+func (db *DB) DeleteWorkflowDefinition(id string) error {
+	id = strings.TrimSpace(id)
+	if id == "" {
+		return fmt.Errorf("工作流 id 不能为空")
+	}
+	if _, err := db.Exec("DELETE FROM workflow_definitions WHERE id = ?", id); err != nil {
+		return fmt.Errorf("删除工作流失败: %w", err)
+	}
+	return nil
+}
+
+func (db *DB) CreateWorkflowRun(run *WorkflowRun) error {
+	if run == nil {
+		return fmt.Errorf("工作流运行为空")
+	}
+	if strings.TrimSpace(run.ID) == "" || strings.TrimSpace(run.WorkflowID) == "" {
+		return fmt.Errorf("工作流运行 id 和 workflow_id 不能为空")
+	}
+	if run.WorkflowVersion <= 0 {
+		run.WorkflowVersion = 1
+	}
+	if strings.TrimSpace(run.Status) == "" {
+		run.Status = "running"
+	}
+	if run.StartedAt.IsZero() {
+		run.StartedAt = time.Now()
+	}
+	_, err := db.Exec(
+		`INSERT INTO workflow_runs (id, workflow_id, workflow_version, conversation_id, project_id, role_id, status, input_json, started_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		run.ID, run.WorkflowID, run.WorkflowVersion, nullString(run.ConversationID), nullString(run.ProjectID), nullString(run.RoleID), run.Status, run.InputJSON, run.StartedAt,
+	)
+	if err != nil {
+		return fmt.Errorf("创建工作流运行失败: %w", err)
+	}
+	return nil
+}
+
+func (db *DB) FinishWorkflowRun(runID, status, outputJSON, errText string) error {
+	runID = strings.TrimSpace(runID)
+	if runID == "" {
+		return fmt.Errorf("工作流运行 id 不能为空")
+	}
+	if strings.TrimSpace(status) == "" {
+		status = "completed"
+	}
+	now := time.Now()
+	_, err := db.Exec(
+		`UPDATE workflow_runs SET status = ?, output_json = ?, error = ?, finished_at = ? WHERE id = ?`,
+		status, outputJSON, errText, now, runID,
+	)
+	if err != nil {
+		return fmt.Errorf("更新工作流运行失败: %w", err)
+	}
+	return nil
+}
+
+func (db *DB) CreateWorkflowNodeRun(n *WorkflowNodeRun) error {
+	if n == nil {
+		return fmt.Errorf("工作流节点运行为空")
+	}
+	if strings.TrimSpace(n.ID) == "" || strings.TrimSpace(n.RunID) == "" || strings.TrimSpace(n.NodeID) == "" {
+		return fmt.Errorf("节点运行 id、run_id 和 node_id 不能为空")
+	}
+	if strings.TrimSpace(n.Status) == "" {
+		n.Status = "running"
+	}
+	if n.StartedAt.IsZero() {
+		n.StartedAt = time.Now()
+	}
+	_, err := db.Exec(
+		`INSERT INTO workflow_node_runs (id, run_id, node_id, status, input_json, started_at)
+		 VALUES (?, ?, ?, ?, ?, ?)`,
+		n.ID, n.RunID, n.NodeID, n.Status, n.InputJSON, n.StartedAt,
+	)
+	if err != nil {
+		return fmt.Errorf("创建工作流节点运行失败: %w", err)
+	}
+	return nil
+}
+
+func (db *DB) FinishWorkflowNodeRun(nodeRunID, status, outputJSON, errText string) error {
+	nodeRunID = strings.TrimSpace(nodeRunID)
+	if nodeRunID == "" {
+		return fmt.Errorf("节点运行 id 不能为空")
+	}
+	if strings.TrimSpace(status) == "" {
+		status = "completed"
+	}
+	now := time.Now()
+	_, err := db.Exec(
+		`UPDATE workflow_node_runs SET status = ?, output_json = ?, error = ?, finished_at = ? WHERE id = ?`,
+		status, outputJSON, errText, now, nodeRunID,
+	)
+	if err != nil {
+		return fmt.Errorf("更新工作流节点运行失败: %w", err)
+	}
+	return nil
+}
+
+func scanWorkflowRun(scanner interface {
+	Scan(dest ...interface{}) error
+}) (*WorkflowRun, error) {
+	var row WorkflowRun
+	var convID, projectID, roleID, inputJSON, outputJSON, errText, pendingNode, pendingJSON sql.NullString
+	var finishedAt sql.NullTime
+	if err := scanner.Scan(
+		&row.ID, &row.WorkflowID, &row.WorkflowVersion,
+		&convID, &projectID, &roleID, &row.Status,
+		&inputJSON, &outputJSON, &errText,
+		&pendingNode, &pendingJSON,
+		&row.StartedAt, &finishedAt,
+	); err != nil {
+		return nil, err
+	}
+	row.ConversationID = convID.String
+	row.ProjectID = projectID.String
+	row.RoleID = roleID.String
+	row.InputJSON = inputJSON.String
+	row.OutputJSON = outputJSON.String
+	row.Error = errText.String
+	row.PendingHITLNodeID = pendingNode.String
+	row.PendingHITLJSON = pendingJSON.String
+	if finishedAt.Valid {
+		t := finishedAt.Time
+		row.FinishedAt = &t
+	}
+	return &row, nil
+}
+
+const workflowRunColumns = `id, workflow_id, workflow_version, conversation_id, project_id, role_id, status, input_json, output_json, error, pending_hitl_node_id, pending_hitl_json, started_at, finished_at`
+
+func (db *DB) GetWorkflowRun(runID string) (*WorkflowRun, error) {
+	runID = strings.TrimSpace(runID)
+	if runID == "" {
+		return nil, nil
+	}
+	row, err := scanWorkflowRun(db.QueryRow("SELECT "+workflowRunColumns+" FROM workflow_runs WHERE id = ?", runID))
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("查询工作流运行失败: %w", err)
+	}
+	return row, nil
+}
+
+func (db *DB) SetWorkflowRunStatus(runID, status string) error {
+	runID = strings.TrimSpace(runID)
+	if runID == "" {
+		return fmt.Errorf("工作流运行 id 不能为空")
+	}
+	_, err := db.Exec(`UPDATE workflow_runs SET status = ? WHERE id = ?`, strings.TrimSpace(status), runID)
+	if err != nil {
+		return fmt.Errorf("更新工作流运行状态失败: %w", err)
+	}
+	return nil
+}
+
+func (db *DB) SetWorkflowRunAwaitingHITL(runID, nodeID, pendingJSON string) error {
+	runID = strings.TrimSpace(runID)
+	if runID == "" {
+		return fmt.Errorf("工作流运行 id 不能为空")
+	}
+	_, err := db.Exec(
+		`UPDATE workflow_runs SET status = 'awaiting_hitl', pending_hitl_node_id = ?, pending_hitl_json = ?, finished_at = NULL WHERE id = ?`,
+		strings.TrimSpace(nodeID), pendingJSON, runID,
+	)
+	if err != nil {
+		return fmt.Errorf("更新工作流 HITL 等待状态失败: %w", err)
+	}
+	return nil
+}
+
+// RecordWorkflowRunHITLDecision stores a human decision on a paused workflow run.
+func (db *DB) RecordWorkflowRunHITLDecision(runID string, approved bool, comment string) error {
+	runID = strings.TrimSpace(runID)
+	if runID == "" {
+		return fmt.Errorf("工作流运行 id 不能为空")
+	}
+	run, err := db.GetWorkflowRun(runID)
+	if err != nil {
+		return err
+	}
+	if run == nil {
+		return fmt.Errorf("工作流运行不存在")
+	}
+	pending := map[string]interface{}{}
+	if strings.TrimSpace(run.PendingHITLJSON) != "" {
+		_ = json.Unmarshal([]byte(run.PendingHITLJSON), &pending)
+	}
+	if approved {
+		pending["decision"] = "approved"
+	} else {
+		pending["decision"] = "rejected"
+	}
+	pending["comment"] = strings.TrimSpace(comment)
+	raw, _ := json.Marshal(pending)
+	_, err = db.Exec(
+		`UPDATE workflow_runs SET pending_hitl_json = ? WHERE id = ? AND status = 'awaiting_hitl'`,
+		string(raw), runID,
+	)
+	if err != nil {
+		return fmt.Errorf("记录工作流审批决定失败: %w", err)
+	}
+	return nil
+}
+
+func (db *DB) ListWorkflowRunsAwaitingHITL(limit int) ([]*WorkflowRun, error) {
+	return db.ListWorkflowRunsAwaitingHITLFiltered("", limit)
+}
+
+// ListWorkflowRunsAwaitingHITLFiltered returns awaiting_hitl runs, optionally scoped to a conversation.
+func (db *DB) ListWorkflowRunsAwaitingHITLFiltered(conversationID string, limit int) ([]*WorkflowRun, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	conversationID = strings.TrimSpace(conversationID)
+	var rows *sql.Rows
+	var err error
+	if conversationID != "" {
+		rows, err = db.Query(
+			`SELECT `+workflowRunColumns+` FROM workflow_runs WHERE status = 'awaiting_hitl' AND conversation_id = ? ORDER BY started_at DESC LIMIT ?`,
+			conversationID, limit,
+		)
+	} else {
+		rows, err = db.Query(
+			`SELECT `+workflowRunColumns+` FROM workflow_runs WHERE status = 'awaiting_hitl' ORDER BY started_at DESC LIMIT ?`,
+			limit,
+		)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("查询等待审批的工作流运行失败: %w", err)
+	}
+	defer rows.Close()
+	var out []*WorkflowRun
+	for rows.Next() {
+		row, err := scanWorkflowRun(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, row)
+	}
+	return out, rows.Err()
+}
+
+func (db *DB) migrateWorkflowRunsTable() error {
+	cols := []struct{ name, ddl string }{
+		{"pending_hitl_node_id", "ALTER TABLE workflow_runs ADD COLUMN pending_hitl_node_id TEXT"},
+		{"pending_hitl_json", "ALTER TABLE workflow_runs ADD COLUMN pending_hitl_json TEXT"},
+	}
+	for _, col := range cols {
+		var count int
+		err := db.QueryRow("SELECT COUNT(*) FROM pragma_table_info('workflow_runs') WHERE name=?", col.name).Scan(&count)
+		if err != nil || count > 0 {
+			continue
+		}
+		if _, err := db.Exec(col.ddl); err != nil {
+			errMsg := strings.ToLower(err.Error())
+			if !strings.Contains(errMsg, "duplicate column") && !strings.Contains(errMsg, "already exists") {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+func nullString(v string) interface{} {
+	v = strings.TrimSpace(v)
+	if v == "" {
+		return nil
+	}
+	return v
+}

internal/einomcp/tool_invoke_notify.go

@@ -2,8 +2,8 @@ package einomcp
 
 import "sync"
 
-// ToolInvokeNotifyHolder 由 Eino run loop 在迭代开始前 Set 回调；MCP/execute 桥在工具调用结束时 Fire，
-// 用于清除 pending tool_call（tool_result 由 ADK schema.Tool 事件推送，含流式工具与 reduction 后正文）。
+// ToolInvokeNotifyHolder 由 Eino run loop 与 MCP/execute 桥共享；Fire 在工具原始返回时触发。
+// UI 的 tool_result 须等 ADK schema.Tool 事件（reduction 后正文），不在此 holder 的回调里推送。
 type ToolInvokeNotifyHolder struct {
 	mu sync.RWMutex
 	fn func(toolCallID, toolName, einoAgent string, success bool, content string, invokeErr error)

internal/handler/agent.go

@@ -77,6 +77,13 @@ type responsePlanAgg struct {
 	b    strings.Builder
 }
 
+// thinkingBuf aggregates thinking_stream_* / reasoning_chain_stream_* before flush to process_details.
+type thinkingBuf struct {
+	b         strings.Builder
+	meta      map[string]interface{}
+	persistAs string // "thinking" | "reasoning_chain"
+}
+
 func normalizeProcessDetailText(s string) string {
 	s = strings.ReplaceAll(s, "\r\n", "\n")
 	s = strings.ReplaceAll(s, "\r", "\n")
@@ -178,7 +185,10 @@ type AgentHandler struct {
 	agentsMarkdownDir string // 多代理：Markdown 子 Agent 目录（绝对路径，空则不从磁盘合并）
 	batchCronParser   cron.Parser
 	// hitlWhitelistSaver 侧栏「应用」HITL 时将会话增量白名单合并写入 config.yaml（可选）
-	hitlWhitelistSaver HitlToolWhitelistSaver
+	hitlWhitelistSaver       HitlToolWhitelistSaver
+	hitlStrategySaver        HitlAuditStrategySaver
+	hitlDefaultReviewerSaver HitlDefaultReviewerSaver
+	auditLLM           *openai.Client
 	audit              *audit.Service
 }
 
@@ -187,14 +197,21 @@ func (h *AgentHandler) SetAudit(s *audit.Service) {
 	h.audit = s
 }
 
+// TaskManager 返回 Agent 任务管理器（供 MCP 监控页终止 Eino execute 等）。
+func (h *AgentHandler) TaskManager() *AgentTaskManager {
+	if h == nil {
+		return nil
+	}
+	return h.tasks
+}
+
 // CancelRunningTaskForConversation stops any in-flight agent work for the conversation (idempotent).
 func (h *AgentHandler) CancelRunningTaskForConversation(conversationID string) {
 	if h == nil || conversationID == "" || h.tasks == nil {
 		return
 	}
-	if execID := h.tasks.ActiveMCPExecutionID(conversationID); execID != "" {
-		h.agent.CancelMCPToolExecutionWithNote(execID, "")
-	}
+	h.cancelActiveMCPToolForConversation(conversationID)
+	h.tasks.AbortActiveEinoExecute(conversationID, "")
 	if ok, err := h.tasks.CancelTask(conversationID, ErrTaskCancelled); ok {
 		h.logger.Info("已取消会话运行中任务", zap.String("conversationId", conversationID))
 	} else if err != nil {
@@ -202,9 +219,19 @@ func (h *AgentHandler) CancelRunningTaskForConversation(conversationID string) {
 	}
 }
 
-// HitlToolWhitelistSaver 合并 HITL 免审批工具到全局配置并落盘
+func (h *AgentHandler) cancelActiveMCPToolForConversation(conversationID string) {
+	if h == nil || h.tasks == nil || h.agent == nil {
+		return
+	}
+	if execID := h.tasks.ActiveMCPExecutionID(conversationID); execID != "" {
+		h.agent.CancelMCPToolExecutionWithNote(execID, "")
+	}
+}
+
+// HitlToolWhitelistSaver 合并/设置 HITL 免审批工具到全局配置并落盘
 type HitlToolWhitelistSaver interface {
 	MergeHitlToolWhitelistIntoConfig(add []string) error
+	SetHitlToolWhitelist(tools []string) error
 }
 
 // NewAgentHandler 创建新的Agent处理器
@@ -220,6 +247,11 @@ func NewAgentHandler(agent *agent.Agent, db *database.DB, cfg *config.Config, lo
 	bus := NewTaskEventBus()
 	tm := NewAgentTaskManager()
 	tm.SetTaskEventBus(bus)
+	llmHTTP := &http.Client{Timeout: 2 * time.Minute}
+	var llmCfg *config.OpenAIConfig
+	if cfg != nil {
+		llmCfg = &cfg.OpenAI
+	}
 	handler := &AgentHandler{
 		agent:            agent,
 		db:               db,
@@ -230,7 +262,9 @@ func NewAgentHandler(agent *agent.Agent, db *database.DB, cfg *config.Config, lo
 		config:           cfg,
 		hitlManager:      NewHITLManager(db, logger),
 		batchCronParser:  cron.NewParser(cron.Minute | cron.Hour | cron.Dom | cron.Month | cron.Dow | cron.Descriptor),
+		auditLLM:         openai.NewClient(llmCfg, llmHTTP, logger),
 	}
+	tm.SetToolCanceler(handler.cancelActiveMCPToolForConversation)
 	if err := handler.hitlManager.EnsureSchema(); err != nil {
 		logger.Warn("初始化 HITL 表失败", zap.Error(err))
 	}
@@ -255,6 +289,23 @@ func (h *AgentHandler) SetHitlToolWhitelistSaver(s HitlToolWhitelistSaver) {
 	h.hitlWhitelistSaver = s
 }
 
+// HitlDefaultReviewerSaver 持久化全局默认审批方到 config.yaml。
+type HitlDefaultReviewerSaver interface {
+	UpdateHitlDefaultReviewer(reviewer string) error
+}
+
+// SetHitlDefaultReviewerSaver 设置 HITL 默认审批方落盘。
+func (h *AgentHandler) SetHitlDefaultReviewerSaver(s HitlDefaultReviewerSaver) {
+	h.hitlDefaultReviewerSaver = s
+}
+
+func (h *AgentHandler) hitlEffectiveDefaultReviewer() string {
+	if h != nil && h.config != nil {
+		return normalizeHitlReviewer(h.config.Hitl.EffectiveDefaultReviewer())
+	}
+	return "human"
+}
+
 // HITLNeedsToolApproval 供 C2 危险任务门控：与会话侧人机协同及免审批白名单判定一致。
 func (h *AgentHandler) HITLNeedsToolApproval(conversationID, toolName string) bool {
 	if h == nil || h.hitlManager == nil {
@@ -303,6 +354,7 @@ func chatReasoningToClientIntent(r *ChatReasoningRequest) *reasoning.ClientInten
 type HITLRequest struct {
 	Enabled        bool     `json:"enabled"`
 	Mode           string   `json:"mode,omitempty"`
+	Reviewer       string   `json:"reviewer,omitempty"` // human | audit_agent
 	SensitiveTools []string `json:"sensitiveTools,omitempty"`
 	TimeoutSeconds int      `json:"timeoutSeconds,omitempty"`
 }
@@ -644,7 +696,7 @@ func (h *AgentHandler) runRobotEinoSingleWithRetry(
 ) (string, string, error) {
 	resultMA, errMA := multiagent.RunEinoSingleChatModelAgent(
 		taskCtx, h.config, &h.config.MultiAgent, h.agent, h.db, h.logger,
-		conversationID, h.conversationProjectID(conversationID), finalMessage, history, roleTools, progressCallback, nil, h.projectBlackboardBlock(conversationID),
+		conversationID, h.conversationProjectID(conversationID), finalMessage, history, roleTools, progressCallback, nil, h.agentSessionContextBlock(conversationID),
 	)
 	if errMA != nil {
 		*taskStatus = "failed"
@@ -665,7 +717,7 @@ func (h *AgentHandler) runRobotMultiAgentWithRetry(
 	resultMA, errMA := multiagent.RunDeepAgent(
 		taskCtx, h.config, &h.config.MultiAgent, h.agent, h.db, h.logger,
 		conversationID, h.conversationProjectID(conversationID), finalMessage, history, roleTools, progressCallback,
-		h.agentsMarkdownDir, orchestration, nil, h.projectBlackboardBlock(conversationID),
+		h.agentsMarkdownDir, orchestration, nil, h.agentSessionContextBlock(conversationID),
 	)
 	if errMA != nil {
 		*taskStatus = "failed"
@@ -832,11 +884,6 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 
 	// thinking_stream_*（ReAct 等助手正文流）与 reasoning_chain_stream_*（Eino ReasoningContent）：
 	// 不逐条落库，按 streamId 聚合，flush 时分别落 thinking / reasoning_chain。
-	type thinkingBuf struct {
-		b         strings.Builder
-		meta      map[string]interface{}
-		persistAs string // "thinking" | "reasoning_chain"
-	}
 	thinkingStreams := make(map[string]*thinkingBuf) // streamId -> buf
 	flushedThinking := make(map[string]bool)         // streamId -> flushed
 	seenToolCallSigs := make(map[string]string)      // toolCallId -> payload signature
@@ -849,6 +896,12 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 	// response_start + response_delta：前端时间线显示为「📝 规划中」（monitor.js），不落逐条 delta；
 	// 聚合为一条 planning 写入 process_details，刷新后与线上一致。
 	var respPlan responsePlanAgg
+	if assistantMessageID != "" {
+		h.tasks.SetHitlAssistantMessageID(conversationID, assistantMessageID)
+	}
+	syncHitlCognition := func() {
+		h.syncHitlCognitionFromProgress(conversationID, assistantMessageID, thinkingStreams, &respPlan)
+	}
 	flushResponsePlan := func() {
 		if assistantMessageID == "" {
 			return
@@ -868,6 +921,7 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 		if err := h.db.AddProcessDetail(assistantMessageID, conversationID, "planning", content, data); err != nil {
 			h.logger.Warn("保存过程详情失败", zap.Error(err), zap.String("eventType", "planning"))
 		}
+		syncHitlCognition()
 		respPlan.meta = nil
 		respPlan.b.Reset()
 	}
@@ -904,6 +958,7 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 			}
 			flushedThinking[sid] = true
 		}
+		syncHitlCognition()
 	}
 
 	return func(eventType, message string, data interface{}) {
@@ -964,6 +1019,25 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 			}
 		}
 
+		if eventType == "tool_result" {
+			if dataMap, ok := data.(map[string]interface{}); ok {
+				toolName, _ := dataMap["toolName"].(string)
+				toolCallID, _ := dataMap["toolCallId"].(string)
+				success := true
+				if v, ok := dataMap["success"].(bool); ok {
+					success = v
+				}
+				resultText := ""
+				if r, ok := dataMap["result"].(string); ok {
+					resultText = r
+				}
+				if strings.TrimSpace(resultText) == "" {
+					resultText = message
+				}
+				h.recordHitlToolExecutionResult(conversationID, toolCallID, toolName, success, resultText)
+			}
+		}
+
 		// 处理知识检索日志记录
 		if eventType == "tool_result" && h.knowledgeManager != nil {
 			if dataMap, ok := data.(map[string]interface{}); ok {
@@ -1171,6 +1245,7 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 					respPlan.meta[k] = v
 				}
 			}
+			syncHitlCognition()
 			return
 		}
 		if eventType == "response" {
@@ -1240,6 +1315,7 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 					}
 				}
 			}
+			syncHitlCognition()
 			return
 		}
 
@@ -1291,10 +1367,60 @@ func (h *AgentHandler) createProgressCallback(runCtx context.Context, cancelRun
 	}
 }
 
+// cancelToolContinueAfter 仅终止当前工具调用，不停止整条 Agent 任务（对话「中断并继续」与 MCP 监控终止共用）。
+func (h *AgentHandler) cancelToolContinueAfter(conversationID, preferredExecID, note string) (bool, gin.H) {
+	conversationID = strings.TrimSpace(conversationID)
+	if conversationID == "" || h.tasks.GetTask(conversationID) == nil {
+		return false, nil
+	}
+	note = strings.TrimSpace(note)
+	execID := strings.TrimSpace(preferredExecID)
+	if execID == "" {
+		execID = h.tasks.ActiveMCPExecutionID(conversationID)
+	}
+	if execID != "" {
+		if h.agent.CancelMCPToolExecutionWithNote(execID, note) {
+			return true, gin.H{
+				"status":              "tool_abort_requested",
+				"conversationId":      conversationID,
+				"executionId":         execID,
+				"message":             "已请求终止当前工具调用；工具返回后本轮推理将继续（与 MCP 监控页终止一致）。",
+				"continueAfter":       true,
+				"interruptWithNote":   note != "",
+				"continueWithoutTool": false,
+			}
+		}
+		if h.tasks.AbortActiveEinoExecute(conversationID, note) {
+			return true, gin.H{
+				"status":              "tool_abort_requested",
+				"conversationId":      conversationID,
+				"executionId":         execID,
+				"message":             "已请求终止当前 execute 命令；命令返回后本轮推理将继续。",
+				"continueAfter":       true,
+				"interruptWithNote":   note != "",
+				"continueWithoutTool": false,
+			}
+		}
+		return false, nil
+	}
+	if h.tasks.AbortActiveEinoExecute(conversationID, note) {
+		return true, gin.H{
+			"status":              "tool_abort_requested",
+			"conversationId":      conversationID,
+			"message":             "已请求终止当前 execute 命令；命令返回后本轮推理将继续。",
+			"continueAfter":       true,
+			"interruptWithNote":   note != "",
+			"continueWithoutTool": false,
+		}
+	}
+	return false, nil
+}
+
 // CancelAgentLoop 取消正在执行的任务
 func (h *AgentHandler) CancelAgentLoop(c *gin.Context) {
 	var req struct {
 		ConversationID string `json:"conversationId" binding:"required"`
+		ExecutionID    string `json:"executionId,omitempty"`
 		Reason         string `json:"reason,omitempty"`
 		ContinueAfter  bool   `json:"continueAfter,omitempty"`
 	}
@@ -1309,42 +1435,20 @@ func (h *AgentHandler) CancelAgentLoop(c *gin.Context) {
 			c.JSON(http.StatusNotFound, gin.H{"error": "未找到正在执行的任务"})
 			return
 		}
-		execID := h.tasks.ActiveMCPExecutionID(req.ConversationID)
 		note := strings.TrimSpace(req.Reason)
-		if execID != "" {
-			if !h.agent.CancelMCPToolExecutionWithNote(execID, note) {
-				c.JSON(http.StatusNotFound, gin.H{"error": "未找到进行中的工具执行或该调用已结束"})
-				return
-			}
-			h.logger.Info("对话页仅终止当前 MCP 工具",
+		activeExec := strings.TrimSpace(h.tasks.ActiveMCPExecutionID(req.ConversationID))
+		if ok, payload := h.cancelToolContinueAfter(req.ConversationID, strings.TrimSpace(req.ExecutionID), note); ok {
+			execID, _ := payload["executionId"].(string)
+			h.logger.Info("对话页仅终止当前工具",
 				zap.String("conversationId", req.ConversationID),
 				zap.String("executionId", execID),
 				zap.Bool("hasNote", note != ""),
 			)
-			c.JSON(http.StatusOK, gin.H{
-				"status":              "tool_abort_requested",
-				"conversationId":      req.ConversationID,
-				"executionId":         execID,
-				"message":             "已请求终止当前工具调用；工具返回后本轮推理将继续（与 MCP 监控页终止一致）。",
-				"continueAfter":       true,
-				"interruptWithNote":   note != "",
-				"continueWithoutTool": false,
-			})
+			c.JSON(http.StatusOK, payload)
 			return
 		}
-		if h.tasks.AbortActiveEinoExecute(req.ConversationID, note) {
-			h.logger.Info("对话页仅终止当前 Eino execute",
-				zap.String("conversationId", req.ConversationID),
-				zap.Bool("hasNote", note != ""),
-			)
-			c.JSON(http.StatusOK, gin.H{
-				"status":              "tool_abort_requested",
-				"conversationId":      req.ConversationID,
-				"message":             "已请求终止当前 execute 命令；命令返回后本轮推理将继续。",
-				"continueAfter":       true,
-				"interruptWithNote":   note != "",
-				"continueWithoutTool": false,
-			})
+		if activeExec != "" {
+			c.JSON(http.StatusNotFound, gin.H{"error": "未找到进行中的工具执行或该调用已结束"})
 			return
 		}
 		// 无进行中的 MCP 工具（模型纯推理/流式输出阶段）：取消当前上下文并由 Eino 流式处理器合并用户补充后自动续跑。
@@ -1376,6 +1480,8 @@ func (h *AgentHandler) CancelAgentLoop(c *gin.Context) {
 
 	var cause error = ErrTaskCancelled
 	msg := "已提交取消请求，任务将在当前步骤完成后停止。"
+	h.cancelActiveMCPToolForConversation(req.ConversationID)
+	h.tasks.AbortActiveEinoExecute(req.ConversationID, "")
 	ok, err := h.tasks.CancelTask(req.ConversationID, cause)
 	if err != nil {
 		h.logger.Error("取消任务失败", zap.Error(err))
@@ -1442,17 +1548,51 @@ func (h *AgentHandler) SubscribeAgentTaskEvents(c *gin.Context) {
 	}
 }
 
+// enrichAgentTasksWithConversationTitles 为任务列表附加当前会话标题（供顶栏/任务页展示，重命名后自动同步）
+func (h *AgentHandler) enrichAgentTasksWithConversationTitles(tasks []*AgentTask) {
+	if h == nil || h.db == nil {
+		return
+	}
+	for _, task := range tasks {
+		if task == nil || strings.TrimSpace(task.ConversationID) == "" {
+			continue
+		}
+		if title, err := h.db.GetConversationTitle(task.ConversationID); err == nil {
+			task.Title = strings.TrimSpace(title)
+		}
+	}
+}
+
+// enrichCompletedTasksWithConversationTitles 为已完成任务附加当前会话标题
+func (h *AgentHandler) enrichCompletedTasksWithConversationTitles(tasks []*CompletedTask) {
+	if h == nil || h.db == nil {
+		return
+	}
+	for _, task := range tasks {
+		if task == nil || strings.TrimSpace(task.ConversationID) == "" {
+			continue
+		}
+		if title, err := h.db.GetConversationTitle(task.ConversationID); err == nil {
+			task.Title = strings.TrimSpace(title)
+		}
+	}
+}
+
 // ListAgentTasks 列出所有运行中的任务
 func (h *AgentHandler) ListAgentTasks(c *gin.Context) {
+	tasks := h.tasks.GetActiveTasks()
+	h.enrichAgentTasksWithConversationTitles(tasks)
 	c.JSON(http.StatusOK, gin.H{
-		"tasks": h.tasks.GetActiveTasks(),
+		"tasks": tasks,
 	})
 }
 
 // ListCompletedTasks 列出最近完成的任务历史
 func (h *AgentHandler) ListCompletedTasks(c *gin.Context) {
+	tasks := h.tasks.GetCompletedTasks()
+	h.enrichCompletedTasksWithConversationTitles(tasks)
 	c.JSON(http.StatusOK, gin.H{
-		"tasks": h.tasks.GetCompletedTasks(),
+		"tasks": tasks,
 	})
 }
 

internal/handler/batch_queue_executor.go

@@ -232,12 +232,12 @@ func (h *AgentHandler) executeOneBatchSubTask(queueID string, queue *BatchTaskQu
 	var runErr error
 	switch {
 	case useBatchMulti:
-		resultMA, runErr = multiagent.RunDeepAgent(taskCtx, h.config, &h.config.MultiAgent, h.agent, h.db, h.logger, conversationID, h.conversationProjectID(conversationID), finalMessage, []agent.ChatMessage{}, roleTools, progressCallback, h.agentsMarkdownDir, batchOrch, nil, h.projectBlackboardBlock(conversationID))
+		resultMA, runErr = multiagent.RunDeepAgent(taskCtx, h.config, &h.config.MultiAgent, h.agent, h.db, h.logger, conversationID, h.conversationProjectID(conversationID), finalMessage, []agent.ChatMessage{}, roleTools, progressCallback, h.agentsMarkdownDir, batchOrch, nil, h.agentSessionContextBlock(conversationID))
 	default:
 		if h.config == nil {
 			runErr = fmt.Errorf("服务器配置未加载")
 		} else {
-			resultMA, runErr = multiagent.RunEinoSingleChatModelAgent(taskCtx, h.config, &h.config.MultiAgent, h.agent, h.db, h.logger, conversationID, h.conversationProjectID(conversationID), finalMessage, []agent.ChatMessage{}, roleTools, progressCallback, nil, h.projectBlackboardBlock(conversationID))
+			resultMA, runErr = multiagent.RunEinoSingleChatModelAgent(taskCtx, h.config, &h.config.MultiAgent, h.agent, h.db, h.logger, conversationID, h.conversationProjectID(conversationID), finalMessage, []agent.ChatMessage{}, roleTools, progressCallback, nil, h.agentSessionContextBlock(conversationID))
 		}
 	}
 

internal/handler/config.go

@@ -798,6 +798,10 @@ func (h *ConfigHandler) UpdateConfig(c *gin.Context) {
 
 	// 更新机器人配置
 	if req.Robots != nil {
+		if err := config.ValidateWecomConfig(req.Robots.Wecom); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
 		h.config.Robots = *req.Robots
 		h.logger.Info("更新机器人配置",
 			zap.Bool("wechat_enabled", h.config.Robots.Wechat.Enabled),
@@ -1329,6 +1333,17 @@ func (h *ConfigHandler) ApplyConfig(c *gin.Context) {
 		h.logger.Info("已更新嵌入模型配置记录")
 	}
 
+	// 从 tools 目录重新加载工具配置（新增/修改/删除 yaml 后无需重启）
+	if err := config.ReloadSecurityToolsFromDir(h.config, h.configPath); err != nil {
+		h.logger.Error("重新加载工具配置失败", zap.Error(err))
+		if h.audit != nil {
+			h.audit.RecordFail(c, "config", "apply", "应用配置失败：重新加载工具", map[string]interface{}{"error": err.Error()})
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "重新加载工具配置失败: " + err.Error()})
+		return
+	}
+	h.logger.Info("已从 tools 目录重新加载工具配置", zap.Int("tools_count", len(h.config.Security.Tools)))
+
 	// 重新注册工具（根据新的启用状态）
 	h.logger.Info("重新注册工具")
 
@@ -1417,12 +1432,7 @@ func (h *ConfigHandler) ApplyConfig(c *gin.Context) {
 
 	// 更新检索器配置（如果知识库启用）
 	if h.config.Knowledge.Enabled && h.retrieverUpdater != nil {
-		retrievalConfig := &knowledge.RetrievalConfig{
-			TopK:                h.config.Knowledge.Retrieval.TopK,
-			SimilarityThreshold: h.config.Knowledge.Retrieval.SimilarityThreshold,
-			SubIndexFilter:      h.config.Knowledge.Retrieval.SubIndexFilter,
-			PostRetrieve:        h.config.Knowledge.Retrieval.PostRetrieve,
-		}
+		retrievalConfig := knowledge.RetrievalConfigFromYAML(h.config.Knowledge.Retrieval)
 		h.retrieverUpdater.UpdateConfig(retrievalConfig)
 		h.logger.Info("检索器配置已更新",
 			zap.Int("top_k", retrievalConfig.TopK),
@@ -1705,6 +1715,13 @@ func updateKnowledgeConfig(doc *yaml.Node, cfg config.KnowledgeConfig) {
 	setIntInMap(retrievalNode, "top_k", cfg.Retrieval.TopK)
 	setFloatInMap(retrievalNode, "similarity_threshold", cfg.Retrieval.SimilarityThreshold)
 	setStringInMap(retrievalNode, "sub_index_filter", cfg.Retrieval.SubIndexFilter)
+	mqNode := ensureMap(retrievalNode, "multi_query")
+	setIntInMap(mqNode, "max_queries", cfg.Retrieval.MultiQuery.MaxQueries)
+	rerankNode := ensureMap(retrievalNode, "rerank")
+	setStringInMap(rerankNode, "provider", cfg.Retrieval.Rerank.Provider)
+	setStringInMap(rerankNode, "model", cfg.Retrieval.Rerank.Model)
+	setStringInMap(rerankNode, "base_url", cfg.Retrieval.Rerank.BaseURL)
+	setStringInMap(rerankNode, "api_key", cfg.Retrieval.Rerank.APIKey)
 	postNode := ensureMap(retrievalNode, "post_retrieve")
 	setIntInMap(postNode, "prefetch_top_k", cfg.Retrieval.PostRetrieve.PrefetchTopK)
 	setIntInMap(postNode, "max_context_chars", cfg.Retrieval.PostRetrieve.MaxContextChars)
@@ -1751,6 +1768,20 @@ func mergeHitlToolWhitelistSlice(existing, add []string) []string {
 	return out
 }
 
+// SetHitlToolWhitelist 将全局免审批工具白名单整表写入 config.yaml（替换，非合并）。
+func (h *ConfigHandler) SetHitlToolWhitelist(tools []string) error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	h.config.Hitl.ToolWhitelist = mergeHitlToolWhitelistSlice(nil, tools)
+	if err := h.saveConfig(); err != nil {
+		return err
+	}
+	h.logger.Info("HITL 全局工具白名单已写入配置文件",
+		zap.Int("count", len(h.config.Hitl.ToolWhitelist)),
+	)
+	return nil
+}
+
 // MergeHitlToolWhitelistIntoConfig 将会话侧栏提交的免审批工具名合并进内存配置并写入 config.yaml（与全局白名单去重规则一致：小写键、保留首次出现的原始大小写）。
 func (h *ConfigHandler) MergeHitlToolWhitelistIntoConfig(add []string) error {
 	h.mu.Lock()
@@ -1771,6 +1802,34 @@ func updateHitlConfig(doc *yaml.Node, cfg config.HitlConfig) {
 	hitlNode := ensureMap(root, "hitl")
 	// flow 样式 [a, b, c] 单行展示，工具多时比块序列省行数
 	setFlowStringSliceInMap(hitlNode, "tool_whitelist", cfg.ToolWhitelist)
+	setStringInMap(hitlNode, "default_reviewer", cfg.EffectiveDefaultReviewer())
+	setStringInMap(hitlNode, "audit_agent_prompt", cfg.AuditAgentPrompt)
+	setStringInMap(hitlNode, "audit_agent_prompt_review_edit", cfg.AuditAgentPromptReviewEdit)
+}
+
+// UpdateHitlDefaultReviewer 更新全局默认审批方并写入 config.yaml。
+func (h *ConfigHandler) UpdateHitlDefaultReviewer(reviewer string) error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	h.config.Hitl.DefaultReviewer = config.HitlConfig{DefaultReviewer: reviewer}.EffectiveDefaultReviewer()
+	if err := h.saveConfig(); err != nil {
+		return err
+	}
+	h.logger.Info("HITL 全局默认审批方已写入配置文件", zap.String("default_reviewer", h.config.Hitl.DefaultReviewer))
+	return nil
+}
+
+// UpdateHitlAuditAgentStrategy 更新审批/审查编辑两套审计 Agent 提示词并写入 config.yaml。
+func (h *ConfigHandler) UpdateHitlAuditAgentStrategy(approvalPrompt, reviewEditPrompt string) error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	h.config.Hitl.AuditAgentPrompt = strings.TrimSpace(approvalPrompt)
+	h.config.Hitl.AuditAgentPromptReviewEdit = strings.TrimSpace(reviewEditPrompt)
+	if err := h.saveConfig(); err != nil {
+		return err
+	}
+	h.logger.Info("HITL 审计 Agent 提示词已写入配置文件")
+	return nil
 }
 
 func updateRobotsConfig(doc *yaml.Node, cfg config.RobotsConfig) {

internal/handler/conversation.go

@@ -103,6 +103,7 @@ func (h *ConversationHandler) ListConversations(c *gin.Context) {
 	limitStr := c.DefaultQuery("limit", "50")
 	offsetStr := c.DefaultQuery("offset", "0")
 	search := c.Query("search") // 获取搜索参数
+	projectID := strings.TrimSpace(c.Query("project_id"))
 
 	limit, _ := strconv.Atoi(limitStr)
 	offset, _ := strconv.Atoi(offsetStr)
@@ -114,7 +115,7 @@ func (h *ConversationHandler) ListConversations(c *gin.Context) {
 		limit = 1000
 	}
 
