Files
goclaw/internal/agent/systemprompt_bootstrap_test.go
T
90e7035100 fix(mcp): tenant isolation, tool policy engine, and prompt preview fixes (#1333)
* fix(prompt): remove duplicate Team Members section from system prompt

The TEAM.md context file already provides the Members section with better
formatting. The system prompt section was redundant and inconsistently
formatted.

- Remove buildTeamMembersSection() call from system prompt building
- Remove unused buildTeamMembersSection() function

* fix(mcp): wire store to manager for prompt preview tool visibility

MCP manager needs database access to query configured servers for tool visibility
in prompt preview.

- Add SetStore() method to MCP manager
- Wire pgStores.MCP to manager after initialization
- Add debug logging for MCP initialization flow

* fix(systemprompt): hide Tooling section when agent has no tools

The Tooling section header and boilerplate were displayed even when the
agent had no tools available. Add early return in buildToolingSection()
to skip the section entirely when toolNames is empty.

This reduces prompt noise for agents with no tool access.

* feat(mcp): cache tool descriptions for prompt preview visibility

MCP tools now show descriptions in prompt preview without requiring a live
server connection.

- Add CacheToolDescriptions() method to MCPServerStore (PG + SQLite)
- Cache tool descriptions in settings['tool_cache'] when server connects
- Use cached descriptions in ListToolsForAgent (fallback: hints → cache → global)
- Descriptions are auto-populated from live server manifest on connection
- Admins can still override via tool_hints in server settings

* test(mcp): add CacheToolDescriptions to MCPServerStore test fakes

Commit 5ce410b6 added CacheToolDescriptions() to the MCPServerStore
interface but missed updating test mock implementations, breaking
go vet across internal/mcp, internal/agent, internal/http, and
internal/channels/bitrix24.

Add no-op implementations matching each fake's existing style.

* fix(providers): enforce per-agent tool policy for Claude CLI provider

The Claude CLI provider (stdio+MCP bridge) was not enforcing per-agent
tool policy, unlike other providers where the policy-filtered tool list
already drives the system prompt's Tooling section.

Two gaps closed:

1. --disallowedTools was previously skipped entirely when no MCP config
   path was resolved, letting the CLI subprocess run with its full
   native toolset (Bash, Edit, Read, Write, Glob, Grep, WebFetch,
   WebSearch) regardless of agent policy. It's now unconditional and
   derived from the agent's actual allowed-tools list (state.Tool.AllowedTools),
   mapped to Claude CLI's native tool names.

2. The MCP bridge server executed any tool call without checking the
   calling agent's policy. It now resolves the agent's policy from
   context (via the existing HMAC-verified agent lookup) and denies
   calls to tools outside that agent's allowed set, logging
   security.mcp_bridge_denied on denial.

Both gaps were closed using existing plumbing (PolicyEngine.WouldAllow,
AgentData.ParseToolsConfig, the bridge context middleware) — no new
cross-cutting mechanism was introduced.

* feat(web): show MCP/tool schemas in system prompt preview dialog

The prompt-preview API response includes a separate `tools` field
(the actual JSON schemas sent to the LLM as the tools API parameter)
alongside `prompt` (the system prompt text), but the web UI only
rendered `prompt`, silently dropping the tools list.

Add a collapsible Tools section to both the full-screen System Prompt
dialog and the inline agent-detail preview, showing tool count, name,
description, and expandable parameter schema per tool. i18n keys added
to en/vi/zh locales.

* fix(prompt): render pinned skills on bootstrap turns

Pinned skills are documented (web UI copy) as "always inlined in the
system prompt", but the entire Skills section was gated behind
!cfg.IsBootstrap, so pinned skill XML never appeared on bootstrap
turns (first message of a session) despite the promise.

Separate pinned-skill rendering from bootstrap-suppressed guidance:
- Bootstrap + pinned skills present: render pinned XML only, no
  search/manage guidance (which stays suppressed as before)
- Non-bootstrap: unchanged behavior
- Minimal/none modes: pinned skills always render regardless of
  bootstrap state

Add regression tests covering all four prompt modes on bootstrap
turns, plus a non-bootstrap guard confirming existing behavior is
preserved.

