refactor: 将客服后端重构为宿主可嵌入模块

- 注入数据库、运行时配置、统一响应、文件存储和平台 AI 能力，补充业务读写工具与客户快捷操作契约。

- 移除模块内重复的组织、客户、工单、标签、技能、旧工作流、MCP 和迁移实现，将身份权限与业务主体交由宿主管理。

- 使用 libSQL 重构向量存储，并完善图片消息、访客身份、排队调度、企业微信和支持聊天页面。

- 统一 HTTP、DTO 与 WebSocket 的 snake_case 协议，补齐模块初始化、业务动作和公共载荷等回归测试。

internal/ai/tooling/executor.go

@@ -1,67 +0,0 @@
-package tooling
-
-import (
-	"context"
-	"fmt"
-	"strings"
-	"time"
-
-	"code.tczkiot.com/wlw/ai-agent/internal/ai/mcps"
-	"code.tczkiot.com/wlw/ai-agent/internal/pkg/toolx"
-)
-
-// MCPExecutor is the single execution boundary for dynamically discovered
-// MCP tools. Engine adapters supply the policy for the current Agent run.
-type MCPExecutor struct {
-	registry *Registry
-	runtime  *mcps.RuntimeService
-}
-
-var DefaultMCPExecutor = NewMCPExecutor(DefaultRegistry, mcps.Runtime)
-
-func NewMCPExecutor(registry *Registry, runtime *mcps.RuntimeService) *MCPExecutor {
-	return &MCPExecutor{registry: registry, runtime: runtime}
-}
-
-func (e *MCPExecutor) Execute(ctx context.Context, toolCode string, arguments map[string]any, policy Policy) (Definition, *mcps.ToolCallResult, error) {
-	definition, err := e.registry.Resolve(toolCode)
-	if err != nil {
-		return Definition{}, nil, err
-	}
-	if err := DefaultPolicyGuard.Authorize(Invocation{Definition: definition, Arguments: arguments, Policy: policy}); err != nil {
-		return Definition{}, nil, err
-	}
-	serverCode, toolName := toolx.SplitMCPToolCode(strings.TrimSpace(definition.Code))
-	if serverCode == "" || toolName == "" {
-		return Definition{}, nil, &UnsupportedExecutionError{ToolCode: definition.Code}
-	}
-	if e.runtime == nil {
-		return Definition{}, nil, fmt.Errorf("MCP executor runtime is not configured")
-	}
-	if definition.TimeoutMS > 0 {
-		var cancel context.CancelFunc
-		ctx, cancel = context.WithTimeout(ctx, time.Duration(definition.TimeoutMS)*time.Millisecond)
-		defer cancel()
-	}
-	result, err := e.runtime.CallTool(ctx, serverCode, toolName, cloneArguments(arguments))
-	return definition, result, err
-}
-
-type UnsupportedExecutionError struct {
-	ToolCode string
-}
-
-func (e *UnsupportedExecutionError) Error() string {
-	return "tool is not executable through MCP: " + e.ToolCode
-}
-
-func cloneArguments(input map[string]any) map[string]any {
-	if len(input) == 0 {
-		return map[string]any{}
-	}
-	ret := make(map[string]any, len(input))
-	for key, value := range input {
-		ret[key] = value
-	}
-	return ret
-}

internal/ai/tooling/registry.go

@@ -32,14 +32,13 @@ type Definition struct {
 // Policy is supplied by the caller's agent/runtime context for one invocation.
 // An empty AllowedToolCodes means the caller did not impose an allow-list.
 type Policy struct {
-	AllowedToolCodes      []string
-	SkillAllowedToolCodes []string
-	AllowedRiskLevels     []string
-	CallCount             int
-	TotalCallCount        int
-	MaxTotalCalls         int
-	MaxArgumentBytes      int
-	Confirmed             bool
+	AllowedToolCodes  []string
+	AllowedRiskLevels []string
+	CallCount         int
+	TotalCallCount    int
+	MaxTotalCalls     int
+	MaxArgumentBytes  int
+	Confirmed         bool
 }
 
