A white-box operation and management method for intelligent agents, as well as storage media and electronic devices.

Abstract

This invention discloses a white-box operation and management method for intelligent agents, as well as storage media and electronic devices, providing a multi-dimensional collaborative architecture: in the security dimension, it provides real-time risk identification and manual forced interruption mechanisms; in the privacy dimension, it desensitizes and restores sensitive data through local privacy-protecting intelligent agents, achieving "data remains still, model moves"; in the memory dimension, it introduces a multi-agent debate mechanism to strategically iterate and select structured memories, significantly reducing token consumption; and with the addition of full-process anti-tampering logs, cross-terminal session synchronization, and hot-plugging of intelligent agent skills and personalities, this invention can effectively eliminate enterprises' compliance concerns in deploying AI intelligent agents, maximize the release of cloud computing power while ensuring data security, and achieve efficient, secure, and low-cost operation of intelligent agents.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and computer software technology. Specifically, it relates to a white-box operation and management method, storage medium, and electronic device for monitoring and intervening in intelligent agents and ensuring user privacy and security throughout their entire lifecycle. Background Technology

[0002] With the rapid development of Large Language Model (LLM) technology, LLM-based agents have been widely applied in customer service, automated business processes, code generation, and other fields. However, existing agent platforms still face the following serious challenges in commercialization, large-scale deployment, and high-concurrency operation:

[0003] First, there are high security risks and a lack of real-time human intervention capabilities. When intelligent agents perform complex orchestration tasks (such as database operations, calling external APIs, and executing scripts), they may exhibit unpredictable behavior or fall into infinite loops due to hallucinations. Users may also induce them to execute dangerous commands through prompt injection. Current mainstream products generally lack a "hard interrupt" mechanism, meaning enterprise administrators cannot terminate tasks in real time when anomalies occur, posing a significant security risk.

[0004] Secondly, there is a fundamental contradiction between data privacy and external service capabilities. Enterprises want to leverage large cloud models and a rich ecosystem of external APIs to handle complex business processes, but are constrained by stringent regulatory requirements (such as in the financial and healthcare industries) and cannot directly export data containing sensitive information. Existing simple anonymization solutions often damage the data structure, making it impossible for external APIs to parse, creating a dilemma of "either sacrificing security or sacrificing capabilities."

[0005] Secondly, inefficient memory management leads to high token costs. Current agent dialogue records are mostly stored as unstructured text, causing agents to absorb large amounts of erroneous, redundant, or low-quality information over long-term operation. This not only results in "garbage in, garbage out," degrading the personalized experience, but also causes agents to repeatedly consume massive amounts of tokens in subsequent reasoning, significantly increasing enterprise operating costs. Traditional optimization methods such as reinforcement learning (RLHF) based on human feedback are time-consuming and costly, making rapid iteration difficult. The dynamic memory compression strategy used in the popular agent architecture Openclaw suffers from frequent memory compression problems and inefficient memory management in high-frequency task scenarios.

[0006] Finally, operation and maintenance and capability management are complex. In multi-tenant environments, session isolation and cross-platform state synchronization provide a fragmented experience; and updating the skill and system prompt configurations of intelligent agents often requires a complex release process and lacks a flexible hot-swap mechanism.

[0007] Therefore, there is an urgent need for a comprehensive management method and system architecture that can realize the "white-box" operation process of intelligent agents—that is, the state is observable, the process is auditable, the privacy is protected, the behavior is interventionable, and the configuration can be dynamically changed. Summary of the Invention

[0008] To address the aforementioned problems in existing technologies, this invention provides a white-box operation and management method for intelligent agents, as well as a storage medium and electronic device, which achieves efficient and secure management of multiple intelligent agents through a multi-dimensional collaborative mechanism.

[0009] To address the above problems, the present invention adopts the following technical solution: a white-box operation and management method for intelligent agents, comprising the following methods:

[0010] Security management includes risk identification of instructions or actions during user-agent interaction and agent tool invocation, and provides an interruption response mechanism that allows authorized users to interrupt ongoing agent tasks in real time. Simultaneously, an offline risk control agent is used to review the responses generated by the large language model during the interaction process and filter responses containing sensitive or harmful information.