* fix(skills): resolve managed skills directory per-tenant, not master-only

skills.Loader was wired at startup to scan a single fixed directory
(the master tenant's managed-skills dir), making any skill belonging
to a non-master tenant invisible to both pinned-skills prompt
resolution and skill_search/use_skill, regardless of DB visibility
settings.

- Loader now resolves the calling tenant's managed-skills directory
  per-call via context (store.TenantIDFromContext), never enumerating
  other tenants' directories
- Skill cache is now tenant-keyed to prevent slug collisions and
  cross-tenant cache leaks across tenants using the same skill slug
- gateway_setup.go passes the root data dir instead of a pre-resolved
  master-tenant path

Write-side tooling (skill_manage, publish_skill) was already correctly
tenant-scoped per-operation — no changes needed there.

Added TestLoader_ManagedSkills_TenantIsolation proving two tenants
with same-slug/different-content skills never see each other's
content, including after cache population from a different tenant's
lookup.

Known follow-up (not in this commit): skill_search's BM25 index is
still a single process-global index shared across tenants, which is
a related but separate cross-tenant search-result leak requiring its
own scoped fix (per-tenant index maps + threading tenant context
through ensureIndex/rebuildIndex).

* fix(tools): scope skill_search BM25 index per-tenant

SkillSearchTool held a single process-global BM25 index built once
from whichever tenant's context first triggered ensureIndex, then
reused for all subsequent Execute() calls regardless of caller —
leaking one tenant's skill search results into another's, the
search-path counterpart to the managed-directory bug fixed in
7b4668ad.

- index/lastVersion are now keyed per-tenant (map[uuid.UUID]*tenantIndexState)
- ensureIndex resolves the calling tenant from context and only
  builds/reads that tenant's index entry, never touching another
  tenant's cached state
- Builtin/bundled skills remain visible in every tenant's index
  (Loader already merges those tiers correctly per 7b4668ad)

Loader.Version() remains a single global counter — a version bump in
one tenant causes unnecessary rebuilds in others but does not cause
cross-tenant leakage, an acceptable tradeoff to avoid scope creep.

Added TestSkillSearchTool_TenantIsolation proving two tenants with
same-slug/different-content skills never see each other's search
results, including after cache population from a different tenant.

* fix(tools): fix group-spec expansion in tool policy engine

PolicyEngine.registry was only ever set via SetRegistry(), which was
never called in production (only in one test) — so pe.registry was
permanently nil in production. Every group-expansion helper
(applyProfile, intersectWithSpec, unionWithSpec, subtractSpec,
expandSpec, matchDenySpec, filterByCapability) silently dropped any
"group:*" spec entry instead of expanding it when registry was nil.

Concretely: "group:mcp" (auto-injected into agentToolPolicy.AlsoAllow
for any agent with MCP tools) never resolved to real tool names, so
MCP tools connected successfully and appeared in prompt text (which
reads the registry directly, bypassing PolicyEngine) but were never
included in the actual ChatRequest.Tools payload sent to the LLM —
confirmed live via mcp.agent.tools_loaded tools=6 immediately followed
by mcp.filtered_tools mcp_defs_count=0 in the same request. This
affects any agent relying on group-based grants, not just MCP.

PolicyEngine is a shared/global singleton used concurrently across
all agents (constructed once at gateway startup), so mutating a
registry field per-call would be a data race. Fix instead threads the
registry as an explicit parameter from FilterTools down through all
internal group-expansion helpers, and adds IsDenied/WouldAllow
registry parameters, removing the dead SetRegistry() mechanism
entirely.

Also fixes group expansion for the per-user-MCP-tools path: FilterTools
is sometimes called with a userToolOverlay wrapping a *Registry rather
than a *Registry directly; added Unwrap() to userToolOverlay so the
new registry-resolution logic works for both cases.