 type Invocation struct {
@@ -69,24 +68,7 @@ func (r *Registry) Resolve(toolCode string) (Definition, error) {
 	if spec, ok := toolx.GetRegisteredToolSpec(toolCode); ok {
 		return definitionFromSpec(spec), nil
 	}
-	serverCode, toolName := toolx.SplitMCPToolCode(toolCode)
-	if serverCode == "" || toolName == "" {
-		return Definition{}, fmt.Errorf("unsupported tool code: %s", toolCode)
-	}
-	// MCP tools are explicitly selected by an administrator before an Agent can
-	// call them. Treat that persisted allow-list as the authorization boundary;
-	// only tools with an explicit built-in policy require extra confirmation.
-	return Definition{
-		Code:                toolCode,
-		Name:                toolName,
-		InputSchema:         map[string]any{"type": "object", "additionalProperties": true},
-		SourceType:          enums.ToolSourceTypeMCP,
-		RiskLevel:           RiskLevelRead,
-		RequireConfirmation: false,
-		MaxCallsPerRun:      3,
-		TimeoutMS:           30000,
-		IdempotencyMode:     "caller",
-	}, nil
+	return Definition{}, fmt.Errorf("unsupported tool code: %s", toolCode)
 }
 
 func (r *Registry) Authorize(definition Definition, policy Policy) error {
@@ -102,9 +84,6 @@ func (g *PolicyGuard) Authorize(invocation Invocation) error {
 	if len(policy.AllowedToolCodes) > 0 && !containsCanonicalToolCode(policy.AllowedToolCodes, definition.Code) {
 		return fmt.Errorf("tool is not allowed: %s", definition.Code)
 	}
-	if len(policy.SkillAllowedToolCodes) > 0 && !containsCanonicalToolCode(policy.SkillAllowedToolCodes, definition.Code) {
-		return fmt.Errorf("tool is not allowed by the selected skill: %s", definition.Code)
-	}
 	if len(policy.AllowedRiskLevels) > 0 && !containsString(policy.AllowedRiskLevels, definition.RiskLevel) {
 		return fmt.Errorf("tool risk level is not allowed: %s", definition.RiskLevel)
 	}
@@ -147,37 +126,18 @@ func definitionFromSpec(spec toolx.ToolSpec) Definition {
 		definition.InputSchema = requiredObjectSchema([]string{"query"}, map[string]any{"query": map[string]any{"type": "string"}})
 	case toolx.GraphTriageServiceRequest.Code:
 		definition.InputSchema = objectSchema(map[string]any{
-			"goal":              map[string]any{"type": "string"},
-			"observedIssue":     map[string]any{"type": "string"},
-			"needTicket":        map[string]any{"type": "boolean"},
-			"needHumanHandoff":  map[string]any{"type": "boolean"},
-			"additionalContext": map[string]any{"type": "string"},
+			"goal":               map[string]any{"type": "string"},
+			"observed_issue":     map[string]any{"type": "string"},
+			"need_human_handoff": map[string]any{"type": "boolean"},
+			"additional_context": map[string]any{"type": "string"},
 		})
 	case toolx.GraphAnalyzeConversation.Code:
 		definition.InputSchema = objectSchema(map[string]any{
-			"goal":              map[string]any{"type": "string"},
-			"observedIssue":     map[string]any{"type": "string"},
-			"needTicket":        map[string]any{"type": "boolean"},
-			"needHumanHandoff":  map[string]any{"type": "boolean"},
-			"needQualityCheck":  map[string]any{"type": "boolean"},
-			"additionalContext": map[string]any{"type": "string"},
-		})
-	case toolx.GraphPrepareTicketDraft.Code:
-		definition.InputSchema = objectSchema(map[string]any{
-			"title":           map[string]any{"type": "string"},
-			"description":     map[string]any{"type": "string"},
-			"issue":           map[string]any{"type": "string"},
-			"impact":          map[string]any{"type": "string"},
-			"expectedOutcome": map[string]any{"type": "string"},
-			"currentAttempt":  map[string]any{"type": "string"},
-		})
-	case toolx.GraphCreateTicketConfirm.Code:
-		definition.RiskLevel = RiskLevelWrite
-		definition.RequireConfirmation = true
-		definition.MaxCallsPerRun = 1
-		definition.IdempotencyMode = "business"
-		definition.InputSchema = requiredObjectSchema([]string{"title", "description"}, map[string]any{
-			"title": map[string]any{"type": "string"}, "description": map[string]any{"type": "string"},
+			"goal":               map[string]any{"type": "string"},
+			"observed_issue":     map[string]any{"type": "string"},
+			"need_human_handoff": map[string]any{"type": "boolean"},
+			"need_quality_check": map[string]any{"type": "boolean"},
+			"additional_context": map[string]any{"type": "string"},
 		})
 	case toolx.GraphHandoffConversation.Code:
 		definition.RiskLevel = RiskLevelWrite

internal/ai/tooling/registry_test.go

@@ -7,34 +7,6 @@ import (
 	"code.tczkiot.com/wlw/ai-agent/internal/pkg/toolx"
 )
 
