ai-agent/internal/ai/tooling/reply_safety.go

package tooling

import (
	"fmt"
	"regexp"
	"strings"
	"unicode"
)

const maxCustomerReplyRunes = 8000

const restrictedNetworkPolicyFallback = "当前网络状态请以实际使用情况为准。如无法联网，请使用“智能检测”或联系人工客服。"

const restrictedICCIDFallback = "ICCID 属于系统内部标识，无法提供。"

var restrictedNetworkPolicyPattern = regexp.MustCompile(`(?i)限速|降速|速率限制|带宽限制|speed[ _-]?limit|throttl|traffic[ _-]?shap|(?:^|[^a-z0-9])\d+(?:\.\d+)?\s*(?:k|m|g)?bps(?:[^a-z0-9]|$)`)

var restrictedICCIDLabelPattern = regexp.MustCompile(`(?i)iccid|集成电路卡识别码|sim\s*卡序列号`)

// ICCIDs normally start with 89 and contain 18 to 22 digits. Allow common
// separators so Markdown emphasis or spaced formatting cannot bypass the
// customer-visible output boundary.
var restrictedICCIDNumberPattern = regexp.MustCompile(`\b89(?:[ \t._*-]*\d){16,20}\b`)

// NormalizeCustomerReply applies the final plain-text boundary before an AI
// response enters a customer conversation. It rejects likely credential
// assignments instead of masking them, because a masked secret is not useful
// customer-facing content.
func NormalizeCustomerReply(value string) (string, error) {
	value = strings.TrimSpace(value)
	if value == "" {
		return "", fmt.Errorf("ai reply is empty")
	}
	if secretAssignmentPattern.MatchString(value) {
		return "", fmt.Errorf("ai reply contains sensitive credential data")
	}
	var builder strings.Builder
	for _, r := range value {
		if (unicode.IsControl(r) && r != '\n' && r != '\t') || unicode.In(r, unicode.Cf) {
			continue
		}
		builder.WriteRune(r)
	}
	value = strings.TrimSpace(builder.String())
	for strings.Contains(value, "\n\n\n") {
		value = strings.ReplaceAll(value, "\n\n\n", "\n\n")
	}
	value = redactRestrictedNetworkPolicy(value)
	value = RedactRestrictedICCID(value)
	if value == "" {
		return "", fmt.Errorf("ai reply is empty")
	}
	if len([]rune(value)) > maxCustomerReplyRunes {
		return "", fmt.Errorf("ai reply exceeds maximum length")
	}
	return value, nil
}

// ContainsRestrictedICCID reports whether text contains an ICCID label or a
// value shaped like an ICCID. Callers use it to keep internal identity values
// out of prompts and automatic customer messages as well as AI replies.
func ContainsRestrictedICCID(value string) bool {
	return restrictedICCIDLabelPattern.MatchString(value) || restrictedICCIDNumberPattern.MatchString(value)
}

// RedactRestrictedICCID removes labelled ICCID lines and hides bare ICCID
// values. A fixed explanation is appended whenever anything was removed.
func RedactRestrictedICCID(value string) string {
	if !ContainsRestrictedICCID(value) {
		return value
	}
	lines := strings.Split(value, "\n")
	safe := make([]string, 0, len(lines)+1)
	redacted := false
	for _, line := range lines {
		if restrictedICCIDLabelPattern.MatchString(line) {
			redacted = true
			continue
		}
		cleaned := restrictedICCIDNumberPattern.ReplaceAllString(line, "[内部标识已隐藏]")
		if cleaned != line {
			redacted = true
		}
		safe = append(safe, cleaned)
	}
	if redacted {
		safe = append(safe, restrictedICCIDFallback)
	}
	return strings.TrimSpace(strings.Join(safe, "\n"))
}

// redactRestrictedNetworkPolicy is a final customer-visible safety boundary.
// The model may still ignore its system prompt, so any line that confirms,
// denies, or quantifies an internal network speed policy is removed before the
// message is persisted. Other useful lines are preserved.
func redactRestrictedNetworkPolicy(value string) string {
	if !restrictedNetworkPolicyPattern.MatchString(value) {
		return value
	}
	lines := strings.Split(value, "\n")
	safe := make([]string, 0, len(lines)+1)
	redacted := false
	for _, line := range lines {
		if restrictedNetworkPolicyPattern.MatchString(line) {
			redacted = true
			continue
		}
		safe = append(safe, line)
	}
	if redacted {
		safe = append(safe, restrictedNetworkPolicyFallback)
	}
	return strings.TrimSpace(strings.Join(safe, "\n"))
}