Added 4 tests proving group expansion works via the threaded parameter
alone (no SetRegistry): plain registry allow, userToolOverlay allow,
deny-side group expansion, and the WouldAllow bridge-server path.

Blast radius note: this restores intended access for every agent
configured with group:* specs (group:mcp, group:vault, group:goclaw,
group:coding, etc.) that were silently inert before. Existing agent
configs relying on group grants will gain the tool access they were
nominally already configured for.

* fix(mcp): cache tool descriptions from pool-connected servers too

5ce410b6 added tool-description caching (for prompt-preview visibility)
only inside connectServer. connectViaPool — the separate connect path
used when MCP connections go through the shared pool — never got the
same caching hook, even though it shares the same underlying
connectAndDiscover wire handshake.

Confirmed live: cloudflare/docker connected via connectViaPool and
received real descriptions over the wire, but prompt preview still
showed blank descriptions because this path never wrote to the cache.

Also removes the temporary mcp.connect.raw_tool debug log added
earlier this session for diagnosing the same issue — no longer needed
now that the root cause is fixed.

* chore(skills): remove temporary pinned-skills diagnostic logging

Confirmed live: pinned skills (caveman, infra-ansible-knowledge) now
resolve correctly end-to-end for tenant-scoped agents. Debug logging
added to trace the resolution chain is no longer needed.

* fix(tools): deny always wins over AlsoAllow group grants

AlsoAllow's unionWithSpec could reintroduce a tool explicitly listed
in Deny, since it added tools back from allTools without re-checking
deny specs. Previously masked because AlsoAllow's group-expansion was
also broken (fixed in f7af95de this session) — group specs silently
expanded to nothing, so this ordering bug never manifested. Now that
group expansion works, an admin-denied tool that's also reachable via
a group:* AlsoAllow entry (e.g. group:mcp) would silently reappear.

Re-apply deny-spec subtraction as a final step after AlsoAllow union,
for both global and per-agent policy, so deny always wins regardless
of which allow mechanism tries to add a tool back.

Added tests proving global and per-agent Deny correctly override an
overlapping AlsoAllow group grant, while sibling non-denied tools in
the same group remain allowed.

* fix(mcp): enumerate cached tools instead of wildcard placeholder in prompt preview

ListToolsForAgent (the prompt-preview path) collapsed any server with
an empty ToolAllow (unrestricted grant — the common case) into a
single "server__*" placeholder entry, even when tool_cache already
had every real tool name and description from connect time (5ce410b6,
8ffd67b9). This meant agents with unrestricted MCP server access never
saw individual tool names or descriptions in prompt preview, forcing
trial-and-error tool usage.

When ToolAllow is empty and tool_cache is populated, enumerate every
cached tool (skipping any explicitly denied) and emit one
MCPToolPreviewInfo per tool, matching the construction logic already
used for the ToolAllow-non-empty case. Falls back to the single
placeholder only when tool_cache is also empty (server never
connected).

The live (non-preview) conversation path, buildMCPToolDescs, does not
have this bug — it resolves tool identity from the live connected
registry, never from ToolAllow, so no placeholder shortcut exists
there.

Added tests covering both the cache-populated enumeration case and
the no-cache placeholder fallback.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* fix(prompt): filter alias re-injection and add MCP schemas to preview ToolDefs

Prompt-preview's tools: schema array (PreviewResult.ToolDefs) had two
bugs, both preview-only — confirmed live conversations already use
correctly-filtered tool payloads via buildToolsPayload/PolicyEngine.FilterTools,
unaffected by either bug:

1. Alias re-injection iterated ALL registry aliases globally with no
   check against the deny-filtered toolNames list, letting denied
   tools reappear via their alias name (e.g. a denied canonical tool
   still showing up as its Claude-Code-compat alias like Bash/Edit/Write/Read).
   Now skips any alias whose canonical tool isn't in the filtered set.