[0011] Privacy protection includes a privacy protection intelligent agent, which is configured to identify and de-identify sensitive information, send the de-identified information to a business intelligent agent to call an external API to execute business tasks; and after receiving the processing result from the business intelligent agent, restore the information based on the mapping relationship established during de-identification, and return the restored result to the corresponding user; the privacy protection intelligent agent is deployed on a local server or edge node, forming a collaborative architecture with the business intelligent agent deployed locally, in the cloud, or on an external network and calling external APIs;

[0012] Memory management, including a dual-track memory management method for intelligent agents, which includes a short-term working memory loading step, a long-term rule of experience retrieval step, and a system-level rule injection step;

[0013] Session management includes using a multi-channel session management and full-duplex communication method to manage the session of an agent. The multi-channel session management and full-duplex communication method includes a multi-channel identity unified mapping step, a full-duplex session establishment and message routing step, and a ReAct state real-time synchronization step.

[0014] Log management includes using a two-layer logging and auditing approach to manage the logs of intelligent agents, specifically including task-level streaming log recording steps and system-level audit log recording steps;

[0015] Skill and personality management includes managing the skills and personality of intelligent agents using polymorphic skill management and dynamic mounting methods. Specifically, this includes polymorphic skill sniffing and loading steps, physical isolation execution steps, dynamic skill hot mounting steps, meta-skill delegation and permission control steps, and instruction manual downgrade calling steps. It also includes personality management and one-click injection methods, specifically including personality template definition steps, personality injection steps, and personality visual identification steps.

[0016] Furthermore, the interruption response mechanism in the security management is implemented through a front-end console, including the following steps:

[0017] The gateway layer receives a forced termination command, locates the target connection, and issues an asynchronous termination signal. When the management terminal triggers a forced termination event, the gateway service locates the corresponding long connection instance from the memory registry based on the target agent's identifier. An emergency termination signal containing the task identifier is sent asynchronously through the long connection instance. At the same time, the gateway service updates the state of the agent in memory to non-busy and records the audit log.

[0018] The edge node receives a signaling message, which includes execution right revocation and status marking. After receiving the emergency termination signaling message, the intelligent agent process of the edge node parses the task identifier; deletes the association between the task identifier and the execution context from the task mapping table in memory, revoking its execution right; and writes a system message indicating task termination to the memory management unit.

[0019] The core engine performs dual killing: physical process killing and logical loop circuit breaking. Physical killing: The process management unit is invoked to find and terminate all process groups corresponding to the task identifier. Logical circuit breaking: In the loop iteration of the task execution engine, the task identifier is checked at a preset checkpoint to see if it still exists in the task mapping table. If it does not exist, the loop is exited and the task logic is terminated. If it exists, the task continues to be executed.

[0020] During the resource cleanup phase, fallback unbinding and status reset are performed. In the final stage of the task execution process, resource cleanup operations are performed, including: deleting the task identifier from the task mapping table; unbinding the task identifier from the streaming log output; and clearing the termination status record of the task identifier in the process management unit.

[0021] Meanwhile, the output content is processed by a privacy-preserving intelligent agent, specifically by using feature library matching technology combined with a multi-verification mechanism that performs semantic cross-review using an independent local large model, and intercepting the output stream in real time.

[0022] Furthermore, the auditing in the aforementioned security management includes:

[0023] An offline risk control agent is used to perform content security reviews on responses generated by a large language model. The review dimensions include at least detection of political, pornographic, violent, and privacy-related content. If unsafe content is detected, the response is blocked and a preset security warning message is used to replace it in the output.

[0024] Furthermore, the privacy protection includes:

[0025] Sensitive information identification: The privacy protection intelligent agent scans the multimodal data input by the user to identify the sensitive information contained therein, including customer privacy data, trade secrets, internal document identifiers, or employee personal information;

[0026] The process involves desensitizing the identified sensitive information, generating desensitized alternative data, and establishing a mapping table between the original sensitive information and the desensitized alternative data. The mapping table is stored in a local secure environment.

[0027] Task distribution involves sending a task request containing the de-identified replacement data to the business intelligence agent.

[0028] External processing: The business intelligence agent calls external APIs to execute complex tasks, including fault diagnosis, business data analysis, or cross-system process orchestration.

[0029] Result restoration: The privacy protection agent receives the processing result returned by the business agent and restores the de-identified replacement data in the result to the original sensitive information according to the mapping relationship table;

[0030] After the task is completed, the mapping table is cleared or archived according to a preset strategy.

[0031] Furthermore, the desensitization sub-step includes:

[0032] For sensitive information in text-type data, desensitization methods such as entity replacement, generalization, or encryption are used.