-func TestRegistryResolvesRegisteredToolPolicy(t *testing.T) {
-	definition, err := DefaultRegistry.Resolve(toolx.GraphCreateTicketConfirm.Code)
-	if err != nil {
-		t.Fatalf("Resolve returned error: %v", err)
-	}
-	if definition.RiskLevel != RiskLevelWrite || !definition.RequireConfirmation || definition.MaxCallsPerRun != 1 {
-		t.Fatalf("unexpected definition: %#v", definition)
-	}
-	if err := DefaultRegistry.Authorize(definition, Policy{AllowedToolCodes: []string{toolx.GraphCreateTicketConfirm.Code}}); err == nil {
-		t.Fatal("expected confirmation requirement")
-	}
-}
-
-func TestRegistryIncludesGraphInputSchemaAndRiskPolicy(t *testing.T) {
-	definition, err := DefaultRegistry.Resolve(toolx.GraphCreateTicketConfirm.Code)
-	if err != nil {
-		t.Fatalf("Resolve returned error: %v", err)
-	}
-	if definition.InputSchema["type"] != "object" || len(definition.InputSchema["required"].([]string)) != 2 {
-		t.Fatalf("unexpected graph schema: %#v", definition.InputSchema)
-	}
-	if err := DefaultPolicyGuard.Authorize(Invocation{Definition: definition, Policy: Policy{
-		AllowedToolCodes: []string{definition.Code}, AllowedRiskLevels: []string{RiskLevelRead}, Confirmed: true,
-	}}); err == nil || !strings.Contains(err.Error(), "risk level") {
-		t.Fatalf("expected risk policy rejection, got %v", err)
-	}
-}
-
 func TestRegistryRequiresConfirmationForHandoff(t *testing.T) {
 	definition, err := DefaultRegistry.Resolve(toolx.GraphHandoffConversation.Code)
 	if err != nil {
@@ -48,29 +20,9 @@ func TestRegistryRequiresConfirmationForHandoff(t *testing.T) {
 	}
 }
 
-func TestRegistryIncludesAllTicketDraftToolInputs(t *testing.T) {
-	definition, err := DefaultRegistry.Resolve(toolx.GraphPrepareTicketDraft.Code)
-	if err != nil {
-		t.Fatalf("Resolve returned error: %v", err)
-	}
-	properties, _ := definition.InputSchema["properties"].(map[string]any)
-	for _, key := range []string{"title", "description", "issue", "impact", "expectedOutcome", "currentAttempt"} {
-		if _, ok := properties[key]; !ok {
-			t.Fatalf("ticket draft schema missing %q: %#v", key, definition.InputSchema)
-		}
-	}
-}
-
-func TestRegistryTreatsAdministratorSelectedMCPToolsAsAllowedTools(t *testing.T) {
-	definition, err := DefaultRegistry.Resolve("knowledge/search")
-	if err != nil {
-		t.Fatalf("Resolve returned error: %v", err)
-	}
-	if definition.RiskLevel != RiskLevelRead || definition.RequireConfirmation {
-		t.Fatalf("unexpected MCP definition: %#v", definition)
-	}
-	if err := DefaultRegistry.Authorize(definition, Policy{AllowedToolCodes: []string{"knowledge/search"}, AllowedRiskLevels: []string{RiskLevelRead}}); err != nil {
-		t.Fatalf("Authorize returned error: %v", err)
+func TestRegistryRejectsUnregisteredDynamicTool(t *testing.T) {
+	if _, err := DefaultRegistry.Resolve("knowledge/search"); err == nil {
+		t.Fatal("expected unregistered dynamic tool to be rejected")
 	}
 }
 
@@ -91,19 +43,33 @@ func TestNormalizeCustomerReplyRejectsSecretAndNormalizesText(t *testing.T) {
 	}
 }
 