2. MCP tool descriptions (from the store-based, connection-free
   ListToolsForAgent path) only ever fed the prompt TEXT section,
   never got converted into ToolDefinition schema objects — so the
   tools: array never showed MCP tools at all, even when the MCP
   section of the prompt text correctly listed them. Now appends a
   ToolDefinition per MCP tool with name+description populated and a
   placeholder {"type":"object"} Parameters schema, documented as
   preview-only (real parameter schemas require a live MCP connection,
   only available during an actual conversation turn).

Added tests proving denied-tool-alias exclusion and MCP tool inclusion
in preview ToolDefs.

* feat(skills): inline full content for pinned skills instead of pointer-only

Web UI documented "Pinned skills are always inlined in the system
prompt", but BuildPinnedSummary was just BuildSummary with an
allowlist filter — same as the general searchable skill list:
name/description(truncated)/location pointer only, requiring
use_skill+read_file round trips to get actual content. No code path
inlined real SKILL.md content for pinned skills specifically.

BuildPinnedSummary now reads and inlines full SKILL.md content
(frontmatter stripped) per pinned skill inside <skill_instructions>
tags. Per-skill (10000 bytes) and total (30000 bytes) size caps fall
back to the original pointer-only format with a note when a skill is
too large to inline, so oversized skills degrade gracefully instead
of blowing the prompt budget.

Added tests: full-content inlining, size-cap fallback, and tenant
isolation for the new inline path (mirroring the existing managed-
skills tenant isolation test).

* fix(mcp): real parameter schemas and full policy enforcement in prompt preview

Three interconnected fixes to prompt preview, none affecting the live
conversation path (which was already correct):

1. Real MCP parameter schemas instead of a useless empty placeholder.
   tool_cache previously stored only name+description; extended to
   also capture the real JSON Schema from the MCP server's tools/list
   response (CachedToolInfo{Description, Parameters}) at connect time,
   for both direct-connect and pool-connect paths. Preview now shows
   complete, real input schemas instead of {"type":"object"} with no
   properties — verified against actual wire data from a live
   cloudflare MCP server showing genuinely rich schemas (zone_id,
   type, name, content, ttl, proxied, all typed with descriptions and
   correct required arrays) that were previously being discarded.
   Backward-compatible: old-shape cache entries degrade gracefully to
   description-only rather than crashing, self-healing on next
   connect.

2. Global tool deny now enforced in preview. BuildPreviewPrompt
   previously hand-rolled a partial policy reimplementation
   (per-agent deny only, explicitly skipping the full PolicyEngine
   "because runtime state isn't available in preview") — but
   PolicyEngine.WouldAllow already handles this per-tool-name without
   needing channel context. A tool denied via the global config (not
   per-agent) would appear in preview despite being correctly denied
   in every real conversation. Preview now calls WouldAllow per
   candidate tool, with a graceful per-agent-deny-only fallback when
   no PolicyEngine is wired (e.g. in tests).

3. MCP tools now also subject to the same policy check — previously
   the MCP tool supplement (store-based, connection-free tool listing)
   added MCP tool names unconditionally, bypassing WouldAllow entirely,
   so a denied MCP tool could still appear in preview.

Added tests for all three: real-schema presence, global-deny exclusion
for both core and MCP tools, and backward-compat cache handling.

* fix(prompt): remove redundant per-tool MCP enumeration from prompt text

Now that MCP tool schemas in the tools: API parameter are real and
complete (1290d4f1), the ## MCP Tools prompt-text section's per-tool
"- mcp_x__y: description" enumeration is pure duplication with zero
added value — the model already gets each tool's real schema
(including description) via tools:.

buildMCPToolsInlineSection now keeps only the behavioral instructions
that aren't expressible via JSON schema and thus aren't duplicated:
prefer-MCP-over-core-tools guidance, and the optional-parameter
guidance (don't guess/fill optional fields). The per-tool name+
description enumeration loop is removed. Section still only appears
when the agent has MCP tools (len(cfg.MCPToolDescs) > 0, unchanged
gate).

Updated tests to assert the enumeration is gone while the behavioral
instructions remain; ToolDefs assertions are now the authoritative
check for MCP tool allow/deny filtering behavior (prompt text no
longer enumerates names at all).