[0033] For sensitive information in image-type data, desensitization methods such as image region blurring, target replacement, or text erasure are used;

[0034] For sensitive information in document-type data, desensitization methods such as structured field desensitization or full-text intelligent recognition and replacement are used.

[0035] The desensitization process hides sensitive information while maintaining the business semantics and structural integrity of the original data.

[0036] Furthermore, the privacy-preserving intelligent agent employs a lightweight multimodal large language model, which possesses the following capabilities:

[0037] Image understanding ability: Recognizing text, faces, objects, and scene elements in images;

[0038] Document parsing capabilities: Parses documents in various formats and extracts sensitive fields;

[0039] Semantic comprehension ability: Judging whether information is sensitive information based on the context;

[0040] De-identification generation capability: Generate de-identified alternative data that conforms to the contextual business logic;

[0041] Preferably, the parameter size of the lightweight multimodal large language model is between 700 million and 10 billion.

[0042] Furthermore, the dual-track memory management method for intelligent agents specifically includes the following steps:

[0043] Short-term working memory loading steps: During the task execution initialization phase, the memory management unit loads the most recent N rounds of dialogue context from the short-term memory bank according to the user identifier and agent identifier, constructs it as a sliding window memory, and injects it into the agent's working memory space; where N is a configurable window size hyperparameter.

[0044] The long-term rule of thumb retrieval step involves the memory management unit sending a request to the gateway memory service to obtain a set of long-term rules of thumb that have been refined and associated with the user identifier and the agent identifier. The long-term rules of thumb are an abstract and structured expression of successful or failed experiences during the execution of historical tasks.

[0045] The system-level rule injection step involves assembling the retrieved long-term empirical rules into the header of the large model call request message list in the form of system role messages. The instruction weight of the system role messages is higher than that of user messages and assistant messages, and they are used to impose mandatory constraints on the behavior of the intelligent agent.

[0046] Furthermore, the multi-channel session management and full-duplex communication method specifically includes the following steps:

[0047] Multi-channel identity unified mapping steps: The gateway layer receives raw messages from different external channels; through the identity manager, the heterogeneous identity identifiers of each channel are uniformly replaced with the global user identifiers within the system, so that cross-channel dialogue contexts do not interfere with each other.

[0048] Full-duplex session establishment and message routing steps: The gateway layer establishes a WebSocket long connection with the front end and maintains the mapping relationship between edge worker nodes and front end sessions; When a user message is received, the gateway layer routes the message to the corresponding edge worker node through the long connection according to the target agent identifier.

[0049] The ReAct state is synchronized in real time; during task execution, the edge worker node pushes the agent's thought process, tool calls, and results to the front end in real time via the WebSocket long connection; the front end displays the thought and call process in a streaming manner, forming a typewriter animation effect.

[0050] Furthermore, the two-layer logging and auditing method specifically includes the following steps:

[0051] Task-level streaming logging steps; On the edge worker node, the task logger is responsible for recording the entire process of the current task, including: large model call requests and responses, fragmented buffering and assembly results of the standard output stream and standard error stream of tool execution;

[0052] The task-level logs are indexed by task identifiers, allowing users to query and replay them on the front end.

[0053] The system-level audit log recording steps are as follows: At the gateway layer, the audit log recorder captures and records all system-level critical events, including: circuit breaker forced termination events, configuration hot reload operations, high-risk command interception events, user login and permission changes; The system-level audit log is indexed by the global user identifier and the intelligent agent identifier, written to the audit data table, and pushed to the real-time log stream and monitoring charts of the front-end dashboard in real time.

[0054] Furthermore, the polymorphic skill management and dynamic mounting method specifically includes the following steps:

[0055] Polymorphic skill sniffing and loading steps: The skill manager automatically scans and loads skill definitions from the target directory according to a preset priority order, which is: manifest.json manifest file > .py Python script > .js JavaScript script > .sh Shell script; For successfully sniffed skills, their name, description, input parameter scheme and executable path are extracted and registered to the skill registry;

[0056] Physical isolation execution steps: When an agent decides to invoke any entity skill, the process manager creates an independent operating system process group to execute the skill; the invocation parameters are passed to the child process in structured JSON format through environment variables, and the environment variables are named SKILL_INPUT; after the skill is executed, the process manager reclaims the process group resources and captures standard output and standard error as the execution result and returns them.