-	excludeGrouped := strings.TrimSpace(search) == "" &&
+	excludeGrouped := strings.TrimSpace(search) == "" && projectID == "" &&
 		(c.Query("exclude_grouped") == "true" || c.Query("exclude_grouped") == "1")
 	sortBy := strings.TrimSpace(c.Query("sort_by"))
 
@@ -122,14 +123,14 @@ func (h *ConversationHandler) ListConversations(c *gin.Context) {
 	var total int
 	var err error
 	if excludeGrouped {
-		conversations, err = h.db.ListUngroupedConversations(limit, offset, sortBy)
+		conversations, err = h.db.ListUngroupedConversations(limit, offset, sortBy, projectID)
 		if err == nil {
-			total, err = h.db.CountUngroupedConversations()
+			total, err = h.db.CountUngroupedConversations(projectID)
 		}
 	} else {
-		conversations, err = h.db.ListConversations(limit, offset, search, sortBy)
+		conversations, err = h.db.ListConversations(limit, offset, search, sortBy, projectID)
 		if err == nil {
-			total, err = h.db.CountConversations(search)
+			total, err = h.db.CountConversations(search, projectID)
 		}
 	}
 	if err != nil {

internal/handler/eino_empty_response_continue.go

@@ -0,0 +1,83 @@
+package handler
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"cyberstrike-ai/internal/agent"
+	"cyberstrike-ai/internal/config"
+	"cyberstrike-ai/internal/multiagent"
+
+	"go.uber.org/zap"
+)
+
+// rebindEinoRunningTask 中断并继续 / 空正文续跑：重建 cancel 链与超时 ctx，保持任务 running。
+func (h *AgentHandler) rebindEinoRunningTask(conversationID string, timeoutCancel context.CancelFunc) (context.Context, context.CancelCauseFunc, context.Context, context.CancelFunc) {
+	if timeoutCancel != nil {
+		timeoutCancel()
+	}
+	baseCtx, cancelWithCause := context.WithCancelCause(context.Background())
+	h.tasks.BindTaskCancel(conversationID, cancelWithCause)
+	taskCtx, newTimeoutCancel := context.WithTimeout(baseCtx, 600*time.Minute)
+	h.tasks.UpdateTaskStatus(conversationID, "running")
+	return baseCtx, cancelWithCause, taskCtx, newTimeoutCancel
+}
+
+// tryContinueOnEinoEmptyResponse Run 成功但 Response 为 emptyHint 时退避续跑；true 表示已准备下一段 Run。
+func (h *AgentHandler) tryContinueOnEinoEmptyResponse(
+	taskCtx context.Context,
+	mw *config.MultiAgentEinoMiddlewareConfig,
+	conversationID string,
+	result *multiagent.RunResult,
+	attempt *int,
+	curHistory *[]agent.ChatMessage,
+	curFinalMessage *string,
+	progressCallback func(eventType, message string, data interface{}),
+) bool {
+	if result == nil || !multiagent.IsEinoEmptyResponseResult(result) || !multiagent.HasEinoResumeTrace(result) {
+		return false
+	}
+	maxAttempts := multiagent.EmptyResponseContinueMaxAttemptsFromConfig(mw)
+	if *attempt >= maxAttempts {
+		if h.logger != nil {
+			h.logger.Warn("eino empty response continue exhausted",
+				zap.String("conversationId", conversationID),
+				zap.Int("maxAttempts", maxAttempts))
+		}
+		return false
+	}
+	*attempt++
+	h.persistEinoAgentTraceForResume(conversationID, result)
+
+	backoff := multiagent.EmptyResponseContinueBackoff(*attempt-1, mw)
+	waitMsg := fmt.Sprintf("会话已结束但未捕获到助手正文，%d 秒后第 %d/%d 次自动续跑…",
+		int(backoff.Seconds()), *attempt, maxAttempts)
+	if progressCallback != nil {
+		progressCallback("eino_empty_response_continue", waitMsg, map[string]interface{}{
+			"conversationId": conversationID,
+			"source":         "eino",
+			"attempt":        *attempt,
+			"maxAttempts":    maxAttempts,
+			"backoffSec":     int(backoff.Seconds()),
+		})
+	}
+	select {
+	case <-taskCtx.Done():
+		return false
+	case <-time.After(backoff):
+	}
+
+	inject := multiagent.FormatEmptyResponseContinueUserMessage()
+	h.applyEinoTraceResumeSegment(conversationID, result, curHistory, curFinalMessage, inject)
+	if progressCallback != nil {
+		progressCallback("eino_empty_response_continue", "已恢复上下文，正在续跑…", map[string]interface{}{
+			"conversationId": conversationID,
+			"source":         "eino",
+			"attempt":        *attempt,
+			"maxAttempts":    maxAttempts,
+			"contextSource":  "empty_response_continue",
+		})
+	}
+	return true
+}

internal/handler/eino_single_agent.go

@@ -116,6 +116,9 @@ func (h *AgentHandler) EinoSingleAgentLoopStream(c *gin.Context) {
 			"userMessageId":  prep.UserMessageID,
 		})
 	}
+	if h.runRoleWorkflowStreamIfBound(&req, prep, sendEvent) {
+		return
+	}
 
 	var cancelWithCause context.CancelCauseFunc
 	curFinalMessage := prep.FinalMessage
@@ -178,6 +181,7 @@ func (h *AgentHandler) EinoSingleAgentLoopStream(c *gin.Context) {
 	var cumulativeMCPExecutionIDs []string
 	// 同一请求内分段续跑时，主代理 iteration 事件按偏移累计，避免 UI 出现「第3轮 → 第1轮」回跳。
 	var mainIterationOffset int
+	var emptyResponseContinueAttempt int
 
 	for {
 		segmentMainIterationMax := 0
@@ -231,7 +235,7 @@ func (h *AgentHandler) EinoSingleAgentLoopStream(c *gin.Context) {
 			roleTools,
 			progressCallback,
 			chatReasoningToClientIntent(req.Reasoning),
-			h.projectBlackboardBlock(conversationID),
+			h.agentSessionContextBlock(conversationID),
 		)
 
 		if result != nil && len(result.MCPExecutionIDs) > 0 {
@@ -239,6 +243,13 @@ func (h *AgentHandler) EinoSingleAgentLoopStream(c *gin.Context) {
 		}
 
 		if runErr == nil {
+			mw := &h.config.MultiAgent.EinoMiddleware
+			if h.tryContinueOnEinoEmptyResponse(taskCtx, mw, conversationID, result, &emptyResponseContinueAttempt, &curHistory, &curFinalMessage, progressCallback) {
+				mainIterationOffset += segmentMainIterationMax
+				timeoutCancel()
+				baseCtx, cancelWithCause, taskCtx, timeoutCancel = h.rebindEinoRunningTask(conversationID, timeoutCancel)
+				continue
+			}
 			timeoutCancel()
 			break
 		}
@@ -377,6 +388,9 @@ func (h *AgentHandler) EinoSingleAgentLoop(c *gin.Context) {
 	if h.hitlManager != nil {
 		defer h.hitlManager.DeactivateConversation(prep.ConversationID)
 	}
+	if h.runRoleWorkflowJSONIfBound(c, &req, prep) {
+		return
+	}
 
 	var progressBuf strings.Builder
 	progressCallbackRaw := func(eventType, message string, data interface{}) {
@@ -416,7 +430,7 @@ func (h *AgentHandler) EinoSingleAgentLoop(c *gin.Context) {
 			prep.RoleTools,
 			progressCallback,
 			chatReasoningToClientIntent(req.Reasoning),
-			h.projectBlackboardBlock(prep.ConversationID),
+			h.agentSessionContextBlock(prep.ConversationID),
 		)
 		if runErr == nil {
 			break

internal/handler/hitl.go

@@ -23,6 +23,7 @@ import (
 type hitlRuntimeConfig struct {
 	Enabled        bool
 	Mode           string
+	Reviewer       string
 	SensitiveTools map[string]struct{}
 	Timeout        time.Duration
 }
@@ -49,6 +50,8 @@ type HITLManager struct {
 	mu      sync.RWMutex
 	runtime map[string]hitlRuntimeConfig
 	pending map[string]*pendingInterrupt
+	// approvedExec 审批通过、待回写 tool_result 的队列（按会话 FIFO）
+	approvedExec map[string][]hitlApprovedExecTrack
 }
 
 func NewHITLManager(db *database.DB, logger *zap.Logger) *HITLManager {
@@ -90,6 +93,7 @@ CREATE TABLE IF NOT EXISTS hitl_conversation_configs (
 	if err != nil {
 		return err
 	}
+	m.migrateHitlSchemaColumns()
 
 	// On startup, cancel all orphaned pending interrupts from previous process.
 	// Their in-memory channels are gone, so they can never be resolved.
@@ -141,6 +145,7 @@ func (m *HITLManager) ActivateConversation(conversationID string, req *HITLReque
 	m.runtime[conversationID] = hitlRuntimeConfig{
 		Enabled:        true,
 		Mode:           normalizeHitlMode(req.Mode),
+		Reviewer:       normalizeHitlReviewer(req.Reviewer),
 		SensitiveTools: tools,
 		Timeout:        timeout,
 	}
@@ -153,17 +158,14 @@ func (m *HITLManager) DeactivateConversation(conversationID string) {
 	m.mu.Unlock()
 }
 
-// hitlConfigGlobalToolWhitelist 来自 config.yaml hitl.tool_whitelist（去重、去空）。
+// hitlConfigGlobalToolWhitelist 来自 config.yaml hitl.tool_whitelist（去重、去空），并合并内置元工具免审批项。
 func (h *AgentHandler) hitlConfigGlobalToolWhitelist() []string {
 	if h == nil || h.config == nil {
-		return nil
+		return multiagent.MergeHitlExemptMetaTools(nil)
 	}
 	raw := h.config.Hitl.ToolWhitelist
-	if len(raw) == 0 {
-		return nil
-	}
 	seen := make(map[string]struct{})
-	out := make([]string, 0, len(raw))
+	out := make([]string, 0, len(raw)+len(multiagent.HitlExemptMetaTools))
 	for _, t := range raw {
 		n := strings.ToLower(strings.TrimSpace(t))
 		if n == "" {
@@ -175,44 +177,35 @@ func (h *AgentHandler) hitlConfigGlobalToolWhitelist() []string {
 		seen[n] = struct{}{}
 		out = append(out, strings.TrimSpace(t))
 	}
-	return out
+	return multiagent.MergeHitlExemptMetaTools(out)
 }
 
-// hitlRequestWithMergedConfigWhitelist 将会话/API 中的白名单与 config.yaml 全局白名单合并（并集），仅用于运行时 Activate；不写入数据库。
+// hitlRequestWithMergedConfigWhitelist 将会话/API 中的白名单与 config.yaml 全局白名单及内置元工具免审批项合并（并集），仅用于运行时 Activate；不写入数据库。
 func (h *AgentHandler) hitlRequestWithMergedConfigWhitelist(req *HITLRequest) *HITLRequest {
-	gw := h.hitlConfigGlobalToolWhitelist()
-	if len(gw) == 0 {
-		return req
-	}
 	if req == nil {
 		return nil
 	}
 	seen := make(map[string]struct{})
-	union := make([]string, 0, len(gw)+len(req.SensitiveTools))
-	for _, t := range gw {
+	union := make([]string, 0, len(req.SensitiveTools)+16)
+	add := func(t string) {
 		n := strings.ToLower(strings.TrimSpace(t))
 		if n == "" {
-			continue
+			return
 		}
 		if _, ok := seen[n]; ok {
-			continue
+			return
 		}
 		seen[n] = struct{}{}
 		union = append(union, strings.TrimSpace(t))
 	}
+	for _, t := range h.hitlConfigGlobalToolWhitelist() {
+		add(t)
+	}
 	for _, t := range req.SensitiveTools {
-		n := strings.ToLower(strings.TrimSpace(t))
-		if n == "" {
-			continue
-		}
-		if _, ok := seen[n]; ok {
-			continue
-		}
-		seen[n] = struct{}{}
-		union = append(union, strings.TrimSpace(t))
+		add(t)
 	}
 	out := *req
-	out.SensitiveTools = union
+	out.SensitiveTools = multiagent.MergeHitlExemptMetaTools(union)
 	return &out
 }
 
@@ -362,22 +355,22 @@ func (m *HITLManager) SaveConversationConfig(conversationID string, req *HITLReq
 		timeout = 0
 	}
 	_, err := m.db.Exec(`INSERT INTO hitl_conversation_configs
-		(conversation_id, enabled, mode, sensitive_tools, timeout_seconds, updated_at)
-		VALUES (?, ?, ?, ?, ?, ?)
+		(conversation_id, enabled, mode, reviewer, sensitive_tools, timeout_seconds, updated_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?)
 		ON CONFLICT(conversation_id) DO UPDATE SET
-		enabled=excluded.enabled, mode=excluded.mode, sensitive_tools=excluded.sensitive_tools, timeout_seconds=excluded.timeout_seconds, updated_at=excluded.updated_at`,
-		conversationID, boolToInt(req.Enabled), mode, string(tools), timeout, time.Now())
+		enabled=excluded.enabled, mode=excluded.mode, reviewer=excluded.reviewer, sensitive_tools=excluded.sensitive_tools, timeout_seconds=excluded.timeout_seconds, updated_at=excluded.updated_at`,
+		conversationID, boolToInt(req.Enabled), mode, normalizeHitlReviewer(req.Reviewer), string(tools), timeout, time.Now())
 	return err
 }
 
 func (m *HITLManager) LoadConversationConfig(conversationID string) (*HITLRequest, error) {
 	var enabledInt int
-	var mode, toolsJSON string
+	var mode, reviewer, toolsJSON string
 	var timeout int
-	err := m.db.QueryRow(`SELECT enabled, mode, sensitive_tools, timeout_seconds FROM hitl_conversation_configs WHERE conversation_id = ?`, conversationID).
-		Scan(&enabledInt, &mode, &toolsJSON, &timeout)
+	err := m.db.QueryRow(`SELECT enabled, mode, COALESCE(reviewer,'human'), sensitive_tools, timeout_seconds FROM hitl_conversation_configs WHERE conversation_id = ?`, conversationID).
+		Scan(&enabledInt, &mode, &reviewer, &toolsJSON, &timeout)
 	if errors.Is(err, sql.ErrNoRows) {
-		return &HITLRequest{Enabled: false, Mode: "off", SensitiveTools: []string{}, TimeoutSeconds: 0}, nil
+		return &HITLRequest{Enabled: false, Mode: "off", Reviewer: "human", SensitiveTools: []string{}, TimeoutSeconds: 0}, nil
 	}
 	if err != nil {
 		return nil, err
@@ -390,11 +383,24 @@ func (m *HITLManager) LoadConversationConfig(conversationID string) (*HITLReques
 	return &HITLRequest{
 		Enabled:        enabledInt == 1,
 		Mode:           mode,
+		Reviewer:       normalizeHitlReviewer(reviewer),
 		SensitiveTools: tools,
 		TimeoutSeconds: timeout,
 	}, nil
 }
 
+func (m *HITLManager) HasConversationConfig(conversationID string) (bool, error) {
+	if strings.TrimSpace(conversationID) == "" {
+		return false, nil
+	}
+	var one int
+	err := m.db.QueryRow(`SELECT 1 FROM hitl_conversation_configs WHERE conversation_id = ? LIMIT 1`, conversationID).Scan(&one)
+	if errors.Is(err, sql.ErrNoRows) {
+		return false, nil
+	}
+	return err == nil, err
+}
+
 func (m *HITLManager) waitDecision(ctx context.Context, p *pendingInterrupt, timeout time.Duration) (hitlDecision, error) {
 	defer func() {
 		m.mu.Lock()
@@ -413,15 +419,16 @@ func (m *HITLManager) waitDecision(ctx context.Context, p *pendingInterrupt, tim
 		if p.Mode != "review_edit" && len(d.EditedArguments) > 0 {
 			d.EditedArguments = nil
 		}
-		_, _ = m.db.Exec(`UPDATE hitl_interrupts SET status='decided', decision=?, decision_comment=?, decided_at=? WHERE id=?`,
+		_, _ = m.db.Exec(`UPDATE hitl_interrupts SET status='decided', decision=?, decision_comment=?, decided_at=?, decided_by='human' WHERE id=?`,
 			d.Decision, d.Comment, time.Now(), p.InterruptID)
 		return d, nil
 	case <-timeoutCh:
-		_, _ = m.db.Exec(`UPDATE hitl_interrupts SET status='timeout', decision='approve', decision_comment='timeout auto approve', decided_at=? WHERE id=?`,
-			time.Now(), p.InterruptID)
-		return hitlDecision{Decision: "approve", Comment: "timeout auto approve"}, nil
+		comment := "HITL timeout auto-reject for safety"
+		_, _ = m.db.Exec(`UPDATE hitl_interrupts SET status='timeout', decision='reject', decision_comment=?, decided_at=?, decided_by='system' WHERE id=?`,
+			comment, time.Now(), p.InterruptID)
+		return hitlDecision{Decision: "reject", Comment: comment}, nil
 	case <-ctx.Done():
-		_, _ = m.db.Exec(`UPDATE hitl_interrupts SET status='cancelled', decision='reject', decision_comment='task cancelled', decided_at=? WHERE id=?`,
+		_, _ = m.db.Exec(`UPDATE hitl_interrupts SET status='cancelled', decision='reject', decision_comment='task cancelled', decided_at=?, decided_by='system' WHERE id=?`,
 			time.Now(), p.InterruptID)
 		return hitlDecision{Decision: "reject", Comment: "task cancelled"}, ctx.Err()
 	}
@@ -432,25 +439,88 @@ func (h *AgentHandler) activateHITLForConversation(conversationID string, req *H
 		return
 	}
 	if req == nil {
-		cfg, err := h.hitlManager.LoadConversationConfig(conversationID)
+		cfg, err := h.loadHITLConversationConfig(conversationID)
 		if err == nil {
 			req = cfg
 		}
 	}
+	if req != nil && strings.TrimSpace(req.Reviewer) == "" {
+		req.Reviewer = h.hitlEffectiveDefaultReviewer()
+	}
 	h.hitlManager.ActivateConversation(conversationID, h.hitlRequestWithMergedConfigWhitelist(req))
 }
 
+func (h *AgentHandler) loadHITLConversationConfig(conversationID string) (*HITLRequest, error) {
+	cfg, err := h.hitlManager.LoadConversationConfig(conversationID)
+	if err != nil {
+		return nil, err
+	}
+	has, err := h.hitlManager.HasConversationConfig(conversationID)
+	if err != nil {
+		return nil, err
+	}
+	if !has {
+		cfg.Reviewer = h.hitlEffectiveDefaultReviewer()
+	}
+	return cfg, nil
+}
+
 func (h *AgentHandler) waitHITLApproval(runCtx context.Context, cancelRun context.CancelCauseFunc, conversationID, assistantMessageID, toolName, toolCallID string, payload map[string]interface{}, sendEventFunc func(eventType, message string, data interface{})) (*hitlDecision, error) {
 	cfg, need := h.hitlManager.shouldInterrupt(conversationID, toolName)
 	if !need {
 		return nil, nil
 	}
+	h.enrichHitlApprovalPayload(conversationID, assistantMessageID, payload)
 	payloadRaw, _ := json.Marshal(payload)
 	p, err := h.hitlManager.CreatePendingInterrupt(conversationID, assistantMessageID, cfg.Mode, toolName, toolCallID, string(payloadRaw))
 	if err != nil {
 		h.logger.Warn("创建 HITL 中断失败", zap.Error(err))
 		return nil, err
 	}
+
+	if cfg.Reviewer == "audit_agent" {
+		ad := h.auditAgentReview(runCtx, cfg.Mode, toolName, payload)
+		now := time.Now()
+		_, _ = h.db.Exec(`UPDATE hitl_interrupts SET status='decided', decision=?, decision_comment=?, decided_at=?, decided_by='audit_agent' WHERE id=?`,
+			ad.Decision, ad.Comment, now, p.InterruptID)
+		if sendEventFunc != nil {
+			sendEventFunc("hitl_audit_agent", "审计 Agent 已裁决", map[string]interface{}{
+				"conversationId": conversationID,
+				"interruptId":    p.InterruptID,
+				"toolName":       toolName,
+				"mode":           cfg.Mode,
+				"decision":       ad.Decision,
+				"comment":        ad.Comment,
+				"editedArgs":     ad.EditedArguments,
+				"decidedBy":      "audit_agent",
+			})
+		}
+		if ad.Decision == "reject" {
+			if sendEventFunc != nil {
+				sendEventFunc("hitl_rejected", "审计 Agent 拒绝本次工具调用", map[string]interface{}{
+					"conversationId": conversationID,
+					"interruptId":    p.InterruptID,
+					"toolName":       toolName,
+					"comment":        ad.Comment,
+					"decidedBy":      "audit_agent",
+				})
+			}
+			return &ad, nil
+		}
+		if sendEventFunc != nil {
+			sendEventFunc("hitl_resumed", "审计 Agent 已通过，继续执行", map[string]interface{}{
+				"conversationId": conversationID,
+				"interruptId":    p.InterruptID,
+				"toolName":       toolName,
+				"comment":        ad.Comment,
+				"editedArgs":     ad.EditedArguments,
+				"decidedBy":      "audit_agent",
+			})
+		}
+		h.hitlManager.TrackApprovedHitlExecution(p.InterruptID, conversationID, toolName, toolCallID)
+		return &ad, nil
+	}
+
 	if sendEventFunc != nil {
 		sendEventFunc("hitl_interrupt", "命中人机协同审批", map[string]interface{}{
 			"conversationId": conversationID,
@@ -479,8 +549,12 @@ func (h *AgentHandler) waitHITLApproval(runCtx context.Context, cancelRun contex
 		return nil, waitErr
 	}
 	if d.Decision == "reject" {
+		rejectMsg := "人工拒绝本次工具调用，模型将基于反馈继续迭代"
+		if strings.Contains(strings.ToLower(strings.TrimSpace(d.Comment)), "timeout") {
+			rejectMsg = "审批超时，安全起见已自动拒绝，模型将基于反馈继续迭代"
+		}
 		if sendEventFunc != nil {
-			sendEventFunc("hitl_rejected", "人工拒绝本次工具调用，模型将基于反馈继续迭代", map[string]interface{}{
+			sendEventFunc("hitl_rejected", rejectMsg, map[string]interface{}{
 				"conversationId": conversationID,
 				"interruptId":    p.InterruptID,
 				"toolName":       toolName,
@@ -498,6 +572,7 @@ func (h *AgentHandler) waitHITLApproval(runCtx context.Context, cancelRun contex
 			"editedArgs":     d.EditedArguments,
 		})
 	}
+	h.hitlManager.TrackApprovedHitlExecution(p.InterruptID, conversationID, toolName, toolCallID)
 	return &d, nil
 }
 
@@ -527,11 +602,6 @@ func (h *AgentHandler) handleHITLToolCall(runCtx context.Context, cancelRun cont
 }
 
 func (h *AgentHandler) ListHITLPending(c *gin.Context) {
-	conversationID := strings.TrimSpace(c.Query("conversationId"))
-	status := strings.TrimSpace(c.Query("status"))
-	if status == "" {
-		status = "pending"
-	}
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
 	if page < 1 {
 		page = 1
@@ -539,15 +609,12 @@ func (h *AgentHandler) ListHITLPending(c *gin.Context) {
 	pageSize, _ := strconv.Atoi(c.DefaultQuery("pageSize", "20"))
 	pageSize = int(math.Max(1, math.Min(float64(pageSize), 200)))
 	offset := (page - 1) * pageSize
-	q := `SELECT id, conversation_id, message_id, mode, tool_name, tool_call_id, payload, status, decision, decision_comment, created_at, decided_at FROM hitl_interrupts WHERE 1=1`
-	args := []interface{}{}
-	if conversationID != "" {
-		q += " AND conversation_id = ?"
-		args = append(args, conversationID)
-	}
-	if status != "all" {
-		q += " AND status = ?"
-		args = append(args, status)
+	q, args := h.buildHitlListQuery(false)
+	q, args = h.appendHitlListFilters(q, args, c)
+	total, err := h.countHitlQuery(q, args)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
 	}
 	q += " ORDER BY created_at DESC LIMIT ? OFFSET ?"
 	args = append(args, pageSize, offset)
@@ -557,41 +624,12 @@ func (h *AgentHandler) ListHITLPending(c *gin.Context) {
 		return
 	}
 	defer rows.Close()
-	items := make([]map[string]interface{}, 0)
-	for rows.Next() {
-		var id, cid, mode, toolName, toolCallID, payload, rowStatus string
-		var messageID sql.NullString
-		var decision, comment sql.NullString
-		var createdAt time.Time
-		var decidedAt sql.NullTime
-		if err := rows.Scan(&id, &cid, &messageID, &mode, &toolName, &toolCallID, &payload, &rowStatus, &decision, &comment, &createdAt, &decidedAt); err != nil {
-			continue
-		}
-		msgID := ""
-		if messageID.Valid {
-			msgID = messageID.String
-		}
-		items = append(items, map[string]interface{}{
-			"id":             id,
-			"conversationId": cid,
-			"messageId":      msgID,
-			"mode":           mode,
-			"toolName":       toolName,
-			"toolCallId":     toolCallID,
-			"payload":        payload,
-			"status":         rowStatus,
-			"decision":       decision.String,
-			"comment":        comment.String,
-			"createdAt":      createdAt,
-			"decidedAt": func() interface{} {
-				if decidedAt.Valid {
-					return decidedAt.Time
-				}
-				return nil
-			}(),
-		})
+	items, err := h.scanHitlInterruptRows(rows)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
 	}
-	c.JSON(http.StatusOK, gin.H{"items": items, "page": page, "pageSize": pageSize})
+	c.JSON(http.StatusOK, gin.H{"items": items, "page": page, "pageSize": pageSize, "total": total})
 }
 
 type hitlDecisionReq struct {
@@ -636,7 +674,7 @@ func (h *AgentHandler) DismissHITLInterrupt(c *gin.Context) {
 		return
 	}
 	res, err := h.db.Exec(`UPDATE hitl_interrupts SET status='cancelled', decision='reject',
-		decision_comment='dismissed by user', decided_at=CURRENT_TIMESTAMP
+		decision_comment='dismissed by user', decided_at=CURRENT_TIMESTAMP, decided_by='human'
 		WHERE id=? AND status='pending'`, req.InterruptID)
 	if err != nil {
 		c.JSON(500, gin.H{"error": err.Error()})
@@ -702,7 +740,7 @@ func (h *AgentHandler) GetHITLConversationConfig(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "conversationId is required"})
 		return
 	}
-	cfg, err := h.hitlManager.LoadConversationConfig(conversationID)
+	cfg, err := h.loadHITLConversationConfig(conversationID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -721,6 +759,7 @@ func (h *AgentHandler) GetHITLConversationConfig(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{
 		"conversationId":          conversationID,
 		"hitl":                    cfg,
+		"defaultReviewer":         h.hitlEffectiveDefaultReviewer(),
 		"hitlGlobalToolWhitelist": h.hitlConfigGlobalToolWhitelist(),
 	})
 }
@@ -732,6 +771,10 @@ func (h *AgentHandler) UpsertHITLConversationConfig(c *gin.Context) {
 		return
 	}
 	req.Mode = normalizeHitlMode(req.Mode)
+	req.Reviewer = normalizeHitlReviewer(req.Reviewer)
+	if strings.TrimSpace(req.Reviewer) == "" {
+		req.Reviewer = h.hitlEffectiveDefaultReviewer()
+	}
 	if err := h.hitlManager.SaveConversationConfig(req.ConversationID, &req.HITLRequest); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -753,6 +796,85 @@ type mergeHitlGlobalWhitelistReq struct {
 	SensitiveTools []string `json:"sensitiveTools"`
 }
 
+type setHitlGlobalWhitelistReq struct {
+	ToolWhitelist []string `json:"toolWhitelist"`
+}
+
+// GetHITLGlobalToolWhitelist 返回 config.yaml 中的全局免审批工具白名单。
+func (h *AgentHandler) GetHITLGlobalToolWhitelist(c *gin.Context) {
+	c.JSON(http.StatusOK, gin.H{
+		"toolWhitelist":   h.hitlConfigGlobalToolWhitelist(),
+		"defaultReviewer": h.hitlEffectiveDefaultReviewer(),
+	})
+}
+
+type setHitlDefaultReviewerReq struct {
+	Reviewer string `json:"reviewer"`
+}
+
+// GetHITLDefaultReviewer 返回 config.yaml 中的全局默认审批方。
+func (h *AgentHandler) GetHITLDefaultReviewer(c *gin.Context) {
+	c.JSON(http.StatusOK, gin.H{
+		"defaultReviewer": h.hitlEffectiveDefaultReviewer(),
+	})
+}
+
+// UpdateHITLDefaultReviewer 将全局默认审批方写入 config.yaml（未选会话时切换审批方）。
+func (h *AgentHandler) UpdateHITLDefaultReviewer(c *gin.Context) {
+	if h.hitlDefaultReviewerSaver == nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "HITL 配置持久化不可用"})
+		return
+	}
+	var req setHitlDefaultReviewerReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	reviewer := normalizeHitlReviewer(req.Reviewer)
+	if err := h.hitlDefaultReviewerSaver.UpdateHitlDefaultReviewer(reviewer); err != nil {
+		h.logger.Warn("写入 HITL 默认审批方到 config.yaml 失败", zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if h.config != nil {
+		h.config.Hitl.DefaultReviewer = reviewer
+	}
+	if h.audit != nil {
+		h.audit.RecordOK(c, "hitl", "default_reviewer_update", "HITL 全局默认审批方更新", "hitl_config", "default_reviewer", nil)
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"ok":              true,
+		"defaultReviewer": reviewer,
+	})
+}
+
+// SetHITLGlobalToolWhitelist 整表替换 config.yaml 中的全局免审批工具白名单。
+func (h *AgentHandler) SetHITLGlobalToolWhitelist(c *gin.Context) {
+	if h.hitlWhitelistSaver == nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "HITL 配置持久化不可用"})
+		return
+	}
+	var req setHitlGlobalWhitelistReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := h.hitlWhitelistSaver.SetHitlToolWhitelist(req.ToolWhitelist); err != nil {
+		h.logger.Warn("写入 HITL 工具白名单到 config.yaml 失败", zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if h.audit != nil {
+		h.audit.RecordOK(c, "hitl", "tool_whitelist_update", "HITL 全局白名单更新", "hitl_config", "tool_whitelist", nil)
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"ok":                      true,
+		"toolWhitelist":           h.hitlConfigGlobalToolWhitelist(),
+		"hitlGlobalToolWhitelist":   h.hitlConfigGlobalToolWhitelist(),
+		"hitlGlobalWhitelistMerged": false,
+	})
+}
+
 // MergeHITLGlobalToolWhitelist 无会话 ID 时将侧栏提交的免审批工具合并进 config.yaml（与 PUT /hitl/config 中白名单落盘规则一致）。
 func (h *AgentHandler) MergeHITLGlobalToolWhitelist(c *gin.Context) {
 	if h.hitlWhitelistSaver == nil {