-func TestMCPExecutorAllowsSelectedToolThroughAuthorization(t *testing.T) {
-	executor := NewMCPExecutor(DefaultRegistry, nil)
-	_, _, err := executor.Execute(t.Context(), "knowledge/search", nil, Policy{
-		AllowedToolCodes:  []string{"knowledge/search"},
-		AllowedRiskLevels: []string{RiskLevelRead},
-	})
-	if err == nil || !strings.Contains(err.Error(), "runtime is not configured") {
-		t.Fatalf("expected authorization to pass before the missing runtime error, got %v", err)
+func TestNormalizeCustomerReplyRedactsRestrictedNetworkPolicy(t *testing.T) {
+	reply, err := NormalizeCustomerReply("剩余流量：10GB\n当前已限速至128kbps\n请重启设备后重试")
+	if err != nil {
+		t.Fatalf("NormalizeCustomerReply() error = %v", err)
+	}
+	if strings.Contains(reply, "限速") || strings.Contains(reply, "128kbps") {
+		t.Fatalf("restricted network policy leaked: %q", reply)
+	}
+	for _, expected := range []string{"剩余流量：10GB", "请重启设备后重试", restrictedNetworkPolicyFallback} {
+		if !strings.Contains(reply, expected) {
+			t.Fatalf("expected %q in sanitized reply: %q", expected, reply)
+		}
+	}
+}
+
+func TestNormalizeCustomerReplyHidesThrottlingDenial(t *testing.T) {
+	reply, err := NormalizeCustomerReply("当前没有限速。")
+	if err != nil {
+		t.Fatalf("NormalizeCustomerReply() error = %v", err)
+	}
+	if reply != restrictedNetworkPolicyFallback {
+		t.Fatalf("unexpected restricted-policy fallback: %q", reply)
 	}
 }
 
 func TestPolicyGuardRejectsTotalCallsAndOversizedArguments(t *testing.T) {
-	definition, err := DefaultRegistry.Resolve("knowledge/search")
+	definition, err := DefaultRegistry.Resolve(toolx.BuiltinKnowledgeRetrieve.Code)
 	if err != nil {
 		t.Fatalf("Resolve returned error: %v", err)
 	}
@@ -120,21 +86,3 @@ func TestPolicyGuardRejectsTotalCallsAndOversizedArguments(t *testing.T) {
 		t.Fatalf("expected argument size rejection, got %v", err)
 	}
 }
-
-func TestPolicyGuardRejectsToolOutsideSelectedSkillWhitelist(t *testing.T) {
-	definition, err := DefaultRegistry.Resolve("knowledge/search")
-	if err != nil {
-		t.Fatalf("Resolve returned error: %v", err)
-	}
-	err = DefaultPolicyGuard.Authorize(Invocation{
-		Definition: definition,
-		Policy: Policy{
-			AllowedToolCodes:      []string{"knowledge/search"},
-			SkillAllowedToolCodes: []string{"customer/profile"},
-			Confirmed:             true,
-		},
-	})
-	if err == nil || !strings.Contains(err.Error(), "selected skill") {
-		t.Fatalf("expected skill whitelist rejection, got %v", err)
-	}
-}

internal/ai/tooling/reply_safety.go

@@ -2,12 +2,17 @@ package tooling
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 	"unicode"
 )
 
 const maxCustomerReplyRunes = 8000
 
+const restrictedNetworkPolicyFallback = "当前网络状态请以实际使用情况为准。如无法联网，请使用“智能检测”或联系人工客服。"
+
+var restrictedNetworkPolicyPattern = regexp.MustCompile(`(?i)限速|降速|速率限制|带宽限制|speed[ _-]?limit|throttl|traffic[ _-]?shap|(?:^|[^a-z0-9])\d+(?:\.\d+)?\s*(?:k|m|g)?bps(?:[^a-z0-9]|$)`)
+
 // NormalizeCustomerReply applies the final plain-text boundary before an AI
 // response enters a customer conversation. It rejects likely credential
 // assignments instead of masking them, because a masked secret is not useful
@@ -31,6 +36,7 @@ func NormalizeCustomerReply(value string) (string, error) {
 	for strings.Contains(value, "\n\n\n") {
 		value = strings.ReplaceAll(value, "\n\n\n", "\n\n")
 	}
+	value = redactRestrictedNetworkPolicy(value)
 	if value == "" {
 		return "", fmt.Errorf("ai reply is empty")
 	}
@@ -39,3 +45,27 @@ func NormalizeCustomerReply(value string) (string, error) {
 	}
 	return value, nil
 }
+
+// redactRestrictedNetworkPolicy is a final customer-visible safety boundary.
+// The model may still ignore its system prompt, so any line that confirms,
+// denies, or quantifies an internal network speed policy is removed before the
+// message is persisted. Other useful lines are preserved.
+func redactRestrictedNetworkPolicy(value string) string {
+	if !restrictedNetworkPolicyPattern.MatchString(value) {
+		return value
+	}
+	lines := strings.Split(value, "\n")
+	safe := make([]string, 0, len(lines)+1)
+	redacted := false
+	for _, line := range lines {
+		if restrictedNetworkPolicyPattern.MatchString(line) {
+			redacted = true
+			continue
+		}
+		safe = append(safe, line)
+	}
+	if redacted {
+		safe = append(safe, restrictedNetworkPolicyFallback)
+	}
+	return strings.TrimSpace(strings.Join(safe, "\n"))
+}