系统提示词装配与代码约束

pub const SYSTEM_DEFAULT: &str = include_str!("../prompts/common/system_default.md");

/// Continuation message — injected as a user turn when the LLM stops without
/// completing the task (i.e. stops calling tools mid-task).
pub const CONTINUATION: &str = include_str!("../prompts/common/continuation.md");

/// Safety boundaries (injection hygiene, secret handling, malicious-code refusal).
///

pub struct SystemPromptSlots {
    /// Agent style — determines which base prompt template is used.
    ///
    /// When `None` (default), the style is auto-detected from the user's message.
    /// Explicitly set this to force a particular style regardless of message content.
    pub style: Option<AgentStyle>,

    /// Custom role/identity prepended before the core prompt.
    ///
    /// Example: "You are a senior Python developer specializing in FastAPI."
    /// When set, replaces the default "You are A3S Code, an expert AI coding agent" line.
    pub role: Option<String>,

    /// Custom coding guidelines appended after the core prompt sections.
    ///
    /// Example: "Always use type hints. Follow PEP 8. Prefer dataclasses over dicts."
    pub guidelines: Option<String>,

    /// Custom response style that replaces the default "Response Format" section.
    ///
    /// When `None`, the default response format is used.
    pub response_style: Option<String>,

    /// Fallback language as a BCP-47 tag (for example `zh-CN` or `en-US`).
    /// User-authored requests determine the reply language when discernible.
    pub output_language: Option<String>,

    /// Freeform extra instructions appended at the very end.
    pub extra: Option<String>,
}

        // 2b. Runtime contract — shared by every style so authority, run
        // control, and evidence semantics cannot drift between built-in agents.
        parts.push(RUNTIME_CONTRACT.replace('\r', "").trim_end().to_string());

        // 2c. Repository-tool contract — style-scoped so read-oriented roles do
        // not advertise mutating tools while claiming a read-only task.
        parts.push(
            style
                .repository_tool_contract()
                .replace('\r', "")
                .trim_end()
                .to_string(),
        );

        // 2d. Safety boundaries — single source of truth, appended uniformly so
        // every style and delegated subagent (which build through this path)
        // carries injection-hygiene, secret-handling, and malware-refusal rules.
        parts.push(BOUNDARIES.replace('\r', "").trim_end().to_string());

        // The UI locale supplies a fallback when the user has not established a language.
        if let Some(language) = self
            .output_language
            .as_deref()
            .map(str::trim)
            .filter(|value| !value.is_empty())
        {

    async fn resolve_effective_style(&self, prompt: &str) -> AgentStyle {
        if let Some(style) = self.config.prompt_slots.style {
            return style;
        }

        // Keep the primary session on GeneralPurpose unless the host explicitly
        // selected a specialty style. Keyword detection remains available for
        // planning heuristics and delegated agents, but must not silently
        // downgrade the writable coding prompt.
        let (detected, confidence) = AgentStyle::detect_with_confidence(prompt);
        tracing::debug!(
            intent.classification = ?detected,
            intent.confidence = ?confidence,
            intent.source = "local_nonbinding",
            "Intent classified locally without changing primary prompt style"
        );
        AgentStyle::GeneralPurpose
    }

    pub(super) async fn resolve_prompt_mode(
        &self,
        explicit_style: Option<AgentStyle>,
        style_prompt: &str,
        event_tx: &Option<mpsc::Sender<AgentEvent>>,

    fn with_verification_context(&self, mut system: String) -> String {
        if self.config.verification_contracts.is_empty() {
            return system;
        }
        // Project the admitted host manifest, never commands inferred from
        // repository text or the user's phrasing. This is model context, not
        // a grant of tool execution or authority to change the manifest.
        let contracts: Vec<_> = self
            .config
            .verification_contracts
            .iter()
            .map(|contract| {
                serde_json::json!({
                    "id": contract.id,
                    "command": contract.command.trim(),
                    "covers": contract.covers,
                })
            })
            .collect();
        system.push_str(
            "\n\nHost verification contracts for this workspace:\n\
             The following JSON is the admitted host manifest. When running a declared command, \
             including a requested baseline check, use the command string as the entire bash command, \
             with no extra arguments, prefixes, suffixes or shell composition. The bash tool already \
             reports its exit code; do not append echo to print it. Read-only inspection is not verification. \
             A successful checker must run after the latest edit; a failed check or a later edit \
             cannot yield Verified completion. These declarations do not authorize execution, \
             waive permission or sandbox checks, or allow changing the checker or the manifest. \

pub fn apply_turn_output_language(
    system: Option<String>,
    user_text: &str,
    published: Option<&str>,
    nested: bool,
) -> (Option<String>, Option<String>) {
    let Some(language) = select_turn_reply_language(published, user_text, nested) else {
        return (system, None);
    };
    let line = turn_output_language_override(&language);
    let system = Some(match system {
        Some(existing) if !existing.is_empty() => format!("{existing}\n\n{line}"),
        _ => line,
    });
    (system, Some(language))
}

/// Infer a BCP-47 reply-language tag from user-authored text.
///
/// Uses script counts only (no NLP). Returns `None` when the sample is too
/// short or script evidence is inconclusive, so hosts can keep the previous
/// pin or the soft "match the user" rule.
pub fn infer_user_reply_language(text: &str) -> Option<&'static str> {