v2026.7.22

.flocks/flocks.json.example

@@ -39,6 +39,9 @@
     "readMaxBytes": 51200,
     "readMaxLineLength": 2000
   },
+  "toolFailure": {
+    "disableOnRepeatedFailure": true
+  },
   "sandbox": {
     "mode": "off",
     "scope": "agent",

.flocks/flockshub/index.json

@@ -14573,7 +14573,7 @@
       "type": "device",
       "name": "Chaitin SafeLine WAF",
       "description": "Chaitin SafeLine WAF OpenAPI integration.",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "category": "integration",
       "tags": [
         "waf",

.flocks/flockshub/plugins/tools/device/chaitin_safeline_waf_v1_0_0/manifest.json

@@ -5,7 +5,7 @@
   "name": "Chaitin SafeLine WAF",
   "description": "Chaitin SafeLine WAF OpenAPI integration.",
   "descriptionCn": "长亭雷池 WAF OpenAPI 接入。",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "author": "Flocks Team",
   "license": "MIT",
   "category": "integration",

.flocks/flockshub/plugins/tools/device/huaweicloud_waf_v39/hw_waf.handler.py

@@ -267,10 +267,10 @@ async def _request(
             if resp.status >= 400:
                 return ToolResult(
                     success=False,
-                    data=resp_json,
+                    output=resp_json,
                     error=f"HTTP {resp.status}: {resp_text[:300]}",
                 )
-            return ToolResult(success=True, data=resp_json)
+            return ToolResult(success=True, output=resp_json)
 
 
 def _pick(params: dict[str, Any], *keys: str) -> dict[str, Any]:
@@ -291,10 +291,9 @@ def _page_query(params: dict[str, Any]) -> dict[str, Any]:
 # ---------------------------------------------------------------------------
 
 
-async def host(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
+async def host(ctx: ToolContext, action: str, **params: Any) -> ToolResult:
     cfg = _load_config(params.get("enterprise_project_id"))
     pid = cfg.project_id
-    action = params.get("action", "")
 
     if action == "host_list":
         q = _page_query(params)
@@ -360,10 +359,9 @@ async def host(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
     return ToolResult(success=False, error=f"Unknown action: {action}")
 
 
-async def policy(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
+async def policy(ctx: ToolContext, action: str, **params: Any) -> ToolResult:
     cfg = _load_config(params.get("enterprise_project_id"))
     pid = cfg.project_id
-    action = params.get("action", "")
 
     if action == "policy_list":
         q = _page_query(params)
@@ -400,7 +398,9 @@ async def policy(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
 
     if action == "cc_rule_create":
         pol_id = params["policy_id"]
-        body = _pick(params, "url", "limit_num", "limit_period", "lock_time", "tag_type", "action")
+        body = _pick(params, "url", "limit_num", "limit_period", "lock_time", "tag_type")
+        if params.get("rule_action") is not None:
+            body["action"] = params["rule_action"]
         return await _request(cfg, "POST", f"/v1/{pid}/waf/policy/{pol_id}/cc", body=body)
 
     if action == "cc_rule_delete":
@@ -415,7 +415,9 @@ async def policy(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
 
     if action == "custom_rule_create":
         pol_id = params["policy_id"]
-        body = _pick(params, "name", "conditions", "action", "priority", "description")
+        body = _pick(params, "name", "conditions", "priority", "description")
+        if params.get("rule_action") is not None:
+            body["action"] = params["rule_action"]
         return await _request(cfg, "POST", f"/v1/{pid}/waf/policy/{pol_id}/custom", body=body)
 
     if action == "custom_rule_delete":
@@ -446,16 +448,17 @@ async def policy(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
     return ToolResult(success=False, error=f"Unknown action: {action}")
 
