Repository navigation
feat(policy-guard): stop resending rejected conversations upstream - #876
Open
nieyuanhong wants to merge 1 commit into
Open
nieyuanhong wants to merge 1 commit into
nieyuanhong wants to merge 1 commit into
Conversation
A safety-gate rejection is a function of the conversation content, so retrying it - on the same account, another account, or after stripping previous_response_id - reproduces the rejection and files another violation report, which is what escalates to an account ban. Remember the rejected conversation and answer follow-up turns locally with a 400, so a rejected conversation reaches the upstream exactly once. Detection prefers the structured error codes (cyber_policy, session_blocked_by_cyber_policy), falls back to message keywords, and lets HTTP status codes only narrow the match, so an ordinary 403 ban or 429 rate limit keeps its existing handling. Quarantine is conversation-scoped: it holds while the new input still contains the recorded prefix, and is released on edit, TTL expiry, or an admin reset. The guard is off by default (policy_guard.enabled = false); enabling it also stops treating a policy 403 as an account ban. The netlab smoke (npm run netlab:policy-guard) now runs in the Linux backend CI job and asserts the one-submission contract end to end.
This was referenced Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
上游安全检测拒绝某段对话后，重试（同账号/换账号/去掉
previous_response_id重发）会复现同样拒绝并再次上报违规，这正是账号升级为封禁的路径。本 PR 引入可开关的「安全策略熔断」：记住被拒绝的对话，后续轮次在本地直接 400 拒绝，使同一拒绝对话对上游的提交恒为 1 次。默认关闭（
policy_guard.enabled = false）；开启后的行为变化：命中的策略 403 不再按账号封禁处理。Changes
src/proxy/policy-rejection.ts（结构化错误码优先 → 文案关键字兜底 → 状态码仅作收窄）、src/proxy/conversation-quarantine.ts（会话身份 + 输入前缀包含判定；编辑/TTL/手动解除放行）src/routes/shared/proxy-handler.ts）、直连路径（direct-request-handler.ts）、流式终态帧记录（streaming-handler.ts+response-processor.ts/responses-passthrough.ts）；403 策略拒绝不再进入封号/限流重试分支（proxy-error-handler.ts、proxy-retry-classifier.ts）src/config-schema.ts、config/default.yaml，并以测试锁定三处默认值一致GET/POST /admin/policy-guard-settings、GET /admin/policy-guard-quarantines、POST .../reset（src/routes/admin/policy-guard.ts）、设置页 Pane（PolicyGuardSettings.tsx、shared/hooks/use-policy-guard.ts、i18n）README.md、API.md；Linux backend job 新增端到端烟测步骤npm run netlab:policy-guardTest Plan
npx tsc --noEmitnpm test— 3513 passed / 38 skipped（含新增：三条拦截路径、隔离表 TTL/前缀、判定矩阵、管理端鉴权、默认值一致性；曾出现 1 次未定位偶发失败，随后两次复跑全绿）npm run buildnpm run netlab:policy-guard— 本地 12/12：turn1 上游恰好 1 次 → turn2 本地 400 且上游计数不变 → 解除后 turn3 重新放行cd web && npx vitest run— PolicyGuardSettings 组件 7 用例通过（web 全量tsc存在既有的AddAccount.tsxi18n key 报错，与本次无关）backend-tests的新增步骤Run policy-guard end-to-end smoke已在 Linux 上通过；Docker smoke ✅Notes
devf824033，与上游当前dev一致