internal/handler/hitl_audit_agent.go

@@ -0,0 +1,357 @@
+package handler
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"cyberstrike-ai/internal/config"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+)
+
+// auditAgentReview 在 reviewer=audit_agent 时由 LLM 代行审批。
+// 白名单工具在 shouldInterrupt 阶段已跳过，到达此处的一律需要裁决。
+func (h *AgentHandler) auditAgentReview(ctx context.Context, hitlMode, toolName string, payload map[string]interface{}) hitlDecision {
+	if h == nil {
+		return hitlDecision{Decision: "reject", Comment: "audit agent: handler unavailable"}
+	}
+	mode := normalizeHitlMode(hitlMode)
+	prompt := config.DefaultHitlAuditAgentPrompt()
+	if h.config != nil {
+		prompt = h.config.Hitl.EffectiveAuditAgentPromptForMode(mode)
+	}
+	if h.auditLLM == nil {
+		return hitlDecision{Decision: "reject", Comment: "audit agent: LLM 未配置"}
+	}
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	callCtx, cancel := context.WithTimeout(ctx, 90*time.Second)
+	defer cancel()
+
+	userContent := buildAuditAgentReviewInput(mode, toolName, payload)
+	requestBody := map[string]interface{}{
+		"model": h.auditLLMModel(),
+		"messages": []map[string]interface{}{
+			{"role": "system", "content": prompt},
+			{"role": "user", "content": userContent},
+		},
+		"temperature":           0.1,
+		"max_completion_tokens": 1024,
+		// 审计裁决需要结构化 JSON；关闭 thinking 避免 Qwen 等把正文放进 reasoning_content 导致解析失败。
+		"thinking": map[string]interface{}{"type": "disabled"},
+	}
+
+	var apiResponse struct {
+		Choices []struct {
+			Message struct {
+				Content          string `json:"content"`
+				ReasoningContent string `json:"reasoning_content"`
+			} `json:"message"`
+		} `json:"choices"`
+	}
+	if err := h.auditLLM.ChatCompletion(callCtx, requestBody, &apiResponse); err != nil {
+		h.logger.Warn("审计 Agent LLM 调用失败", zap.Error(err), zap.String("tool", toolName))
+		return hitlDecision{
+			Decision: "reject",
+			Comment:  "audit agent: LLM 调用失败，保守拒绝",
+		}
+	}
+	if len(apiResponse.Choices) == 0 {
+		return hitlDecision{Decision: "reject", Comment: "audit agent: LLM 无有效响应，保守拒绝"}
+	}
+	msg := apiResponse.Choices[0].Message
+	raw := strings.TrimSpace(msg.Content)
+	if raw == "" {
+		raw = strings.TrimSpace(msg.ReasoningContent)
+	}
+	dec, err := parseAuditAgentLLMContent(raw)
+	if err != nil {
+		snippet := raw
+		if len(snippet) > 240 {
+			snippet = snippet[:240] + "..."
+		}
+		h.logger.Warn("审计 Agent 响应解析失败",
+			zap.Error(err),
+			zap.String("tool", toolName),
+			zap.String("mode", mode),
+			zap.String("snippet", snippet),
+		)
+		return hitlDecision{Decision: "reject", Comment: "audit agent: 响应无法解析，保守拒绝"}
+	}
+	if mode != "review_edit" && len(dec.EditedArguments) > 0 {
+		h.logger.Warn("审计 Agent 在审批模式下返回 editedArguments，已忽略",
+			zap.String("tool", toolName),
+		)
+		dec.EditedArguments = nil
+	}
+	if dec.Comment == "" {
+		dec.Comment = "audit agent: " + dec.Decision
+	} else if !strings.HasPrefix(strings.ToLower(dec.Comment), "audit agent") {
+		dec.Comment = "audit agent: " + dec.Comment
+	}
+	return dec
+}
+
+func (h *AgentHandler) auditLLMModel() string {
+	if h.config != nil && strings.TrimSpace(h.config.OpenAI.Model) != "" {
+		return strings.TrimSpace(h.config.OpenAI.Model)
+	}
+	return ""
+}
+
+func buildAuditAgentReviewInput(hitlMode, toolName string, payload map[string]interface{}) string {
+	review := map[string]interface{}{
+		"hitlMode": normalizeHitlMode(hitlMode),
+		"toolName": strings.TrimSpace(toolName),
+	}
+	if payload != nil {
+		for _, k := range []string{"arguments", "argumentsObj", "command", hitlPayloadUserMessage, hitlPayloadThinking, hitlPayloadReasoningChain, hitlPayloadPlanning} {
+			if v, ok := payload[k]; ok && v != nil && fmt.Sprint(v) != "" {
+				review[k] = v
+			}
+		}
+	}
+	b, err := json.MarshalIndent(review, "", "  ")
+	if err != nil {
+		return fmt.Sprintf(`{"hitlMode":%q,"toolName":%q}`, normalizeHitlMode(hitlMode), toolName)
+	}
+	return string(b)
+}
+
+func parseAuditAgentLLMContent(content string) (hitlDecision, error) {
+	s := strings.TrimSpace(content)
+	if s == "" {
+		return hitlDecision{}, errors.New("empty content")
+	}
+	for _, candidate := range auditAgentJSONCandidates(s) {
+		dec, comment, editedArgs, err := parseAuditAgentDecisionObject(candidate)
+		if err == nil {
+			return hitlDecision{
+				Decision:        dec,
+				Comment:         comment,
+				EditedArguments: editedArgs,
+			}, nil
+		}
+	}
+	return hitlDecision{}, fmt.Errorf("no valid decision json in response")
+}
+
+func auditAgentJSONCandidates(s string) []string {
+	out := make([]string, 0, 4)
+	seen := make(map[string]struct{})
+	add := func(c string) {
+		c = strings.TrimSpace(c)
+		if c == "" {
+			return
+		}
+		if _, ok := seen[c]; ok {
+			return
+		}
+		seen[c] = struct{}{}
+		out = append(out, c)
+	}
+	add(s)
+	add(stripMarkdownCodeFence(s))
+	if obj := extractFirstJSONObject(s); obj != "" {
+		add(obj)
+	}
+	if obj := extractFirstJSONObject(stripMarkdownCodeFence(s)); obj != "" {
+		add(obj)
+	}
+	return out
+}
+
+func stripMarkdownCodeFence(s string) string {
+	s = strings.TrimSpace(s)
+	for _, fence := range []string{"```json", "```JSON", "```"} {
+		if strings.HasPrefix(s, fence) {
+			s = strings.TrimPrefix(s, fence)
+		}
+	}
+	s = strings.TrimSuffix(s, "```")
+	return strings.TrimSpace(s)
+}
+
+func extractFirstJSONObject(s string) string {
+	start := strings.Index(s, "{")
+	if start < 0 {
+		return ""
+	}
+	depth := 0
+	inStr := false
+	esc := false
+	for i := start; i < len(s); i++ {
+		ch := s[i]
+		if inStr {
+			if esc {
+				esc = false
+				continue
+			}
+			if ch == '\\' {
+				esc = true
+				continue
+			}
+			if ch == '"' {
+				inStr = false
+			}
+			continue
+		}
+		switch ch {
+		case '"':
+			inStr = true
+		case '{':
+			depth++
+		case '}':
+			depth--
+			if depth == 0 {
+				return s[start : i+1]
+			}
+		}
+	}
+	return ""
+}
+
+func parseAuditAgentDecisionObject(jsonText string) (decision, comment string, editedArgs map[string]interface{}, err error) {
+	var parsed map[string]interface{}
+	if err := json.Unmarshal([]byte(jsonText), &parsed); err != nil {
+		return "", "", nil, err
+	}
+	rawDecision := auditAgentPickString(parsed, "decision", "Decision", "result", "action", "verdict", "决策", "决定")
+	decision = normalizeAuditAgentDecision(rawDecision)
+	if decision == "" {
+		return "", "", nil, fmt.Errorf("missing decision")
+	}
+	comment = auditAgentPickString(parsed, "comment", "Comment", "reason", "message", "rationale", "备注", "理由", "说明")
+	editedArgs = auditAgentPickObject(parsed, "editedArguments", "edited_arguments", "editedArgs")
+	return decision, strings.TrimSpace(comment), editedArgs, nil
+}
+
+func auditAgentPickString(m map[string]interface{}, keys ...string) string {
+	for _, k := range keys {
+		if v, ok := m[k]; ok && v != nil {
+			s := strings.TrimSpace(fmt.Sprint(v))
+			if s != "" {
+				return s
+			}
+		}
+	}
+	return ""
+}
+
+func auditAgentPickObject(m map[string]interface{}, keys ...string) map[string]interface{} {
+	for _, k := range keys {
+		v, ok := m[k]
+		if !ok || v == nil {
+			continue
+		}
+		switch t := v.(type) {
+		case map[string]interface{}:
+			if len(t) > 0 {
+				return t
+			}
+		case string:
+			s := strings.TrimSpace(t)
+			if s == "" || s == "{}" {
+				continue
+			}
+			var obj map[string]interface{}
+			if err := json.Unmarshal([]byte(s), &obj); err == nil && len(obj) > 0 {
+				return obj
+			}
+		}
+	}
+	return nil
+}
+
+func normalizeAuditAgentDecision(v string) string {
+	d := strings.ToLower(strings.TrimSpace(v))
+	switch d {
+	case "approve", "approved", "pass", "passed", "allow", "allowed", "yes", "ok", "accept", "accepted":
+		return "approve"
+	case "reject", "rejected", "deny", "denied", "no", "block", "blocked", "refuse", "refused":
+		return "reject"
+	}
+	switch strings.TrimSpace(v) {
+	case "通过", "批准", "允许", "同意", "放行":
+		return "approve"
+	case "拒绝", "驳回", "禁止", "否决":
+		return "reject"
+	}
+	return ""
+}
+
+type hitlAuditStrategyReq struct {
+	AuditAgentPrompt           string `json:"auditAgentPrompt"`
+	AuditAgentPromptReviewEdit string `json:"auditAgentPromptReviewEdit"`
+}
+
+func (h *AgentHandler) GetHITLAuditStrategy(c *gin.Context) {
+	approvalPrompt := config.DefaultHitlAuditAgentPrompt()
+	reviewEditPrompt := config.DefaultHitlAuditAgentPromptReviewEdit()
+	approvalCustom := false
+	reviewEditCustom := false
+	if h.config != nil {
+		approvalPrompt = h.config.Hitl.EffectiveAuditAgentPromptForMode("approval")
+		reviewEditPrompt = h.config.Hitl.EffectiveAuditAgentPromptForMode("review_edit")
+		approvalCustom = strings.TrimSpace(h.config.Hitl.AuditAgentPrompt) != ""
+		reviewEditCustom = strings.TrimSpace(h.config.Hitl.AuditAgentPromptReviewEdit) != ""
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"auditAgentPrompt":                  approvalPrompt,
+		"auditAgentPromptCustom":            approvalCustom,
+		"auditAgentPromptReviewEdit":        reviewEditPrompt,
+		"auditAgentPromptReviewEditCustom":  reviewEditCustom,
+		"defaultAuditAgentPrompt":           config.DefaultHitlAuditAgentPrompt(),
+		"defaultAuditAgentPromptReviewEdit": config.DefaultHitlAuditAgentPromptReviewEdit(),
+	})
+}
+
+func (h *AgentHandler) UpdateHITLAuditStrategy(c *gin.Context) {
+	if h.hitlStrategySaver == nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "HITL 策略持久化不可用"})
+		return
+	}
+	var req hitlAuditStrategyReq
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	approvalPrompt := strings.TrimSpace(req.AuditAgentPrompt)
+	reviewEditPrompt := strings.TrimSpace(req.AuditAgentPromptReviewEdit)
+	if err := h.hitlStrategySaver.UpdateHitlAuditAgentStrategy(approvalPrompt, reviewEditPrompt); err != nil {
+		h.logger.Warn("保存审计 Agent 提示词失败", zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if h.audit != nil {
+		h.audit.RecordOK(c, "hitl", "audit_strategy_update", "HITL 审计策略更新", "hitl_config", "audit_agent_prompt", nil)
+	}
+	if h.config != nil {
+		h.config.Hitl.AuditAgentPrompt = approvalPrompt
+		h.config.Hitl.AuditAgentPromptReviewEdit = reviewEditPrompt
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"ok":                                true,
+		"auditAgentPrompt":                  config.HitlConfig{AuditAgentPrompt: approvalPrompt}.EffectiveAuditAgentPromptForMode("approval"),
+		"auditAgentPromptCustom":            approvalPrompt != "",
+		"auditAgentPromptReviewEdit":        config.HitlConfig{AuditAgentPromptReviewEdit: reviewEditPrompt}.EffectiveAuditAgentPromptForMode("review_edit"),
+		"auditAgentPromptReviewEditCustom":  reviewEditPrompt != "",
+	})
+}
+
+// HitlAuditStrategySaver 持久化审计 Agent 提示词到 config.yaml。
+type HitlAuditStrategySaver interface {
+	UpdateHitlAuditAgentStrategy(approvalPrompt, reviewEditPrompt string) error
+}
+
+// SetHitlAuditStrategySaver 设置审计策略落盘。
+func (h *AgentHandler) SetHitlAuditStrategySaver(s HitlAuditStrategySaver) {
+	h.hitlStrategySaver = s
+}

internal/handler/hitl_audit_agent_test.go

@@ -0,0 +1,88 @@
+package handler
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestParseAuditAgentLLMContentApprove(t *testing.T) {
+	d, err := parseAuditAgentLLMContent(`{"decision":"approve","comment":"与任务一致"}`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if d.Decision != "approve" || d.Comment != "与任务一致" {
+		t.Fatalf("unexpected %+v", d)
+	}
+}
+
+func TestParseAuditAgentLLMContentReject(t *testing.T) {
+	d, err := parseAuditAgentLLMContent("```json\n{\"decision\":\"reject\",\"comment\":\"风险过高\"}\n```")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if d.Decision != "reject" {
+		t.Fatalf("expected reject, got %s", d.Decision)
+	}
+}
+
+func TestParseAuditAgentLLMContentInvalid(t *testing.T) {
+	_, err := parseAuditAgentLLMContent(`{"decision":"maybe"}`)
+	if err == nil {
+		t.Fatal("expected error for invalid decision")
+	}
+}
+
+func TestParseAuditAgentLLMContentProseWrapped(t *testing.T) {
+	d, err := parseAuditAgentLLMContent("好的，裁决如下：\n```json\n{\"decision\":\"approve\",\"comment\":\"只读 ls\"}\n```\n以上。")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if d.Decision != "approve" {
+		t.Fatalf("expected approve, got %s", d.Decision)
+	}
+}
+
+func TestParseAuditAgentLLMContentChineseDecision(t *testing.T) {
+	d, err := parseAuditAgentLLMContent(`{"decision":"通过","comment":"风险低"}`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if d.Decision != "approve" {
+		t.Fatalf("expected approve, got %s", d.Decision)
+	}
+}
+
+func TestParseAuditAgentLLMContentWithEditedArguments(t *testing.T) {
+	d, err := parseAuditAgentLLMContent(`{"decision":"approve","comment":"收窄路径","editedArguments":{"path":"/safe"}}`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if d.Decision != "approve" {
+		t.Fatalf("expected approve, got %s", d.Decision)
+	}
+	if d.EditedArguments == nil || d.EditedArguments["path"] != "/safe" {
+		t.Fatalf("unexpected edited args: %+v", d.EditedArguments)
+	}
+}
+
+func TestBuildAuditAgentReviewInputIncludesMode(t *testing.T) {
+	s := buildAuditAgentReviewInput("review_edit", "execute", map[string]interface{}{
+		"arguments": `{"command":"pwd"}`,
+	})
+	if !strings.Contains(s, "review_edit") || !strings.Contains(s, "execute") {
+		t.Fatalf("unexpected input: %s", s)
+	}
+}
+
+func TestBuildAuditAgentReviewInput(t *testing.T) {
+	s := buildAuditAgentReviewInput("approval", "nmap", map[string]interface{}{
+		"arguments":   `{"target":"10.0.0.1"}`,
+		"userMessage": "扫描内网",
+	})
+	if s == "" {
+		t.Fatal("expected non-empty input")
+	}
+	if !strings.Contains(s, "nmap") || !strings.Contains(s, "10.0.0.1") || !strings.Contains(s, "扫描内网") {
+		t.Fatalf("unexpected input: %s", s)
+	}
+}

internal/handler/hitl_cognition.go

@@ -0,0 +1,97 @@
+package handler
+
+import (
+	"strings"
+)
+
+type hitlCognitionState struct {
+	AssistantMessageID string
+	UserMessage        string
+	Thinking           string
+	ReasoningChain     string
+	Planning           string
+}
+
+// GetHitlCognition 返回当前运行任务上缓存的本轮 HITL 上下文（不含会话历史）。
+func (m *AgentTaskManager) GetHitlCognition(conversationID string) hitlCognitionFields {
+	conversationID = strings.TrimSpace(conversationID)
+	if m == nil || conversationID == "" {
+		return hitlCognitionFields{}
+	}
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	t, ok := m.tasks[conversationID]
+	if !ok || t == nil || t.hitlCognition == nil {
+		return hitlCognitionFields{}
+	}
+	c := t.hitlCognition
+	return hitlCognitionFields{
+		UserMessage:    c.UserMessage,
+		Thinking:       c.Thinking,
+		ReasoningChain: c.ReasoningChain,
+		Planning:       c.Planning,
+	}
+}
+
+// ResetHitlCognition 新任务开始时重置本轮 HITL 上下文。
+func (m *AgentTaskManager) ResetHitlCognition(conversationID, userMessage string) {
+	conversationID = strings.TrimSpace(conversationID)
+	if m == nil || conversationID == "" {
+		return
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	t, ok := m.tasks[conversationID]
+	if !ok || t == nil {
+		return
+	}
+	t.hitlCognition = &hitlCognitionState{UserMessage: strings.TrimSpace(userMessage)}
+}
+
+// SetHitlAssistantMessageID 记录当前助手消息 ID，供 HITL 与 DB 回退对齐。
+func (m *AgentTaskManager) SetHitlAssistantMessageID(conversationID, assistantMessageID string) {
+	conversationID = strings.TrimSpace(conversationID)
+	assistantMessageID = strings.TrimSpace(assistantMessageID)
+	if m == nil || conversationID == "" || assistantMessageID == "" {
+		return
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	t, ok := m.tasks[conversationID]
+	if !ok || t == nil {
+		return
+	}
+	if t.hitlCognition == nil {
+		t.hitlCognition = &hitlCognitionState{}
+	}
+	t.hitlCognition.AssistantMessageID = assistantMessageID
+}
+
+// UpdateHitlCognitionSnapshot 从进行中的进度流快照更新 thinking / reasoning / planning。
+func (m *AgentTaskManager) UpdateHitlCognitionSnapshot(conversationID, assistantMessageID, thinking, reasoningChain, planning string) {
+	conversationID = strings.TrimSpace(conversationID)
+	if m == nil || conversationID == "" {
+		return
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	t, ok := m.tasks[conversationID]
+	if !ok || t == nil {
+		return
+	}
+	if t.hitlCognition == nil {
+		t.hitlCognition = &hitlCognitionState{}
+	}
+	if id := strings.TrimSpace(assistantMessageID); id != "" {
+		t.hitlCognition.AssistantMessageID = id
+	}
+	if s := strings.TrimSpace(thinking); s != "" {
+		t.hitlCognition.Thinking = s
+	}
+	if s := strings.TrimSpace(reasoningChain); s != "" {
+		t.hitlCognition.ReasoningChain = s
+	}
+	if s := strings.TrimSpace(planning); s != "" {
+		t.hitlCognition.Planning = s
+	}
+}

internal/handler/hitl_context.go

@@ -0,0 +1,102 @@
+package handler
+
+import (
+	"strings"
+)
+
+const (
+	hitlPayloadUserMessage    = "userMessage"
+	hitlPayloadThinking       = "thinking"
+	hitlPayloadReasoningChain = "reasoningChain"
+	hitlPayloadPlanning       = "planning"
+)
+
+type hitlCognitionFields struct {
+	UserMessage    string
+	Thinking       string
+	ReasoningChain string
+	Planning       string
+}
+
+func (h *AgentHandler) enrichHitlApprovalPayload(conversationID, assistantMessageID string, payload map[string]interface{}) {
+	if h == nil || payload == nil {
+		return
+	}
+	cog := h.collectHitlCognition(conversationID, assistantMessageID)
+	if s := strings.TrimSpace(cog.UserMessage); s != "" {
+		payload[hitlPayloadUserMessage] = s
+	}
+	if s := strings.TrimSpace(cog.Thinking); s != "" {
+		payload[hitlPayloadThinking] = s
+	}
+	if s := strings.TrimSpace(cog.ReasoningChain); s != "" {
+		payload[hitlPayloadReasoningChain] = s
+	}
+	if s := strings.TrimSpace(cog.Planning); s != "" {
+		payload[hitlPayloadPlanning] = s
+	}
+}
+
+func (h *AgentHandler) collectHitlCognition(conversationID, assistantMessageID string) hitlCognitionFields {
+	var out hitlCognitionFields
+	if h.tasks != nil {
+		out = h.tasks.GetHitlCognition(conversationID)
+	}
+	if strings.TrimSpace(out.UserMessage) == "" && h.db != nil {
+		if msg, err := h.db.GetTurnUserMessage(conversationID, assistantMessageID); err == nil {
+			out.UserMessage = msg
+		}
+	}
+	if h.db != nil && assistantMessageID != "" {
+		dbCog, err := h.db.GetAssistantCognitionTexts(assistantMessageID)
+		if err == nil {
+			if strings.TrimSpace(out.Thinking) == "" {
+				out.Thinking = dbCog.Thinking
+			}
+			if strings.TrimSpace(out.ReasoningChain) == "" {
+				out.ReasoningChain = dbCog.ReasoningChain
+			}
+			if strings.TrimSpace(out.Planning) == "" {
+				out.Planning = dbCog.Planning
+			}
+		}
+	}
+	return out
+}
+
+func snapshotHitlCognitionFromStreams(thinkingStreams map[string]*thinkingBuf, respPlan *responsePlanAgg) (thinking, reasoningChain, planning string) {
+	if len(thinkingStreams) > 0 {
+		var thinkingParts, reasoningParts []string
+		for _, tb := range thinkingStreams {
+			if tb == nil {
+				continue
+			}
+			content := strings.TrimSpace(tb.b.String())
+			if content == "" {
+				continue
+			}
+			if tb.persistAs == "reasoning_chain" {
+				reasoningParts = append(reasoningParts, content)
+			} else {
+				thinkingParts = append(thinkingParts, content)
+			}
+		}
+		thinking = strings.Join(thinkingParts, "\n\n")
+		reasoningChain = strings.Join(reasoningParts, "\n\n")
+	}
+	if respPlan != nil {
+		planning = strings.TrimSpace(respPlan.b.String())
+	}
+	return thinking, reasoningChain, planning
+}
+
+func (h *AgentHandler) syncHitlCognitionFromProgress(conversationID, assistantMessageID string, thinkingStreams map[string]*thinkingBuf, respPlan *responsePlanAgg) {
+	if h == nil || h.tasks == nil {
+		return
+	}
+	thinking, reasoning, planning := snapshotHitlCognitionFromStreams(thinkingStreams, respPlan)
+	if thinking == "" && reasoning == "" && planning == "" {
+		return
+	}
+	h.tasks.UpdateHitlCognitionSnapshot(conversationID, assistantMessageID, thinking, reasoning, planning)
+}

internal/handler/hitl_context_test.go

@@ -0,0 +1,46 @@
+package handler
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"cyberstrike-ai/internal/database"
+
+	"go.uber.org/zap"
+)
+
+func TestEnrichHitlApprovalPayload(t *testing.T) {
+	tmp := t.TempDir()
+	db, err := database.NewDB(filepath.Join(tmp, "test.sqlite"), zap.NewNop())
+	if err != nil {
+		t.Fatalf("db: %v", err)
+	}
+	defer os.RemoveAll(tmp)
+
+	conv, err := db.CreateConversation("hitl ctx", database.ConversationCreateMeta{})
+	if err != nil {
+		t.Fatalf("conv: %v", err)
+	}
+	if _, err := db.AddMessage(conv.ID, "user", "scan 10.0.0.1 please", nil); err != nil {
+		t.Fatalf("user msg: %v", err)
+	}
+	asst, err := db.AddMessage(conv.ID, "assistant", "", nil)
+	if err != nil {
+		t.Fatalf("asst msg: %v", err)
+	}
+	if err := db.AddProcessDetail(asst.ID, conv.ID, "thinking", "need port scan first", nil); err != nil {
+		t.Fatalf("detail: %v", err)
+	}
+
+	h := &AgentHandler{db: db, tasks: NewAgentTaskManager()}
+	payload := map[string]interface{}{"toolName": "nmap", "arguments": "{}"}
+	h.enrichHitlApprovalPayload(conv.ID, asst.ID, payload)
+
+	if got := payload["userMessage"]; got != "scan 10.0.0.1 please" {
+		t.Fatalf("userMessage=%v", got)
+	}
+	if got := payload["thinking"]; got != "need port scan first" {
+		t.Fatalf("thinking=%v", got)
+	}
+}

internal/handler/hitl_execution.go

@@ -0,0 +1,132 @@
+package handler
+
+import (
+	"encoding/json"
+	"strings"
+	"time"
+)
+
+const hitlPayloadExecutionResult = "executionResult"
+
+type hitlExecutionResult struct {
+	Success    bool      `json:"success"`
+	Result     string    `json:"result,omitempty"`
+	ToolName   string    `json:"toolName,omitempty"`
+	ToolCallID string    `json:"toolCallId,omitempty"`
+	RecordedAt time.Time `json:"recordedAt"`
+}
+
+type hitlApprovedExecTrack struct {
+	InterruptID    string
+	ConversationID string
+	ToolName       string
+	ToolCallID     string
+}
+
+// TrackApprovedHitlExecution 审批通过后登记，待 tool_result 回写执行结果。
+func (m *HITLManager) TrackApprovedHitlExecution(interruptID, conversationID, toolName, toolCallID string) {
+	if m == nil {
+		return
+	}
+	interruptID = strings.TrimSpace(interruptID)
+	conversationID = strings.TrimSpace(conversationID)
+	if interruptID == "" || conversationID == "" {
+		return
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.approvedExec == nil {
+		m.approvedExec = make(map[string][]hitlApprovedExecTrack)
+	}
+	m.approvedExec[conversationID] = append(m.approvedExec[conversationID], hitlApprovedExecTrack{
+		InterruptID:    interruptID,
+		ConversationID: conversationID,
+		ToolName:       strings.TrimSpace(toolName),
+		ToolCallID:     strings.TrimSpace(toolCallID),
+	})
+}
+
+func (m *HITLManager) popApprovedInterruptForTool(conversationID, toolCallID, toolName string) string {
+	if m == nil {
+		return ""
+	}
+	conversationID = strings.TrimSpace(conversationID)
+	toolCallID = strings.TrimSpace(toolCallID)
+	toolName = strings.TrimSpace(toolName)
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	queue := m.approvedExec[conversationID]
+	if len(queue) == 0 {
+		return ""
+	}
+	idx := -1
+	if toolCallID != "" {
+		for i, t := range queue {
+			if t.ToolCallID == toolCallID {
+				idx = i
+				break
+			}
+		}
+	}
+	if idx < 0 && toolName != "" {
+		for i, t := range queue {
+			if strings.EqualFold(t.ToolName, toolName) {
+				idx = i
+				break
+			}
+		}
+	}
+	if idx < 0 {
+		return ""
+	}
+	id := queue[idx].InterruptID
+	queue = append(queue[:idx], queue[idx+1:]...)
+	if len(queue) == 0 {
+		delete(m.approvedExec, conversationID)
+	} else {
+		m.approvedExec[conversationID] = queue
+	}
+	return id
+}
+
+func mergeHitlPayloadExecutionResult(payloadJSON string, exec hitlExecutionResult) (string, error) {
+	root := make(map[string]interface{})
+	if strings.TrimSpace(payloadJSON) != "" {
+		_ = json.Unmarshal([]byte(payloadJSON), &root)
+	}
+	if root == nil {
+		root = make(map[string]interface{})
+	}
+	root[hitlPayloadExecutionResult] = exec
+	out, err := json.Marshal(root)
+	if err != nil {
+		return payloadJSON, err
+	}
+	return string(out), nil
+}
+
+func (h *AgentHandler) recordHitlToolExecutionResult(conversationID, toolCallID, toolName string, success bool, result string) {
+	if h == nil || h.hitlManager == nil || h.db == nil {
+		return
+	}
+	interruptID := h.hitlManager.popApprovedInterruptForTool(conversationID, toolCallID, toolName)
+	if interruptID == "" {
+		return
+	}
+	var payloadJSON string
+	err := h.db.QueryRow(`SELECT payload FROM hitl_interrupts WHERE id = ?`, interruptID).Scan(&payloadJSON)
+	if err != nil {
+		return
+	}
+	merged, err := mergeHitlPayloadExecutionResult(payloadJSON, hitlExecutionResult{
+		Success:    success,
+		Result:     strings.TrimSpace(result),
+		ToolName:   strings.TrimSpace(toolName),
+		ToolCallID: strings.TrimSpace(toolCallID),
+		RecordedAt: time.Now(),
+	})
+	if err != nil {
+		return
+	}
+	_, _ = h.db.Exec(`UPDATE hitl_interrupts SET payload = ? WHERE id = ?`, merged, interruptID)
+}

internal/handler/hitl_execution_test.go

@@ -0,0 +1,39 @@
+package handler
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestMergeHitlPayloadExecutionResult(t *testing.T) {
+	merged, err := mergeHitlPayloadExecutionResult(`{"userMessage":"hi","toolName":"nmap"}`, hitlExecutionResult{
+		Success: true,
+		Result:  "open ports: 80",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var root map[string]interface{}
+	if err := json.Unmarshal([]byte(merged), &root); err != nil {
+		t.Fatal(err)
+	}
+	if root["userMessage"] != "hi" {
+		t.Fatalf("userMessage lost: %v", root["userMessage"])
+	}
+	exec, ok := root["executionResult"].(map[string]interface{})
+	if !ok || exec["success"] != true {
+		t.Fatalf("executionResult missing: %v", root["executionResult"])
+	}
+}
+
+func TestPopApprovedInterruptForTool(t *testing.T) {
+	m := NewHITLManager(nil, nil)
+	m.TrackApprovedHitlExecution("hitl_a", "conv1", "nmap", "tc1")
+	m.TrackApprovedHitlExecution("hitl_b", "conv1", "exec", "")
+	if id := m.popApprovedInterruptForTool("conv1", "tc1", "nmap"); id != "hitl_a" {
+		t.Fatalf("tc1 match=%q", id)
+	}
+	if id := m.popApprovedInterruptForTool("conv1", "", "exec"); id != "hitl_b" {
+		t.Fatalf("tool name match=%q", id)
+	}
+}

internal/handler/hitl_logs.go

@@ -0,0 +1,263 @@
+package handler
+
+import (
+	"database/sql"
+	"errors"
+	"math"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"cyberstrike-ai/internal/config"
+
+	"github.com/gin-gonic/gin"
+)
+
+func normalizeHitlReviewer(v string) string {
+	switch strings.ToLower(strings.TrimSpace(v)) {
+	case "audit_agent", "agent", "ai":
+		return "audit_agent"
+	default:
+		return "human"
+	}
+}
+
+func normalizeHitlDecidedBy(v string) string {
+	switch strings.ToLower(strings.TrimSpace(v)) {
+	case "audit_agent", "agent", "ai":
+		return "audit_agent"
+	case "system", "timeout":
+		return "system"
+	case "manual":
+		return "manual"
+	default:
+		return "human"
+	}
+}
+
+func (m *HITLManager) migrateHitlSchemaColumns() {
+	_, _ = m.db.Exec(`ALTER TABLE hitl_interrupts ADD COLUMN decided_by TEXT NOT NULL DEFAULT 'human'`)
+	_, _ = m.db.Exec(`ALTER TABLE hitl_conversation_configs ADD COLUMN reviewer TEXT NOT NULL DEFAULT 'human'`)
+}
+
+func hitlInterruptRowToMap(
+	id, cid, mode, toolName, toolCallID, payload, rowStatus, decidedBy string,
+	messageID sql.NullString,
+	decision, comment sql.NullString,
+	createdAt time.Time,
+	decidedAt sql.NullTime,
+) map[string]interface{} {
+	msgID := ""
+	if messageID.Valid {
+		msgID = messageID.String
+	}
+	return map[string]interface{}{
+		"id":             id,
+		"conversationId": cid,
+		"messageId":      msgID,
+		"mode":           mode,
+		"toolName":       toolName,
+		"toolCallId":     toolCallID,
+		"payload":        payload,
+		"status":         rowStatus,
+		"decision":       decision.String,
+		"comment":        comment.String,
+		"decidedBy":      decidedBy,
+		"createdAt":      createdAt,
+		"decidedAt": func() interface{} {
+			if decidedAt.Valid {
+				return decidedAt.Time
+			}
+			return nil
+		}(),
+	}
+}
+
+func (h *AgentHandler) buildHitlListQuery(logs bool) (string, []interface{}) {
+	where, args := h.buildHitlLogsWhere(logs)
+	q := `SELECT id, conversation_id, message_id, mode, tool_name, tool_call_id, payload, status, decision, decision_comment, COALESCE(decided_by,'human'), created_at, decided_at FROM hitl_interrupts` + where
+	return q, args
+}
+
+func (h *AgentHandler) buildHitlLogsWhere(logs bool) (string, []interface{}) {
+	q := " WHERE 1=1"
+	args := []interface{}{}
+	if logs {
+		q += " AND status != 'pending'"
+	} else {
+		q += " AND status = 'pending'"
+	}
+	return q, args
+}
+
+func (h *AgentHandler) appendHitlListFilters(q string, args []interface{}, c *gin.Context) (string, []interface{}) {
+	conversationID := strings.TrimSpace(c.Query("conversationId"))
+	toolName := strings.TrimSpace(c.Query("toolName"))
+	decision := strings.TrimSpace(c.Query("decision"))
+	decidedBy := strings.TrimSpace(c.Query("decidedBy"))
+	status := strings.TrimSpace(c.Query("status"))
+	search := strings.TrimSpace(c.Query("q"))
+
+	if conversationID != "" {
+		q += " AND conversation_id = ?"
+		args = append(args, conversationID)
+	}
+	if toolName != "" {
+		q += " AND tool_name LIKE ?"
+		args = append(args, "%"+toolName+"%")
+	}
+	if decision != "" && decision != "all" {
+		q += " AND decision = ?"
+		args = append(args, decision)
+	}
+	if decidedBy != "" && decidedBy != "all" {
+		q += " AND COALESCE(decided_by,'human') = ?"
+		args = append(args, normalizeHitlDecidedBy(decidedBy))
+	}
+	if status != "" && status != "all" {
+		q += " AND status = ?"
+		args = append(args, status)
+	}
+	if search != "" {
+		like := "%" + search + "%"
+		q += " AND (id LIKE ? OR conversation_id LIKE ? OR tool_name LIKE ? OR payload LIKE ? OR COALESCE(decision_comment,'') LIKE ?)"
+		args = append(args, like, like, like, like, like)
+	}
+	return q, args
+}
+
+func (h *AgentHandler) scanHitlInterruptRows(rows *sql.Rows) ([]map[string]interface{}, error) {
+	items := make([]map[string]interface{}, 0)
+	for rows.Next() {
+		var id, cid, mode, toolName, toolCallID, payload, rowStatus, decidedBy string
+		var messageID sql.NullString
+		var decision, comment sql.NullString
+		var createdAt time.Time
+		var decidedAt sql.NullTime
+		if err := rows.Scan(&id, &cid, &messageID, &mode, &toolName, &toolCallID, &payload, &rowStatus, &decision, &comment, &decidedBy, &createdAt, &decidedAt); err != nil {
+			continue
+		}
+		items = append(items, hitlInterruptRowToMap(id, cid, mode, toolName, toolCallID, payload, rowStatus, decidedBy, messageID, decision, comment, createdAt, decidedAt))
+	}
+	return items, nil
+}
+
+func (h *AgentHandler) countHitlQuery(baseQ string, args []interface{}) (int, error) {
+	countQ := "SELECT COUNT(*) FROM (" + baseQ + ") AS hitl_cnt"
+	var total int
+	if err := h.db.QueryRow(countQ, args...).Scan(&total); err != nil {
+		return 0, err
+	}
+	return total, nil
+}
+
+func (h *AgentHandler) ListHITLLogs(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	if page < 1 {
+		page = 1
+	}
+	pageSize, _ := strconv.Atoi(c.DefaultQuery("pageSize", "20"))
+	pageSize = int(math.Max(1, math.Min(float64(pageSize), 200)))
+	offset := (page - 1) * pageSize
+
+	q, args := h.buildHitlListQuery(true)
+	q, args = h.appendHitlListFilters(q, args, c)
+	total, err := h.countHitlQuery(q, args)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	q += " ORDER BY COALESCE(decided_at, created_at) DESC LIMIT ? OFFSET ?"
+	args = append(args, pageSize, offset)
+	rows, err := h.db.Query(q, args...)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	defer rows.Close()
+	items, err := h.scanHitlInterruptRows(rows)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"items": items, "page": page, "pageSize": pageSize, "total": total, "retentionDays": h.hitlRetentionDays()})
+}
+
+func (h *AgentHandler) hitlRetentionDays() int {
+	if h.config != nil {
+		return h.config.Hitl.RetentionDaysEffective()
+	}
+	return config.HitlConfig{}.RetentionDaysEffective()
+}
+
+// DeleteHITLLogs 批量删除或按筛选清空已决策的人机协同审计日志（不删除 pending）。
+func (h *AgentHandler) DeleteHITLLogs(c *gin.Context) {
+	var request struct {
+		IDs []string `json:"ids"`
+		All bool     `json:"all"`
+	}
+	if err := c.ShouldBindJSON(&request); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "请求参数无效: " + err.Error()})
+		return
+	}
+
+	var deleted int64
+	var err error
+	if request.All {
+		where, args := h.buildHitlLogsWhere(true)
+		where, args = h.appendHitlListFilters(where, args, c)
+		deleted, err = h.db.DeleteHitlInterruptLogsMatching(where, args)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		if h.audit != nil {
+			h.audit.RecordOK(c, "hitl", "logs_clear", "清空人机协同审计日志", "hitl_interrupt", "", map[string]interface{}{
+				"deleted": deleted,
+			})
+		}
+	} else {
+		if len(request.IDs) == 0 {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "审计日志 ID 列表不能为空"})
+			return
+		}
+		deleted, err = h.db.DeleteHitlInterruptLogsByIDs(request.IDs)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+			return
+		}
+		if h.audit != nil {
+			h.audit.RecordOK(c, "hitl", "logs_delete_batch", "批量删除人机协同审计日志", "hitl_interrupt", "", map[string]interface{}{
+				"count":   len(request.IDs),
+				"deleted": deleted,
+			})
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "删除成功", "deleted": deleted})
+}
+
+func (h *AgentHandler) GetHITLLog(c *gin.Context) {
+	id := strings.TrimSpace(c.Param("id"))
+	if id == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "id is required"})
+		return
+	}
+	q := `SELECT id, conversation_id, message_id, mode, tool_name, tool_call_id, payload, status, decision, decision_comment, COALESCE(decided_by,'human'), created_at, decided_at FROM hitl_interrupts WHERE id = ?`
+	var rowID, cid, mode, toolName, toolCallID, payload, rowStatus, decidedBy string
+	var messageID sql.NullString
+	var decision, comment sql.NullString
+	var createdAt time.Time
+	var decidedAt sql.NullTime
+	err := h.db.QueryRow(q, id).Scan(&rowID, &cid, &messageID, &mode, &toolName, &toolCallID, &payload, &rowStatus, &decision, &comment, &decidedBy, &createdAt, &decidedAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
+		return
+	}
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, hitlInterruptRowToMap(rowID, cid, mode, toolName, toolCallID, payload, rowStatus, decidedBy, messageID, decision, comment, createdAt, decidedAt))
+}

internal/handler/monitor.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"io"
 	"net/http"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -23,6 +24,8 @@ import (
 type MonitorHandler struct {
 	mcpServer        *mcp.Server
 	externalMCPMgr   *mcp.ExternalMCPManager
+	taskManager      *AgentTaskManager
+	agentHandler     *AgentHandler
 	executor         *security.Executor
 	db               *database.DB
 	logger           *zap.Logger
@@ -56,16 +59,44 @@ func (h *MonitorHandler) SetExternalMCPManager(mgr *mcp.ExternalMCPManager) {
 	h.externalMCPMgr = mgr
 }
 
+// SetTaskManager 设置 Agent 任务管理器（用于 Eino execute 等按 executionId 终止）。
+func (h *MonitorHandler) SetTaskManager(mgr *AgentTaskManager) {
+	h.taskManager = mgr
+}
+
+// SetAgentHandler 设置 Agent 处理器（MCP 监控终止与对话页「中断并继续」共用逻辑）。
+func (h *MonitorHandler) SetAgentHandler(ah *AgentHandler) {
+	h.agentHandler = ah
+}
+
+const monitorPageTopTools = 6
+
+// MonitorStatsSummary 工具调用汇总
+type MonitorStatsSummary struct {
+	TotalCalls   int        `json:"totalCalls"`
+	SuccessCalls int        `json:"successCalls"`
+	FailedCalls  int        `json:"failedCalls"`
+	LastCallTime *time.Time `json:"lastCallTime,omitempty"`
+	ToolCount    int        `json:"toolCount"`
+}
+
 // MonitorResponse 监控响应
 type MonitorResponse struct {
-	Executions    []*mcp.ToolExecution      `json:"executions"`
-	Stats         map[string]*mcp.ToolStats `json:"stats"`
-	Timestamp     time.Time                 `json:"timestamp"`
-	Total         int                       `json:"total,omitempty"`
-	Page          int                       `json:"page,omitempty"`
-	PageSize      int                       `json:"page_size,omitempty"`
-	TotalPages    int                       `json:"total_pages,omitempty"`
-	RetentionDays int                       `json:"retention_days,omitempty"`
+	Executions    []*mcp.ToolExecution `json:"executions"`
+	Summary       *MonitorStatsSummary `json:"summary"`
+	TopTools      []*mcp.ToolStats     `json:"topTools"`
+	Timestamp     time.Time            `json:"timestamp"`
+	Total         int                  `json:"total"`
+	Page          int                  `json:"page"`
+	PageSize      int                  `json:"pageSize"`
+	TotalPages    int                  `json:"totalPages"`
+	RetentionDays int                  `json:"retentionDays"`
+}
+
+// StatsResponse 统计信息响应（Dashboard 等）
+type StatsResponse struct {
+	Summary  *MonitorStatsSummary `json:"summary"`
+	TopTools []*mcp.ToolStats     `json:"topTools"`
 }
 