* test(agent): update TeamContextInjection test for removed Team Members section

TestBuildSystemPrompt_TeamContextInjection asserted the presence of a
'Team Members' prompt-text section that was intentionally removed in
71d33180 (duplicate of the canonical TEAM.md-context-file Members
section, which has better formatting). The test was never updated to
match, causing it to fail on every run since. Moved the assertion
from wantIn to wantNotIn for the 3 affected subtests -- BuildSystemPrompt
correctly no longer renders team-member roster info directly; that
info now comes exclusively from the TEAM.md context-file mechanism,
outside this test's isolated scope.

* fix(prompt): resolve real registry for WouldAllow calls in preview

BuildPreviewPrompt's two WouldAllow calls hardcoded reg=nil, silently
breaking group:* expansion (e.g. group:mcp) needed to resolve the
AlsoAllow grant production actually uses to grant MCP tool access
(resolver_helpers.go's agentToolPolicyWithMCP injects
AlsoAllow: ["group:mcp"]). With reg=nil, WouldAllow could match
literal tool names fine (the 18 core/static tools) but could never
resolve group-based grants, so every MCP tool silently failed
WouldAllow and was excluded from preview -- confirmed live via curl:
18 tools returned, zero mcp_* ones, for an agent with genuinely
working MCP access in real conversations.

Live conversations were never affected -- internal/mcp/bridge_server.go's
WouldAllow call already correctly passes a real registry.

Fix resolves a real *tools.Registry from deps.ToolLister via
tools.ResolveConcreteRegistry (the same helper used at the live call
site), passing it to both WouldAllow calls instead of nil. Falls back
to nil gracefully for test mocks that don't implement the full
ToolExecutor interface, preserving existing test behavior.

Added a test proving an MCP tool granted via the exact production
AlsoAllow: ["group:mcp"] pattern is now correctly included in preview
ToolDefs, where the old reg=nil bug would have silently excluded it.

* fix(prompt): use literal deny check for MCP tools in preview, not group expansion

The MCP-tools policy gate added in 1290d4f1 called WouldAllow with a
real registry (per 9b5fd2eb), which requires group:mcp expansion
against that registry to grant access via the production
AlsoAllow: ["group:mcp"] pattern. But MCP tools are only ever
registered into ephemeral per-agent registry clones at live connection
time (manager_connect.go) -- never into the shared/global registry
preview uses. group:mcp always resolved empty in preview's
connection-free context, so WouldAllow denied every MCP tool --
confirmed live via tool-name diff: live conversations correctly
included all 6 MCP tools, preview included zero.

MCP access-granting is already correctly handled by
ListToolsForAgent's own per-server tool_allow/tool_deny grant logic
(confirmed working correctly earlier this session). The preview gate
only needs to catch the narrower case of a literally-denied tool name
via global/per-agent policy config -- it never needed group
expansion. Replaced WouldAllow with IsDenied(nil, name, agentPolicy),
which forces a pure literal-name match with zero registry dependency,
matching the existing usage pattern already established elsewhere in
policy.go. This class of bug cannot recur: there's no registry-passing
code path left in this check to silently reintroduce group-expansion
dependence.

Added a test proving MCP tool inclusion in preview is independent of
group-expansion outcome (no AlsoAllow: group:mcp needed for a
non-denied tool to appear).

Also reverts the temporary loop.filtered_tool_names/
preview_prompt.filtered_tool_names diagnostic logging used to capture
the live-vs-preview tool-name comparison that diagnosed this bug.

* fix(http): preserve real MCP parameter schemas through HTTP preview adapter

mcpPreviewAdapter.ListToolsForAgent (the HTTP-layer glue converting
mcp.MCPToolPreviewInfo to agent.MCPToolPreviewInfo for BuildPreviewPrompt)
only copied RegisteredName and Description, silently dropping
Parameters -- a bug present since this adapter was introduced
(2499d0be/7e250244), unrelated to today's other MCP preview fixes.