 
-async def event(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
+async def event(ctx: ToolContext, action: str, **params: Any) -> ToolResult:
     cfg = _load_config(params.get("enterprise_project_id"))
     pid = cfg.project_id
-    action = params.get("action", "")
 
     if action == "event_list":
         q = _page_query(params)
-        for k in ("from", "to", "hosts", "attacks", "action"):
+        for k in ("from", "to", "hosts", "attacks"):
             if params.get(k) is not None:
                 q[k] = params[k]
+        if params.get("event_action") is not None:
+            q["action"] = params["event_action"]
         return await _request(cfg, "GET", f"/v1/{pid}/waf/event/attack/logs", query=q)
 
     if action == "event_show":
@@ -471,9 +474,11 @@ async def event(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
 
     if action == "event_export_job":
         body = {}
-        for k in ("from", "to", "hosts", "attacks", "action"):
+        for k in ("from", "to", "hosts", "attacks"):
             if params.get(k) is not None:
                 body[k] = params[k]
+        if params.get("event_action") is not None:
+            body["action"] = params["event_action"]
         return await _request(cfg, "POST", f"/v1/{pid}/waf/event/attack/log/job", body=body)
 
     if action == "threat_distribution":
@@ -500,10 +505,9 @@ async def event(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
     return ToolResult(success=False, error=f"Unknown action: {action}")
 
 
-async def overview(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
+async def overview(ctx: ToolContext, action: str, **params: Any) -> ToolResult:
     cfg = _load_config(params.get("enterprise_project_id"))
     pid = cfg.project_id
-    action = params.get("action", "")
 
     def _time_query() -> dict[str, Any]:
         q: dict[str, Any] = {}

.flocks/flockshub/plugins/tools/device/huaweicloud_waf_v39/hw_waf_event.yaml

@@ -20,7 +20,7 @@ inputSchema:
         - event_list
           用途: 查询攻击事件列表（分页）
           必填: 无
-          常用: `from`、`to`、`hosts`、`attacks`、`action`、`page`、`pagesize`
+          常用: `from`、`to`、`hosts`、`attacks`、`event_action`、`page`、`pagesize`
           风险提示: 只读查询接口；建议传 from/to 缩小范围
           是否任务型: 否
         - event_show
@@ -38,7 +38,7 @@ inputSchema:
         - event_export_job
           用途: 下发自定义导出攻击事件的异步任务
           必填: `from`、`to`
-          常用: `from`、`to`、`hosts`、`attacks`、`action`
+          常用: `from`、`to`、`hosts`、`attacks`、`event_action`
           风险提示: 写操作（下发异步任务）；任务完成后可通过 `event_log_download` 获取结果
           是否任务型: 是
         - threat_distribution
@@ -89,9 +89,12 @@ inputSchema:
       items:
         type: string
       description: 攻击类型列表（如 `sqli`、`xss`、`cmdi`、`cc` 等）
-    action:
+    event_action:
       type: string
       description: 防护动作筛选，`block`（拦截）或 `log`（仅记录）
+      enum:
+        - block
+        - log
     top:
       type: integer
       description: 返回 Top N 条数，默认 5

.flocks/flockshub/plugins/tools/device/huaweicloud_waf_v39/hw_waf_policy.yaml

@@ -61,8 +61,8 @@ inputSchema:
           是否任务型: 否
         - cc_rule_create
           用途: 创建 CC 防护规则
-          必填: `policy_id`、`url`、`limit_num`、`limit_period`、`lock_time`、`tag_type`、`action`
-          常用: `policy_id`、`url`、`limit_num`、`limit_period`、`lock_time`、`tag_type`、`action`
+          必填: `policy_id`、`url`、`limit_num`、`limit_period`、`lock_time`、`tag_type`、`rule_action`
+          常用: `policy_id`、`url`、`limit_num`、`limit_period`、`lock_time`、`tag_type`、`rule_action`
           风险提示: 写操作；会新增 CC 规则
           是否任务型: 否
         - cc_rule_delete
@@ -79,8 +79,8 @@ inputSchema:
           是否任务型: 否
         - custom_rule_create
           用途: 创建精准防护规则
-          必填: `policy_id`、`name`、`conditions`、`action`
-          常用: `policy_id`、`name`、`conditions`、`action`、`priority`
+          必填: `policy_id`、`name`、`conditions`、`rule_action`
+          常用: `policy_id`、`name`、`conditions`、`rule_action`、`priority`
           风险提示: 写操作；会新增精准防护规则
           是否任务型: 否
         - custom_rule_delete
@@ -168,7 +168,7 @@ inputSchema:
     tag_type:
       type: string
       description: CC 规则标签类型，如 `ip`、`cookie`、`header` 等
-    action:
+    rule_action:
       type: object
       description: 规则匹配后的动作，含 `category`（`block`/`pass`/`log`）等字段
     conditions:

