fix(agent): 约束 jina 工具用法,不关闭搜索

- jina 工具砍到 allowlist(默认 search_web,read_url),21→2;其余工具不暴露,
  减少 prompt 膨胀与误用(env JINA_TOOL_ALLOWLIST 可调)。
- prompt 加 workspace/tool 边界:本地 base_commit 代码是唯一真源,本地读改;
  web 搜索/read_url 仅用于外部知识(库文档/语言特性/报错查证),严禁取本仓源码
  (web 版本≠本地 base_commit,会污染 patch);read_url 不接受 file:// 本地路径。

搜索作为模型验证/补能手段保留,仅约束调用边界。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

agent/task_executor.py

@@ -419,6 +419,16 @@ Relevant workspace file contents:
 Peer specialist input:
 {json.dumps(peer_context, indent=2)}
 
+Workspace & tool boundaries (IMPORTANT):
+- The target repository is ALREADY checked out locally in your workspace at the correct base commit.
+  The file contents above ARE that local code — treat them as the single source of truth. Read and
+  edit these local files; return complete modified file content in `files`.
+- The web search / read_url tools are for EXTERNAL knowledge ONLY (library/framework docs, language
+  features, error-message lookups). NEVER use them to fetch THIS repository's own source — the web
+  copy is a DIFFERENT version than your local base commit and will corrupt your patch.
+- Do not pass local paths or file:// URLs to read_url; it only fetches public web URLs. To see a
+  repo file not shown above, infer from the listed files rather than fetching it from the web.
+
 Alignment requirements:
 - If your role is testing, align your tests with the implementation artifacts and their stated error semantics.
 - If your role is documentation, align your docs with both implementation and testing artifacts.
@@ -502,6 +512,12 @@ Return ONLY the JSON, no other text."""
                 async with ClientSession(read, write) as session:
                     await session.initialize()
                     tools = (await session.list_tools()).tools
+                    # Constrain the toolset: the agent only needs web SEARCH + fetch a page's full
+                    # CONTENT. Exposing all ~21 Jina tools bloats the prompt and tempts the model to
+                    # misuse them (e.g. read_url on local file:// paths, or fetching the repo's own
+                    # source from the web = WRONG version vs the local base_commit checkout).
+                    allow = {t.strip() for t in os.getenv(
+                        "JINA_TOOL_ALLOWLIST", "search_web,read_url").split(",") if t.strip()}
                     self._jina_tools = [
                         {
                             "type": "function",
@@ -512,8 +528,10 @@ Return ONLY the JSON, no other text."""
                             },
                         }
                         for t in tools
+                        if not allow or t.name in allow
                     ]
-            logger.info("Loaded %d Jina MCP tools (mcp SDK)", len(self._jina_tools))
+            logger.info("Loaded %d Jina MCP tools (allowlist=%s, of %d offered)",
+                        len(self._jina_tools), sorted(allow) or "*", len(tools))
         except Exception as exc:
             logger.warning("Failed to load Jina MCP tools: %s", exc)
             self._jina_tools = []