 // Monitor 获取监控信息
@@ -89,8 +120,9 @@ func (h *MonitorHandler) Monitor(c *gin.Context) {
 	// 解析工具筛选参数（兼容 mcp__tool 与内部 mcp::tool）
 	toolName := normalizeToolNameFilter(c.Query("tool"))
 
-	executions, total := h.loadExecutionsWithPagination(page, pageSize, status, toolName)
-	stats := h.loadStats()
+	executions, total := h.loadExecutionListWithPagination(page, pageSize, status, toolName)
+	h.enrichExecutionsConversationID(executions)
+	summary, topTools := h.loadStatsSummary(monitorPageTopTools)
 
 	totalPages := (total + pageSize - 1) / pageSize
 	if totalPages == 0 {
@@ -99,7 +131,8 @@ func (h *MonitorHandler) Monitor(c *gin.Context) {
 
 	c.JSON(http.StatusOK, MonitorResponse{
 		Executions:    executions,
-		Stats:         stats,
+		Summary:       summary,
+		TopTools:      topTools,
 		Timestamp:     time.Now(),
 		Total:         total,
 		Page:          page,
@@ -121,6 +154,112 @@ func (h *MonitorHandler) loadExecutions() []*mcp.ToolExecution {
 	return executions
 }
 
+func (h *MonitorHandler) loadExecutionListWithPagination(page, pageSize int, status, toolName string) ([]*mcp.ToolExecution, int) {
+	if h.db == nil {
+		allExecutions := h.mcpServer.GetAllExecutions()
+		if status != "" || toolName != "" {
+			filtered := make([]*mcp.ToolExecution, 0)
+			for _, exec := range allExecutions {
+				matchStatus := status == "" || exec.Status == status
+				matchTool := toolNameFilterMatches(exec.ToolName, toolName)
+				if matchStatus && matchTool {
+					filtered = append(filtered, exec)
+				}
+			}
+			allExecutions = filtered
+		}
+		total := len(allExecutions)
+		offset := (page - 1) * pageSize
+		end := offset + pageSize
+		if end > total {
+			end = total
+		}
+		if offset >= total {
+			return []*mcp.ToolExecution{}, total
+		}
+		pageSlice := allExecutions[offset:end]
+		out := make([]*mcp.ToolExecution, 0, len(pageSlice))
+		for _, exec := range pageSlice {
+			if exec == nil {
+				continue
+			}
+			out = append(out, slimToolExecution(exec))
+		}
+		return out, total
+	}
+
+	offset := (page - 1) * pageSize
+	executions, err := h.db.LoadToolExecutionListPage(offset, pageSize, status, toolName)
+	if err != nil {
+		h.logger.Warn("从数据库加载执行记录列表失败，回退到内存数据", zap.Error(err))
+		return h.loadExecutionListWithPaginationFromMemory(page, pageSize, status, toolName)
+	}
+
+	total, err := h.db.CountToolExecutions(status, toolName)
+	if err != nil {
+		h.logger.Warn("获取执行记录总数失败", zap.Error(err))
+		total = offset + len(executions)
+		if len(executions) == pageSize {
+			total = offset + len(executions) + 1
+		}
+	}
+
+	return executions, total
+}
+
+func (h *MonitorHandler) loadExecutionListWithPaginationFromMemory(page, pageSize int, status, toolName string) ([]*mcp.ToolExecution, int) {
+	allExecutions := h.mcpServer.GetAllExecutions()
+	if status != "" || toolName != "" {
+		filtered := make([]*mcp.ToolExecution, 0)
+		for _, exec := range allExecutions {
+			matchStatus := status == "" || exec.Status == status
+			matchTool := toolNameFilterMatches(exec.ToolName, toolName)
+			if matchStatus && matchTool {
+				filtered = append(filtered, exec)
+			}
+		}
+		allExecutions = filtered
+	}
+	total := len(allExecutions)
+	offset := (page - 1) * pageSize
+	end := offset + pageSize
+	if end > total {
+		end = total
+	}
+	if offset >= total {
+		return []*mcp.ToolExecution{}, total
+	}
+	pageSlice := allExecutions[offset:end]
+	out := make([]*mcp.ToolExecution, 0, len(pageSlice))
+	for _, exec := range pageSlice {
+		if exec == nil {
+			continue
+		}
+		out = append(out, slimToolExecution(exec))
+	}
+	return out, total
+}
+
+func slimToolExecution(exec *mcp.ToolExecution) *mcp.ToolExecution {
+	if exec == nil {
+		return nil
+	}
+	slim := &mcp.ToolExecution{
+		ID:        exec.ID,
+		ToolName:  exec.ToolName,
+		Status:    exec.Status,
+		StartTime: exec.StartTime,
+	}
+	if exec.EndTime != nil {
+		end := *exec.EndTime
+		slim.EndTime = &end
+	}
+	if exec.Duration > 0 {
+		slim.Duration = exec.Duration
+	}
+	return slim
+}
+
 func (h *MonitorHandler) loadExecutionsWithPagination(page, pageSize int, status, toolName string) ([]*mcp.ToolExecution, int) {
 	if h.db == nil {
 		allExecutions := h.mcpServer.GetAllExecutions()
@@ -193,7 +332,78 @@ func (h *MonitorHandler) loadExecutionsWithPagination(page, pageSize int, status
 	return executions, total
 }
 
-func (h *MonitorHandler) loadStats() map[string]*mcp.ToolStats {
+func (h *MonitorHandler) loadStatsSummary(topN int) (*MonitorStatsSummary, []*mcp.ToolStats) {
+	if topN <= 0 {
+		topN = monitorPageTopTools
+	}
+
+	if h.db != nil {
+		result, err := h.db.LoadToolStatsSummary(topN)
+		if err == nil {
+			return dbStatsSummaryToMonitor(result), result.TopTools
+		}
+		h.logger.Warn("从数据库加载统计汇总失败，回退到内存数据", zap.Error(err))
+	}
+
+	stats := h.loadStatsMap()
+	return summarizeToolStats(stats, topN)
+}
+
+func dbStatsSummaryToMonitor(result *database.ToolStatsSummaryResult) *MonitorStatsSummary {
+	if result == nil {
+		return &MonitorStatsSummary{}
+	}
+	summary := &MonitorStatsSummary{
+		TotalCalls:   result.Summary.TotalCalls,
+		SuccessCalls: result.Summary.SuccessCalls,
+		FailedCalls:  result.Summary.FailedCalls,
+		ToolCount:    result.Summary.ToolCount,
+	}
+	if result.Summary.LastCallTime != nil {
+		t := *result.Summary.LastCallTime
+		summary.LastCallTime = &t
+	}
+	return summary
+}
+
+func summarizeToolStats(stats map[string]*mcp.ToolStats, topN int) (*MonitorStatsSummary, []*mcp.ToolStats) {
+	summary := &MonitorStatsSummary{}
+	if len(stats) == 0 {
+		return summary, nil
+	}
+
+	all := make([]*mcp.ToolStats, 0, len(stats))
+	for _, stat := range stats {
+		if stat == nil {
+			continue
+		}
+		summary.ToolCount++
+		summary.TotalCalls += stat.TotalCalls
+		summary.SuccessCalls += stat.SuccessCalls
+		summary.FailedCalls += stat.FailedCalls
+		if stat.LastCallTime != nil && (summary.LastCallTime == nil || stat.LastCallTime.After(*summary.LastCallTime)) {
+			t := *stat.LastCallTime
+			summary.LastCallTime = &t
+		}
+		if stat.TotalCalls > 0 {
+			statCopy := *stat
+			all = append(all, &statCopy)
+		}
+	}
+
+	sort.Slice(all, func(i, j int) bool {
+		if all[i].TotalCalls == all[j].TotalCalls {
+			return all[i].ToolName < all[j].ToolName
+		}
+		return all[i].TotalCalls > all[j].TotalCalls
+	})
+	if len(all) > topN {
+		all = all[:topN]
+	}
+	return summary, all
+}
+
+func (h *MonitorHandler) loadStatsMap() map[string]*mcp.ToolStats {
 	// 合并内部MCP服务器和外部MCP管理器的统计信息
 	stats := make(map[string]*mcp.ToolStats)
 
@@ -247,6 +457,7 @@ func (h *MonitorHandler) GetExecution(c *gin.Context) {
 	// 先从内部MCP服务器查找
 	exec, exists := h.mcpServer.GetExecution(id)
 	if exists {
+		h.enrichExecutionsConversationID([]*mcp.ToolExecution{exec})
 		c.JSON(http.StatusOK, exec)
 		return
 	}
@@ -255,6 +466,7 @@ func (h *MonitorHandler) GetExecution(c *gin.Context) {
 	if h.externalMCPMgr != nil {
 		exec, exists = h.externalMCPMgr.GetExecution(id)
 		if exists {
+			h.enrichExecutionsConversationID([]*mcp.ToolExecution{exec})
 			c.JSON(http.StatusOK, exec)
 			return
 		}
@@ -264,6 +476,7 @@ func (h *MonitorHandler) GetExecution(c *gin.Context) {
 	if h.db != nil {
 		exec, err := h.db.GetToolExecution(id)
 		if err == nil && exec != nil {
+			h.enrichExecutionsConversationID([]*mcp.ToolExecution{exec})
 			c.JSON(http.StatusOK, exec)
 			return
 		}
@@ -290,6 +503,19 @@ func (h *MonitorHandler) CancelExecution(c *gin.Context) {
 		return
 	}
 	note = strings.TrimSpace(body.Note)
+
+	convID := h.conversationIDForRunningExecution(id)
+	if convID != "" && h.agentHandler != nil {
+		if ok, payload := h.agentHandler.cancelToolContinueAfter(convID, id, note); ok {
+			h.logger.Info("MCP 监控页终止工具（与对话中断并继续一致）",
+				zap.String("executionId", id),
+				zap.String("conversationId", convID),
+				zap.Bool("hasNote", note != ""),
+			)
+			c.JSON(http.StatusOK, payload)
+			return
+		}
+	}
 	if h.mcpServer.CancelToolExecutionWithNote(id, note) {
 		h.logger.Info("已请求取消 MCP 工具执行", zap.String("executionId", id), zap.String("source", "internal"), zap.Bool("hasNote", note != ""))
 		c.JSON(http.StatusOK, gin.H{"message": "已发送终止信号", "executionId": id})
@@ -303,6 +529,52 @@ func (h *MonitorHandler) CancelExecution(c *gin.Context) {
 	c.JSON(http.StatusNotFound, gin.H{"error": "未找到进行中的工具执行，或该任务已结束"})
 }
 
+func (h *MonitorHandler) enrichExecutionsConversationID(executions []*mcp.ToolExecution) {
+	for _, exec := range executions {
+		if exec == nil || exec.Status != "running" {
+			continue
+		}
+		exec.ConversationID = h.conversationIDForRunningExecution(exec.ID)
+	}
+}
+
+func (h *MonitorHandler) conversationIDForRunningExecution(executionID string) string {
+	executionID = strings.TrimSpace(executionID)
+	if executionID == "" || h.taskManager == nil {
+		return ""
+	}
+	if conv := h.taskManager.ConversationIDForActiveMCPExecution(executionID); conv != "" {
+		return conv
+	}
+	exec := h.lookupExecution(executionID)
+	if exec == nil || exec.Status != "running" {
+		return ""
+	}
+	if strings.TrimSpace(exec.ToolName) == "execute" {
+		if onlyConv, ok := h.taskManager.ConversationIDForActiveEinoExecute(); ok {
+			return onlyConv
+		}
+	}
+	return ""
+}
+
+func (h *MonitorHandler) lookupExecution(id string) *mcp.ToolExecution {
+	if exec, ok := h.mcpServer.GetExecution(id); ok {
+		return exec
+	}
+	if h.externalMCPMgr != nil {
+		if exec, ok := h.externalMCPMgr.GetExecution(id); ok {
+			return exec
+		}
+	}
+	if h.db != nil {
+		if exec, err := h.db.GetToolExecution(id); err == nil && exec != nil {
+			return exec
+		}
+	}
+	return nil
+}
+
 // BatchGetToolNames 批量获取工具执行的工具名称（消除前端 N+1 请求）
 func (h *MonitorHandler) BatchGetToolNames(c *gin.Context) {
 	var req struct {
@@ -340,8 +612,17 @@ func (h *MonitorHandler) BatchGetToolNames(c *gin.Context) {
 
 // GetStats 获取统计信息
 func (h *MonitorHandler) GetStats(c *gin.Context) {
-	stats := h.loadStats()
-	c.JSON(http.StatusOK, stats)
+	topN := 30
+	if topStr := c.Query("top"); topStr != "" {
+		if t, err := strconv.Atoi(topStr); err == nil && t > 0 && t <= 100 {
+			topN = t
+		}
+	}
+	summary, topTools := h.loadStatsSummary(topN)
+	c.JSON(http.StatusOK, StatsResponse{
+		Summary:  summary,
+		TopTools: topTools,
+	})
 }
 
 // CallsTimelinePoint 调用趋势数据点

internal/handler/multi_agent.go

@@ -133,6 +133,9 @@ func (h *AgentHandler) MultiAgentLoopStream(c *gin.Context) {
 			"userMessageId":  prep.UserMessageID,
 		})
 	}
+	if h.runRoleWorkflowStreamIfBound(&req, prep, sendEvent) {
+		return
+	}
 
 	var cancelWithCause context.CancelCauseFunc
 	curFinalMessage := prep.FinalMessage
@@ -188,6 +191,7 @@ func (h *AgentHandler) MultiAgentLoopStream(c *gin.Context) {
 	var cumulativeMCPExecutionIDs []string
 	// 同一请求内分段续跑时，主代理 iteration 事件按偏移累计，避免 UI 出现「第3轮 → 第1轮」回跳。
 	var mainIterationOffset int
+	var emptyResponseContinueAttempt int
 
 	for {
 		segmentMainIterationMax := 0
@@ -243,7 +247,7 @@ func (h *AgentHandler) MultiAgentLoopStream(c *gin.Context) {
 			h.agentsMarkdownDir,
 			orch,
 			chatReasoningToClientIntent(req.Reasoning),
-			h.projectBlackboardBlock(conversationID),
+			h.agentSessionContextBlock(conversationID),
 		)
 
 		if result != nil && len(result.MCPExecutionIDs) > 0 {
@@ -251,6 +255,13 @@ func (h *AgentHandler) MultiAgentLoopStream(c *gin.Context) {
 		}
 
 		if runErr == nil {
+			mw := &h.config.MultiAgent.EinoMiddleware
+			if h.tryContinueOnEinoEmptyResponse(taskCtx, mw, conversationID, result, &emptyResponseContinueAttempt, &curHistory, &curFinalMessage, progressCallback) {
+				mainIterationOffset += segmentMainIterationMax
+				timeoutCancel()
+				baseCtx, cancelWithCause, taskCtx, timeoutCancel = h.rebindEinoRunningTask(conversationID, timeoutCancel)
+				continue
+			}
 			timeoutCancel()
 			break
 		}
@@ -399,6 +410,9 @@ func (h *AgentHandler) MultiAgentLoop(c *gin.Context) {
 	if h.hitlManager != nil {
 		defer h.hitlManager.DeactivateConversation(prep.ConversationID)
 	}
+	if h.runRoleWorkflowJSONIfBound(c, &req, prep) {
+		return
+	}
 
 	baseCtx, cancelWithCause := context.WithCancelCause(c.Request.Context())
 	defer cancelWithCause(nil)
@@ -430,7 +444,7 @@ func (h *AgentHandler) MultiAgentLoop(c *gin.Context) {
 			h.agentsMarkdownDir,
 			strings.TrimSpace(req.Orchestration),
 			chatReasoningToClientIntent(req.Reasoning),
-			h.projectBlackboardBlock(prep.ConversationID),
+			h.agentSessionContextBlock(prep.ConversationID),
 		)
 		if runErr == nil {
 			break

internal/handler/openapi.go

@@ -506,7 +506,7 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 				},
 				"CreateVulnerabilityRequest": map[string]interface{}{
 					"type":     "object",
-					"required": []string{"conversation_id", "title", "severity"},
+					"required": []string{"conversation_id", "title", "description", "severity", "type", "target", "reproduction_steps", "evidence", "impact", "recommendation"},
 					"properties": map[string]interface{}{
 						"conversation_id": map[string]interface{}{
 							"type":        "string",
@@ -538,10 +538,9 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 							"type":        "string",
 							"description": "受影响的目标",
 						},
-						"proof": map[string]interface{}{
-							"type":        "string",
-							"description": "漏洞证明",
-						},
+						"preconditions":      map[string]interface{}{"type": "string", "description": "前置条件"},
+						"reproduction_steps": map[string]interface{}{"type": "string", "description": "复现步骤"},
+						"evidence":           map[string]interface{}{"type": "string", "description": "证据/POC，包含请求响应、命令输出、截图说明、日志等"},
 						"impact": map[string]interface{}{
 							"type":        "string",
 							"description": "影响",
@@ -550,6 +549,7 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 							"type":        "string",
 							"description": "修复建议",
 						},
+						"retest_notes": map[string]interface{}{"type": "string", "description": "复测方式"},
 					},
 				},
 				"UpdateVulnerabilityRequest": map[string]interface{}{
@@ -581,10 +581,9 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 							"type":        "string",
 							"description": "受影响的目标",
 						},
-						"proof": map[string]interface{}{
-							"type":        "string",
-							"description": "漏洞证明",
-						},
+						"preconditions":      map[string]interface{}{"type": "string", "description": "前置条件"},
+						"reproduction_steps": map[string]interface{}{"type": "string", "description": "复现步骤"},
+						"evidence":           map[string]interface{}{"type": "string", "description": "证据/POC，包含请求响应、命令输出、截图说明、日志等"},
 						"impact": map[string]interface{}{
 							"type":        "string",
 							"description": "影响",
@@ -593,6 +592,7 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 							"type":        "string",
 							"description": "修复建议",
 						},
+						"retest_notes": map[string]interface{}{"type": "string", "description": "复测方式"},
 					},
 				},
 				"ListVulnerabilitiesResponse": map[string]interface{}{
@@ -740,14 +740,21 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 					"properties": map[string]interface{}{
 						"executions": map[string]interface{}{
 							"type":        "array",
-							"description": "执行记录列表",
+							"description": "执行记录列表（轻量字段，不含 arguments/result）",
 							"items": map[string]interface{}{
 								"$ref": "#/components/schemas/ToolExecution",
 							},
 						},
-						"stats": map[string]interface{}{
+						"summary": map[string]interface{}{
 							"type":        "object",
-							"description": "统计信息",
+							"description": "工具调用汇总",
+						},
+						"topTools": map[string]interface{}{
+							"type":        "array",
+							"description": "调用量 Top N 工具",
+							"items": map[string]interface{}{
+								"type": "object",
+							},
 						},
 						"timestamp": map[string]interface{}{
 							"type":        "string",
@@ -756,20 +763,24 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 						},
 						"total": map[string]interface{}{
 							"type":        "integer",
-							"description": "总数",
+							"description": "执行记录总数",
 						},
 						"page": map[string]interface{}{
 							"type":        "integer",
 							"description": "当前页",
 						},
-						"page_size": map[string]interface{}{
+						"pageSize": map[string]interface{}{
 							"type":        "integer",
 							"description": "每页数量",
 						},
-						"total_pages": map[string]interface{}{
+						"totalPages": map[string]interface{}{
 							"type":        "integer",
 							"description": "总页数",
 						},
+						"retentionDays": map[string]interface{}{
+							"type":        "integer",
+							"description": "执行记录保留天数",
+						},
 					},
 				},
 				"ConfigResponse": map[string]interface{}{
@@ -794,18 +805,18 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 					"type":        "object",
 					"description": "视觉分析（analyze_image MCP 工具）；enabled 且 model 非空时注册工具",
 					"properties": map[string]interface{}{
-						"enabled":                      map[string]interface{}{"type": "boolean", "description": "是否启用 analyze_image"},
-						"model":                        map[string]interface{}{"type": "string", "description": "视觉模型名（必填）", "example": "qwen-vl-max"},
-						"api_key":                      map[string]interface{}{"type": "string", "description": "API Key；留空复用 openai.api_key"},
-						"base_url":                     map[string]interface{}{"type": "string", "description": "Base URL；留空复用 openai.base_url"},
-						"provider":                     map[string]interface{}{"type": "string", "description": "提供商；留空复用 openai.provider"},
-						"timeout_seconds":              map[string]interface{}{"type": "integer", "description": "VL 调用超时（秒）"},
-						"max_image_bytes":              map[string]interface{}{"type": "integer", "description": "原始文件大小上限（字节）"},
-						"max_dimension":                map[string]interface{}{"type": "integer", "description": "长边缩放像素"},
-						"jpeg_quality":                 map[string]interface{}{"type": "integer", "description": "JPEG 质量 60-100"},
-						"max_payload_bytes":            map[string]interface{}{"type": "integer", "description": "送 API 体积上限（字节）"},
-						"skip_preprocess_below_bytes":  map[string]interface{}{"type": "integer", "description": "低于该字节且尺寸合规时可原图直传；0=始终压缩"},
-						"detail": map[string]interface{}{"type": "string", "enum": []string{"low", "high", "auto"}, "description": "OpenAI 兼容 image detail"},
+						"enabled":                     map[string]interface{}{"type": "boolean", "description": "是否启用 analyze_image"},
+						"model":                       map[string]interface{}{"type": "string", "description": "视觉模型名（必填）", "example": "qwen-vl-max"},
+						"api_key":                     map[string]interface{}{"type": "string", "description": "API Key；留空复用 openai.api_key"},
+						"base_url":                    map[string]interface{}{"type": "string", "description": "Base URL；留空复用 openai.base_url"},
+						"provider":                    map[string]interface{}{"type": "string", "description": "提供商；留空复用 openai.provider"},
+						"timeout_seconds":             map[string]interface{}{"type": "integer", "description": "VL 调用超时（秒）"},
+						"max_image_bytes":             map[string]interface{}{"type": "integer", "description": "原始文件大小上限（字节）"},
+						"max_dimension":               map[string]interface{}{"type": "integer", "description": "长边缩放像素"},
+						"jpeg_quality":                map[string]interface{}{"type": "integer", "description": "JPEG 质量 60-100"},
+						"max_payload_bytes":           map[string]interface{}{"type": "integer", "description": "送 API 体积上限（字节）"},
+						"skip_preprocess_below_bytes": map[string]interface{}{"type": "integer", "description": "低于该字节且尺寸合规时可原图直传；0=始终压缩"},
+						"detail":                      map[string]interface{}{"type": "string", "enum": []string{"low", "high", "auto"}, "description": "OpenAI 兼容 image detail"},
 					},
 				},
 				"AnalyzeImageToolCall": map[string]interface{}{
@@ -1232,6 +1243,34 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 								"type": "string",
 							},
 						},
+						{
+							"name":        "project_id",
+							"in":          "query",
+							"required":    false,
+							"description": "按项目筛选；传 __none__ 表示仅未绑定项目的对话",
+							"schema": map[string]interface{}{
+								"type": "string",
+							},
+						},
+						{
+							"name":        "exclude_grouped",
+							"in":          "query",
+							"required":    false,
+							"description": "为 true 时排除已加入分组的对话（默认在未搜索且未按项目筛选时启用）",
+							"schema": map[string]interface{}{
+								"type": "boolean",
+							},
+						},
+						{
+							"name":        "sort_by",
+							"in":          "query",
+							"required":    false,
+							"description": "排序字段：updated_at（默认）或 created_at",
+							"schema": map[string]interface{}{
+								"type": "string",
+								"enum": []string{"updated_at", "created_at"},
+							},
+						},
 					},
 					"responses": map[string]interface{}{
 						"200": map[string]interface{}{
@@ -1393,7 +1432,7 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 						{
 							"name": "id", "in": "path", "required": true,
 							"description": "对话ID",
-							"schema": map[string]interface{}{"type": "string"},
+							"schema":      map[string]interface{}{"type": "string"},
 						},
 					},
 					"requestBody": map[string]interface{}{
@@ -2531,7 +2570,7 @@ func (h *OpenAPIHandler) GetOpenAPISpec(c *gin.Context) {
 						"content": map[string]interface{}{
 							"application/json": map[string]interface{}{
 								"schema": map[string]interface{}{
-									"type": "object",
+									"type":     "object",
 									"required": []string{"source_fact_key", "target_fact_key", "edge_type"},
 									"properties": map[string]interface{}{
 										"source_fact_key": map[string]interface{}{"type": "string"},

internal/handler/project_context.go

@@ -7,6 +7,43 @@ import (
 	"go.uber.org/zap"
 )
 
+// agentSessionContextBlock 注入会话工作目录与项目黑板（用于 system prompt 追加块）。
+// 用户输入由 message history 承载；压缩后由 summarization 摘要指令保留关键约束。
+func (h *AgentHandler) agentSessionContextBlock(conversationID string) string {
+	var parts []string
+	if ws := h.buildWorkspaceBlock(conversationID); ws != "" {
+		parts = append(parts, ws)
+	}
+	if bb := h.projectBlackboardBlock(conversationID); bb != "" {
+		parts = append(parts, bb)
+	}
+	return strings.Join(parts, "\n\n")
+}
+
+func (h *AgentHandler) buildWorkspaceBlock(conversationID string) string {
+	if h == nil || h.config == nil {
+		return ""
+	}
+	conversationID = strings.TrimSpace(conversationID)
+	if conversationID == "" {
+		return ""
+	}
+	projectID := h.conversationProjectID(conversationID)
+	rel := project.WorkspaceRootDir(h.config.Agent.WorkspaceRootDir, projectID, conversationID)
+	abs, err := project.EnsureWorkspace(rel)
+	if err != nil {
+		if h.logger != nil {
+			h.logger.Warn("创建会话工作目录失败",
+				zap.String("conversationId", conversationID),
+				zap.String("projectId", projectID),
+				zap.String("path", rel),
+				zap.Error(err))
+		}
+		return ""
+	}
+	return project.BuildWorkspaceBlock(abs)
+}
+
 // projectBlackboardBlock 根据对话 ID 构建项目事实索引块（用于注入 system prompt）。
 func (h *AgentHandler) projectBlackboardBlock(conversationID string) string {
 	if h == nil || h.db == nil || h.config == nil {

internal/handler/robot.go

@@ -447,7 +447,7 @@ func (h *RobotHandler) cmdUnbindProject(platform, userID string) string {
 }
 
 func (h *RobotHandler) cmdList() string {
-	convs, err := h.db.ListConversations(50, 0, "", "")
+	convs, err := h.db.ListConversations(50, 0, "", "", "")
 	if err != nil {
 		return "获取对话列表失败: " + err.Error()
 	}
@@ -711,12 +711,27 @@ type wecomReplyXML struct {
 	Content      string   `xml:"Content"`
 }
 
+// wecomRequireToken 企业微信回调必须配置 Token；未配置时拒绝请求，防止未授权触发 Agent。
+func (h *RobotHandler) wecomRequireToken(c *gin.Context) (string, bool) {
+	token := strings.TrimSpace(h.config.Robots.Wecom.Token)
+	if token == "" {
+		h.logger.Warn("企业微信已启用但未配置 token，已拒绝回调（请在配置中设置 robots.wecom.token）")
+		c.String(http.StatusForbidden, "")
+		return "", false
+	}
+	return token, true
+}
+
 // HandleWecomGET 企业微信 URL 校验（GET）
 func (h *RobotHandler) HandleWecomGET(c *gin.Context) {
 	if !h.config.Robots.Wecom.Enabled {
 		c.String(http.StatusNotFound, "")
 		return
 	}
+	token, ok := h.wecomRequireToken(c)
+	if !ok {
+		return
+	}
 	// Gin 的 Query() 会自动 URL 解码，拿到的就是正确的 base64 字符串
 	echostr := c.Query("echostr")
 	msgSignature := c.Query("msg_signature")
@@ -724,7 +739,7 @@ func (h *RobotHandler) HandleWecomGET(c *gin.Context) {
 	nonce := c.Query("nonce")
 
 	// 验证签名：将 token、timestamp、nonce、echostr 四个参数排序后拼接计算 SHA1
-	signature := h.signWecomRequest(h.config.Robots.Wecom.Token, timestamp, nonce, echostr)
+	signature := h.signWecomRequest(token, timestamp, nonce, echostr)
 	if signature != msgSignature {
 		h.logger.Warn("企业微信 URL 验证签名失败", zap.String("expected", msgSignature), zap.String("got", signature))
 		c.String(http.StatusBadRequest, "invalid signature")
@@ -865,27 +880,28 @@ func (h *RobotHandler) HandleWecomPOST(c *gin.Context) {
 	}
 	h.logger.Debug("企业微信 POST 收到请求", zap.String("body", string(bodyRaw)))
 
-	// 验证请求签名防止伪造。企业微信签名算法同 URL 验证，使用 token、timestamp、nonce、 Encrypt 四个字段
-	// 若配置了 Token 则必须校验签名，避免未授权请求触发 Agent（防止平台被接管）
-	token := h.config.Robots.Wecom.Token
-	if token != "" {
-		if msgSignature == "" {
-			h.logger.Warn("企业微信 POST 缺少签名，已拒绝（需配置 token 并确保回调携带 msg_signature）")
-			c.String(http.StatusOK, "")
-			return
-		}
-		var tmp wecomXML
-		if err := xml.Unmarshal(bodyRaw, &tmp); err != nil {
-			h.logger.Warn("企业微信 POST 签名验证前解析 XML 失败", zap.Error(err))
-			c.String(http.StatusOK, "")
-			return
-		}
-		expected := h.signWecomRequest(token, timestamp, nonce, tmp.Encrypt)
-		if expected != msgSignature {
-			h.logger.Warn("企业微信 POST 签名验证失败", zap.String("expected", expected), zap.String("got", msgSignature))
-			c.String(http.StatusOK, "")
-			return
-		}
+	// 验证请求签名防止伪造。企业微信签名算法同 URL 验证，使用 token、timestamp、nonce、 Encrypt 四个字段。
+	// 启用企业微信时必须配置 token 并校验签名，避免未授权请求触发 Agent。
+	token, ok := h.wecomRequireToken(c)
+	if !ok {
+		return
+	}
+	if msgSignature == "" {
+		h.logger.Warn("企业微信 POST 缺少签名，已拒绝（需确保回调携带 msg_signature）")
+		c.String(http.StatusOK, "")
+		return
+	}
+	var tmp wecomXML
+	if err := xml.Unmarshal(bodyRaw, &tmp); err != nil {
+		h.logger.Warn("企业微信 POST 签名验证前解析 XML 失败", zap.Error(err))
+		c.String(http.StatusOK, "")
+		return
+	}
+	expected := h.signWecomRequest(token, timestamp, nonce, tmp.Encrypt)
+	if expected != msgSignature {
+		h.logger.Warn("企业微信 POST 签名验证失败", zap.String("expected", expected), zap.String("got", msgSignature))
+		c.String(http.StatusOK, "")
+		return
 	}
 
 	var body wecomXML
@@ -899,6 +915,13 @@ func (h *RobotHandler) HandleWecomPOST(c *gin.Context) {
 	// 保存企业 ID（用于明文模式回复）
 	enterpriseID := body.ToUserName
 
+	// 配置了 EncodingAESKey 时必须走加密消息，拒绝明文 XML 绕过
+	if strings.TrimSpace(h.config.Robots.Wecom.EncodingAESKey) != "" && strings.TrimSpace(body.Encrypt) == "" {
+		h.logger.Warn("企业微信已配置加密模式但收到明文消息，已拒绝")
+		c.String(http.StatusOK, "")
+		return
+	}
+
 	// 加密模式：先解密再解析内层 XML
 	if body.Encrypt != "" && h.config.Robots.Wecom.EncodingAESKey != "" {
 		h.logger.Debug("企业微信进入加密模式解密流程")

internal/handler/robot_wecom_test.go

@@ -0,0 +1,78 @@
+package handler
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"cyberstrike-ai/internal/config"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+)
+
+func newWecomTestHandler(token string, aesKey string) *RobotHandler {
+	return &RobotHandler{
+		config: &config.Config{
+			Robots: config.RobotsConfig{
+				Wecom: config.RobotWecomConfig{
+					Enabled:        true,
+					Token:          token,
+					EncodingAESKey: aesKey,
+				},
+			},
+		},
+		logger: zap.NewNop(),
+	}
+}
+
+func TestHandleWecomPOST_rejectsWhenTokenEmpty(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	h := newWecomTestHandler("", "")
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	body := `<?xml version="1.0"?><xml><FromUserName>attacker</FromUserName><MsgType>text</MsgType><Content>hi</Content></xml>`
+	c.Request = httptest.NewRequest(http.MethodPost, "/api/robot/wecom", strings.NewReader(body))
+
+	h.HandleWecomPOST(c)
+
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", w.Code, http.StatusForbidden)
+	}
+	if w.Body.String() == "success" {
+		t.Fatal("expected rejection, got success")
+	}
+}
+
+func TestHandleWecomPOST_rejectsPlaintextWhenEncryptionConfigured(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	h := newWecomTestHandler("secret-token", "abcdefghijklmnopqrstuvwxyz0123456789ABCD")
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	body := `<?xml version="1.0"?><xml><FromUserName>attacker</FromUserName><MsgType>text</MsgType><Content>hi</Content></xml>`
+	c.Request = httptest.NewRequest(http.MethodPost, "/api/robot/wecom?timestamp=1&nonce=2&msg_signature=fake", strings.NewReader(body))
+
+	h.HandleWecomPOST(c)
+
+	if w.Body.String() == "success" {
+		t.Fatal("expected rejection for plaintext in encryption mode, got success")
+	}
+}
+
+func TestHandleWecomGET_rejectsWhenTokenEmpty(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	h := newWecomTestHandler("", "")
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest(http.MethodGet, "/api/robot/wecom?msg_signature=x&timestamp=1&nonce=2&echostr=abc", nil)
+
+	h.HandleWecomGET(c)
+
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", w.Code, http.StatusForbidden)
+	}
+}

internal/handler/task_manager.go

@@ -26,6 +26,7 @@ func shouldPersistEinoAgentTraceAfterRunError(baseCtx context.Context) bool {
 // AgentTask 描述正在运行的Agent任务
 type AgentTask struct {
 	ConversationID string    `json:"conversationId"`
+	Title          string    `json:"title,omitempty"`
 	Message        string    `json:"message,omitempty"`
 	StartedAt      time.Time `json:"startedAt"`
 	Status         string    `json:"status"`
@@ -42,6 +43,9 @@ type AgentTask struct {
 	// activeEinoExecuteAbortNote AbortActiveEinoExecute 写入的用户说明，由 execute 收尾时合并进工具结果
 	activeEinoExecuteAbortNote string
 
+	// hitlCognition 本轮运行中供 HITL/审计 Agent 读取的上下文（用户原话 + 思考，不含会话历史）
+	hitlCognition *hitlCognitionState
+
 	cancel func(error)
 }
 
@@ -103,6 +107,40 @@ func (m *AgentTaskManager) UnregisterActiveEinoExecute(conversationID string) {
 	}
 }
 
+// ConversationIDForActiveMCPExecution 根据当前登记的工具 executionId 反查会话 ID（供 MCP 监控页按 executionId 终止）。
+func (m *AgentTaskManager) ConversationIDForActiveMCPExecution(executionID string) string {
+	executionID = strings.TrimSpace(executionID)
+	if executionID == "" {
+		return ""
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for convID, t := range m.tasks {
+		if t != nil && t.ActiveMCPExecutionID == executionID {
+			return convID
+		}
+	}
+	return ""
+}
+
+// ConversationIDForActiveEinoExecute 返回当前唯一进行 Eino execute 的会话 ID；多会话并行时返回空。
+func (m *AgentTaskManager) ConversationIDForActiveEinoExecute() (string, bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	var found string
+	count := 0
+	for convID, t := range m.tasks {
+		if t != nil && t.activeEinoExecuteCancel != nil {
+			found = convID
+			count++
+		}
+	}
+	if count == 1 {
+		return found, true
+	}
+	return "", false
+}
+
 // AbortActiveEinoExecute 终止当前 Eino execute 并暂存用户说明（与 MCP 工具终止一致）。
 func (m *AgentTaskManager) AbortActiveEinoExecute(conversationID, note string) bool {
 	conversationID = strings.TrimSpace(conversationID)
@@ -199,6 +237,7 @@ func (m *AgentTaskManager) ActiveMCPExecutionID(conversationID string) string {
 // CompletedTask 已完成的任务（用于历史记录）
 type CompletedTask struct {
 	ConversationID string    `json:"conversationId"`
+	Title          string    `json:"title,omitempty"`
 	Message        string    `json:"message,omitempty"`
 	StartedAt      time.Time `json:"startedAt"`
 	CompletedAt    time.Time `json:"completedAt"`
@@ -213,6 +252,8 @@ type AgentTaskManager struct {
 	maxHistorySize   int              // 最大历史记录数
 	historyRetention time.Duration    // 历史记录保留时间
 	eventBus         *TaskEventBus    // 可选：任务结束时关闭镜像 SSE 订阅
+	// toolCanceler 在用户整轮停止任务时终止当前 MCP 工具（非「中断并继续」）。
+	toolCanceler func(conversationID string)
 }
 
 const (
@@ -243,6 +284,13 @@ func (m *AgentTaskManager) SetTaskEventBus(b *TaskEventBus) {
 	m.eventBus = b
 }
 