This was masked until d5fc6344 fixed MCP tools being excluded from
preview entirely (a separate bug) -- once MCP tools started appearing
again, this pre-existing adapter gap became visible: tools showed up
correctly, but always with the bare {"type":"object"} placeholder
instead of their real cached schema (confirmed live: update_dns_record
missing its 7 real properties).

One-line fix: copy Parameters through in the adapter's struct literal.

Added a regression test constructing a real *mcp.Manager with
populated tool_cache, asserting the adapter's output preserves
specific real schema properties (not just non-nil Parameters) --
verified this test fails without the fix and passes with it.

---------

Co-authored-by: Bruno Clermont <bruno.clermont@gmail.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-03 08:25:05 +07:00

326 lines
10 KiB
Go

package agent
import (
"strings"
"testing"
"github.com/nextlevelbuilder/goclaw/internal/bootstrap"
"github.com/nextlevelbuilder/goclaw/internal/store"
)
// TestBuildSystemPrompt_BootstrapStates verifies the 4 bootstrap states
// produce the correct system prompt sections.
func TestBuildSystemPrompt_BootstrapStates(t *testing.T) {
blankUserMD := "# USER.md\n\n- **Name:**\n- **Language:**\n- **Timezone:**\n"
populatedUserMD := "# USER.md\n\n- **Name:** Alice\n- **Language:** English\n- **Timezone:** UTC+7\n"
tests := []struct {
name string
cfg SystemPromptConfig
wantIn string // substring that MUST appear
wantNotIn string // substring that MUST NOT appear (empty = skip check)
}{
{
name: "open agent with BOOTSTRAP.md → FIRST RUN slim mode",
cfg: SystemPromptConfig{
IsBootstrap: true,
AgentType: store.AgentTypeOpen,
ContextFiles: []bootstrap.ContextFile{
{Path: bootstrap.BootstrapFile, Content: "# BOOTSTRAP"},
{Path: bootstrap.UserFile, Content: blankUserMD},
},
ToolNames: []string{"write_file", "Write"},
},
wantIn: "## FIRST RUN",
wantNotIn: "USER PROFILE INCOMPLETE",
},
{
name: "predefined agent with BOOTSTRAP.md → FIRST RUN full capabilities",
cfg: SystemPromptConfig{
IsBootstrap: false,
AgentType: store.AgentTypePredefined,
ContextFiles: []bootstrap.ContextFile{
{Path: bootstrap.BootstrapFile, Content: "# BOOTSTRAP"},
{Path: bootstrap.UserFile, Content: blankUserMD},
},
ToolNames: []string{"write_file", "Write", "skill_search"},
},
wantIn: "## FIRST RUN",
wantNotIn: "USER PROFILE INCOMPLETE",
},
{
name: "no BOOTSTRAP.md + blank USER.md → USER PROFILE INCOMPLETE",
cfg: SystemPromptConfig{
IsBootstrap: false,
AgentType: store.AgentTypePredefined,
ContextFiles: []bootstrap.ContextFile{
{Path: bootstrap.UserFile, Content: blankUserMD},
},
ToolNames: []string{"write_file"},
},
wantIn: "## USER PROFILE INCOMPLETE",
wantNotIn: "FIRST RUN",
},
{
name: "no BOOTSTRAP.md + populated USER.md → no nudge at all",
cfg: SystemPromptConfig{
IsBootstrap: false,
AgentType: store.AgentTypePredefined,
ContextFiles: []bootstrap.ContextFile{
{Path: bootstrap.UserFile, Content: populatedUserMD},
},
ToolNames: []string{"write_file"},
},
wantNotIn: "FIRST RUN",
},
{
name: "open agent slim mode has write_file note",
cfg: SystemPromptConfig{
IsBootstrap: true,
AgentType: store.AgentTypeOpen,
ContextFiles: []bootstrap.ContextFile{
{Path: bootstrap.BootstrapFile, Content: "# BOOTSTRAP"},
},
ToolNames: []string{"write_file"},
},
wantIn: "only have write_file available",
},
{
name: "predefined agent first run uses softened get-to-know copy",
