fix: move local network policy notice into system prompts

[Soulter]

Local Shell and Python executions repeated the network-disabled policy in every tool result, including successful results and execution errors. Put that guidance in the system prompt so it is available before execution without accumulating duplicate notices in tool history.

Modifications

• Add the policy notice to the main agent's system prompt when local execution is permitted and network access is disabled for the current caller.

• Apply the same guidance to plugin and subagent tool loops when local execution/session tools are available, preserving existing instructions and avoiding duplicate notices.

• Remove the notice prefix and policy_notice field from shell results and the extra notice content from Python results. Keep command output, errors, session status, and sandbox enforcement unchanged.

• This is NOT a breaking change to tool arguments or sandbox permissions. The informational policy_notice result field is intentionally removed.

Verification Steps and Test Results

• uv run pytest tests/unit/test_astr_main_agent.py tests/unit/test_star_context.py tests/unit/test_func_tool_manager.py tests/unit/test_python_tools.py -q: 210 passed.
• Coverage includes role-specific network permissions, disabled execution, plugin/subagent prompts, duplicate suppression, non-local runtimes, missing execution tools, and normal/error tool results.
• ruff format ., ruff check ., and git diff --check: passed.

Checklist

• Changes are tested, with verification steps and results above.
• No WebUI navigation, structure, or labels changed; documentation screenshots do not need updating.
• No new dependencies are introduced.
• No malicious code is introduced.

Summary by Sourcery

Move local network policy guidance into applicable agent system prompts and stop repeating it in execution results.

Bug Fixes:

• Move the local network-disabled policy guidance from repeated shell and Python tool results into agent system prompts.
• Remove the informational policy notice from shell and Python outputs while preserving command results, errors, session status, and sandbox enforcement.

Enhancements:

• Apply the policy guidance consistently across the main agent, plugin loops, and subagent loops only when local execution is available and network access is disabled, with duplicate suppression.

Tests:

• Expand coverage for role-specific permissions, runtime and tool availability, duplicate suppression, and normal and error execution results.

[sourcery-ai]

Hey - I've found 2 issues

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="astrbot/core/star/context.py" line_range="311-313" />
<code_context>
+                    "astrbot_execute_python",
+                )
+            )
+            and is_local_runtime(run_context)
+        ):
+            local_policy = get_local_permission_policy(run_context)
+            if (
+                local_policy.allow_execution
</code_context>
<issue_to_address>
**issue (bug_risk):** The runtime and permission policy are resolved from `run_context`, but `is_local_runtime` and `get_local_permission_policy` read the context captured by the `Context` instance rather than the explicitly supplied `agent_context`. A caller that supplies an agent context from a different runtime or message origin therefore receives no notice when its tools run under a network-disabled local policy, or receives a misleading notice for the wrong policy.

**Triggers:** When `tool_loop_agent` is called with an explicit `agent_context` whose context/config differs from `self`.

**Suggested fix:** Resolve the runtime and local policy exclusively from the supplied `agent_context` (or reject agent contexts belonging to another `Context`) before modifying the prompt.
</issue_to_address>

### Comment 2
<location path="astrbot/core/star/context.py" line_range="302-311" />
<code_context>
+            tool_call_timeout=tool_call_timeout,
+        )
+        if (
+            tools
+            and any(
+                tools.get_tool(name)
+                for name in (
+                    "astrbot_execute_shell",
+                    "astrbot_shell_session",
+                    "astrbot_execute_python",
+                )
+            )
+            and is_local_runtime(run_context)
+        ):
+            local_policy = get_local_permission_policy(run_context)
</code_context>
<issue_to_address>
**nitpick (bug_risk):** The notice is added when `get_tool` returns a local execution tool even if that tool is inactive. Inactive tools are excluded from the exposed tool set, so the model receives a network-disabled execution warning despite having no local Shell/Python/session tool it can call.

**Triggers:** When a `ToolSet` contains an inactive local execution tool.

**Suggested fix:** Require the matching tool's `active` attribute to be true when deciding whether local execution tools are available.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 1 finding to address first, and this changes how the agent is instructed about a denied local network policy and removes the notice from tool results, which can alter subsequent tool choices and command execution. Reverting restores the prior behavior, while the underlying network restriction remains enforced; any incorrect guidance would therefore be bounded but could require rerunning affected agent interactions.

Blocking findings: astrbot/core/star/context.py:313

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

issue (bug_risk): The runtime and permission policy are resolved from run_context, but is_local_runtime and get_local_permission_policy read the context captured by the Context instance rather than the explicitly supplied agent_context. A caller that supplies an agent context from a different runtime or message origin therefore receives no notice when its tools run under a network-disabled local policy, or receives a misleading notice for the wrong policy.

Triggers: When tool_loop_agent is called with an explicit agent_context whose context/config differs from self.

Suggested fix: Resolve the runtime and local policy exclusively from the supplied agent_context (or reject agent contexts belonging to another Context) before modifying the prompt.

[sourcery-ai]

nitpick (bug_risk): The notice is added when get_tool returns a local execution tool even if that tool is inactive. Inactive tools are excluded from the exposed tool set, so the model receives a network-disabled execution warning despite having no local Shell/Python/session tool it can call.

Triggers: When a ToolSet contains an inactive local execution tool.

Suggested fix: Require the matching tool's active attribute to be true when deciding whether local execution tools are available.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	astrbot-docs	77db504	Commit Preview URL Branch Preview URL	Sep 19 2026, 04:24 AM