+// SetToolCanceler 设置整轮停止任务时终止当前 MCP 工具的回调（由 AgentHandler 注入）。
+func (m *AgentTaskManager) SetToolCanceler(fn func(conversationID string)) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.toolCanceler = fn
+}
+
 // GetTask 返回运行中任务（无则 nil）。
 func (m *AgentTaskManager) GetTask(conversationID string) *AgentTask {
 	m.mu.RLock()
@@ -309,6 +357,7 @@ func (m *AgentTaskManager) StartTask(conversationID, message string, cancel cont
 	}
 
 	m.tasks[conversationID] = task
+	task.hitlCognition = &hitlCognitionState{UserMessage: strings.TrimSpace(message)}
 	return task, nil
 }
 
@@ -338,14 +387,21 @@ func (m *AgentTaskManager) CancelTask(conversationID string, cause error) (bool,
 		task.InterruptContinueNote = ""
 	}
 	cancel := task.cancel
-	m.mu.Unlock()
-
 	if cause == nil {
 		cause = ErrTaskCancelled
 	}
+	var toolCanceler func(string)
+	if errors.Is(cause, ErrTaskCancelled) {
+		toolCanceler = m.toolCanceler
+	}
+	m.mu.Unlock()
+
 	if cancel != nil {
 		cancel(cause)
 	}
+	if toolCanceler != nil {
+		toolCanceler(conversationID)
+	}
 	return true, nil
 }
 

internal/handler/task_manager_eino_execute_test.go

@@ -38,3 +38,19 @@ func TestAbortActiveEinoExecute(t *testing.T) {
 		t.Fatal("second abort should fail when no active execute")
 	}
 }
+
+func TestConversationIDForActiveMCPExecution(t *testing.T) {
+	m := NewAgentTaskManager()
+	conv := "conv-mcp-exec"
+	_, err := m.StartTask(conv, "test", func(error) {})
+	if err != nil {
+		t.Fatalf("StartTask: %v", err)
+	}
+	m.RegisterRunningTool(conv, "exec-123")
+	if got := m.ConversationIDForActiveMCPExecution("exec-123"); got != conv {
+		t.Fatalf("got %q, want %q", got, conv)
+	}
+	if got := m.ConversationIDForActiveMCPExecution("missing"); got != "" {
+		t.Fatalf("missing should be empty, got %q", got)
+	}
+}

internal/handler/task_manager_tool_cancel_test.go

@@ -0,0 +1,80 @@
+package handler
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"cyberstrike-ai/internal/multiagent"
+)
+
+func TestCancelTaskInvokesToolCancelerOnFullStop(t *testing.T) {
+	tm := NewAgentTaskManager()
+	called := false
+	tm.SetToolCanceler(func(conversationID string) {
+		if conversationID == "conv-1" {
+			called = true
+		}
+	})
+
+	_, cancel := context.WithCancelCause(context.Background())
+	_, err := tm.StartTask("conv-1", "hello", cancel)
+	if err != nil {
+		t.Fatalf("StartTask: %v", err)
+	}
+
+	ok, err := tm.CancelTask("conv-1", ErrTaskCancelled)
+	if err != nil || !ok {
+		t.Fatalf("CancelTask: ok=%v err=%v", ok, err)
+	}
+	if !called {
+		t.Fatal("expected tool canceler to be invoked on full task cancel")
+	}
+}
+
+func TestCancelTaskSkipsToolCancelerOnInterruptContinue(t *testing.T) {
+	tm := NewAgentTaskManager()
+	called := false
+	tm.SetToolCanceler(func(conversationID string) {
+		called = true
+	})
+
+	_, cancel := context.WithCancelCause(context.Background())
+	_, err := tm.StartTask("conv-1", "hello", cancel)
+	if err != nil {
+		t.Fatalf("StartTask: %v", err)
+	}
+
+	ok, err := tm.CancelTask("conv-1", multiagent.ErrInterruptContinue)
+	if err != nil || !ok {
+		t.Fatalf("CancelTask: ok=%v err=%v", ok, err)
+	}
+	if called {
+		t.Fatal("tool canceler must not run for interrupt-continue")
+	}
+}
+
+func TestCancelTaskDefaultCauseIsTaskCancelled(t *testing.T) {
+	tm := NewAgentTaskManager()
+	var gotCause error
+	tm.SetToolCanceler(func(conversationID string) {
+		if conversationID == "conv-2" {
+			gotCause = ErrTaskCancelled
+		}
+	})
+
+	ctx, cancel := context.WithCancelCause(context.Background())
+	if _, err := tm.StartTask("conv-2", "hello", cancel); err != nil {
+		t.Fatalf("StartTask: %v", err)
+	}
+
+	if _, err := tm.CancelTask("conv-2", nil); err != nil {
+		t.Fatalf("CancelTask: %v", err)
+	}
+	if !errors.Is(context.Cause(ctx), ErrTaskCancelled) {
+		t.Fatalf("expected ErrTaskCancelled cause, got %v", context.Cause(ctx))
+	}
+	if gotCause != ErrTaskCancelled {
+		t.Fatalf("expected tool canceler path for default cancel cause")
+	}
+}

internal/handler/terminal_ws_windows.go

@@ -0,0 +1,16 @@
+//go:build windows
+
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// RunCommandWS 交互式 PTY 终端依赖 Unix PTY（见 terminal_ws_unix.go）；Windows 暂不支持。
+func (h *TerminalHandler) RunCommandWS(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, gin.H{
+		"error": "Interactive WebSocket terminal is not supported on Windows; use POST /terminal/run or /terminal/run/stream instead.",
+	})
+}

internal/handler/vulnerability.go

@@ -45,9 +45,12 @@ type CreateVulnerabilityRequest struct {
 	Status          string `json:"status"`
 	Type            string `json:"type"`
 	Target          string `json:"target"`
-	Proof           string `json:"proof"`
+	Preconditions   string `json:"preconditions"`
+	ReproSteps      string `json:"reproduction_steps"`
+	Evidence        string `json:"evidence"`
 	Impact          string `json:"impact"`
 	Recommendation  string `json:"recommendation"`
+	RetestNotes     string `json:"retest_notes"`
 }
 
 // CreateVulnerability 创建漏洞
@@ -69,9 +72,12 @@ func (h *VulnerabilityHandler) CreateVulnerability(c *gin.Context) {
 		Status:          req.Status,
 		Type:            req.Type,
 		Target:          req.Target,
-		Proof:           req.Proof,
+		Preconditions:   req.Preconditions,
+		ReproSteps:      req.ReproSteps,
+		Evidence:        req.Evidence,
 		Impact:          req.Impact,
 		Recommendation:  req.Recommendation,
+		RetestNotes:     req.RetestNotes,
 	}
 
 	created, err := h.db.CreateVulnerability(vuln)
@@ -118,7 +124,7 @@ func parseVulnerabilityListFilter(c *gin.Context) database.VulnerabilityListFilt
 		q = strings.TrimSpace(c.Query("search"))
 	}
 	return database.VulnerabilityListFilter{
-		ProjectID: c.Query("project_id"),
+		ProjectID:       c.Query("project_id"),
 		ID:              c.Query("id"),
 		Search:          q,
 		ConversationID:  c.Query("conversation_id"),
@@ -197,17 +203,20 @@ func (h *VulnerabilityHandler) ListVulnerabilities(c *gin.Context) {
 // UpdateVulnerabilityRequest 更新漏洞请求
 type UpdateVulnerabilityRequest struct {
 	ProjectID       *string `json:"project_id"`
-	ConversationTag string  `json:"conversation_tag"`
-	TaskTag         string  `json:"task_tag"`
-	Title           string  `json:"title"`
-	Description     string  `json:"description"`
-	Severity        string  `json:"severity"`
-	Status          string  `json:"status"`
-	Type            string  `json:"type"`
-	Target          string  `json:"target"`
-	Proof           string  `json:"proof"`
-	Impact          string  `json:"impact"`
-	Recommendation  string  `json:"recommendation"`
+	ConversationTag *string `json:"conversation_tag"`
+	TaskTag         *string `json:"task_tag"`
+	Title           *string `json:"title"`
+	Description     *string `json:"description"`
+	Severity        *string `json:"severity"`
+	Status          *string `json:"status"`
+	Type            *string `json:"type"`
+	Target          *string `json:"target"`
+	Preconditions   *string `json:"preconditions"`
+	ReproSteps      *string `json:"reproduction_steps"`
+	Evidence        *string `json:"evidence"`
+	Impact          *string `json:"impact"`
+	Recommendation  *string `json:"recommendation"`
+	RetestNotes     *string `json:"retest_notes"`
 }
 
 // UpdateVulnerability 更新漏洞
@@ -231,38 +240,47 @@ func (h *VulnerabilityHandler) UpdateVulnerability(c *gin.Context) {
 	if req.ProjectID != nil {
 		existing.ProjectID = strings.TrimSpace(*req.ProjectID)
 	}
-	if req.ConversationTag != "" {
-		existing.ConversationTag = req.ConversationTag
+	if req.ConversationTag != nil {
+		existing.ConversationTag = *req.ConversationTag
 	}
-	if req.TaskTag != "" {
-		existing.TaskTag = req.TaskTag
+	if req.TaskTag != nil {
+		existing.TaskTag = *req.TaskTag
 	}
-	if req.Title != "" {
-		existing.Title = req.Title
+	if req.Title != nil {
+		existing.Title = *req.Title
 	}
-	if req.Description != "" {
-		existing.Description = req.Description
+	if req.Description != nil {
+		existing.Description = *req.Description
 	}
-	if req.Severity != "" {
-		existing.Severity = req.Severity
+	if req.Severity != nil {
+		existing.Severity = *req.Severity
 	}
-	if req.Status != "" {
-		existing.Status = req.Status
+	if req.Status != nil {
+		existing.Status = *req.Status
 	}
-	if req.Type != "" {
-		existing.Type = req.Type
+	if req.Type != nil {
+		existing.Type = *req.Type
 	}
-	if req.Target != "" {
-		existing.Target = req.Target
+	if req.Target != nil {
+		existing.Target = *req.Target
 	}
-	if req.Proof != "" {
-		existing.Proof = req.Proof
+	if req.Preconditions != nil {
+		existing.Preconditions = *req.Preconditions
 	}
-	if req.Impact != "" {
-		existing.Impact = req.Impact
+	if req.ReproSteps != nil {
+		existing.ReproSteps = *req.ReproSteps
 	}
-	if req.Recommendation != "" {
-		existing.Recommendation = req.Recommendation
+	if req.Evidence != nil {
+		existing.Evidence = *req.Evidence
+	}
+	if req.Impact != nil {
+		existing.Impact = *req.Impact
+	}
+	if req.Recommendation != nil {
+		existing.Recommendation = *req.Recommendation
+	}
+	if req.RetestNotes != nil {
+		existing.RetestNotes = *req.RetestNotes
 	}
 
 	if err := h.db.UpdateVulnerability(id, existing); err != nil {
@@ -495,9 +513,19 @@ func appendVulnerabilityMarkdown(b *strings.Builder, v *database.Vulnerability,
 		b.WriteString(v.Description)
 		b.WriteString("\n")
 	}
-	if v.Proof != "" {
-		b.WriteString("\n#### 证明（POC）\n\n```\n")
-		b.WriteString(v.Proof)
+	if v.Preconditions != "" {
+		b.WriteString("\n#### 前置条件\n\n")
+		b.WriteString(v.Preconditions)
+		b.WriteString("\n")
+	}
+	if v.ReproSteps != "" {
+		b.WriteString("\n#### 复现步骤\n\n")
+		b.WriteString(v.ReproSteps)
+		b.WriteString("\n")
+	}
+	if v.Evidence != "" {
+		b.WriteString("\n#### 证据 / POC\n\n```\n")
+		b.WriteString(v.Evidence)
 		b.WriteString("\n```\n")
 	}
 	if v.Impact != "" {
@@ -510,6 +538,11 @@ func appendVulnerabilityMarkdown(b *strings.Builder, v *database.Vulnerability,
 		b.WriteString(v.Recommendation)
 		b.WriteString("\n")
 	}
+	if v.RetestNotes != "" {
+		b.WriteString("\n#### 复测方式\n\n")
+		b.WriteString(v.RetestNotes)
+		b.WriteString("\n")
+	}
 	b.WriteString("\n")
 }
 

internal/handler/workflow.go

@@ -0,0 +1,153 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+
+	"cyberstrike-ai/internal/agent"
+	"cyberstrike-ai/internal/audit"
+	"cyberstrike-ai/internal/config"
+	"cyberstrike-ai/internal/database"
+	workflowrunner "cyberstrike-ai/internal/workflow"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+)
+
+type WorkflowHandler struct {
+	db     *database.DB
+	logger *zap.Logger
+	audit  *audit.Service
+	agent  *agent.Agent
+	cfg    *config.Config
+}
+
+func NewWorkflowHandler(db *database.DB, logger *zap.Logger) *WorkflowHandler {
+	return &WorkflowHandler{db: db, logger: logger}
+}
+
+func (h *WorkflowHandler) SetAudit(s *audit.Service) {
+	h.audit = s
+}
+
+type workflowSaveRequest struct {
+	ID          string          `json:"id"`
+	Name        string          `json:"name"`
+	Description string          `json:"description,omitempty"`
+	Version     int             `json:"version,omitempty"`
+	Enabled     *bool           `json:"enabled,omitempty"`
+	Graph       json.RawMessage `json:"graph,omitempty"`
+	GraphJSON   json.RawMessage `json:"graph_json,omitempty"`
+}
+
+func (h *WorkflowHandler) List(c *gin.Context) {
+	includeDisabled := strings.EqualFold(c.Query("includeDisabled"), "true") || c.Query("include_disabled") == "1"
+	items, err := h.db.ListWorkflowDefinitions(includeDisabled)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"workflows": items})
+}
+
+func (h *WorkflowHandler) Get(c *gin.Context) {
+	id := strings.TrimSpace(c.Param("id"))
+	wf, err := h.db.GetWorkflowDefinition(id)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if wf == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "工作流不存在"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"workflow": wf})
+}
+
+func (h *WorkflowHandler) Create(c *gin.Context) {
+	h.save(c, "")
+}
+
+func (h *WorkflowHandler) Update(c *gin.Context) {
+	h.save(c, c.Param("id"))
+}
+
+func (h *WorkflowHandler) save(c *gin.Context, pathID string) {
+	var req workflowSaveRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的请求参数: " + err.Error()})
+		return
+	}
+	id := strings.TrimSpace(req.ID)
+	if strings.TrimSpace(pathID) != "" {
+		id = strings.TrimSpace(pathID)
+	}
+	name := strings.TrimSpace(req.Name)
+	if id == "" || name == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "工作流 id 和 name 不能为空"})
+		return
+	}
+	graph := req.Graph
+	if len(graph) == 0 {
+		graph = req.GraphJSON
+	}
+	if len(graph) == 0 {
+		graph = []byte(`{"nodes":[],"edges":[],"config":{}}`)
+	}
+	if !json.Valid(graph) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "graph 必须是合法 JSON"})
+		return
+	}
+	if err := workflowrunner.ValidateGraphJSON(c.Request.Context(), string(graph)); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "工作流图无法编译: " + err.Error()})
+		return
+	}
+	var probe interface{}
+	if err := json.Unmarshal(graph, &probe); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "graph JSON 解析失败: " + err.Error()})
+		return
+	}
+	enabled := true
+	if req.Enabled != nil {
+		enabled = *req.Enabled
+	}
+	wf := &database.WorkflowDefinition{
+		ID:          id,
+		Name:        name,
+		Description: strings.TrimSpace(req.Description),
+		Version:     req.Version,
+		GraphJSON:   string(graph),
+		Enabled:     enabled,
+	}
+	if err := h.db.UpsertWorkflowDefinition(wf); err != nil {
+		if h.logger != nil {
+			h.logger.Warn("保存工作流失败", zap.String("id", id), zap.Error(err))
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	saved, _ := h.db.GetWorkflowDefinition(id)
+	workflowrunner.InvalidateCompiledCache(id)
+	if h.audit != nil {
+		h.audit.RecordOK(c, "workflow", "save", "保存图编排流程", "workflow", id, map[string]interface{}{"name": name})
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "工作流已保存", "workflow": saved})
+}
+
+func (h *WorkflowHandler) Delete(c *gin.Context) {
+	id := strings.TrimSpace(c.Param("id"))
+	if id == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "工作流 id 不能为空"})
+		return
+	}
+	if err := h.db.DeleteWorkflowDefinition(id); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	workflowrunner.InvalidateCompiledCache(id)
+	if h.audit != nil {
+		h.audit.RecordOK(c, "workflow", "delete", "删除图编排流程", "workflow", id, nil)
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "工作流已删除"})
+}

internal/handler/workflow_integration.go

@@ -0,0 +1,263 @@
+package handler
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+	"time"
+
+	"cyberstrike-ai/internal/config"
+	workflowrunner "cyberstrike-ai/internal/workflow"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+)
+
+func (h *AgentHandler) roleForWorkflow(req *ChatRequest) (config.RoleConfig, bool) {
+	if h == nil || h.config == nil || h.config.Roles == nil || req == nil {
+		return config.RoleConfig{}, false
+	}
+	roleName := strings.TrimSpace(req.Role)
+	if roleName == "" {
+		return config.RoleConfig{}, false
+	}
+	role, ok := h.config.Roles[roleName]
+	if !ok || !role.Enabled {
+		return config.RoleConfig{}, false
+	}
+	if role.Name == "" {
+		role.Name = roleName
+	}
+	if !workflowrunner.ShouldAutoRunRoleWorkflow(role) {
+		return config.RoleConfig{}, false
+	}
+	return role, true
+}
+
+func (h *AgentHandler) runRoleWorkflowStreamIfBound(
+	req *ChatRequest,
+	prep *multiAgentPrepared,
+	sendEvent func(eventType, message string, data interface{}),
+) bool {
+	role, ok := h.roleForWorkflow(req)
+	if !ok || prep == nil {
+		return false
+	}
+
+	conversationID := prep.ConversationID
+	assistantMessageID := prep.AssistantMessageID
+	userMessage := ""
+	if req != nil {
+		userMessage = req.Message
+	}
+
+	taskStatus := "completed"
+	taskOwned := false
+	defer func() {
+		if taskOwned {
+			h.tasks.FinishTask(conversationID, taskStatus)
+		}
+	}()
+
+	baseCtx, cancelWithCause := context.WithCancelCause(context.Background())
+	defer cancelWithCause(nil)
+	taskCtx, timeoutCancel := context.WithTimeout(baseCtx, 600*time.Minute)
+	defer timeoutCancel()
+
+	if _, err := h.tasks.StartTask(conversationID, userMessage, cancelWithCause); err != nil {
+		var errorMsg string
+		if errors.Is(err, ErrTaskAlreadyRunning) {
+			errorMsg = "⚠️ 当前会话已有任务正在执行中，请等待当前任务完成或点击「停止任务」后再尝试。"
+			sendEvent("error", errorMsg, map[string]interface{}{
+				"conversationId": conversationID,
+				"errorType":      "task_already_running",
+			})
+		} else {
+			errorMsg = "❌ 无法启动任务: " + err.Error()
+			sendEvent("error", errorMsg, nil)
+		}
+		if assistantMessageID != "" {
+			_, _ = h.db.Exec("UPDATE messages SET content = ?, updated_at = ? WHERE id = ?", errorMsg, time.Now(), assistantMessageID)
+		}
+		sendEvent("done", "", map[string]interface{}{"conversationId": conversationID})
+		return true
+	}
+	taskOwned = true
+
+	progress := h.createProgressCallback(taskCtx, cancelWithCause, conversationID, assistantMessageID, sendEvent)
+	result, err := workflowrunner.RunRoleBoundWorkflow(taskCtx, workflowrunner.RunArgs{
+		DB:                 h.db,
+		Logger:             h.logger,
+		Role:               role,
+		AppCfg:             h.config,
+		Agent:              h.agent,
+		ConversationID:     conversationID,
+		ProjectID:          h.conversationProjectID(conversationID),
+		UserMessage:        prep.FinalMessage,
+		History:            prep.History,
+		RoleTools:          prep.RoleTools,
+		AgentsMarkdownDir:  h.agentsMarkdownDir,
+		SystemPromptExtra:  h.agentSessionContextBlock(conversationID),
+		AssistantMessageID: assistantMessageID,
+		Progress:           progress,
+	})
+	if err != nil {
+		cause := context.Cause(baseCtx)
+		if errors.Is(cause, ErrTaskCancelled) {
+			taskStatus = "cancelled"
+			h.tasks.UpdateTaskStatus(conversationID, taskStatus)
+			cancelMsg := "任务已被用户取消，后续操作已停止。"
+			if assistantMessageID != "" {
+				if err := h.appendAssistantMessageNotice(assistantMessageID, cancelMsg); err != nil {
+					h.logger.Warn("更新取消后的助手消息失败", zap.Error(err))
+				}
+				_ = h.db.AddProcessDetail(assistantMessageID, conversationID, "cancelled", cancelMsg, nil)
+			}
+			sendEvent("cancelled", cancelMsg, map[string]interface{}{
+				"conversationId": conversationID,
+				"messageId":      assistantMessageID,
+			})
+			sendEvent("done", "", map[string]interface{}{"conversationId": conversationID})
+			return true
+		}
+		if errors.Is(err, context.DeadlineExceeded) || errors.Is(context.Cause(taskCtx), context.DeadlineExceeded) {
+			taskStatus = "timeout"
+			h.tasks.UpdateTaskStatus(conversationID, taskStatus)
+			timeoutMsg := "任务执行超时，已自动终止。"
+			if assistantMessageID != "" {
+				_, _ = h.db.Exec("UPDATE messages SET content = ?, updated_at = ? WHERE id = ?", timeoutMsg, time.Now(), assistantMessageID)
+				_ = h.db.AddProcessDetail(assistantMessageID, conversationID, "timeout", timeoutMsg, nil)
+			}
+			sendEvent("error", timeoutMsg, map[string]interface{}{
+				"conversationId": conversationID,
+				"messageId":      assistantMessageID,
+				"errorType":      "timeout",
+			})
+			sendEvent("done", "", map[string]interface{}{"conversationId": conversationID})
+			return true
+		}
+		errMsg := "执行角色绑定流程失败: " + err.Error()
+		taskStatus = "failed"
+		h.tasks.UpdateTaskStatus(conversationID, taskStatus)
+		if assistantMessageID != "" {
+			_, _ = h.db.Exec("UPDATE messages SET content = ?, updated_at = ? WHERE id = ?", errMsg, time.Now(), assistantMessageID)
+			_ = h.db.AddProcessDetail(assistantMessageID, conversationID, "error", errMsg, nil)
+		}
+		sendEvent("error", errMsg, map[string]interface{}{"conversationId": conversationID})
+		sendEvent("done", "", map[string]interface{}{"conversationId": conversationID})
+		return true
+	}
+	if prep.AssistantMessageID != "" {
+		_ = h.db.UpdateAssistantMessageFinalize(prep.AssistantMessageID, result.Response, nil, "")
+	}
+	payload := map[string]interface{}{
+		"conversationId": prep.ConversationID,
+		"messageId":      prep.AssistantMessageID,
+		"agentMode":      "workflow",
+		"workflowRunId":  result.RunID,
+	}
+	if result.AwaitingHITL {
+		payload["workflowStatus"] = "awaiting_hitl"
+		payload["awaitingHitl"] = true
+	}
+	sendEvent("response", result.Response, payload)
+	sendEvent("done", "", map[string]interface{}{"conversationId": prep.ConversationID})
+	return true
+}
+
+func (h *AgentHandler) runRoleWorkflowJSONIfBound(c *gin.Context, req *ChatRequest, prep *multiAgentPrepared) bool {
+	role, ok := h.roleForWorkflow(req)
+	if !ok || prep == nil {
+		return false
+	}
+
+	conversationID := prep.ConversationID
+	assistantMessageID := prep.AssistantMessageID
+	userMessage := ""
+	if req != nil {
+		userMessage = req.Message
+	}
+
+	taskStatus := "completed"
+	taskOwned := false
+	defer func() {
+		if taskOwned {
+			h.tasks.FinishTask(conversationID, taskStatus)
+		}
+	}()
+
+	baseCtx, cancelWithCause := context.WithCancelCause(c.Request.Context())
+	defer cancelWithCause(nil)
+	taskCtx, timeoutCancel := context.WithTimeout(baseCtx, 600*time.Minute)
+	defer timeoutCancel()
+
+	if _, err := h.tasks.StartTask(conversationID, userMessage, cancelWithCause); err != nil {
+		if errors.Is(err, ErrTaskAlreadyRunning) {
+			c.JSON(http.StatusConflict, gin.H{
+				"error":          "⚠️ 当前会话已有任务正在执行中，请等待当前任务完成或点击「停止任务」后再尝试。",
+				"conversationId": conversationID,
+				"errorType":      "task_already_running",
+			})
+		} else {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "❌ 无法启动任务: " + err.Error()})
+		}
+		return true
+	}
+	taskOwned = true
+
+	progress := h.createProgressCallback(taskCtx, cancelWithCause, conversationID, assistantMessageID, nil)
+	result, err := workflowrunner.RunRoleBoundWorkflow(taskCtx, workflowrunner.RunArgs{
+		DB:                 h.db,
+		Logger:             h.logger,
+		Role:               role,
+		AppCfg:             h.config,
+		Agent:              h.agent,
+		ConversationID:     conversationID,
+		ProjectID:          h.conversationProjectID(conversationID),
+		UserMessage:        prep.FinalMessage,
+		History:            prep.History,
+		RoleTools:          prep.RoleTools,
+		AgentsMarkdownDir:  h.agentsMarkdownDir,
+		SystemPromptExtra:  h.agentSessionContextBlock(conversationID),
+		AssistantMessageID: assistantMessageID,
+		Progress:           progress,
+	})
+	if err != nil {
+		cause := context.Cause(baseCtx)
+		if errors.Is(cause, ErrTaskCancelled) {
+			taskStatus = "cancelled"
+			cancelMsg := "任务已被用户取消，后续操作已停止。"
+			if assistantMessageID != "" {
+				_ = h.appendAssistantMessageNotice(assistantMessageID, cancelMsg)
+				_ = h.db.AddProcessDetail(assistantMessageID, conversationID, "cancelled", cancelMsg, nil)
+			}
+			c.JSON(http.StatusOK, gin.H{
+				"status":         "cancelled",
+				"message":        cancelMsg,
+				"conversationId": conversationID,
+			})
+			return true
+		}
+		errMsg := "执行角色绑定流程失败: " + err.Error()
+		taskStatus = "failed"
+		if assistantMessageID != "" {
+			_, _ = h.db.Exec("UPDATE messages SET content = ?, updated_at = ? WHERE id = ?", errMsg, time.Now(), assistantMessageID)
+		}
+		c.JSON(http.StatusInternalServerError, gin.H{"error": errMsg, "conversationId": conversationID})
+		return true
+	}
+	if prep.AssistantMessageID != "" {
+		_ = h.db.UpdateAssistantMessageFinalize(prep.AssistantMessageID, result.Response, nil, "")
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"response":           result.Response,
+		"conversationId":     prep.ConversationID,
+		"assistantMessageId": prep.AssistantMessageID,
+		"agentMode":          "workflow",
+		"workflowRunId":      result.RunID,
+		"workflowStatus":     result.Status,
+		"awaitingHitl":       result.AwaitingHITL,
+	})
+	return true
+}

internal/handler/workflow_run.go

@@ -0,0 +1,128 @@
+package handler
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	"cyberstrike-ai/internal/agent"
+	"cyberstrike-ai/internal/config"
+	workflowrunner "cyberstrike-ai/internal/workflow"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *WorkflowHandler) SetRuntime(agent *agent.Agent, cfg *config.Config) {
+	h.agent = agent
+	h.cfg = cfg
+}
+
+func (h *WorkflowHandler) GetRun(c *gin.Context) {
+	runID := strings.TrimSpace(c.Param("runId"))
+	run, err := h.db.GetWorkflowRun(runID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if run == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "工作流运行不存在"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"run": run})
+}
+
+func (h *WorkflowHandler) ListPendingRuns(c *gin.Context) {
+	conversationID := strings.TrimSpace(c.Query("conversationId"))
+	runs, err := h.db.ListWorkflowRunsAwaitingHITLFiltered(conversationID, 50)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"runs": runs})
+}
+
+type workflowResumeRequest struct {
+	Approved bool   `json:"approved"`
+	Comment  string `json:"comment,omitempty"`
+}
+
+func (h *WorkflowHandler) ResumeRun(c *gin.Context) {
+	if h.agent == nil || h.cfg == nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "工作流运行时未初始化"})
+		return
+	}
+	runID := strings.TrimSpace(c.Param("runId"))
+	var req workflowResumeRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的请求参数: " + err.Error()})
+		return
+	}
+	run, err := h.db.GetWorkflowRun(runID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	if run == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "工作流运行不存在"})
+		return
+	}
+	role := config.RoleConfig{Name: strings.TrimSpace(run.RoleID)}
+	if role.Name != "" && h.cfg.Roles != nil {
+		if r, ok := h.cfg.Roles[role.Name]; ok {
+			role = r
+			if role.Name == "" {
+				role.Name = run.RoleID
+			}
+		}
+	}
+	if run.Status != "awaiting_hitl" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "工作流运行不在等待审批状态: " + run.Status})
+		return
+	}
+	if err := h.db.RecordWorkflowRunHITLDecision(runID, req.Approved, req.Comment); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	decision := workflowrunner.HITLDecision{
+		Approved: req.Approved,
+		Comment:  strings.TrimSpace(req.Comment),
+	}
+	delegated := workflowrunner.NotifyHITLDecision(runID, decision)
+	if !delegated {
+		for i := 0; i < 10; i++ {
+			time.Sleep(50 * time.Millisecond)
+			if workflowrunner.NotifyHITLDecision(runID, decision) {
+				delegated = true
+				break
+			}
+		}
+	}
+	if delegated {
+		c.JSON(http.StatusOK, gin.H{
+			"workflowRunId":    runID,
+			"status":           "delegated",
+			"streamResuming":   true,
+			"approved":         req.Approved,
+		})
+		return
+	}
+	result, err := workflowrunner.ResumeWorkflowRun(c.Request.Context(), workflowrunner.RunArgs{
+		DB:             h.db,
+		Logger:         h.logger,
+		Role:           role,
+		AppCfg:         h.cfg,
+		Agent:          h.agent,
+		ConversationID: run.ConversationID,
+		ProjectID:      run.ProjectID,
+	}, runID, req.Approved, req.Comment)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"response":      result.Response,
+		"workflowRunId": result.RunID,
+		"status":        result.Status,
+		"awaitingHitl":  result.AwaitingHITL,
+	})
+}

internal/hitl/retention.go

@@ -0,0 +1,71 @@
+package hitl
+
+import (
+	"time"
+
+	"cyberstrike-ai/internal/config"
+	"cyberstrike-ai/internal/database"
+
+	"go.uber.org/zap"
+)
+
+const retentionPurgeInterval = time.Hour
+
+// Service manages HITL audit log retention (decided hitl_interrupts rows).
+type Service struct {
+	db     *database.DB
+	cfg    *config.Config
+	logger *zap.Logger
+}
+
+// NewService creates a HITL audit log retention service.
+func NewService(db *database.DB, cfg *config.Config, logger *zap.Logger) *Service {
+	return &Service{db: db, cfg: cfg, logger: logger}
+}
+
+// RetentionDays returns configured retention; 0 means keep forever.
+func (s *Service) RetentionDays() int {
+	if s == nil || s.cfg == nil {
+		return config.HitlConfig{}.RetentionDaysEffective()
+	}
+	return s.cfg.Hitl.RetentionDaysEffective()
+}
+
+// PurgeExpired deletes decided HITL log rows older than retention_days when configured.
+func (s *Service) PurgeExpired() {
+	if s == nil || s.db == nil || s.cfg == nil {
+		return
+	}
+	days := s.cfg.Hitl.RetentionDaysEffective()
+	if days <= 0 {
+		return
+	}
+	cutoff := time.Now().AddDate(0, 0, -days)
+	n, err := s.db.PurgeHitlInterruptLogsBefore(cutoff)
+	if err != nil {
+		if s.logger != nil {
+			s.logger.Warn("清理过期人机协同审计日志失败", zap.Error(err))
+		}
+		return
+	}
+	if n > 0 && s.logger != nil {
+		s.logger.Info("已清理过期人机协同审计日志", zap.Int64("deleted", n), zap.Int("retention_days", days))
+	}
+}
+
+// StartRetentionLoop periodically purges expired HITL audit log rows.
+func StartRetentionLoop(s *Service, logger *zap.Logger) {
+	if s == nil {
+		return
+	}
+	go func() {
+		ticker := time.NewTicker(retentionPurgeInterval)
+		defer ticker.Stop()
+		for range ticker.C {
+			s.PurgeExpired()
+			if logger != nil {
+				logger.Debug("hitl audit log retention tick completed")
+			}
+		}
+	}()
+}

internal/hitl/retention_test.go

@@ -0,0 +1,50 @@
+package hitl
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	appconfig "cyberstrike-ai/internal/config"
+	"cyberstrike-ai/internal/database"
+
+	"go.uber.org/zap"
+)
+
+func TestServicePurgeExpired_respectsZeroRetention(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "hitl.db")
+	db, err := database.NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	defer db.Close()
+	if _, err := db.Exec(`CREATE TABLE IF NOT EXISTS hitl_interrupts (
+		id TEXT PRIMARY KEY,
+		conversation_id TEXT NOT NULL,
+		mode TEXT NOT NULL,
+		tool_name TEXT NOT NULL,
+		status TEXT NOT NULL,
+		decision TEXT,
+		created_at DATETIME NOT NULL,
+		decided_at DATETIME
+	)`); err != nil {
+		t.Fatalf("create table: %v", err)
+	}
+
+	old := time.Now().AddDate(0, 0, -100).UTC().Format(time.RFC3339)
+	if _, err := db.Exec(`INSERT INTO hitl_interrupts
+		(id, conversation_id, mode, tool_name, status, decision, created_at, decided_at)
+		VALUES ('old-1', 'c1', 'approval', 'exec', 'decided', 'approve', ?, ?)`, old, old); err != nil {
+		t.Fatalf("insert: %v", err)
+	}
+
+	zero := 0
+	svc := NewService(db, &appconfig.Config{
+		Hitl: appconfig.HitlConfig{RetentionDays: &zero},
+	}, zap.NewNop())
+	svc.PurgeExpired()
+
+	if err := db.QueryRow(`SELECT id FROM hitl_interrupts WHERE id = 'old-1'`).Scan(new(string)); err != nil {
+		t.Fatalf("record should remain when retention_days=0: %v", err)
+	}
+}

internal/knowledge/eino_pipeline_retriever.go

@@ -0,0 +1,96 @@
+package knowledge
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"cyberstrike-ai/internal/config"
+
+	"github.com/cloudwego/eino/callbacks"
+	"github.com/cloudwego/eino/components"
+	"github.com/cloudwego/eino/components/retriever"
+	"github.com/cloudwego/eino/schema"
+	"go.uber.org/zap"
+)
+
+// knowledgePipelineRetriever: MultiQuery → vector candidates → rerank → post-process.
+type knowledgePipelineRetriever struct {
+	inner retriever.Retriever
+	base  *Retriever
+}
+
+func newKnowledgePipelineRetriever(inner retriever.Retriever, base *Retriever) *knowledgePipelineRetriever {
+	if inner == nil || base == nil {
+		return nil
+	}
+	return &knowledgePipelineRetriever{inner: inner, base: base}
+}
+
+func (p *knowledgePipelineRetriever) GetType() string {
+	return "KnowledgeRAGPipeline"
+}
+
+func (p *knowledgePipelineRetriever) Retrieve(ctx context.Context, query string, opts ...retriever.Option) (out []*schema.Document, err error) {
+	if p == nil || p.inner == nil || p.base == nil {
+		return nil, fmt.Errorf("knowledge pipeline retriever: nil")
+	}
+	q := strings.TrimSpace(query)
+	if q == "" {
+		return nil, fmt.Errorf("查询不能为空")
+	}
+
+	ro := retriever.GetCommonOptions(nil, opts...)
+	finalTopK := p.base.config.TopK
+	if finalTopK <= 0 {
+		finalTopK = 5
+	}
+	if ro.TopK != nil && *ro.TopK > 0 {
+		finalTopK = *ro.TopK
+	}
+
+	ctx = callbacks.EnsureRunInfo(ctx, p.GetType(), components.ComponentOfRetriever)
+	ctx = callbacks.OnStart(ctx, &retriever.CallbackInput{Query: q, TopK: finalTopK, Extra: ro.DSLInfo})
+	defer func() {
+		if err != nil {
+			_ = callbacks.OnError(ctx, err)
+			return
+		}
+		_ = callbacks.OnEnd(ctx, &retriever.CallbackOutput{Docs: out})
+	}()
+
+	out, err = p.inner.Retrieve(ctx, q, opts...)
+	if err != nil {
+		return nil, err
+	}
+	if len(out) == 0 {
+		return out, nil
+	}
+
+	if rr := p.base.documentReranker(); rr != nil && len(out) > 1 {
+		reranked, rerr := rr.Rerank(ctx, q, out)
+		if rerr != nil {
+			if p.base.logger != nil {
+				p.base.logger.Warn("知识检索重排失败，已使用融合序", zap.Error(rerr))
+			}
+		} else if len(reranked) > 0 {
+			out = reranked
+		}
+	}
+
+	tokenModel := ""
+	if p.base.embedder != nil {
+		tokenModel = p.base.embedder.EmbeddingModelName()
+	}
+	var postPO *config.PostRetrieveConfig
+	if p.base.config != nil {
+		postPO = &p.base.config.PostRetrieve
+	}
+	out, err = ApplyPostRetrieve(out, postPO, tokenModel, finalTopK)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+var _ retriever.Retriever = (*knowledgePipelineRetriever)(nil)

internal/knowledge/eino_retrieve_chain.go

@@ -8,8 +8,7 @@ import (
 	"github.com/cloudwego/eino/schema"
 )
 