.flocks/flockshub/plugins/tools/device/huorong_edr_v1_0/huorong.handler.py

@@ -156,10 +156,10 @@ async def _post(
             if resp.status >= 400:
                 return ToolResult(
                     success=False,
-                    data=resp_json,
+                    output=resp_json,
                     error=f"HTTP {resp.status}: {resp_text[:200]}",
                 )
-            return ToolResult(success=True, data=resp_json)
+            return ToolResult(success=True, output=resp_json)
 
 
 def _pick(params: dict[str, Any], *keys: str) -> dict[str, Any]:
@@ -171,9 +171,8 @@ def _pick(params: dict[str, Any], *keys: str) -> dict[str, Any]:
 # ---------------------------------------------------------------------------
 
 
-async def group(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
+async def group(ctx: ToolContext, action: str, **params: Any) -> ToolResult:
     base_url, timeout, secret_id, secret_key, verify_ssl = _resolve_runtime_config()
-    action = params.get("action", "")
 
     if action == "group_list":
         return await _post(base_url, "/api/group/_list", {}, secret_id, secret_key, timeout, verify_ssl)
@@ -194,9 +193,8 @@ async def group(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
     return ToolResult(success=False, error=f"Unknown action: {action}")
 
 
-async def clnts(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
+async def clnts(ctx: ToolContext, action: str, **params: Any) -> ToolResult:
     base_url, timeout, secret_id, secret_key, verify_ssl = _resolve_runtime_config()
-    action = params.get("action", "")
 
     if action == "clnts_online":
         body = _pick(params, "offset")
@@ -231,9 +229,8 @@ async def clnts(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
     return ToolResult(success=False, error=f"Unknown action: {action}")
 
 
-async def task(params: dict[str, Any], ctx: ToolContext) -> ToolResult:
+async def task(ctx: ToolContext, action: str, **params: Any) -> ToolResult:
     base_url, timeout, secret_id, secret_key, verify_ssl = _resolve_runtime_config()
-    action = params.get("action", "")
 
     if action == "task_create":
         body = _pick(params, "offset")

.flocks/flockshub/plugins/workflows/stream_alert_triage/guide.md

@@ -218,7 +218,7 @@ alert_records
 | `input_paths` | 无 | 显式路径列表，优先级最高 |
 | `input_path` | 无 | 单个显式路径 |
 | `input_date` | 今天 | 自动发现该日所有上游 `dedup_result_*.jsonl` |
-| `concurrency` | `1` | `workflow.md` 和 metadata 推荐 1；`concurrent_triage` 会限制到 1 到 5 |
+| `concurrency` | `1` | 控制外层 work unit 和运行级 LLM 并发预算；`concurrent_triage` 会限制到 1 到 5 |
 | `max_triage_cache_size` | `100000` | 小于 1 时回退 100000 |
 | `triage_output_mode` | `soc_db` | 输出模式：`soc_db` / `jsonl` / `both` / `none` |
 | `soc_db_path` | `~/.flocks/data/soc.db` | 默认 SOC DB 写入位置 |
@@ -228,10 +228,10 @@ alert_records
 并发注意：
 