cfg: SystemPromptConfig{
IsBootstrap: false,
AgentType: store.AgentTypePredefined,
ContextFiles: []bootstrap.ContextFile{
{Path: bootstrap.BootstrapFile, Content: "# BOOTSTRAP"},
},
ToolNames: []string{"write_file", "web_search"},
},
wantIn: "GET TO KNOW THE USER",
wantNotIn: "only have write_file available",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
prompt := BuildSystemPrompt(tt.cfg)
if tt.wantIn != "" && !strings.Contains(prompt, tt.wantIn) {
t.Errorf("expected %q in system prompt, got:\n%s", tt.wantIn, prompt[:min(len(prompt), 500)])
}
if tt.wantNotIn != "" && strings.Contains(prompt, tt.wantNotIn) {
t.Errorf("unexpected %q in system prompt", tt.wantNotIn)
}
// Always verify: populated USER.md must never trigger INCOMPLETE
if tt.name == "no BOOTSTRAP.md + populated USER.md → no nudge at all" {
if strings.Contains(prompt, "USER PROFILE INCOMPLETE") {
t.Error("populated USER.md should not trigger USER PROFILE INCOMPLETE")
}
}
})
}
}
// TestBuildSystemPrompt_PredefinedBootstrapSoftened verifies that the
// predefined+BOOTSTRAP.md branch no longer forces write_file on turn 1.
// Context: Gemini 3 with thinking_level=low exhausted its 8192-token budget
// before emitting tool args, resulting in write_file({}) → HTTP 400.
// Removing the MUST-call-write_file-this-turn mandate lets small models
// respond conversationally when they lack real user info to write.
// Trace: 019d8f33-2de1-7ab2-9a32-9df92cd610dd.
func TestBuildSystemPrompt_PredefinedBootstrapSoftened(t *testing.T) {
baseCfg := func(channel string) SystemPromptConfig {
return SystemPromptConfig{
IsBootstrap: false,
AgentType: store.AgentTypePredefined,
Channel: channel,
ContextFiles: []bootstrap.ContextFile{
{Path: bootstrap.BootstrapFile, Content: "# BOOTSTRAP"},
},
ToolNames: []string{"write_file", "web_search"},
}
}
tests := []struct {
name string
cfg SystemPromptConfig
wantIn []string
wantNotIn []string
}{
{
name: "A: ws channel uses softened copy",
cfg: baseCfg("ws"),
wantIn: []string{
"GET TO KNOW THE USER",
},
wantNotIn: []string{
"before your response ends",
"MUST ALSO call write_file",
},
},
{
name: "B: forbids empty/placeholder args explicitly",
cfg: baseCfg("ws"),
wantIn: []string{
"Do NOT call write_file",
"empty or placeholder",
},
},
{
name: "C: forbids session-identifier content",
cfg: baseCfg("ws"),
wantIn: []string{
"never copy session identifiers",
},
},
{
name: "D: telegram channel uses same softened copy (uniform)",
cfg: baseCfg("telegram"),
wantIn: []string{
"GET TO KNOW THE USER",
},
wantNotIn: []string{
"before your response ends",
"MUST ALSO call write_file",
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
prompt := BuildSystemPrompt(tt.cfg)
for _, want := range tt.wantIn {
if !strings.Contains(prompt, want) {
t.Errorf("expected %q in prompt", want)
}
}
for _, notWant := range tt.wantNotIn {
if strings.Contains(prompt, notWant) {
t.Errorf("unexpected %q in prompt (must be removed)", notWant)
}
}
})
}
}
// TestBuildSystemPrompt_OpenBootstrapUnchanged verifies Phase 04 did NOT
// touch the open-agent slim branch — its existing mandate copy stays.
func TestBuildSystemPrompt_OpenBootstrapUnchanged(t *testing.T) {
cfg := SystemPromptConfig{
IsBootstrap: true,
AgentType: store.AgentTypeOpen,
ContextFiles: []bootstrap.ContextFile{
{Path: bootstrap.BootstrapFile, Content: "# BOOTSTRAP"},
},