-// BuildKnowledgeRetrieveChain 编译「查询字符串 → 文档列表」的 Eino Chain，底层为 SQLite 向量检索（[VectorEinoRetriever]）。
-// 去重、上下文预算截断与最终 Top-K 均在 [VectorEinoRetriever.Retrieve] 内完成，与 HTTP/MCP 检索路径一致。
+// BuildKnowledgeRetrieveChain 编译「查询字符串 → 文档列表」的 Eino Chain（MultiQuery → 向量 → 重排 → 后处理）。
 func BuildKnowledgeRetrieveChain(ctx context.Context, r *Retriever) (compose.Runnable[string, []*schema.Document], error) {
 	if r == nil {
 		return nil, fmt.Errorf("retriever is nil")

internal/knowledge/eino_retriever_adapter.go

@@ -11,19 +11,10 @@ import (
 	"github.com/cloudwego/eino/components"
 	"github.com/cloudwego/eino/components/retriever"
 	"github.com/cloudwego/eino/schema"
-	"go.uber.org/zap"
 )
 
 // VectorEinoRetriever implements [retriever.Retriever] on top of SQLite-stored embeddings + cosine similarity.
-//
-// Options:
-//   - [retriever.WithTopK]
-//   - [retriever.WithDSLInfo] with [DSLRiskType] (string), [DSLSimilarityThreshold] (float, cosine 0–1), [DSLSubIndexFilter] (string)
-//
-// Document scores are cosine similarity; [retriever.WithScoreThreshold] is not mapped to a different metric.
-//
-// After vector search: optional [DocumentReranker] (see [Retriever.SetDocumentReranker]), then
-// [ApplyPostRetrieve] (normalized-text dedupe, context budget, final Top-K) using [config.PostRetrieveConfig].
+// It returns prefetch-sized vector candidates only; rerank and post-process run in [knowledgePipelineRetriever].
 type VectorEinoRetriever struct {
 	inner *Retriever
 }
@@ -119,26 +110,6 @@ func (h *VectorEinoRetriever) Retrieve(ctx context.Context, query string, opts .
 		return nil, err
 	}
 	out = retrievalResultsToDocuments(results)
-
-	if rr := h.inner.documentReranker(); rr != nil && len(out) > 1 {
-		reranked, rerr := rr.Rerank(ctx, q, out)
-		if rerr != nil {
-			if h.inner.logger != nil {
-				h.inner.logger.Warn("知识检索重排失败，已使用向量序", zap.Error(rerr))
-			}
-		} else if len(reranked) > 0 {
-			out = reranked
-		}
-	}
-
-	tokenModel := ""
-	if h.inner.embedder != nil {
-		tokenModel = h.inner.embedder.EmbeddingModelName()
-	}
-	out, err = ApplyPostRetrieve(out, postPO, tokenModel, finalTopK)
-	if err != nil {
-		return nil, err
-	}
 	return out, nil
 }
 

internal/knowledge/rerank_http.go

@@ -0,0 +1,226 @@
+package knowledge
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"cyberstrike-ai/internal/config"
+
+	"github.com/cloudwego/eino/schema"
+	"go.uber.org/zap"
+)
+
+// HTTPReranker calls a hosted rerank API (DashScope or Cohere-compatible).
+type HTTPReranker struct {
+	provider string
+	model    string
+	baseURL  string
+	apiKey   string
+	client   *http.Client
+	logger   *zap.Logger
+}
+
+// NewHTTPReranker builds a rerank client from knowledge retrieval config; openAI supplies fallback credentials.
+func NewHTTPReranker(rc *config.RerankConfig, openAI *config.OpenAIConfig, logger *zap.Logger) (*HTTPReranker, error) {
+	if rc == nil {
+		return nil, fmt.Errorf("rerank config is nil")
+	}
+	baseURL := strings.TrimSpace(rc.BaseURL)
+	apiKey := strings.TrimSpace(rc.APIKey)
+	if openAI != nil {
+		if baseURL == "" {
+			baseURL = strings.TrimSpace(openAI.BaseURL)
+		}
+		if apiKey == "" {
+			apiKey = strings.TrimSpace(openAI.APIKey)
+		}
+	}
+	if apiKey == "" {
+		return nil, fmt.Errorf("rerank api_key is required")
+	}
+	provider := rc.ProviderEffective(baseURL)
+	model := rc.ModelEffective(provider)
+	return &HTTPReranker{
+		provider: provider,
+		model:    model,
+		baseURL:  strings.TrimSuffix(baseURL, "/"),
+		apiKey:   apiKey,
+		client:   &http.Client{Timeout: 60 * time.Second},
+		logger:   logger,
+	}, nil
+}
+
+func (r *HTTPReranker) Rerank(ctx context.Context, query string, docs []*schema.Document) ([]*schema.Document, error) {
+	if r == nil {
+		return docs, nil
+	}
+	q := strings.TrimSpace(query)
+	if q == "" || len(docs) == 0 {
+		return docs, nil
+	}
+	if len(docs) == 1 {
+		return docs, nil
+	}
+	texts := make([]string, 0, len(docs))
+	for _, d := range docs {
+		if d == nil {
+			texts = append(texts, "")
+			continue
+		}
+		texts = append(texts, d.Content)
+	}
+	var order []int
+	var err error
+	switch r.provider {
+	case "dashscope":
+		order, err = r.rerankDashScope(ctx, q, texts, len(docs))
+	default:
+		order, err = r.rerankCohere(ctx, q, texts, len(docs))
+	}
+	if err != nil {
+		return nil, err
+	}
+	out := make([]*schema.Document, 0, len(order))
+	for _, idx := range order {
+		if idx < 0 || idx >= len(docs) || docs[idx] == nil {
+			continue
+		}
+		out = append(out, docs[idx])
+	}
+	if len(out) == 0 {
+		return docs, nil
+	}
+	return out, nil
+}
+
+func (r *HTTPReranker) rerankCohere(ctx context.Context, query string, documents []string, topN int) ([]int, error) {
+	url := r.cohereRerankURL()
+	body := map[string]any{
+		"model":     r.model,
+		"query":     query,
+		"documents": documents,
+		"top_n":     topN,
+	}
+	raw, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(raw))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+r.apiKey)
+	resp, err := r.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("rerank request: %w", err)
+	}
+	defer resp.Body.Close()
+	respBody, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("rerank http %d: %s", resp.StatusCode, truncateForRerankLog(string(respBody)))
+	}
+	var parsed struct {
+		Results []struct {
+			Index int `json:"index"`
+		} `json:"results"`
+	}
+	if err := json.Unmarshal(respBody, &parsed); err != nil {
+		return nil, fmt.Errorf("rerank decode: %w", err)
+	}
+	order := make([]int, 0, len(parsed.Results))
+	for _, row := range parsed.Results {
+		order = append(order, row.Index)
+	}
+	return order, nil
+}
+
+func (r *HTTPReranker) rerankDashScope(ctx context.Context, query string, documents []string, topN int) ([]int, error) {
+	url := r.dashscopeRerankURL()
+	body := map[string]any{
+		"model": r.model,
+		"input": map[string]any{
+			"query":     query,
+			"documents": documents,
+		},
+		"parameters": map[string]any{
+			"return_documents": false,
+			"top_n":            topN,
+		},
+	}
+	raw, err := json.Marshal(body)
+	if err != nil {
+		return nil, err
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, bytes.NewReader(raw))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+r.apiKey)
+	resp, err := r.client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("dashscope rerank: %w", err)
+	}
+	defer resp.Body.Close()
+	respBody, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("dashscope rerank http %d: %s", resp.StatusCode, truncateForRerankLog(string(respBody)))
+	}
+	var parsed struct {
+		Output struct {
+			Results []struct {
+				Index int `json:"index"`
+			} `json:"results"`
+		} `json:"output"`
+	}
+	if err := json.Unmarshal(respBody, &parsed); err != nil {
+		return nil, fmt.Errorf("dashscope rerank decode: %w", err)
+	}
+	order := make([]int, 0, len(parsed.Output.Results))
+	for _, row := range parsed.Output.Results {
+		order = append(order, row.Index)
+	}
+	return order, nil
+}
+
+func (r *HTTPReranker) cohereRerankURL() string {
+	base := r.baseURL
+	if base == "" {
+		base = "https://api.cohere.com"
+	}
+	if strings.HasSuffix(base, "/v1") {
+		return base + "/rerank"
+	}
+	return base + "/v1/rerank"
+}
+
+func (r *HTTPReranker) dashscopeRerankURL() string {
+	base := strings.TrimSpace(r.baseURL)
+	if base == "" {
+		return "https://dashscope.aliyuncs.com/api/v1/services/rerank/text-rerank/text-rerank"
+	}
+	if strings.Contains(base, "/api/v1/services/rerank") {
+		return base
+	}
+	if strings.Contains(base, "dashscope.aliyuncs.com") || strings.Contains(base, "compatible-mode") {
+		return "https://dashscope.aliyuncs.com/api/v1/services/rerank/text-rerank/text-rerank"
+	}
+	return strings.TrimSuffix(base, "/")
+}
+
+func truncateForRerankLog(s string) string {
+	s = strings.TrimSpace(s)
+	if len(s) > 512 {
+		return s[:512] + "..."
+	}
+	return s
+}
+
+var _ DocumentReranker = (*HTTPReranker)(nil)

internal/knowledge/rerank_http_test.go

@@ -0,0 +1,97 @@
+package knowledge
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"cyberstrike-ai/internal/config"
+
+	"github.com/cloudwego/eino/schema"
+)
+
+func TestHTTPReranker_CohereOrder(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v1/rerank" {
+			t.Fatalf("path %s", r.URL.Path)
+		}
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"results": []map[string]any{
+				{"index": 2, "relevance_score": 0.9},
+				{"index": 0, "relevance_score": 0.5},
+			},
+		})
+	}))
+	defer srv.Close()
+
+	rr, err := NewHTTPReranker(&config.RerankConfig{
+		Provider: "cohere",
+		Model:    "rerank-multilingual-v3.0",
+		BaseURL:  srv.URL,
+		APIKey:   "test-key",
+	}, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	docs := []*schema.Document{
+		{ID: "a", Content: "alpha"},
+		{ID: "b", Content: "beta"},
+		{ID: "c", Content: "gamma"},
+	}
+	out, err := rr.Rerank(context.Background(), "query", docs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(out) != 2 || out[0].ID != "c" || out[1].ID != "a" {
+		t.Fatalf("order wrong: %#v", out)
+	}
+}
+
+func TestHTTPReranker_DashScopeOrder(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"output": map[string]any{
+				"results": []map[string]any{
+					{"index": 1, "relevance_score": 0.88},
+				},
+			},
+		})
+	}))
+	defer srv.Close()
+
+	rr, err := NewHTTPReranker(&config.RerankConfig{
+		Provider: "dashscope",
+		Model:    "gte-rerank",
+		BaseURL:  srv.URL,
+		APIKey:   "test-key",
+	}, nil, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	docs := []*schema.Document{{ID: "a", Content: "a"}, {ID: "b", Content: "b"}}
+	out, err := rr.Rerank(context.Background(), "q", docs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(out) != 1 || out[0].ID != "b" {
+		t.Fatalf("got %#v", out)
+	}
+}
+
+func TestRerankConfigDefaults(t *testing.T) {
+	t.Parallel()
+	rc := config.RerankConfig{}
+	if rc.ProviderEffective("https://dashscope.aliyuncs.com/x") != "dashscope" {
+		t.Fatal("dashscope detect")
+	}
+	if rc.ModelEffective("dashscope") != "gte-rerank" {
+		t.Fatal("dashscope model")
+	}
+	if rc.ModelEffective("cohere") != "rerank-multilingual-v3.0" {
+		t.Fatal("cohere model")
+	}
+}

internal/knowledge/retrieval_postprocess.go

@@ -19,7 +19,7 @@ import (
 // postRetrieveMaxPrefetchCap 限制单次向量候选上限，避免误配置导致全表扫压力过大。
 const postRetrieveMaxPrefetchCap = 200
 
-// DocumentReranker 可选重排（如交叉编码器 / 第三方 Rerank API），由 [Retriever.SetDocumentReranker] 注入；失败时在适配层降级为向量序。
+// DocumentReranker 精排（HTTP dashscope / Cohere 兼容 API），由 [WireRetrieverPipeline] 注入。
 type DocumentReranker interface {
 	Rerank(ctx context.Context, query string, docs []*schema.Document) ([]*schema.Document, error)
 }
@@ -167,13 +167,16 @@ func truncateDocumentsByBudget(docs []*schema.Document, maxRunes, maxTokens int,
 	return out, nil
 }
 
-// EffectivePrefetchTopK 计算向量检索应拉取的候选条数（供粗排 / 去重 / 重排）。
+// EffectivePrefetchTopK 计算每条 MultiQuery 变体在向量阶段的候选条数（供融合 / 重排 / 后处理）。
 func EffectivePrefetchTopK(topK int, po *config.PostRetrieveConfig) int {
 	if topK < 1 {
 		topK = 5
 	}
-	fetch := topK
-	if po != nil && po.PrefetchTopK > fetch {
+	fetch := topK * 4
+	if fetch < 20 {
+		fetch = 20
+	}
+	if po != nil && po.PrefetchTopK > 0 {
 		fetch = po.PrefetchTopK
 	}
 	if fetch > postRetrieveMaxPrefetchCap {
@@ -182,7 +185,7 @@ func EffectivePrefetchTopK(topK int, po *config.PostRetrieveConfig) int {
 	return fetch
 }
 
-// ApplyPostRetrieve 检索后处理：规范化正文去重 → 预算截断 → 最终 TopK。重排在 [VectorEinoRetriever] 中单独调用以便失败时降级。
+// ApplyPostRetrieve 检索后处理：规范化正文去重 → 预算截断 → 最终 TopK（精排已在流水线中完成）。
 func ApplyPostRetrieve(docs []*schema.Document, po *config.PostRetrieveConfig, tokenModel string, finalTopK int) ([]*schema.Document, error) {
 	if finalTopK < 1 {
 		finalTopK = 5

internal/knowledge/retrieval_postprocess_test.go

@@ -28,8 +28,8 @@ func TestDedupeByNormalizedContent(t *testing.T) {
 }
 
 func TestEffectivePrefetchTopK(t *testing.T) {
-	if g := EffectivePrefetchTopK(5, nil); g != 5 {
-		t.Fatalf("got %d", g)
+	if g := EffectivePrefetchTopK(5, nil); g != 20 {
+		t.Fatalf("default prefetch got %d want 20", g)
 	}
 	if g := EffectivePrefetchTopK(5, &config.PostRetrieveConfig{PrefetchTopK: 50}); g != 50 {
 		t.Fatalf("got %d", g)

internal/knowledge/retriever.go

@@ -27,15 +27,19 @@ type Retriever struct {
 
 	rerankMu sync.RWMutex
 	reranker DocumentReranker
+
+	pipeline retriever.Retriever
+	wireOpenAI *config.OpenAIConfig
 }
 
 // RetrievalConfig 检索配置
 type RetrievalConfig struct {
 	TopK                int
 	SimilarityThreshold float64
-	// SubIndexFilter 非空时仅检索 sub_indexes 包含该标签（逗号分隔之一）的行；空 sub_indexes 的旧行仍保留以兼容。
-	SubIndexFilter string
-	PostRetrieve   config.PostRetrieveConfig
+	SubIndexFilter      string
+	MultiQuery          config.MultiQueryConfig
+	Rerank              config.RerankConfig
+	PostRetrieve        config.PostRetrieveConfig
 }
 
 // NewRetriever 创建新的检索器
@@ -48,7 +52,7 @@ func NewRetriever(db *sql.DB, embedder *Embedder, config *RetrievalConfig, logge
 	}
 }
 
-// UpdateConfig 更新检索配置
+// UpdateConfig 更新检索配置并重建 Eino MultiQuery + 重排流水线。
 func (r *Retriever) UpdateConfig(cfg *RetrievalConfig) {
 	if cfg != nil {
 		r.config = cfg
@@ -57,12 +61,18 @@ func (r *Retriever) UpdateConfig(cfg *RetrievalConfig) {
 				zap.Int("top_k", cfg.TopK),
 				zap.Float64("similarity_threshold", cfg.SimilarityThreshold),
 				zap.String("sub_index_filter", cfg.SubIndexFilter),
+				zap.Int("multi_query_max", cfg.MultiQuery.MaxQueriesEffective()),
 				zap.Int("post_retrieve_prefetch_top_k", cfg.PostRetrieve.PrefetchTopK),
 				zap.Int("post_retrieve_max_context_chars", cfg.PostRetrieve.MaxContextChars),
 				zap.Int("post_retrieve_max_context_tokens", cfg.PostRetrieve.MaxContextTokens),
 			)
 		}
 	}
+	if r.wireOpenAI != nil {
+		if err := WireRetrieverPipeline(context.Background(), r, r.wireOpenAI); err != nil && r.logger != nil {
+			r.logger.Warn("检索流水线重建失败", zap.Error(err))
+		}
+	}
 }
 
 // SetDocumentReranker 注入可选重排器（并发安全）；nil 表示禁用。
@@ -103,7 +113,7 @@ func cosineSimilarity(a, b []float32) float64 {
 	return dotProduct / (math.Sqrt(normA) * math.Sqrt(normB))
 }
 
-// Search 搜索知识库。统一经 [VectorEinoRetriever]（Eino retriever.Retriever 边界）。
+// Search 搜索知识库（Eino MultiQuery → 向量检索 → 重排 → 后处理）。
 func (r *Retriever) Search(ctx context.Context, req *SearchRequest) ([]*RetrievalResult, error) {
 	if req == nil {
 		return nil, fmt.Errorf("请求不能为空")
@@ -113,7 +123,7 @@ func (r *Retriever) Search(ctx context.Context, req *SearchRequest) ([]*Retrieva
 		return nil, fmt.Errorf("查询不能为空")
 	}
 	opts := r.einoRetrieverOptions(req)
-	docs, err := NewVectorEinoRetriever(r).Retrieve(ctx, q, opts...)
+	docs, err := r.activeEinoRetriever().Retrieve(ctx, q, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -143,7 +153,19 @@ func (r *Retriever) einoRetrieverOptions(req *SearchRequest) []retriever.Option
 
 // EinoRetrieve 直接返回 [schema.Document]，供 Eino Graph / Chain 使用。
 func (r *Retriever) EinoRetrieve(ctx context.Context, query string, opts ...retriever.Option) ([]*schema.Document, error) {
-	return NewVectorEinoRetriever(r).Retrieve(ctx, query, opts...)
+	return r.activeEinoRetriever().Retrieve(ctx, query, opts...)
+}
+
+func (r *Retriever) activeEinoRetriever() retriever.Retriever {
+	if r != nil && r.pipeline != nil {
+		return r.pipeline
+	}
+	return NewVectorEinoRetriever(r)
+}
+
+// AsEinoRetriever 将知识库检索流水线暴露为 Eino [retriever.Retriever]。
+func (r *Retriever) AsEinoRetriever() retriever.Retriever {
+	return r.activeEinoRetriever()
 }
 
 func (r *Retriever) knowledgeEmbeddingSelectSQL(riskType, subIndexFilter string) (string, []interface{}) {
@@ -299,7 +321,14 @@ func (r *Retriever) vectorSearch(ctx context.Context, req *SearchRequest) ([]*Re
 	return results, nil
 }
 
-// AsEinoRetriever 将纯向量检索暴露为 Eino [retriever.Retriever]。
-func (r *Retriever) AsEinoRetriever() retriever.Retriever {
-	return NewVectorEinoRetriever(r)
+// RetrievalConfigFromYAML maps API/YAML retrieval settings into the knowledge package.
+func RetrievalConfigFromYAML(r config.RetrievalConfig) *RetrievalConfig {
+	return &RetrievalConfig{
+		TopK:                r.TopK,
+		SimilarityThreshold: r.SimilarityThreshold,
+		SubIndexFilter:      r.SubIndexFilter,
+		MultiQuery:          r.MultiQuery,
+		Rerank:              r.Rerank,
+		PostRetrieve:        r.PostRetrieve,
+	}
 }

internal/knowledge/wire_retriever.go

@@ -0,0 +1,74 @@
+package knowledge
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"cyberstrike-ai/internal/config"
+	"cyberstrike-ai/internal/openai"
+
+	einoopenai "github.com/cloudwego/eino-ext/components/model/openai"
+	"github.com/cloudwego/eino/flow/retriever/multiquery"
+	"go.uber.org/zap"
+)
+
+// WireRetrieverPipeline builds Eino MultiQuery + HTTP rerank + post-process pipeline on r.
+// Call once after NewRetriever; UpdateConfig re-invokes when wireOpenAI is set.
+func WireRetrieverPipeline(ctx context.Context, r *Retriever, openAI *config.OpenAIConfig) error {
+	if r == nil {
+		return fmt.Errorf("retriever is nil")
+	}
+	if openAI == nil {
+		return fmt.Errorf("openai config is nil")
+	}
+	if r.config == nil {
+		return fmt.Errorf("retrieval config is nil")
+	}
+	r.wireOpenAI = openAI
+
+	httpClient := openai.NewEinoHTTPClient(openAI, &http.Client{Timeout: 120 * time.Second})
+	chatCfg := &einoopenai.ChatModelConfig{
+		APIKey:     strings.TrimSpace(openAI.APIKey),
+		BaseURL:    strings.TrimSuffix(strings.TrimSpace(openAI.BaseURL), "/"),
+		Model:      strings.TrimSpace(openAI.Model),
+		HTTPClient: httpClient,
+	}
+	if chatCfg.Model == "" {
+		chatCfg.Model = "gpt-4o"
+	}
+	rewriteLLM, err := einoopenai.NewChatModel(ctx, chatCfg)
+	if err != nil {
+		return fmt.Errorf("multi_query rewrite model: %w", err)
+	}
+
+	reranker, err := NewHTTPReranker(&r.config.Rerank, openAI, r.logger)
+	if err != nil {
+		return fmt.Errorf("reranker: %w", err)
+	}
+	r.SetDocumentReranker(reranker)
+
+	vec := NewVectorEinoRetriever(r)
+	mq, err := multiquery.NewRetriever(ctx, &multiquery.Config{
+		RewriteLLM:    rewriteLLM,
+		MaxQueriesNum: r.config.MultiQuery.MaxQueriesEffective(),
+		OrigRetriever: vec,
+	})
+	if err != nil {
+		return fmt.Errorf("multi_query: %w", err)
+	}
+
+	r.pipeline = newKnowledgePipelineRetriever(mq, r)
+	if r.logger != nil {
+		provider := r.config.Rerank.ProviderEffective(strings.TrimSpace(openAI.BaseURL))
+		r.logger.Info("知识库检索流水线已启用",
+			zap.String("pipeline", "MultiQuery→Vector→Rerank→PostRetrieve"),
+			zap.Int("multi_query_max", r.config.MultiQuery.MaxQueriesEffective()),
+			zap.String("rerank_provider", provider),
+			zap.String("rerank_model", r.config.Rerank.ModelEffective(provider)),
+		)
+	}
+	return nil
+}

internal/mcp/external_manager.go

@@ -814,6 +814,23 @@ func (m *ExternalMCPManager) CancelToolExecution(id string) bool {
 	return m.CancelToolExecutionWithNote(id, "")
 }
 
+// ActiveRunningExecutionIDs 返回当前进程内仍登记 cancel 的外部 MCP executionId 快照。
+func (m *ExternalMCPManager) ActiveRunningExecutionIDs() map[string]struct{} {
+	if m == nil {
+		return nil
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if len(m.runningCancels) == 0 {
+		return nil
+	}
+	out := make(map[string]struct{}, len(m.runningCancels))
+	for id := range m.runningCancels {
+		out[id] = struct{}{}
+	}
+	return out
+}
+
 // updateStats 更新统计信息
 func (m *ExternalMCPManager) updateStats(toolName string, failed bool) {
 	now := time.Now()

internal/mcp/server.go

@@ -921,9 +921,8 @@ func (s *Server) CallTool(ctx context.Context, toolName string, args map[string]
 	return finalResult, executionID, nil
 }
 
-// RecordCompletedToolInvocation 将已在其它路径完成的工具调用写入监控存储（格式与 CallTool 结束后一致），
-// 用于 Eino ADK filesystem execute 等未经过 CallTool 的场景；返回 executionId 供助手消息 mcpExecutionIds 关联。
-func (s *Server) RecordCompletedToolInvocation(toolName string, args map[string]interface{}, resultText string, invokeErr error) string {
+// BeginToolExecution 创建 running 状态的执行记录，供 Eino 等非 CallTool 路径在工具开始时落库。
+func (s *Server) BeginToolExecution(toolName string, args map[string]interface{}) string {
 	if s == nil {
 		return ""
 	}
@@ -931,21 +930,73 @@ func (s *Server) RecordCompletedToolInvocation(toolName string, args map[string]
 		args = map[string]interface{}{}
 	}
 	executionID := uuid.New().String()
-	now := time.Now()
-	failed := invokeErr != nil
-	exec := &ToolExecution{
+	execution := &ToolExecution{
 		ID:        executionID,
 		ToolName:  toolName,
 		Arguments: args,
-		StartTime: now,
-		EndTime:   &now,
-		Duration:  0,
+		Status:    "running",
+		StartTime: time.Now(),
 	}
+
+	s.mu.Lock()
+	s.executions[executionID] = execution
+	s.cleanupOldExecutions()
+	s.mu.Unlock()
+
+	if s.storage != nil {
+		if err := s.storage.SaveToolExecution(execution); err != nil {
+			s.logger.Warn("保存执行记录到数据库失败", zap.Error(err))
+		}
+	}
+	return executionID
+}
+
+// FinishToolExecution 完成先前 BeginToolExecution 创建的记录；executionID 为空时等同 RecordCompletedToolInvocation。
+func (s *Server) FinishToolExecution(executionID, toolName string, args map[string]interface{}, resultText string, invokeErr error) string {
+	if s == nil {
+		return ""
+	}
+	if args == nil {
+		args = map[string]interface{}{}
+	}
+	id := strings.TrimSpace(executionID)
+	if id == "" {
+		return s.RecordCompletedToolInvocation(toolName, args, resultText, invokeErr)
+	}
+
+	now := time.Now()
+	failed := invokeErr != nil
+	var finalResult *ToolResult
+
+	s.mu.Lock()
+	exec, inMem := s.executions[id]
+	if !inMem || exec == nil {
+		exec = &ToolExecution{
+			ID:        id,
+			ToolName:  toolName,
+			Arguments: args,
+			StartTime: now,
+		}
+		s.executions[id] = exec
+	} else if toolName != "" {
+		exec.ToolName = toolName
+	}
+	if len(args) > 0 {
+		exec.Arguments = args
+	}
+	exec.EndTime = &now
+	if exec.StartTime.IsZero() {
+		exec.StartTime = now
+	}
+	exec.Duration = now.Sub(exec.StartTime)
+
 	if failed {
-		exec.Status = "failed"
-		exec.Error = invokeErr.Error()
+		st, msg := executionStatusAndMessage(invokeErr)
+		exec.Status = st
+		exec.Error = msg
 		if strings.TrimSpace(resultText) != "" {
-			exec.Result = &ToolResult{Content: []Content{{Type: "text", Text: resultText}}}
+			finalResult = &ToolResult{Content: []Content{{Type: "text", Text: resultText}}}
+			exec.Result = finalResult
 		}
 	} else {
 		exec.Status = "completed"
@@ -953,15 +1004,31 @@ func (s *Server) RecordCompletedToolInvocation(toolName string, args map[string]
 		if strings.TrimSpace(text) == "" {
 			text = "（无输出）"
 		}
-		exec.Result = &ToolResult{Content: []Content{{Type: "text", Text: text}}}
+		finalResult = &ToolResult{Content: []Content{{Type: "text", Text: text}}}
+		exec.Result = finalResult
 	}
+	s.mu.Unlock()
+
 	if s.storage != nil {
 		if err := s.storage.SaveToolExecution(exec); err != nil {
-			s.logger.Warn("RecordCompletedToolInvocation 保存失败", zap.Error(err))
+			s.logger.Warn("保存执行记录到数据库失败", zap.Error(err))
 		}
 	}
-	s.updateStats(toolName, failed)
-	return executionID
+
+	s.updateStats(exec.ToolName, failed)
+
+	if s.storage != nil {
+		s.mu.Lock()
+		delete(s.executions, id)
+		s.mu.Unlock()
+	}
+	return id
+}
+
+// RecordCompletedToolInvocation 将已在其它路径完成的工具调用写入监控存储（格式与 CallTool 结束后一致），
+// 用于 Eino ADK filesystem execute 等未经过 CallTool 的场景；返回 executionId 供助手消息 mcpExecutionIds 关联。
+func (s *Server) RecordCompletedToolInvocation(toolName string, args map[string]interface{}, resultText string, invokeErr error) string {
+	return s.FinishToolExecution("", toolName, args, resultText, invokeErr)
 }
 
 // UpdateToolExecutionResult 将监控库中的工具结果更新为送入模型的展示正文（如 reduction 后的 persisted-output）。
@@ -1103,6 +1170,23 @@ func (s *Server) CancelToolExecution(id string) bool {
 	return s.CancelToolExecutionWithNote(id, "")
 }
 
+// ActiveRunningExecutionIDs 返回当前进程内仍登记 cancel 的 executionId 快照。
+func (s *Server) ActiveRunningExecutionIDs() map[string]struct{} {
+	if s == nil {
+		return nil
+	}
+	s.runningCancelsMu.Lock()
+	defer s.runningCancelsMu.Unlock()
+	if len(s.runningCancels) == 0 {
+		return nil
+	}
+	out := make(map[string]struct{}, len(s.runningCancels))
+	for id := range s.runningCancels {
+		out[id] = struct{}{}
+	}
+	return out
+}
+
 // initDefaultPrompts 初始化默认提示词模板
 func (s *Server) initDefaultPrompts() {
 	s.mu.Lock()

internal/mcp/types.go

@@ -199,6 +199,8 @@ type ToolExecution struct {
 	StartTime time.Time              `json:"startTime"`
 	EndTime   *time.Time             `json:"endTime,omitempty"`
 	Duration  time.Duration          `json:"duration,omitempty"`
+	// ConversationID 仅 API 展示用（进行中的 Agent 任务），不写入 tool_executions 表。
+	ConversationID string `json:"conversationId,omitempty"`
 }
 
 // ToolStats 工具统计信息

internal/monitor/reconcile.go

@@ -0,0 +1,101 @@
+package monitor
+
+import (
+	"time"
+
+	"cyberstrike-ai/internal/database"
+	"cyberstrike-ai/internal/mcp"
+
+	"go.uber.org/zap"
+)
+
+const (
+	staleRunningMinAge       = 45 * time.Second
+	staleRunningReconcileGap = 2 * time.Minute
+)
+
+// ExecutionReconciler 在启动或运行期将无对应协程的 running 执行记录收尾为 cancelled。
+type ExecutionReconciler struct {
+	db          *database.DB
+	mcpServer   *mcp.Server
+	externalMgr *mcp.ExternalMCPManager
+	logger      *zap.Logger
+}
+
+// NewExecutionReconciler creates a reconciler for orphaned MCP tool executions.
+func NewExecutionReconciler(db *database.DB, mcpServer *mcp.Server, externalMgr *mcp.ExternalMCPManager, logger *zap.Logger) *ExecutionReconciler {
+	return &ExecutionReconciler{
+		db:          db,
+		mcpServer:   mcpServer,
+		externalMgr: externalMgr,
+		logger:      logger,
+	}
+}
+
+// ReconcileOnStartup marks every persisted running row as cancelled (safe right after process start).
+func (r *ExecutionReconciler) ReconcileOnStartup() {
+	if r == nil || r.db == nil {
+		return
+	}
+	now := time.Now()
+	n, err := r.db.CancelOrphanedRunningToolExecutions(now, "执行已中断（服务重启）")
+	if err != nil {
+		if r.logger != nil {
+			r.logger.Warn("启动时清理孤儿 running 工具执行记录失败", zap.Error(err))
+		}
+		return
+	}
+	if n > 0 && r.logger != nil {
+		r.logger.Info("启动时已收尾孤儿 running 工具执行记录", zap.Int64("count", n))
+	}
+}
+
+func (r *ExecutionReconciler) activeExecutionIDs() map[string]struct{} {
+	ids := make(map[string]struct{})
+	if r.mcpServer != nil {
+		for id := range r.mcpServer.ActiveRunningExecutionIDs() {
+			ids[id] = struct{}{}
+		}
+	}
+	if r.externalMgr != nil {
+		for id := range r.externalMgr.ActiveRunningExecutionIDs() {
+			ids[id] = struct{}{}
+		}
+	}
+	return ids
+}
+
+// ReconcileStaleRunning finalizes running rows that are not tracked in-memory and older than staleRunningMinAge.
+func (r *ExecutionReconciler) ReconcileStaleRunning() {
+	if r == nil || r.db == nil {
+		return
+	}
+	now := time.Now()
+	n, err := r.db.FinalizeStaleRunningToolExecutions(now, staleRunningMinAge, r.activeExecutionIDs(), "执行已中断（会话已结束）")
+	if err != nil {
+		if r.logger != nil {
+			r.logger.Warn("定期收尾 stale running 工具执行记录失败", zap.Error(err))
+		}
+		return
+	}
+	if n > 0 && r.logger != nil {
+		r.logger.Info("已收尾 stale running 工具执行记录", zap.Int64("count", n))
+	}
+}
+
+// StartStaleRunningReconcileLoop periodically reconciles orphaned running tool executions.
+func StartStaleRunningReconcileLoop(r *ExecutionReconciler, logger *zap.Logger) {
+	if r == nil {
+		return
+	}
+	go func() {
+		ticker := time.NewTicker(staleRunningReconcileGap)
+		defer ticker.Stop()
+		for range ticker.C {
+			r.ReconcileStaleRunning()
+			if logger != nil {
+				logger.Debug("monitor stale running reconcile tick completed")
+			}
+		}
+	}()
+}

internal/monitor/reconcile_test.go

@@ -0,0 +1,38 @@
+package monitor
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"cyberstrike-ai/internal/database"
+	"cyberstrike-ai/internal/mcp"
+
+	"go.uber.org/zap"
+)
+
+func TestExecutionReconciler_ReconcileOnStartup(t *testing.T) {
+	dbPath := filepath.Join(t.TempDir(), "monitor.db")
+	db, err := database.NewDB(dbPath, zap.NewNop())
+	if err != nil {
+		t.Fatalf("NewDB: %v", err)
+	}
+	defer db.Close()
+
+	if err := db.SaveToolExecution(&mcp.ToolExecution{
+		ID: "run-1", ToolName: "hydra", Status: "running", StartTime: time.Now().Add(-time.Hour),
+	}); err != nil {
+		t.Fatalf("SaveToolExecution: %v", err)
+	}
+
+	r := NewExecutionReconciler(db, mcp.NewServer(zap.NewNop()), nil, zap.NewNop())
+	r.ReconcileOnStartup()
+
+	got, err := db.GetToolExecution("run-1")
+	if err != nil {
+		t.Fatalf("GetToolExecution: %v", err)
+	}
+	if got.Status != "cancelled" {
+		t.Fatalf("expected cancelled after startup reconcile, got %s", got.Status)
+	}
+}

internal/multiagent/adk_init.go

@@ -0,0 +1,16 @@
+package multiagent
+
+import (
+	"fmt"
+
+	"github.com/cloudwego/eino/adk"
+)
+
+// InitADK configures global Eino ADK settings. Call once at process startup before
+// any ADK middleware or agents are created.
+func InitADK() error {
+	if err := adk.SetLanguage(adk.LanguageChinese); err != nil {
+		return fmt.Errorf("adk set language: %w", err)
+	}
+	return nil
+}

internal/multiagent/eino_adk_run_loop.go

@@ -18,6 +18,7 @@ import (
 	"cyberstrike-ai/internal/einomcp"
 	"cyberstrike-ai/internal/einoobserve"
 	"cyberstrike-ai/internal/openai"
+	"cyberstrike-ai/internal/security"
 