 - 外层 `ThreadPoolExecutor(max_workers=concurrency)` 处理 unique work units。
-- 内层每个 leader 会用 4 路并行 LLM 分支：`survey`、`cve_related`、`cve_info`、`payload_analysis`。
-- 稳态 LLM 峰值约为 `concurrency * 4`。
-- 配置引导应默认显式给出 `concurrency=1`。如果用户要提高到 2 到 5，先说明 LLM 并发和上游工具压力，再确认。
-- 当前 `load_dedup_file` 节点在完全不传 `concurrency` 时会输出 5；因此引导和样例中应显式传 `concurrency=1`，避免与文档推荐值不一致。
+- 每个 leader 仍会执行 `survey`、`cve_related`、`cve_info`、`payload_analysis` 4 个 LLM 分支。
+- 所有 `llm.ask()` 共享运行级信号量，稳态 LLM 峰值不超过 `concurrency`，不会再与 4 个分支相乘。
+- 配置引导应默认显式给出 `concurrency=1`。如果用户要提高到 2 到 5，先说明 LLM 和上游工具压力，再确认。
+- `load_dedup_file` 在完全不传 `concurrency` 时同样输出 1，与文档和样例保持一致。
 
 leader/follower 规则：
 
@@ -298,7 +298,7 @@ leader/follower 规则：
 3. 后续每行是否能按 JSON 对象解析。
 4. 是否至少有 `dedup_key`、`sip`、`dip`、`req_http_url`、`threat_name` 中的关键字段。
 5. 按 `dedup_key` 估算 unique work units 和 follower 数。
-6. 预估 `concurrency * 4` 的 LLM 峰值。
+6. 确认运行级 LLM 峰值不超过 `concurrency`。
 
 真实执行验证注意：
 

.flocks/flockshub/plugins/workflows/stream_alert_triage/meta.json

@@ -1,7 +1,7 @@
 {
   "name": "stream_alert_triage",
   "nameCn": "HTTP研判工作流",
-  "description": "Self-contained downstream pipeline for stream_alert_denoise. Loads enriched_alerts from JSONL files written by stream_alert_denoise, then runs leader/follower concurrent triage with the tdp_alert_triage logic INLINED (no sub-workflow invocation). Alerts sharing the same dedup_key in a batch form groups; only the LEADER (first occurrence) is triaged, FOLLOWERS reuse the leader result with no extra LLM calls. Each alert's 4 LLM analysis branches (survey / cve_related / cve_info / payload_analysis) still run in parallel via a nested 4-way ThreadPoolExecutor. The semantic-tagged markdown verdict report is attached to each alert via the `triage_report` field — NO per-alert markdown file is written to disk. Persistent cache (triage_cache.pkl, FIFO LRU, file-locked, atomic write): historic dedup_key hits reuse the cached verdict/title/triage_report instantly; misses run the full inline triage and persist new results. Default persistence writes enriched triage alerts into ~/.flocks/data/soc.db alert_records; optional JSONL output is controlled by config.json or triage_output_mode=jsonl/both.",
+  "description": "Self-contained downstream pipeline for stream_alert_denoise. Loads enriched_alerts from JSONL files written by stream_alert_denoise, then runs leader/follower concurrent triage with the tdp_alert_triage logic INLINED (no sub-workflow invocation). Alerts sharing the same dedup_key in a batch form groups; only the LEADER (first occurrence) is triaged, FOLLOWERS reuse the leader result with no extra LLM calls. Each alert keeps the 4 LLM analysis branches (survey / cve_related / cve_info / payload_analysis), while every llm.ask call shares the run-wide concurrency budget so nested executors cannot multiply provider load. The semantic-tagged markdown verdict report is attached to each alert via the `triage_report` field — NO per-alert markdown file is written to disk. Persistent cache (triage_cache.pkl, FIFO LRU, file-locked, atomic write): historic dedup_key hits reuse the cached verdict/title/triage_report instantly; misses run the full inline triage and persist new results. Default persistence writes enriched triage alerts into ~/.flocks/data/soc.db alert_records; optional JSONL output is controlled by config.json or triage_output_mode=jsonl/both.",
   "category": "default",
   "status": "active",
   "createdBy": null,