ToolNames: []string{"write_file"},
}
prompt := BuildSystemPrompt(cfg)
if !strings.Contains(prompt, "Do NOT give a generic greeting") {
t.Error("open-bootstrap branch must keep its existing mandate copy")
}
if !strings.Contains(prompt, "only have write_file available") {
t.Error("open-bootstrap branch must keep its tool-limit note")
}
}
// TestBuildSystemPrompt_NoBootstrapNoUser verifies that when there are no
// bootstrap-related files at all, no nudge sections appear.
func TestBuildSystemPrompt_NoBootstrapNoUser(t *testing.T) {
prompt := BuildSystemPrompt(SystemPromptConfig{
AgentType: store.AgentTypePredefined,
ToolNames: []string{"write_file"},
})
if strings.Contains(prompt, "FIRST RUN") {
t.Error("unexpected FIRST RUN section with no context files")
}
if strings.Contains(prompt, "USER PROFILE INCOMPLETE") {
t.Error("unexpected USER PROFILE INCOMPLETE section with no context files")
}
}
// TestBuildSystemPrompt_PinnedSkillsAlwaysRenderOnBootstrap verifies that
// pinned skills are inlined into the system prompt even on bootstrap turns.
// Pinned skills are advertised in the UI as "always inlined in the system
// prompt" (ui/web/src/pages/agents/agent-detail/overview-sections/pinned-skills-section.tsx)
// so IsBootstrap must not suppress them, across all prompt modes.
func TestBuildSystemPrompt_PinnedSkillsAlwaysRenderOnBootstrap(t *testing.T) {
const pinnedXML = "<available_skills><skill><name>weather-lookup</name></skill></available_skills>"
tests := []struct {
name string
cfg SystemPromptConfig
}{
{
name: "full mode bootstrap",
cfg: SystemPromptConfig{
IsBootstrap: true,
AgentType: store.AgentTypePredefined,
ToolNames: []string{"write_file"},
PinnedSkillsSummary: pinnedXML,
},
},
{
name: "task mode bootstrap",
cfg: SystemPromptConfig{
IsBootstrap: true,
Mode: PromptTask,
AgentType: store.AgentTypePredefined,
ToolNames: []string{"write_file"},
PinnedSkillsSummary: pinnedXML,
},
},
{
name: "minimal mode bootstrap",
cfg: SystemPromptConfig{
IsBootstrap: true,
Mode: PromptMinimal,
AgentType: store.AgentTypeOpen,
ToolNames: []string{"write_file"},
PinnedSkillsSummary: pinnedXML,
},
},
{
name: "none mode bootstrap",
cfg: SystemPromptConfig{
IsBootstrap: true,
Mode: PromptNone,
AgentType: store.AgentTypeOpen,
ToolNames: []string{"write_file"},
PinnedSkillsSummary: pinnedXML,
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
prompt := BuildSystemPrompt(tt.cfg)
if !strings.Contains(prompt, pinnedXML) {
t.Errorf("expected pinned skills XML in bootstrap system prompt (mode %q), got:\n%s", tt.cfg.Mode, prompt)
}
})
}
}
// TestBuildSystemPrompt_PinnedSkillsNonBootstrapUnchanged verifies pinned
// skills continue to render normally on non-bootstrap turns, alongside the
// search/manage guidance that bootstrap turns must suppress.
func TestBuildSystemPrompt_PinnedSkillsNonBootstrapUnchanged(t *testing.T) {
const pinnedXML = "<available_skills><skill><name>weather-lookup</name></skill></available_skills>"
prompt := BuildSystemPrompt(SystemPromptConfig{
IsBootstrap: false,
AgentType: store.AgentTypePredefined,
ToolNames: []string{"write_file", "skill_search"},
PinnedSkillsSummary: pinnedXML,
HasSkillSearch: true,
})
if !strings.Contains(prompt, pinnedXML) {
t.Error("expected pinned skills XML in non-bootstrap system prompt")
}
if !strings.Contains(prompt, "skill_search") {
t.Error("expected skill_search guidance in non-bootstrap system prompt")
}
}