 	"github.com/cloudwego/eino/adk"
 	"github.com/cloudwego/eino/schema"
@@ -196,6 +197,16 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 		pendingByID[tc.ToolCallID] = tc
 		pendingQueueByAgent[tc.EinoAgent] = append(pendingQueueByAgent[tc.EinoAgent], tc.ToolCallID)
 	}
+	markPendingWithMonitor := func(tc toolCallPendingInfo) {
+		markPending(tc)
+		beginEinoADKFilesystemToolMonitor(
+			args.FilesystemMonitorAgent,
+			args.FilesystemMonitorRecord,
+			args.MCPExecutionBinder,
+			tc.ToolCallID,
+			tc.ToolName,
+		)
+	}
 	popNextPendingForAgent := func(agentName string) (toolCallPendingInfo, bool) {
 		pendingMu.Lock()
 		defer pendingMu.Unlock()
@@ -288,6 +299,8 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 
 	var toolResultSent sync.Map // toolCallID -> struct{}；ADK Tool 事件去重（权威正文来自 reduction 处理后的 agent 上下文）
 	tryEmitToolResultProgress := func(toolName, content, toolCallID string, isErr bool, agentName string) {
+		// 仅由 ADK schema.Tool 事件调用；MCP/execute 桥在 reduction 前的 ToolInvokeNotify 不得推送 tool_result，
+		// 否则全量输出会先占位并触发 toolResultSent 去重，导致 UI/监控展示与 agent 实际收到的截断正文不一致。
 		if progress == nil {
 			return
 		}
@@ -305,6 +318,7 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 			"isError":        isErr,
 			"result":         content,
 			"resultPreview":  preview,
+			"agentFacing":    true, // 与 reduction 后送入 ChatModel 的正文一致，供前端展示
 			"conversationId": conversationID,
 			"einoAgent":      agentName,
 			"einoRole":       einoRoleTag(agentName),
@@ -331,7 +345,7 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 			toolCallID = tid
 		}
 		recordPendingExecuteStdoutDup(toolName, content, isErr)
-		recordEinoADKFilesystemToolMonitor(args.FilesystemMonitorAgent, args.FilesystemMonitorRecord, toolName, toolCallID, runAccumulatedMsgs, content, isErr)
+		recordEinoADKFilesystemToolMonitor(args.FilesystemMonitorAgent, args.FilesystemMonitorRecord, args.MCPExecutionBinder, toolName, toolCallID, runAccumulatedMsgs, content, isErr)
 		if args.FilesystemMonitorAgent != nil && args.MCPExecutionBinder != nil {
 			if execID := args.MCPExecutionBinder.ExecutionID(toolCallID); execID != "" {
 				args.FilesystemMonitorAgent.UpdateMCPExecutionDisplayResult(execID, content)
@@ -339,26 +353,6 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 		}
 		progress("tool_result", fmt.Sprintf("工具结果 (%s)", toolName), data)
 	}
-	if args.ToolInvokeNotify != nil {
-		args.ToolInvokeNotify.Set(func(toolCallID, toolName, einoAgent string, success bool, content string, invokeErr error) {
-			// Eino execute / MCP 桥在工具返回时 Fire；若 ADK schema.Tool 事件迟迟不到，此处立即推送
-			// tool_result 解除 UI「执行中」。tryEmitToolResultProgress 经 toolResultSent 去重，ADK 晚到不重复。
-			isErr := !success || invokeErr != nil
-			body := content
-			if strings.HasPrefix(body, einomcp.ToolErrorPrefix) {
-				isErr = true
-				body = strings.TrimPrefix(body, einomcp.ToolErrorPrefix)
-			}
-			if tail := friendlyEinoExecuteInvokeTail(invokeErr); tail != "" {
-				if body == "" {
-					body = tail
-				} else if !strings.Contains(body, tail) {
-					body = strings.TrimSpace(body) + "\n\n" + tail
-				}
-			}
-			tryEmitToolResultProgress(toolName, body, toolCallID, isErr, einoAgent)
-		})
-	}
 
 	if args.EinoCallbacks != nil {
 		ctx = einoobserve.AttachAgentRunCallbacks(ctx, args.EinoCallbacks, einoobserve.Params{
@@ -553,6 +547,13 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 		return true, nil
 	}
 
+	// 仅在退避重试后真正收到数据/完成一步时清零，避免重启后首个无错 ADK 事件误把计数打回 0。
+	confirmTransientRetryRecovery := func() {
+		if transientRetrier.attempt() > 0 {
+			transientRetrier.reset()
+		}
+	}
+
 	takePartial := func(runErr error) (*RunResult, error) {
 		if len(runAccumulatedMsgs) <= baseAccumulatedCount {
 			return nil, runErr
@@ -638,8 +639,6 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 			if restarted {
 				continue
 			}
-		} else {
-			transientRetrier.reset()
 		}
 		if ev.AgentName != "" && progress != nil {
 			iterEinoAgent := orchestratorName
@@ -703,11 +702,8 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 		if mv.IsStreaming && mv.MessageStream != nil && mv.Role == schema.Tool {
 			toolName := strings.TrimSpace(mv.ToolName)
 			content, streamToolCallID, toolStreamRecvErr := recvSchemaMessageStream(ctx, mv.MessageStream)
-			isErr := false
-			if strings.HasPrefix(content, einomcp.ToolErrorPrefix) {
-				isErr = true
-				content = strings.TrimPrefix(content, einomcp.ToolErrorPrefix)
-			}
+			isErr := einoToolResultIsError(toolName, content)
+			content = einoToolResultBody(content)
 			if streamToolCallID != "" {
 				opts := []schema.ToolMessageOption{schema.WithToolName(toolName)}
 				runAccumulatedMsgs = append(runAccumulatedMsgs, schema.ToolMessage(content, streamToolCallID, opts...))
@@ -719,6 +715,9 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 					zap.String("agent", ev.AgentName),
 					zap.String("tool", toolName))
 			}
+			if toolStreamRecvErr == nil {
+				confirmTransientRetryRecovery()
+			}
 			continue
 		}
 
@@ -966,7 +965,7 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 			if merged := mergeStreamingToolCallFragments(toolStreamFragments); len(merged) > 0 {
 				lastToolChunk = mergeMessageToolCalls(&schema.Message{ToolCalls: merged})
 			}
-			tryEmitToolCallsOnce(lastToolChunk, ev.AgentName, orchestratorName, conversationID, orchMode, progress, toolEmitSeen, subAgentToolStep, mainAgentToolStep, markPending)
+			tryEmitToolCallsOnce(lastToolChunk, ev.AgentName, orchestratorName, conversationID, orchMode, progress, toolEmitSeen, subAgentToolStep, mainAgentToolStep, markPendingWithMonitor)
 			// 流式路径此前只把 tool_calls 推给进度 UI，未写入 runAccumulatedMsgs；落库后 loadHistory→RepairOrphan 会删掉全部 tool 结果，表现为「续跑/下轮失忆」。
 			if lastToolChunk != nil && len(lastToolChunk.ToolCalls) > 0 {
 				runAccumulatedMsgs = append(runAccumulatedMsgs, schema.AssistantMessage("", lastToolChunk.ToolCalls))
@@ -990,6 +989,8 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 				if restarted {
 					continue
 				}
+			} else {
+				confirmTransientRetryRecovery()
 			}
 			continue
 		}
@@ -999,7 +1000,7 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 			continue
 		}
 		runAccumulatedMsgs = append(runAccumulatedMsgs, msg)
-		tryEmitToolCallsOnce(mergeMessageToolCalls(msg), ev.AgentName, orchestratorName, conversationID, orchMode, progress, toolEmitSeen, subAgentToolStep, mainAgentToolStep, markPending)
+		tryEmitToolCallsOnce(mergeMessageToolCalls(msg), ev.AgentName, orchestratorName, conversationID, orchMode, progress, toolEmitSeen, subAgentToolStep, mainAgentToolStep, markPendingWithMonitor)
 
 		if mv.Role == schema.Assistant {
 			if progress != nil && strings.TrimSpace(msg.ReasoningContent) != "" {
@@ -1074,15 +1075,13 @@ func runEinoADKAgentLoop(ctx context.Context, args *einoADKRunLoopArgs, baseMsgs
 			}
 
 			content := msg.Content
-			isErr := false
-			if strings.HasPrefix(content, einomcp.ToolErrorPrefix) {
-				isErr = true
-				content = strings.TrimPrefix(content, einomcp.ToolErrorPrefix)
-			}
+			isErr := einoToolResultIsError(toolName, content)
+			content = einoToolResultBody(content)
 
 			toolCallID := strings.TrimSpace(msg.ToolCallID)
 			tryEmitToolResultProgress(toolName, content, toolCallID, isErr, ev.AgentName)
 		}
+		confirmTransientRetryRecovery()
 	}
 
 	mcpIDsMu.Lock()
@@ -1110,17 +1109,47 @@ func einoPartialRunLastOutputHint() string {
 		"[Run ended abnormally; continue from the trace above without repeating completed steps.]"
 }
 
-// friendlyEinoExecuteInvokeTail 将 Eino execute 等非 MCP 路径的结尾错误转成简短提示；其它情况保留原 error 文本。
+// friendlyEinoExecuteInvokeTail 将 Eino execute 超时/中断/流异常转为简短提示。
+// 命令非零退出（ExecuteExitError）已有 exec 对齐的正文，不再追加「执行未正常结束」。
 func friendlyEinoExecuteInvokeTail(invokeErr error) string {
 	if invokeErr == nil {
 		return ""
 	}
+	var exitErr *ExecuteExitError
+	if errors.As(invokeErr, &exitErr) {
+		return ""
+	}
 	if errors.Is(invokeErr, context.DeadlineExceeded) {
 		return einoExecuteTimeoutUserHint()
 	}
+	if errors.Is(invokeErr, context.Canceled) {
+		return ""
+	}
+	if strings.Contains(invokeErr.Error(), "shell inactivity timeout") {
+		return ""
+	}
 	return "[执行未正常结束] " + invokeErr.Error()
 }
 
+// einoToolResultIsError 统一判断 Eino 工具结果是否应标记为错误（与 MCP exec 的 IsError 对齐）。
+func einoToolResultIsError(toolName, content string) bool {
+	if strings.HasPrefix(content, einomcp.ToolErrorPrefix) {
+		return true
+	}
+	if strings.TrimSpace(toolName) == "execute" && security.IsCommandFailureResult(content) {
+		return true
+	}
+	return false
+}
+
+// einoToolResultBody 去掉工具错误前缀，返回展示/持久化正文。
+func einoToolResultBody(content string) string {
+	if strings.HasPrefix(content, einomcp.ToolErrorPrefix) {
+		return strings.TrimPrefix(content, einomcp.ToolErrorPrefix)
+	}
+	return content
+}
+
 // nextAgentEventWithContext 在 ctx 取消时不再无限阻塞于 iter.Next()（工具执行/模型推理期间常见）。
 func nextAgentEventWithContext(ctx context.Context, iter *adk.AsyncIterator[*adk.AgentEvent]) (ev *adk.AgentEvent, ok bool, ctxErr error) {
 	if iter == nil {

internal/multiagent/eino_empty_response.go

@@ -0,0 +1,59 @@
+package multiagent
+
+import (
+	"strings"
+	"time"
+
+	"cyberstrike-ai/internal/config"
+)
+
+const defaultEmptyResponseContinueMaxAttempts = 5
+
+// IsEinoEmptyResponseResult 判断 Run 是否以「未捕获助手正文」占位结束（非真实用户可见回复）。
+func IsEinoEmptyResponseResult(result *RunResult) bool {
+	if result == nil {
+		return false
+	}
+	return isEinoEmptyResponseText(result.Response)
+}
+
+func isEinoEmptyResponseText(s string) bool {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return false
+	}
+	return strings.Contains(s, "no assistant text was captured") ||
+		strings.Contains(s, "未捕获到助手文本输出")
+}
+
+// HasEinoResumeTrace 轨迹非空，续跑才有上下文可恢复。
+func HasEinoResumeTrace(result *RunResult) bool {
+	if result == nil {
+		return false
+	}
+	s := strings.TrimSpace(result.LastAgentTraceInput)
+	return s != "" && s != "[]" && s != "null"
+}
+
+// EmptyResponseContinueMaxAttemptsFromConfig 无助手正文时 Handler 层退避续跑上限；0=默认 5。
+func EmptyResponseContinueMaxAttemptsFromConfig(mw *config.MultiAgentEinoMiddlewareConfig) int {
+	if mw != nil && mw.EmptyResponseContinueMaxAttempts > 0 {
+		return mw.EmptyResponseContinueMaxAttempts
+	}
+	return defaultEmptyResponseContinueMaxAttempts
+}
+
+// EmptyResponseContinueBackoff 与 run_retry 相同指数退避（2s, 4s, 8s… capped）。
+func EmptyResponseContinueBackoff(attempt int, mw *config.MultiAgentEinoMiddlewareConfig) time.Duration {
+	maxBackoff := defaultEinoRunRetryMaxBackoff
+	if mw != nil && mw.RunRetryMaxBackoffSec > 0 {
+		maxBackoff = time.Duration(mw.RunRetryMaxBackoffSec) * time.Second
+	}
+	return einoTransientRetryBackoff(attempt, maxBackoff)
+}
+
+// FormatEmptyResponseContinueUserMessage 系统自动续跑时注入的 user 轮次（不写入 messages 表气泡）。
+func FormatEmptyResponseContinueUserMessage() string {
+	return strings.TrimSpace(`【系统自动续跑 / Auto resume】
+上一轮 Eino 会话未产出可见助手正文（可能流式中断或仅完成工具调用）。请基于已有轨迹与工具结果继续推进，并给出阶段性总结；勿重复已完成步骤。`)
+}

internal/multiagent/eino_empty_response_test.go

@@ -0,0 +1,38 @@
+package multiagent
+
+import "testing"
+
+func TestIsEinoEmptyResponseResult(t *testing.T) {
+	empty := &RunResult{
+		Response: "(Eino ADK single-agent session completed but no assistant text was captured. Check process details or logs.) " +
+			"（Eino ADK 单代理会话已完成，但未捕获到助手文本输出。请查看过程详情或日志。）",
+	}
+	if !IsEinoEmptyResponseResult(empty) {
+		t.Fatal("expected empty placeholder response")
+	}
+	ok := &RunResult{Response: "扫描完成，发现 2 个开放端口。"}
+	if IsEinoEmptyResponseResult(ok) {
+		t.Fatalf("expected real response, got placeholder match")
+	}
+	if IsEinoEmptyResponseResult(nil) {
+		t.Fatal("nil result should be false")
+	}
+}
+
+func TestHasEinoResumeTrace(t *testing.T) {
+	if HasEinoResumeTrace(nil) {
+		t.Fatal("nil")
+	}
+	if HasEinoResumeTrace(&RunResult{LastAgentTraceInput: "[]"}) {
+		t.Fatal("enable resume on empty trace")
+	}
+	if !HasEinoResumeTrace(&RunResult{LastAgentTraceInput: `[{"role":"user","content":"hi"}]`}) {
+		t.Fatal("expected resume trace")
+	}
+}
+
+func TestEmptyResponseContinueMaxAttemptsFromConfig(t *testing.T) {
+	if got := EmptyResponseContinueMaxAttemptsFromConfig(nil); got != defaultEmptyResponseContinueMaxAttempts {
+		t.Fatalf("default: got %d want %d", got, defaultEmptyResponseContinueMaxAttempts)
+	}
+}

internal/multiagent/eino_execute_failure_format_test.go

@@ -0,0 +1,114 @@
+package multiagent
+
+import (
+	"context"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"cyberstrike-ai/internal/einomcp"
+	"cyberstrike-ai/internal/security"
+
+	"github.com/cloudwego/eino/adk/filesystem"
+	"github.com/cloudwego/eino/schema"
+)
+
+type mockStreamingShellExitFail struct {
+	output string
+	code   int
+}
+
+func (m *mockStreamingShellExitFail) ExecuteStreaming(ctx context.Context, input *filesystem.ExecuteRequest) (*schema.StreamReader[*filesystem.ExecuteResponse], error) {
+	outR, outW := schema.Pipe[*filesystem.ExecuteResponse](4)
+	go func() {
+		defer outW.Close()
+		if m.output != "" {
+			_ = outW.Send(&filesystem.ExecuteResponse{Output: m.output}, nil)
+		}
+		code := m.code
+		_ = outW.Send(&filesystem.ExecuteResponse{ExitCode: &code}, nil)
+	}()
+	return outR, nil
+}
+
+func TestEinoStreamingShellWrap_CommandFailureFormat(t *testing.T) {
+	inner := &mockStreamingShellExitFail{
+		output: "sudo: a password is required\n",
+		code:   1,
+	}
+	notify := einomcp.NewToolInvokeNotifyHolder()
+	var firedBody string
+	var firedSuccess bool
+	var firedErr error
+	notify.Set(func(toolCallID, toolName, einoAgent string, success bool, content string, invokeErr error) {
+		firedBody = content
+		firedSuccess = success
+		firedErr = invokeErr
+	})
+	wrap := &einoStreamingShellWrap{inner: inner, invokeNotify: notify}
+	sr, err := wrap.ExecuteStreaming(context.Background(), &filesystem.ExecuteRequest{Command: "sudo whoami"})
+	if err != nil {
+		t.Fatalf("ExecuteStreaming: %v", err)
+	}
+	defer sr.Close()
+
+	var stream strings.Builder
+	for {
+		resp, rerr := sr.Recv()
+		if errors.Is(rerr, io.EOF) {
+			break
+		}
+		if rerr != nil {
+			t.Fatalf("recv: %v", rerr)
+		}
+		if resp != nil {
+			stream.WriteString(resp.Output)
+		}
+	}
+
+	if firedSuccess {
+		t.Fatal("expected success=false")
+	}
+	var exitErr *ExecuteExitError
+	if !errors.As(firedErr, &exitErr) || exitErr.Code != 1 {
+		t.Fatalf("expected ExecuteExitError code 1, got %v", firedErr)
+	}
+	if !strings.HasPrefix(firedBody, einomcp.ToolErrorPrefix) {
+		t.Fatalf("missing tool error prefix: %q", firedBody)
+	}
+	body := strings.TrimPrefix(firedBody, einomcp.ToolErrorPrefix)
+	if body != security.FormatCommandFailureResult(1, "sudo: a password is required\n") {
+		t.Fatalf("fire body = %q", body)
+	}
+	if !strings.Contains(stream.String(), "sudo:") {
+		t.Fatalf("stream missing sudo output: %q", stream.String())
+	}
+	if strings.Contains(stream.String(), "command exited with non-zero") {
+		t.Fatalf("stream has legacy noise: %q", stream.String())
+	}
+	if strings.Contains(stream.String(), "执行未正常结束") {
+		t.Fatalf("stream has abnormal tail: %q", stream.String())
+	}
+	if !security.IsCommandFailureResult(stream.String()) {
+		t.Fatalf("stream missing failure status line: %q", stream.String())
+	}
+	if tail := friendlyEinoExecuteInvokeTail(firedErr); tail != "" {
+		t.Fatalf("unexpected invoke tail: %q", tail)
+	}
+	if !einoToolResultIsError("execute", firedBody) {
+		t.Fatal("expected isError for execute failure")
+	}
+}
+
+func TestFriendlyEinoExecuteInvokeTail(t *testing.T) {
+	if friendlyEinoExecuteInvokeTail(&ExecuteExitError{Code: 1}) != "" {
+		t.Fatal("exit error should not get abnormal tail")
+	}
+	if !strings.Contains(friendlyEinoExecuteInvokeTail(context.DeadlineExceeded), "Timed out") {
+		t.Fatal("deadline should get timeout hint")
+	}
+	if friendlyEinoExecuteInvokeTail(errors.New("broken pipe")) == "" {
+		t.Fatal("unexpected error should get tail")
+	}
+}

internal/multiagent/eino_execute_monitor.go

@@ -7,11 +7,25 @@ import (
 	"cyberstrike-ai/internal/einomcp"
 )
 
-// newEinoExecuteMonitorCallback 在 Eino filesystem execute 结束时写入 MCP 监控库并 recorder(executionId)，
-// 与 CallTool 路径一致，供助手消息展示「渗透测试详情」芯片。
-func newEinoExecuteMonitorCallback(ag *agent.Agent, recorder einomcp.ExecutionRecorder) func(toolCallID, command, stdout string, success bool, invokeErr error) {
-	return func(toolCallID, command, stdout string, success bool, invokeErr error) {
-		if ag == nil || recorder == nil {
+// newEinoExecuteMonitorCallbacks 在 Eino filesystem execute 开始/结束时写入 MCP 监控库并 recorder(executionId)，
+// 与 CallTool 路径一致，使监控页能展示「执行中」状态。
+func newEinoExecuteMonitorCallbacks(ag *agent.Agent, recorder einomcp.ExecutionRecorder) (
+	begin func(toolCallID, command string) string,
+	finish func(executionID, toolCallID, command, stdout string, success bool, invokeErr error),
+) {
+	begin = func(toolCallID, command string) string {
+		if ag == nil {
+			return ""
+		}
+		args := map[string]interface{}{"command": command}
+		id := ag.BeginLocalToolExecution("execute", args)
+		if id != "" && recorder != nil {
+			recorder(id, toolCallID)
+		}
+		return id
+	}
+	finish = func(executionID, toolCallID, command, stdout string, success bool, invokeErr error) {
+		if ag == nil {
 			return
 		}
 		var err error
@@ -23,9 +37,10 @@ func newEinoExecuteMonitorCallback(ag *agent.Agent, recorder einomcp.ExecutionRe
 			}
 		}
 		args := map[string]interface{}{"command": command}
-		id := ag.RecordLocalToolExecution("execute", args, stdout, err)
-		if id != "" {
+		id := ag.FinishLocalToolExecution(executionID, "execute", args, stdout, err)
+		if id != "" && recorder != nil && executionID == "" {
 			recorder(id, toolCallID)
 		}
 	}
+	return begin, finish
 }

internal/multiagent/eino_execute_streaming_wrap.go

@@ -63,8 +63,11 @@ type einoStreamingShellWrap struct {
 	outputChunk func(toolName, toolCallID, chunk string)
 	// toolTimeoutMinutes 与 agent.tool_timeout_minutes 对齐；>0 时对单次 execute 套用 context 超时（与 MCP 工具经 executeToolViaMCP 行为一致）。0 表示仅依赖上层 ctx（如整任务 10h 上限）。
 	toolTimeoutMinutes int
-	// recordMonitor 在 execute 流结束后写入 tool_executions 并 recorder(executionId)，使「渗透测试详情」与常规 MCP 一致。
-	recordMonitor func(toolCallID, command, stdout string, success bool, invokeErr error)
+	// shellNoOutputTimeoutSec：无任何输出时的空闲秒数；0=关闭。
+	shellNoOutputTimeoutSec int
+	// beginMonitor 在 execute 开始时写入 running 状态；finishMonitor 在流结束后更新为 completed/failed。
+	beginMonitor func(toolCallID, command string) string
+	finishMonitor func(executionID, toolCallID, command, stdout string, success bool, invokeErr error)
 }
 
 func (w *einoStreamingShellWrap) ExecuteStreaming(ctx context.Context, input *filesystem.ExecuteRequest) (*schema.StreamReader[*filesystem.ExecuteResponse], error) {
@@ -76,15 +79,26 @@ func (w *einoStreamingShellWrap) ExecuteStreaming(ctx context.Context, input *fi
 	}
 	req := *input
 	userCmd := strings.TrimSpace(req.Command)
+	tid := strings.TrimSpace(compose.GetToolCallID(ctx))
+	agentTag := strings.TrimSpace(w.einoAgentName)
 	if security.IsBackgroundShellCommand(req.Command) && !req.RunInBackendGround {
 		req.RunInBackendGround = true
 	}
 	req.Command = prependPythonUnbufferedEnv(req.Command)
-	tid := strings.TrimSpace(compose.GetToolCallID(ctx))
-	agentTag := strings.TrimSpace(w.einoAgentName)
 	convID := mcp.MCPConversationIDFromContext(ctx)
 	execReg := mcp.EinoExecuteRunRegistryFromContext(ctx)
 
+	var monitorExecID string
+	if w.beginMonitor != nil {
+		monitorExecID = w.beginMonitor(tid, userCmd)
+	}
+	if monitorExecID != "" && convID != "" {
+		if toolReg := mcp.ToolRunRegistryFromContext(ctx); toolReg != nil {
+			toolReg.RegisterRunningTool(convID, monitorExecID)
+		}
+	}
+	toolRunReg := mcp.ToolRunRegistryFromContext(ctx)
+
 	execCtx, execCancel := context.WithCancel(ctx)
 	var timeoutCancel context.CancelFunc
 	if w.toolTimeoutMinutes > 0 {
@@ -104,23 +118,23 @@ func (w *einoStreamingShellWrap) ExecuteStreaming(ctx context.Context, input *fi
 		}
 		if einoExecuteRecvErrIsToolTimeout(err, execCtx) {
 			hint := "\n\n" + einoExecuteTimeoutUserHint() + "\n"
-			if w.recordMonitor != nil {
-				w.recordMonitor(tid, userCmd, hint, false, context.DeadlineExceeded)
+			if w.finishMonitor != nil {
+				w.finishMonitor(monitorExecID, tid, userCmd, hint, false, context.DeadlineExceeded)
 			}
 			if w.invokeNotify != nil && tid != "" {
 				w.invokeNotify.Fire(tid, "execute", agentTag, false, hint, context.DeadlineExceeded)
 			}
 			return schema.StreamReaderFromArray([]*filesystem.ExecuteResponse{{Output: hint}}), nil
 		}
-		if w.recordMonitor != nil {
-			w.recordMonitor(tid, userCmd, "", false, err)
+		if w.finishMonitor != nil {
+			w.finishMonitor(monitorExecID, tid, userCmd, "", false, err)
 		}
 		if w.invokeNotify != nil && tid != "" {
 			w.invokeNotify.Fire(tid, "execute", agentTag, false, "", err)
 		}
 		return nil, err
 	}
-	if sr == nil || w.invokeNotify == nil {
+	if sr == nil {
 		if timeoutCancel != nil {
 			timeoutCancel()
 		}
@@ -132,7 +146,7 @@ func (w *einoStreamingShellWrap) ExecuteStreaming(ctx context.Context, input *fi
 
 	outR, outW := schema.Pipe[*filesystem.ExecuteResponse](32)
 
-	go func(inner *schema.StreamReader[*filesystem.ExecuteResponse], command string, cancel context.CancelFunc, timeoutCleanup context.CancelFunc, tctx context.Context, conversationID string, reg mcp.EinoExecuteRunRegistry) {
+	go func(inner *schema.StreamReader[*filesystem.ExecuteResponse], command string, cancel context.CancelFunc, timeoutCleanup context.CancelFunc, tctx context.Context, conversationID string, reg mcp.EinoExecuteRunRegistry, toolReg mcp.ToolRunRegistry, execID string, toolCallID string, noOutputSec int) {
 		var innerCloseOnce sync.Once
 		closeInner := func() {
 			innerCloseOnce.Do(func() { inner.Close() })
@@ -147,6 +161,9 @@ func (w *einoStreamingShellWrap) ExecuteStreaming(ctx context.Context, input *fi
 		if reg != nil && conversationID != "" {
 			defer reg.UnregisterActiveEinoExecute(conversationID)
 		}
+		if toolReg != nil && conversationID != "" && execID != "" {
+			defer toolReg.UnregisterRunningTool(conversationID, execID)
+		}
 
 		// ctx 取消时关闭内层流，避免 amass 等长时间无换行输出时 Recv 永久阻塞。
 		stopWatch := make(chan struct{})
@@ -165,50 +182,103 @@ func (w *einoStreamingShellWrap) ExecuteStreaming(ctx context.Context, input *fi
 		exitCode := 0
 		hasExitCode := false
 
+		idleWatch := security.NewShellInactivityWatch(noOutputSec)
+		if idleWatch != nil {
+			defer idleWatch.Stop()
+		}
+
+		type execRecvMsg struct {
+			resp *filesystem.ExecuteResponse
+			err  error
+		}
+		recvCh := make(chan execRecvMsg, 1)
+		go func() {
+			for {
+				resp, rerr := inner.Recv()
+				recvCh <- execRecvMsg{resp: resp, err: rerr}
+				if rerr != nil {
+					return
+				}
+			}
+		}()
+
+		fireInactivityTimeout := func() {
+			success = false
+			invokeErr = fmt.Errorf("shell inactivity timeout (%ds)", idleWatch.Sec)
+			msg := security.ShellNoOutputTimeoutMessage(idleWatch.Sec)
+			_ = outW.Send(&filesystem.ExecuteResponse{Output: msg}, nil)
+			sb.WriteString(msg)
+			if w.outputChunk != nil && toolCallID != "" {
+				w.outputChunk("execute", toolCallID, msg)
+			}
+			if cancel != nil {
+				cancel()
+			}
+			closeInner()
+		}
+
+	recvLoop:
 		for {
-			resp, rerr := inner.Recv()
-			if errors.Is(rerr, io.EOF) {
-				break
+			var idleCh <-chan struct{}
+			if idleWatch != nil {
+				idleCh = idleWatch.Expired
 			}
-			if rerr != nil {
-				success = false
-				invokeErr = rerr
-				// 单次 execute 超时须与 MCP 工具一致：写入工具结果尾标、继续迭代，不得向 ADK 流注入硬错误。
-				if einoExecuteRecvErrIsToolTimeout(rerr, tctx) {
-					invokeErr = context.DeadlineExceeded
-					break
+			select {
+			case <-idleCh:
+				fireInactivityTimeout()
+				break recvLoop
+			case msg := <-recvCh:
+				rerr := msg.err
+				resp := msg.resp
+				if errors.Is(rerr, io.EOF) {
+					break recvLoop
 				}
-				if errors.Is(rerr, context.Canceled) || (tctx != nil && errors.Is(tctx.Err(), context.Canceled)) {
-					invokeErr = context.Canceled
-					break
-				}
-				_ = outW.Send(nil, rerr)
-				break
-			}
-			if resp != nil {
-				if resp.ExitCode != nil {
-					hasExitCode = true
-					exitCode = *resp.ExitCode
-				}
-				var appended string
-				if resp.Output != "" {
-					sb.WriteString(resp.Output)
-					appended = resp.Output
-				}
-				if w.outputChunk != nil && strings.TrimSpace(appended) != "" {
-					w.outputChunk("execute", tid, appended)
-				}
-				if outW.Send(resp, nil) {
+				if rerr != nil {
 					success = false
-					invokeErr = fmt.Errorf("execute stream closed by consumer")
-					break
+					invokeErr = rerr
+					if einoExecuteRecvErrIsToolTimeout(rerr, tctx) {
+						invokeErr = context.DeadlineExceeded
+						break recvLoop
+					}
+					if errors.Is(rerr, context.Canceled) || (tctx != nil && errors.Is(tctx.Err(), context.Canceled)) {
+						invokeErr = context.Canceled
+						break recvLoop
+					}
+					_ = outW.Send(nil, rerr)
+					break recvLoop
+				}
+				if resp != nil {
+					if resp.ExitCode != nil {
+						hasExitCode = true
+						exitCode = *resp.ExitCode
+						continue
+					}
+					var appended string
+					if resp.Output != "" {
+						if security.IsLegacyShellExitNoise(resp.Output) {
+							continue
+						}
+						if idleWatch != nil {
+							idleWatch.Bump()
+						}
+						sb.WriteString(resp.Output)
+						appended = resp.Output
+					}
+					if w.outputChunk != nil && strings.TrimSpace(appended) != "" {
+						w.outputChunk("execute", toolCallID, appended)
+					}
+					if outW.Send(resp, nil) {
+						success = false
+						invokeErr = fmt.Errorf("execute stream closed by consumer")
+						break recvLoop
+					}
 				}
 			}
 		}
 
 		if success && hasExitCode && exitCode != 0 {
 			success = false
-			invokeErr = fmt.Errorf("execute exited with code %d", exitCode)
+			invokeErr = &ExecuteExitError{Code: exitCode}
 		}
 		// WithTimeout 触发后，子进程常被信号结束，local 侧多报 exit -1 / canceled，错误链里不一定带 DeadlineExceeded。
 		// 用执行所用 ctx 归一化，便于 UI 展示「超时」而非含糊的 -1。
@@ -248,12 +318,24 @@ func (w *einoStreamingShellWrap) ExecuteStreaming(ctx context.Context, input *fi
 				_ = outW.Send(&filesystem.ExecuteResponse{Output: text + "\n"}, nil)
 			}
 		}
-		if w.recordMonitor != nil {
-			w.recordMonitor(tid, command, sb.String(), success, invokeErr)
+		rawOutput := sb.String()
+		fireBody := rawOutput
+		if !success && hasExitCode && exitCode != 0 {
+			statusLine := security.ExecuteFailureStatusLine(exitCode)
+			if !strings.Contains(rawOutput, "命令执行失败:") {
+				_ = outW.Send(&filesystem.ExecuteResponse{Output: statusLine}, nil)
+				sb.WriteString(statusLine)
+			}
+			fireBody = einomcp.ToolErrorPrefix + security.FormatCommandFailureResult(exitCode, rawOutput)
+		}
+		if w.finishMonitor != nil {
+			w.finishMonitor(execID, toolCallID, command, sb.String(), success, invokeErr)
+		}
+		if w.invokeNotify != nil {
+			w.invokeNotify.Fire(toolCallID, "execute", agentTag, success, fireBody, invokeErr)
 		}
-		w.invokeNotify.Fire(tid, "execute", agentTag, success, sb.String(), invokeErr)
 		outW.Close()
-	}(sr, userCmd, execCancel, timeoutCancel, execCtx, convID, execReg)
+	}(sr, userCmd, execCancel, timeoutCancel, execCtx, convID, execReg, toolRunReg, monitorExecID, tid, w.shellNoOutputTimeoutSec)
 
 	return outR, nil
 }

internal/multiagent/eino_execute_streaming_wrap_test.go

@@ -19,9 +19,15 @@ type mockStreamingShell struct {
 	immediateErr error
 	recvErr      error
 	output       string
+	called       bool
+	lastCommand  string
 }
 
 func (m *mockStreamingShell) ExecuteStreaming(ctx context.Context, input *filesystem.ExecuteRequest) (*schema.StreamReader[*filesystem.ExecuteResponse], error) {
+	m.called = true
+	if input != nil {
+		m.lastCommand = input.Command
+	}
 	if m.immediateErr != nil {
 		return nil, m.immediateErr
 	}
@@ -38,6 +44,129 @@ func (m *mockStreamingShell) ExecuteStreaming(ctx context.Context, input *filesy
 	return outR, nil
 }
 
+func TestEinoStreamingShellWrap_PreparesNonInteractiveCommand(t *testing.T) {
+	inner := &mockStreamingShell{output: "ok\n"}
+	wrap := &einoStreamingShellWrap{inner: inner}
+	sr, err := wrap.ExecuteStreaming(context.Background(), &filesystem.ExecuteRequest{Command: "echo ok"})
+	if err != nil {
+		t.Fatalf("ExecuteStreaming: %v", err)
+	}
+	defer sr.Close()
+	for {
+		_, rerr := sr.Recv()
+		if errors.Is(rerr, io.EOF) {
+			break
+		}
+		if rerr != nil {
+			t.Fatalf("recv: %v", rerr)
+		}
+	}
+	if !strings.Contains(inner.lastCommand, "PYTHONUNBUFFERED=1") {
+		t.Fatalf("missing python unbuffer in inner command: %q", inner.lastCommand)
+	}
+}
+
+func TestEinoStreamingShellWrap_NoOutputTimeout(t *testing.T) {
+	inner := &mockStreamingShellHanging{}
+	notify := einomcp.NewToolInvokeNotifyHolder()
+	var fired string
+	notify.Set(func(toolCallID, toolName, einoAgent string, success bool, content string, invokeErr error) {
+		fired = content
+	})
+	wrap := &einoStreamingShellWrap{
+		inner:                   inner,
+		invokeNotify:            notify,
+		shellNoOutputTimeoutSec: 1,
+	}
+	sr, err := wrap.ExecuteStreaming(context.Background(), &filesystem.ExecuteRequest{Command: "sudo whoami"})
+	if err != nil {
+		t.Fatalf("ExecuteStreaming: %v", err)
+	}
+	defer sr.Close()
+	var got strings.Builder
+	for {
+		resp, rerr := sr.Recv()
+		if errors.Is(rerr, io.EOF) {
+			break
+		}
+		if rerr != nil {
+			t.Fatalf("recv: %v", rerr)
+		}
+		if resp != nil {
+			got.WriteString(resp.Output)
+		}
+	}
+	if !inner.called {
+		t.Fatal("inner shell should run (no command blacklist)")
+	}
+	out := got.String()
+	if !strings.Contains(out, "没有新的输出") && !strings.Contains(out, "no new output") {
+		t.Fatalf("expected inactivity timeout message, got: %q notify=%q", out, fired)
+	}
+}
+
+type mockStreamingShellPartialThenHang struct {
+	called bool
+}
+
+func (m *mockStreamingShellPartialThenHang) ExecuteStreaming(ctx context.Context, input *filesystem.ExecuteRequest) (*schema.StreamReader[*filesystem.ExecuteResponse], error) {
+	m.called = true
+	outR, outW := schema.Pipe[*filesystem.ExecuteResponse](4)
+	go func() {
+		_ = outW.Send(&filesystem.ExecuteResponse{Output: "[sudo] password:\n"}, nil)
+		<-ctx.Done()
+		outW.Close()
+	}()
+	return outR, nil
+}
+
+func TestEinoStreamingShellWrap_InactivityAfterPartialOutput(t *testing.T) {
+	inner := &mockStreamingShellPartialThenHang{}
+	wrap := &einoStreamingShellWrap{
+		inner:                   inner,
+		shellNoOutputTimeoutSec: 1,
+	}
+	start := time.Now()
+	sr, err := wrap.ExecuteStreaming(context.Background(), &filesystem.ExecuteRequest{Command: "sudo whoami"})
+	if err != nil {
+		t.Fatalf("ExecuteStreaming: %v", err)
+	}
+	defer sr.Close()
+	var got strings.Builder
+	for {
+		resp, rerr := sr.Recv()
+		if errors.Is(rerr, io.EOF) {
+			break
+		}
+		if rerr != nil {
+			t.Fatalf("recv: %v", rerr)
+		}
+		if resp != nil {
+			got.WriteString(resp.Output)
+		}
+	}
+	if time.Since(start) > 5*time.Second {
+		t.Fatalf("expected inactivity timeout ~1s, took %v", time.Since(start))
+	}
+	if !strings.Contains(got.String(), "没有新的输出") && !strings.Contains(got.String(), "no new output") {
+		t.Fatalf("expected inactivity message, got: %q", got.String())
+	}
+}
+
+type mockStreamingShellHanging struct {
+	called bool
+}
+
+func (m *mockStreamingShellHanging) ExecuteStreaming(ctx context.Context, input *filesystem.ExecuteRequest) (*schema.StreamReader[*filesystem.ExecuteResponse], error) {
+	m.called = true
+	outR, outW := schema.Pipe[*filesystem.ExecuteResponse](4)
+	go func() {
+		<-ctx.Done()
+		outW.Close()
+	}()
+	return outR, nil
+}
+
 func TestEinoExecuteRecvErrIsToolTimeout(t *testing.T) {
 	tctx, cancel := context.WithTimeout(context.Background(), time.Millisecond)
 	defer cancel()

internal/multiagent/eino_filesystem_tool_monitor.go

@@ -63,10 +63,43 @@ func toolCallArgsFromAccumulated(msgs []adk.Message, toolCallID, expectToolName
 	return map[string]interface{}{}
 }
 
