tmp

agent/bots/bot-escort-admin/agent.js

@@ -1,20 +1,24 @@
 import 'dotenv/config';
-import { createDeepAgent, FilesystemBackend } from "deepagents";
-import { AIMessageChunk, ToolMessage } from "langchain";
+import { createDeepAgent } from "deepagents";
+import { AIMessageChunk, ToolMessage, todoListMiddleware } from "langchain";
 import { HumanMessage } from "@langchain/core/messages";
 import { ChatDeepSeek } from "@langchain/deepseek";
-import config from '../../conf.json' with { type: 'json' };
-import logger from '../../utils/logger.js';
+import config from '../../../conf.json' with { type: 'json' };
+import logger from '../../../utils/logger.js';
+import { createRestrictedBackend } from "../../infra/restricted_fs_backend.js";
 
 // 密钥由 conf.json 统一提供；百度地图 skill 通过 env_get 读环境变量，此处桥接
 process.env.TAVILY_API_KEY ??= config.agent.tavily?.apiKey;
 process.env.BAIDU_MAP_AUTH_TOKEN ??= config.agent.baiduMap?.authToken;
 import EscortAdminPrompts from "./prompts.js";
+import { createPatientRecordSubagent } from "../../subagent/patient_record.js";
+import { createResearchSubagent } from "../../subagent/research.js";
+import { createHospitalInfoSubagent } from "../../subagent/hospital_info.js";
 import {
     getEnvTool, webFetchTool, webSearchTool, getCalendarInfoTool,
     getLunarCalendarInfoTool, getYearHolidaysTool, getYearTermsTool, getLatLngTool,
     httpGetTool, httpPostTool, escortRecordQueryTool, escortRecordSetTool
-} from "./tools/index.js";
+} from "../../infra/tools/index.js";
 
 export default class EscortAdminAgent {
     constructor() {
@@ -126,7 +130,8 @@ export default class EscortAdminAgent {
 
     _genAgent(userInfo) {
         const rootDir = process.cwd();
-        const backend = new FilesystemBackend({ rootDir });
+        // 受限后端：锁定沙箱根并禁止读取 conf.json/.env/logs 及用户数据目录
+        const backend = createRestrictedBackend({ rootDir, dataDir: config.agent.dataDir });
 
         this.flashModel = new ChatDeepSeek({
             model: config.agent.deepseek.flashModel,
@@ -139,31 +144,16 @@ export default class EscortAdminAgent {
             temperature: 0.3
         });
 
-        const escortRecordOperSubagent = {
-            name: "escort-record-oper-subagent",
-            description: "查询和设置陪诊预约记录",
-            systemPrompt: "根据用户指令，调用工具完成查询和设置陪诊记录。",
-            model: this.flashModel,
-            tools: [escortRecordQueryTool, escortRecordSetTool],
-        };
-
-        const escortResearchSubagent = {
-            name: "escort-research-subagent",
-            description: "陪诊（陪同就医）行业问题研究和解答",
-            systemPrompt: "你是陪诊（陪同就医）行业政策、发展趋势、行业知识研究和解答专家。",
-            model: this.proModel,
-            tools: [webFetchTool, webSearchTool],
-        };
-
         return createDeepAgent({
             name: "deep-agent",
             model: this.flashModel,
             systemPrompt: EscortAdminPrompts.buildSystemPrompt(userInfo),
             backend,
+            middleware: [todoListMiddleware()], // deepagents 1.12 起 todo 计划工具改为显式开启，多步记录操作用
             tools: [getEnvTool, webFetchTool, webSearchTool, getLatLngTool, httpGetTool, httpPostTool,
                 getCalendarInfoTool, getLunarCalendarInfoTool, getYearHolidaysTool, getYearTermsTool,
                 escortRecordQueryTool, escortRecordSetTool],
-            subagents: [escortRecordOperSubagent, escortResearchSubagent]
+            subagents: [createPatientRecordSubagent(this.flashModel), createResearchSubagent(this.proModel), createHospitalInfoSubagent(this.flashModel)]
         });
     }
 }

agent/bots/bot-escort-admin/prompts.js

@@ -1,5 +1,5 @@
-import services from "../../resource/services.js";
-import agreement from "../../resource/agreement.js";
+import services from "../../../resource/services.js";
+import agreement from "../../../resource/agreement.js";
 
 class EscortAdminPrompts {
   static buildSystemPrompt(userInfo) {