+// beginEinoADKFilesystemToolMonitor 在 Eino ADK filesystem 工具开始调用时写入 running 状态。
+func beginEinoADKFilesystemToolMonitor(
+	ag *agent.Agent,
+	rec einomcp.ExecutionRecorder,
+	binder *MCPExecutionBinder,
+	toolCallID, toolName string,
+) {
+	if ag == nil || rec == nil {
+		return
+	}
+	name := strings.TrimSpace(toolName)
+	if name == "" || strings.EqualFold(name, "execute") {
+		return
+	}
+	if !isBuiltinEinoADKFilesystemToolName(name) {
+		return
+	}
+	tid := strings.TrimSpace(toolCallID)
+	if tid == "" {
+		return
+	}
+	storedName := "eino_fs::" + strings.ToLower(name)
+	id := ag.BeginLocalToolExecution(storedName, map[string]interface{}{})
+	if id == "" {
+		return
+	}
+	rec(id, tid)
+	if binder != nil {
+		binder.Bind(tid, id)
+	}
+}
+
 // recordEinoADKFilesystemToolMonitor 将 Eino ADK filesystem 中间件工具结果写入 MCP 监控（与 execute / MCP 桥芯片一致）。
 func recordEinoADKFilesystemToolMonitor(
 	ag *agent.Agent,
 	rec einomcp.ExecutionRecorder,
+	binder *MCPExecutionBinder,
 	toolName string,
 	toolCallID string,
 	msgs []adk.Message,
@@ -94,8 +127,12 @@ func recordEinoADKFilesystemToolMonitor(
 			invErr = errors.New(t)
 		}
 	}
-	id := ag.RecordLocalToolExecution(storedName, args, resultText, invErr)
-	if id != "" {
+	execID := ""
+	if binder != nil {
+		execID = binder.ExecutionID(toolCallID)
+	}
+	id := ag.FinishLocalToolExecution(execID, storedName, args, resultText, invErr)
+	if id != "" && execID == "" {
 		rec(id, toolCallID)
 	}
 }

internal/multiagent/eino_orchestration.go

@@ -80,34 +80,9 @@ func NewPlanExecuteRoot(ctx context.Context, a *PlanExecuteRootArgs) (adk.Resuma
 		return nil, fmt.Errorf("plan_execute replanner: %w", err)
 	}
 
-	// 组装 executor handler 栈，顺序与 Deep/Supervisor 主代理一致（outermost first）。
-	var execHandlers []adk.ChatModelAgentMiddleware
-	// 1. patchtoolcalls, reduction, toolsearch, plantask（来自 prependEinoMiddlewares）
-	if len(a.ExecPreMiddlewares) > 0 {
-		execHandlers = append(execHandlers, a.ExecPreMiddlewares...)
-	}
-	// 2. filesystem 中间件（可选）
-	if a.FilesystemMiddleware != nil {
-		execHandlers = append(execHandlers, a.FilesystemMiddleware)
-	}
-	// 3. skill 中间件（可选）
-	if a.SkillMiddleware != nil {
-		execHandlers = append(execHandlers, a.SkillMiddleware)
-	}
-	// 4. pre-summarization normalize + continuation dedup, then summarization (与 Deep/Supervisor 一致)
-	if a.AppCfg != nil {
-		sumMw, sumErr := newEinoSummarizationMiddleware(ctx, a.ExecModel, a.AppCfg, a.MwCfg, a.ConversationID, a.DB, a.ProjectID, a.Logger)
-		if sumErr != nil {
-			return nil, fmt.Errorf("plan_execute executor summarization: %w", sumErr)
-		}
-		execHandlers = appendEinoChatModelTailMiddlewares(execHandlers, einoChatModelTailConfig{
-			logger:         a.Logger,
-			phase:          "plan_execute_executor",
-			summarization:  sumMw,
-			modelName:      a.ModelName,
-			conversationID: a.ConversationID,
-			trace:          a.ModelFacingTrace,
-		})
+	execHandlers, err := buildPlanExecuteExecutorHandlers(ctx, a)
+	if err != nil {
+		return nil, err
 	}
 	executor, err := newPlanExecuteExecutor(ctx, &planexecute.ExecutorConfig{
 		Model:         a.ExecModel,
@@ -130,6 +105,39 @@ func NewPlanExecuteRoot(ctx context.Context, a *PlanExecuteRootArgs) (adk.Resuma
 	})
 }
 
+// buildPlanExecuteExecutorHandlers 组装 Executor 中间件栈（outermost first），与 Deep/Supervisor 主代理对齐：
+// ExecPreMiddlewares（patch / reduction / toolsearch / plantask）→ filesystem → skill → summarization tail。
+func buildPlanExecuteExecutorHandlers(ctx context.Context, a *PlanExecuteRootArgs) ([]adk.ChatModelAgentMiddleware, error) {
+	if a == nil {
+		return nil, fmt.Errorf("plan_execute: args 为空")
+	}
+	var execHandlers []adk.ChatModelAgentMiddleware
+	if len(a.ExecPreMiddlewares) > 0 {
+		execHandlers = append(execHandlers, a.ExecPreMiddlewares...)
+	}
+	if a.FilesystemMiddleware != nil {
+		execHandlers = append(execHandlers, a.FilesystemMiddleware)
+	}
+	if a.SkillMiddleware != nil {
+		execHandlers = append(execHandlers, a.SkillMiddleware)
+	}
+	if a.AppCfg != nil {
+		sumMw, sumErr := newEinoSummarizationMiddleware(ctx, a.ExecModel, a.AppCfg, a.MwCfg, a.ConversationID, a.DB, a.ProjectID, a.Logger)
+		if sumErr != nil {
+			return nil, fmt.Errorf("plan_execute executor summarization: %w", sumErr)
+		}
+		execHandlers = appendEinoChatModelTailMiddlewares(execHandlers, einoChatModelTailConfig{
+			logger:         a.Logger,
+			phase:          "plan_execute_executor",
+			summarization:  sumMw,
+			modelName:      a.ModelName,
+			conversationID: a.ConversationID,
+			trace:          a.ModelFacingTrace,
+		})
+	}
+	return execHandlers, nil
+}
+
 // planExecutePlannerGenInput 将 orchestrator instruction 作为 SystemMessage 注入 planner 输入。
 // 返回 nil 时 Eino 使用内置默认 planner prompt。
 func planExecutePlannerGenInput(

internal/multiagent/eino_single_runner.go

@@ -81,7 +81,7 @@ func RunEinoSingleChatModelAgent(
 	}
 
 	toolInvokeNotify := einomcp.NewToolInvokeNotifyHolder()
-	einoExecMonitor := newEinoExecuteMonitorCallback(ag, recorder)
+	einoExecBegin, einoExecFinish := newEinoExecuteMonitorCallbacks(ag, recorder)
 	mainDefs := ag.ToolsForRole(roleTools)
 	mainTools, err := einomcp.ToolsFromDefinitions(ag, holder, mainDefs, recorder, nil, toolInvokeNotify, einoSingleAgentName)
 	if err != nil {
@@ -136,7 +136,7 @@ func RunEinoSingleChatModelAgent(
 	}
 	if einoSkillMW != nil {
 		if einoFSTools && einoLoc != nil {
-			fsMw, fsErr := subAgentFilesystemMiddleware(ctx, einoLoc, toolInvokeNotify, einoSingleAgentName, einoExecMonitor, agentToolTimeoutMinutes(appCfg), nil)
+			fsMw, fsErr := subAgentFilesystemMiddleware(ctx, einoLoc, toolInvokeNotify, einoSingleAgentName, einoExecBegin, einoExecFinish, agentToolTimeoutMinutes(appCfg), agentShellNoOutputTimeoutSeconds(appCfg), nil)
 			if fsErr != nil {
 				return nil, fmt.Errorf("eino single filesystem 中间件: %w", fsErr)
 			}
@@ -184,6 +184,7 @@ func RunEinoSingleChatModelAgent(
 		Name:          einoSingleAgentName,
 		Description:   "Eino ADK ChatModelAgent with MCP tools for authorized security testing.",
 		Instruction:   ins,
+		GenModelInput: literalInstructionGenModelInput,
 		Model:         mainModel,
 		ToolsConfig:   mainToolsCfg,
 		MaxIterations: maxIter,

internal/multiagent/eino_skills.go

@@ -9,6 +9,7 @@ import (
 
 	"cyberstrike-ai/internal/config"
 	"cyberstrike-ai/internal/einomcp"
+	"cyberstrike-ai/internal/security"
 
 	localbk "github.com/cloudwego/eino-ext/adk/backend/local"
 	"github.com/cloudwego/eino/adk"
@@ -81,8 +82,10 @@ func subAgentFilesystemMiddleware(
 	loc *localbk.Local,
 	invokeNotify *einomcp.ToolInvokeNotifyHolder,
 	einoAgentName string,
-	recordMonitor func(toolCallID, command, stdout string, success bool, invokeErr error),
+	beginMonitor func(toolCallID, command string) string,
+	finishMonitor func(executionID, toolCallID, command, stdout string, success bool, invokeErr error),
 	toolTimeoutMinutes int,
+	shellNoOutputTimeoutSec int,
 	outputChunk func(toolName, toolCallID, chunk string),
 ) (adk.ChatModelAgentMiddleware, error) {
 	if loc == nil {
@@ -91,12 +94,14 @@ func subAgentFilesystemMiddleware(
 	return filesystem.New(ctx, &filesystem.MiddlewareConfig{
 		Backend: loc,
 		StreamingShell: &einoStreamingShellWrap{
-			inner:              loc,
-			invokeNotify:       invokeNotify,
-			einoAgentName:      strings.TrimSpace(einoAgentName),
-			outputChunk:        outputChunk,
-			recordMonitor:      recordMonitor,
-			toolTimeoutMinutes: toolTimeoutMinutes,
+			inner:                   security.NewEinoStreamingShell(),
+			invokeNotify:            invokeNotify,
+			einoAgentName:           strings.TrimSpace(einoAgentName),
+			outputChunk:             outputChunk,
+			beginMonitor:            beginMonitor,
+			finishMonitor:           finishMonitor,
+			toolTimeoutMinutes:      toolTimeoutMinutes,
+			shellNoOutputTimeoutSec: shellNoOutputTimeoutSec,
 		},
 	})
 }
@@ -108,3 +113,18 @@ func agentToolTimeoutMinutes(cfg *config.Config) int {
 	}
 	return cfg.Agent.ToolTimeoutMinutes
 }
+
+// agentShellNoOutputTimeoutSeconds：0=默认 300s（5 分钟）；-1=关闭；>0=自定义秒数。
+func agentShellNoOutputTimeoutSeconds(cfg *config.Config) int {
+	if cfg == nil {
+		return 300
+	}
+	v := cfg.Agent.ShellNoOutputTimeoutSeconds
+	if v < 0 {
+		return 0
+	}
+	if v == 0 {
+		return 300
+	}
+	return v
+}

internal/multiagent/eino_summarize.go

@@ -22,15 +22,60 @@ import (
 	"go.uber.org/zap"
 )
 
-// einoSummarizeUserInstruction：压缩历史时保留渗透测试关键信息。
-const einoSummarizeUserInstruction = `在保持所有关键安全测试信息完整的前提下压缩对话历史。
+// einoSummarizeUserInstruction：压缩历史时保留渗透测试与用户约束关键信息。
+// 结构对齐 Eino 最佳实践（禁止工具、<analysis>+<summary>、<all_user_messages>），章节为安全测试领域化。
+const einoSummarizeUserInstruction = `关键：仅以纯文本响应。禁止调用任何工具（read_file、exec、grep、glob、write、edit 等）。
+上述对话中已包含全部待压缩上下文；不要要求用户粘贴历史，不要输出「请提供待压缩的对话历史」等占位/meta 回复。
+工具调用将被拒绝并浪费唯一一次摘要机会。
 
-必须保留：已确认漏洞与攻击路径、工具输出中的核心发现、凭证与认证细节、架构与薄弱点、当前进度、失败尝试与死路、策略决策。
-保留精确技术细节（URL、路径、参数、Payload、版本号、报错原文可摘要但要点不丢）。
-将冗长扫描输出概括为结论；重复发现合并表述。
-已枚举资产须保留**可继承的摘要**：主域、关键子域/主机短表（或数量+代表样例）、高价值目标与已识别服务/端口要点，避免后续子代理因「看不见清单」而重复全量枚举。
+你的任务：在保持所有关键安全测试信息完整的前提下压缩对话历史，使后续代理能无缝继续同一授权测试任务。
 
-输出须使后续代理能无缝继续同一授权测试任务。`
+压缩原则：
+- 必须保留：已确认漏洞与攻击路径、工具输出核心发现、凭证与认证细节、架构与薄弱点、当前进度、失败尝试与死路、策略决策
+- 保留精确技术细节（URL、路径、参数、Payload、版本号；报错原文可摘要但要点不丢）
+- 冗长扫描输出概括为结论；重复发现合并表述
+- 已枚举资产须保留可继承摘要：主域、关键子域/主机短表（或数量+代表样例）、高价值目标、已识别服务/端口要点
+
+输出格式（严格遵循，仅一轮回复）：
+1. 先输出 <analysis> 块：按时间顺序梳理对话，检查是否涵盖下方各章节要点；analysis 仅供自检，保持简洁（建议 ≤400 字）
+2. 再输出 <summary> 块：按以下章节写入可继承的压缩报告（无信息处写「无」，禁止留空模板占位符）
+
+<summary>
+## 1. 授权范围与约束
+- 目标/范围/禁止项（域名、路径、IP、环境）
+- 凭证/认证信息（账号、Token、Cookie；敏感值原文保留）
+- 用户指定的方法、工具、优先级与待办
+- 否定约束（不测什么、不用什么手法）
+
+## 2. 资产与服务枚举摘要
+- 主域/核心资产、关键子域或主机短表（或数量+代表样例）
+- 高价值目标、已识别服务/端口要点
+- 资产状态（存活/可攻/已排除/待验证）
+
+## 3. 架构与已知薄弱点
+- 技术栈/部署拓扑/信任边界
+- 已识别薄弱点列表
+
+## 4. 已确认漏洞与攻击路径
+- 漏洞名/CVE、URL/路径、参数/Payload、PoC 要点、影响等级
+- 攻击链/利用路径（步骤化）
+
+## 5. 工具核心发现与扫描结论
+- 各工具结论（概括核心输出，非冗长日志）
+- 重复发现合并表述
+
+## 6. 所有用户消息
+<all_user_messages>
+- [逐条列出非 tool 结果的用户消息要点；敏感约束与原文措辞尽量保留]
+</all_user_messages>
+
+## 7. 当前进度、策略决策与下一步
+- 当前位置（已完成/进行中/卡点）
+- 失败尝试与死路（方法、现象/报错摘要、结论）
+- 策略决策与下一步具体操作（须与最近用户请求及未完成任务一致）
+</summary>
+
+提醒：不要调用任何工具；必须基于上文已有对话直接输出 <analysis> 与 <summary>，勿输出 analysis 以外的正文。`
 
 // newEinoSummarizationMiddleware 使用 Eino ADK Summarization 中间件（见 https://www.cloudwego.io/zh/docs/eino/core_modules/eino_adk/eino_adk_chatmodelagentmiddleware/middleware_summarization/）。
 // 触发阈值：估算 token 超过 openai.max_total_tokens * summarization_trigger_ratio（默认 0.8）时摘要。
@@ -144,6 +189,7 @@ func newEinoSummarizationMiddleware(
 			},
 		},
 		Finalize: func(ctx context.Context, originalMessages []adk.Message, summary adk.Message) ([]adk.Message, error) {
+			summary = stripAnalysisFromSummarizationMessage(summary)
 			out, ferr := summarizeFinalizeWithRecentAssistantToolTrail(ctx, originalMessages, summary, tokenCounter, recentTrailMax)
 			if ferr != nil {
 				return nil, ferr

internal/multiagent/eino_summarize_output.go

@@ -0,0 +1,73 @@
+package multiagent
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/cloudwego/eino/adk"
+	"github.com/cloudwego/eino/schema"
+)
+
+var (
+	summarizationAnalysisBlockRegex = regexp.MustCompile(`(?is)<analysis>\s*.*?\s*</analysis>`)
+	summarizationSummaryBlockRegex  = regexp.MustCompile(`(?is)<summary>\s*(.*?)\s*</summary>`)
+)
+
+// stripAnalysisFromSummarizationMessage removes the <analysis> block from a post-processed
+// Eino summary user message. Analysis helps one-shot generation quality but should not
+// occupy continuation context after compaction.
+func stripAnalysisFromSummarizationMessage(msg adk.Message) adk.Message {
+	if msg == nil {
+		return msg
+	}
+	cloned := *msg
+	if cloned.Content != "" {
+		cloned.Content = stripAnalysisFromSummarizationText(cloned.Content)
+	}
+	if len(cloned.UserInputMultiContent) > 0 {
+		parts := make([]schema.MessageInputPart, len(cloned.UserInputMultiContent))
+		copy(parts, cloned.UserInputMultiContent)
+		// Only the first text part carries model output plus Eino preamble/transcript path.
+		for i := range parts {
+			if parts[i].Type != schema.ChatMessagePartTypeText || parts[i].Text == "" {
+				continue
+			}
+			if i == 0 {
+				parts[i].Text = stripAnalysisFromSummarizationText(parts[i].Text)
+			}
+			break
+		}
+		cloned.UserInputMultiContent = parts
+	}
+	return &cloned
+}
+
+func stripAnalysisFromSummarizationText(text string) string {
+	text = strings.TrimSpace(text)
+	if text == "" {
+		return text
+	}
+	stripped := strings.TrimSpace(summarizationAnalysisBlockRegex.ReplaceAllString(text, ""))
+	if stripped == "" {
+		return text
+	}
+	return stripped
+}
+
+// extractSummarizationSummaryBody returns the inner text of the last <summary> block when present.
+// Used by tests and optional strict compaction paths.
+func extractSummarizationSummaryBody(text string) (string, bool) {
+	text = strings.TrimSpace(text)
+	if text == "" {
+		return "", false
+	}
+	all := summarizationSummaryBlockRegex.FindAllStringSubmatch(text, -1)
+	if len(all) == 0 || len(all[len(all)-1]) < 2 {
+		return "", false
+	}
+	body := strings.TrimSpace(all[len(all)-1][1])
+	if body == "" {
+		return "", false
+	}
+	return body, true
+}

internal/multiagent/eino_summarize_output_test.go

@@ -0,0 +1,67 @@
+package multiagent
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/cloudwego/eino/schema"
+)
+
+func TestStripAnalysisFromSummarizationText(t *testing.T) {
+	in := "<analysis>internal notes</analysis>\n\n<summary>\n## 1. 授权\n- example.com\n</summary>"
+	got := stripAnalysisFromSummarizationText(in)
+	if strings.Contains(got, "<analysis>") {
+		t.Fatalf("analysis block should be removed: %q", got)
+	}
+	if !strings.Contains(got, "## 1. 授权") {
+		t.Fatalf("summary body should remain: %q", got)
+	}
+}
+
+func TestStripAnalysisFromSummarizationMessage_UserInputMultiContent(t *testing.T) {
+	msg := &schema.Message{
+		Role: schema.User,
+		UserInputMultiContent: []schema.MessageInputPart{
+			{
+				Type: schema.ChatMessagePartTypeText,
+				Text: "此会话延续自此前一段因上下文耗尽而终止的对话。\n\n<analysis>draft</analysis>\n<summary>body</summary>\n\n完整记录位于：/tmp/transcript.txt",
+			},
+			{
+				Type: schema.ChatMessagePartTypeText,
+				Text: "请从我们中断的地方继续对话，无需向用户提出任何进一步的问题。",
+			},
+		},
+	}
+	out := stripAnalysisFromSummarizationMessage(msg)
+	if len(out.UserInputMultiContent) != 2 {
+		t.Fatalf("expected 2 parts, got %d", len(out.UserInputMultiContent))
+	}
+	if strings.Contains(out.UserInputMultiContent[0].Text, "<analysis>") {
+		t.Fatalf("part 0 should drop analysis: %q", out.UserInputMultiContent[0].Text)
+	}
+	if !strings.Contains(out.UserInputMultiContent[0].Text, "<summary>body</summary>") {
+		t.Fatalf("part 0 should keep summary: %q", out.UserInputMultiContent[0].Text)
+	}
+	if out.UserInputMultiContent[1].Text != "请从我们中断的地方继续对话，无需向用户提出任何进一步的问题。" {
+		t.Fatalf("continue instruction part should be unchanged: %q", out.UserInputMultiContent[1].Text)
+	}
+}
+
+func TestExtractSummarizationSummaryBody(t *testing.T) {
+	body, ok := extractSummarizationSummaryBody("<analysis>x</analysis><summary>  kept  </summary>")
+	if !ok || body != "kept" {
+		t.Fatalf("extract summary body: ok=%v body=%q", ok, body)
+	}
+	_, ok = extractSummarizationSummaryBody("plain text only")
+	if ok {
+		t.Fatal("expected false for plain text")
+	}
+}
+
+func TestStripAnalysisFromSummarizationText_NoAnalysisUnchanged(t *testing.T) {
+	in := "<summary>only summary</summary>"
+	got := stripAnalysisFromSummarizationText(in)
+	if got != in {
+		t.Fatalf("expected unchanged text, got %q", got)
+	}
+}

internal/multiagent/eino_summarize_payload.go

@@ -1,35 +1,12 @@
 package multiagent
 
 import (
-	"github.com/bytedance/sonic"
+	copenai "cyberstrike-ai/internal/openai"
 )
 
 // stripReasoningFromSummarizationPayload removes thinking / reasoning fields from a
 // chat-completions JSON body. Applied only to summarization Generate calls via
 // model.ModelOptions on the shared ChatModel — main-agent requests are unchanged.
 func stripReasoningFromSummarizationPayload(rawBody []byte) ([]byte, error) {
-	var payload map[string]any
-	if err := sonic.Unmarshal(rawBody, &payload); err != nil {
-		return rawBody, nil
-	}
-	changed := false
-	for _, key := range []string{
-		"thinking",
-		"reasoning_effort",
-		"output_config",
-		"reasoning",
-	} {
-		if _, ok := payload[key]; ok {
-			delete(payload, key)
-			changed = true
-		}
-	}
-	if !changed {
-		return rawBody, nil
-	}
-	out, err := sonic.Marshal(payload)
-	if err != nil {
-		return rawBody, err
-	}
-	return out, nil
+	return copenai.StripReasoningFromChatCompletionBody(rawBody)
 }

internal/multiagent/eino_summarize_test.go

@@ -409,9 +409,9 @@ func TestSanitizeSystemContentForTranscript_BestPractice(t *testing.T) {
 		"需要写入请使用 upsert_project_fact。",
 		project.FactIndexSectionEndMarker,
 		"",
-		"# Skills System",
-		"**How to Use Skills**",
-		"Remember: Skills make you more capable",
+		transcriptSkillsSystemMarker,
+		"**如何使用 Skill（技能）（渐进式展示）：**",
+		"记住：Skill 让你更加强大和稳定",
 	}, "\n")
 
 	out := sanitizeSystemContentForTranscript(system)
@@ -421,7 +421,7 @@ func TestSanitizeSystemContentForTranscript_BestPractice(t *testing.T) {
 	if strings.Contains(out, "- nmap") || strings.Contains(out, "高强度扫描要求") {
 		t.Fatalf("static persona should be stripped: %q", out)
 	}
-	if strings.Contains(out, "# Skills System") || strings.Contains(out, "How to Use Skills") {
+	if strings.Contains(out, transcriptSkillsSystemMarker) || strings.Contains(out, "如何使用 Skill") {
 		t.Fatalf("skills boilerplate should be stripped: %q", out)
 	}
 	if !strings.Contains(out, transcriptStaticSystemOmitNote) {
@@ -435,7 +435,7 @@ func TestSanitizeSystemContentForTranscript_BestPractice(t *testing.T) {
 func TestFormatSummarizationTranscript_OmitsBloatedSystem(t *testing.T) {
 	t.Parallel()
 	msgs := []adk.Message{
-		schema.SystemMessage("以下是当前会话绑定的工具名称索引\n- nmap\n\n你是CyberStrikeAI\n" + project.FactIndexSectionStartMarker + "\n## 项目黑板索引（project: p1, id: x）\n（暂无事实）\n" + project.FactIndexSectionEndMarker + "\n# Skills System\nboiler"),
+		schema.SystemMessage("以下是当前会话绑定的工具名称索引\n- nmap\n\n你是CyberStrikeAI\n" + project.FactIndexSectionStartMarker + "\n## 项目黑板索引（project: p1, id: x）\n（暂无事实）\n" + project.FactIndexSectionEndMarker + "\n" + transcriptSkillsSystemMarker + "\nboiler"),
 		schema.UserMessage("hello"),
 		schema.AssistantMessage("reply", nil),
 	}

internal/multiagent/eino_summarize_transcript.go

@@ -20,7 +20,9 @@ const (
 	transcriptStaticSystemOmitNote = "[static system prompt omitted — unchanged in live context after compaction]"
 	transcriptToolIndexStartMarker   = "以下是当前会话绑定的工具名称索引"
 	transcriptPersonaStartMarker     = "你是CyberStrikeAI"
-	transcriptSkillsSystemMarker     = "# Skills System"
+	// ADK LanguageChinese injects skill middleware prompt with this header (see eino adk/middlewares/skill/prompt.go).
+	transcriptSkillsSystemMarker        = "# Skill 系统"
+	transcriptSkillsSystemMarkerEnglish = "# Skills System"
 )
 
 type transcriptToolCall struct {
@@ -86,13 +88,23 @@ func stripToolNamesIndexFromSystem(s string) string {
 }
 
 func stripSkillsSystemBoilerplate(s string) string {
-	idx := strings.Index(s, transcriptSkillsSystemMarker)
+	idx := indexFirstSubstring(s, transcriptSkillsSystemMarker, transcriptSkillsSystemMarkerEnglish)
 	if idx < 0 {
 		return strings.TrimSpace(s)
 	}
 	return strings.TrimSpace(s[:idx])
 }
 
+func indexFirstSubstring(s string, markers ...string) int {
+	first := -1
+	for _, m := range markers {
+		if i := strings.Index(s, m); i >= 0 && (first < 0 || i < first) {
+			first = i
+		}
+	}
+	return first
+}
+
 func extractProjectBlackboardSection(s string) string {
 	start := strings.Index(s, project.FactIndexSectionStartMarker)
 	if start < 0 {

internal/multiagent/eino_tool_name_injection.go

@@ -46,6 +46,10 @@ func injectToolNamesOnlyInstruction(ctx context.Context, instruction string, too
 		sb.WriteString("2) 调用具体工具前，请先确认该工具的参数要求（以当前请求中的工具定义为准）；不确定时先澄清再调用。\n")
 		sb.WriteString("3) 不要臆造不存在的工具名。\n\n")
 	}
+	if s := strings.TrimSpace(injectShellToolGuidance("", names)); s != "" {
+		sb.WriteString(s)
+		sb.WriteString("\n\n")
+	}
 	if s := strings.TrimSpace(instruction); s != "" {
 		sb.WriteString(s)
 	}

internal/multiagent/eino_transient_retry.go

@@ -143,7 +143,7 @@ func (r *einoTransientRunRetrier) attempt() int { return r.attempts }
 
 func (r *einoTransientRunRetrier) maxAttempts() int { return r.policy.maxAttempts }
 
-// reset 在一次成功推进后清零重试计数，使后续临时错误从第 1 次退避重新开始。
+// reset 在退避重试后成功推进（流/消息完整接收）时清零计数，使后续临时错误从第 1 次退避重新开始。
 func (r *einoTransientRunRetrier) reset() { r.attempts = 0 }
 
 func einoRunRetryMaxAttempts(args *einoADKRunLoopArgs) int {
@@ -190,29 +190,26 @@ func einoMessagesForRunRestart(args *einoADKRunLoopArgs, baseMsgs, accumulated [
 	return append([]adk.Message(nil), baseMsgs...), einoRestartContextInitial
 }
 
-// adkMessagesHasUserContent 从尾部向前查找，是否已有与 want 相同的 user 消息（避免重复 append）。
+// adkMessagesHasUserContent reports whether the conversation tail is already a user turn
+// with the given content. Only the last message counts: matching text in an earlier round
+// (e.g. user repeats the same prompt after an assistant reply) must not suppress appending
+// the new user turn — Claude 4.6+ rejects requests whose final message is assistant.
 func adkMessagesHasUserContent(msgs []adk.Message, want string) bool {
 	want = strings.TrimSpace(want)
 	if want == "" {
 		return true
 	}
-	for i := len(msgs) - 1; i >= 0; i-- {
-		m := msgs[i]
-		if m == nil {
-			continue
-		}
-		if m.Role == schema.User {
-			return strings.TrimSpace(m.Content) == want
-		}
-		if m.Role == schema.Assistant || m.Role == schema.Tool {
-			continue
-		}
-		break
+	if len(msgs) == 0 {
+		return false
 	}
-	return false
+	last := msgs[len(msgs)-1]
+	if last == nil || last.Role != schema.User {
+		return false
+	}
+	return strings.TrimSpace(last.Content) == want
 }
 
-// appendUserMessageIfNeeded 在 history 轨迹之后追加本轮 user 消息（仅当轨迹中尚未包含该句）。
+// appendUserMessageIfNeeded 在 history 轨迹之后追加本轮 user 消息（仅当尾部已是相同 user 句）。
 func appendUserMessageIfNeeded(msgs []adk.Message, userMessage string) []adk.Message {
 	if strings.TrimSpace(userMessage) == "" || adkMessagesHasUserContent(msgs, userMessage) {
 		return msgs

internal/multiagent/eino_transient_retry_test.go

@@ -105,6 +105,32 @@ func TestEinoTransientRunRetrierReset(t *testing.T) {
 	}
 }
 
+func TestEinoTransientRunRetrierConsecutiveFailures(t *testing.T) {
+	t.Parallel()
+	r := newEinoTransientRunRetrier(einoTransientRunRetryPolicy{maxAttempts: 10, maxBackoff: 30 * time.Second})
+	ctx := context.Background()
+	runErr := errors.New("internal server error")
+	args := &einoADKRunLoopArgs{}
+	base := []adk.Message{schema.UserMessage("hi")}
+
+	for want := 1; want <= 3; want++ {
+		restarted, _, _, _, err := r.tryRetry(ctx, runErr, args, base, nil, len(base))
+		if err != nil {
+			t.Fatalf("tryRetry attempt %d: %v", want, err)
+		}
+		if !restarted {
+			t.Fatalf("tryRetry attempt %d: want restarted", want)
+		}
+		if got := r.attempt(); got != want {
+			t.Fatalf("after failure %d: attempt=%d, want %d", want, got, want)
+		}
+	}
+	r.reset()
+	if r.attempt() != 0 {
+		t.Fatalf("after successful recovery reset: attempt=%d, want 0", r.attempt())
+	}
+}
+
 func TestAppendUserMessageIfNeeded(t *testing.T) {
 	t.Parallel()
 	msgs := []adk.Message{schema.UserMessage("old task")}
@@ -117,3 +143,18 @@ func TestAppendUserMessageIfNeeded(t *testing.T) {
 		t.Fatalf("should not duplicate user message: len=%d", len(dup))
 	}
 }
+
+func TestAppendUserMessageIfNeeded_repeatPromptAfterAssistant(t *testing.T) {
+	t.Parallel()
+	msgs := []adk.Message{
+		schema.UserMessage("扫描 example.com"),
+		schema.AssistantMessage("开始扫描...", nil),
+	}
+	out := appendUserMessageIfNeeded(msgs, "扫描 example.com")
+	if len(out) != 3 {
+		t.Fatalf("should append new user turn after assistant reply: len=%d", len(out))
+	}
+	if out[2].Role != schema.User || out[2].Content != "扫描 example.com" {
+		t.Fatalf("tail should be repeated user prompt, got role=%s content=%q", out[2].Role, out[2].Content)
+	}
+}

internal/multiagent/execute_exit_error.go

@@ -0,0 +1,15 @@
+package multiagent
+
+import "fmt"
+
+// ExecuteExitError 表示 execute 命令非零退出（预期失败，非超时/中断/流异常）。
+type ExecuteExitError struct {
+	Code int
+}
+
+func (e *ExecuteExitError) Error() string {
+	if e == nil {
+		return "exit status unknown"
+	}
+	return fmt.Sprintf("exit status %d", e.Code)
+}

internal/multiagent/gen_model_input.go

@@ -0,0 +1,23 @@
+package multiagent
+
+import (
+	"context"
+
+	"github.com/cloudwego/eino/adk"
+	"github.com/cloudwego/eino/schema"
+)
+
+// literalInstructionGenModelInput passes Instruction through as a system message without
+// FString template formatting. Eino defaultGenModelInput formats instruction whenever
+// SessionValues exist; prompts with literal curly braces (project blackboard "{关系边: ...}",
+// JSON examples, link syntax) then fail with "could not find key".
+//
+// Matches eino/adk/prebuilt/deep genModelInput — the supported fix per Eino docs.
+func literalInstructionGenModelInput(ctx context.Context, instruction string, input *adk.AgentInput) ([]adk.Message, error) {
+	msgs := make([]adk.Message, 0, len(input.Messages)+1)
+	if instruction != "" {
+		msgs = append(msgs, schema.SystemMessage(instruction))
+	}
+	msgs = append(msgs, input.Messages...)
+	return msgs, nil
+}

internal/multiagent/gen_model_input_test.go

@@ -0,0 +1,33 @@
+package multiagent
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/cloudwego/eino/adk"
+	"github.com/cloudwego/eino/schema"
+)
+
+func TestLiteralInstructionGenModelInput_PreservesLiteralCurlyBraces(t *testing.T) {
+	t.Parallel()
+	instruction := "- [finding/x] summary {关系边: discovered_on←target/dev}\n" +
+		"如 finding 上 {from:target/*, type:discovered_on}"
+	msgs, err := literalInstructionGenModelInput(context.Background(), instruction, &adk.AgentInput{
+		Messages: []adk.Message{schema.UserMessage("继续")},
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(msgs) != 2 {
+		t.Fatalf("expected 2 messages, got %d", len(msgs))
+	}
+	if msgs[0].Role != schema.System {
+		t.Fatalf("first message must be system, got %s", msgs[0].Role)
+	}
+	for _, want := range []string{"{关系边:", "{from:target/*, type:discovered_on}"} {
+		if !strings.Contains(msgs[0].Content, want) {
+			t.Fatalf("system content missing %q: %q", want, msgs[0].Content)
+		}
+	}
+}

internal/multiagent/hitl_middleware.go

@@ -3,7 +3,6 @@ package multiagent
 import (
 	"context"
 	"errors"
-	"fmt"
 	"strings"
 
 	"github.com/cloudwego/eino/adk"
@@ -75,8 +74,8 @@ func hitlInvokableToolCallMiddleware() compose.InvokableToolMiddleware {
 					if err != nil {
 						if IsHumanRejectError(err) {
 							// Human rejection should be a soft tool result so the model can continue iterating.
-							msg := fmt.Sprintf("[HITL Reject] Tool '%s' was rejected by human reviewer. Reason: %s\nPlease adjust parameters/plan and continue without this call.",
-								input.Name, strings.TrimSpace(err.Error()))
+							// tool_search 须保持 JSON，否则 Eino toolsearch 中间件解析历史时会硬崩 ChatModel。
+							msg := HitlRejectToolResult(input.Name, err.Error())
 							// transfer_to_agent 在 Eino 中标记为 returnDirectly：工具成功后 ReAct 子图会直接 END，
 							// 并依赖真实工具内的 SendToolGenAction 触发移交。HITL 拒绝时不会执行真实工具，
 							// 若仍走 returnDirectly 分支，监督者会在无 Transfer 动作的情况下结束，模型不再迭代。
@@ -103,8 +102,7 @@ func hitlStreamableToolCallMiddleware() compose.StreamableToolMiddleware {
 					edited, err := fn(ctx, input.Name, input.Arguments)
 					if err != nil {
 						if IsHumanRejectError(err) {
-							msg := fmt.Sprintf("[HITL Reject] Tool '%s' was rejected by human reviewer. Reason: %s\nPlease adjust parameters/plan and continue without this call.",
-								input.Name, strings.TrimSpace(err.Error()))
+							msg := HitlRejectToolResult(input.Name, err.Error())
 							hitlClearReturnDirectlyIfTransfer(ctx, input.Name)
 							return &compose.StreamToolOutput{
 								Result: schema.StreamReaderFromArray([]string{msg}),