[0057] Dynamic skill hot-mounting steps: Receive a dynamic skill mounting request from the management terminal, the request including the skill name and code snippet; Mount the code snippet as a memory module to the agent runtime, enabling the new skill without restarting the service;

[0058] The steps for delegating meta-skills and controlling permissions are as follows: The underlying capabilities of the system are encapsulated into meta-skills, which include: run_skill (execute any skill), list_skills (list available skills), and execute_linux_command (execute Linux commands); Through the permission tag configuration of the UI layer, the execution permissions of the meta-skills are granted or deprived to different intelligent agents or user roles, thereby controlling the dangerous operation boundaries of each intelligent agent.

[0059] The instruction manual downgrades the invocation steps as follows: When an agent attempts to invoke a target skill that cannot be directly executed, the skill manager automatically loads the instruction manual file (SKILL.md) corresponding to the skill; the content of the instruction manual is injected into the agent's context, guiding the agent to indirectly invoke the skill through the standard command-line interface (CLI).

[0060] Furthermore, the personality management and one-click injection method specifically includes the following steps:

[0061] The steps for defining a personality template include: defining a personality template data structure, which includes: a unique personality identifier, a personality name, a system prompt (i.e., "thought imprint"), and a whitelist of associated skills ("weapon list"). The system prompt is used to define the agent's role positioning, behavioral style, and response paradigm. The whitelist of associated skills is used to limit the set of skills that the personality can access.

[0062] Personality Injection Steps: In response to the "Inject Personality" operation on the target agent by the management terminal, the following sub-steps are executed: the system prompt words in the personality template are overwritten into the runtime configuration of the target agent; according to the associated skill whitelist, the corresponding skills are automatically mounted to the agent's large model tool list in standard JSON Schema format; the agent's metadata is updated, and the currently active personality identifier is marked;

[0063] The steps for visually identifying personalities are as follows: In the agent management interface, display a personality identification label for each agent: if the agent has been infused with a personality, display a label with a purple background; if the agent has not been infused with a personality, display a label with a gray background.

[0064] The present invention also provides a non-volatile computer-readable storage medium storing computer instructions, the computer instructions being used to enable the computer to perform the white-box operation and management method of the intelligent agent.

[0065] The present invention provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor implements the intelligent agent white-box operation and management method.

[0066] Compared with the prior art, the beneficial technical effects of the present invention are as follows:

[0067] 1. This application establishes a control channel between the gateway layer and the execution engine layer. When a risk event is detected or a user interrupt command is received, a termination signal is sent via WebSocket to forcibly kill the process group and clear the user task relationship mapping table in memory, thereby blocking asynchronous callbacks. This solves the problem of uncontrollability during the operation of the intelligent agent and effectively prevents the spread of errors and the expansion of losses. At the same time, the unique forced interrupt response mechanism gives the administrator the ability to "unplug the power" in abnormal states, solving the biggest compliance concern of enterprise-level AI applications.

[0068] 2. Breaking the zero-sum game between "privacy and capability," this application adopts an architecture that separates local desensitization of a lightweight multimodal model from external large-scale model API call processing. The locally deployed lightweight model identifies sensitive entities and generates desensitization instructions and mapping tables. The cloud receives requests containing desensitization instructions for business logic reasoning and API calls. After the results are returned, the local end performs a reverse restoration operation based on the mapping table. This architecture achieves data isolation, ensuring that the original data is stored locally, thus preventing the risk of internal privacy data leakage.

[0069] 3. Achieving exponential cost reduction and efficiency improvement, this application adopts a dual-track intelligent agent memory management method, which can autonomously clean and compress redundant contexts (the embodiment shows that it can save about 64% of tokens), which greatly reduces the API call overhead of enterprises;

[0070] 4. To improve operational agility and user experience, this application ensures system auditability by adopting hard-coded logs throughout the entire lifecycle. Based on the hot reload mechanism and configuration center broadcast protocol, skill modules can be dynamically mounted or unmounted without restarting the service process. Through a multi-channel identity unified mapping mechanism, multi-terminal sessions are kept synchronized, avoiding the poor experience of fragmented cross-terminal sessions. Attached Figure Description

[0071] Figure 1 This is a system architecture diagram of the white-box operation and management of the intelligent agent described in the embodiments of this application;

[0072] Figure 2 This is a flowchart illustrating the memory management implementation in the embodiments of this application.

[0073] Figure 3 This is a flowchart illustrating the privacy protection process in an embodiment of this application. Detailed Implementation

[0074] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0075] like Figure 1 As shown, this embodiment of the invention provides a device 100 for implementing the white-box operation control method of the intelligent agent, including five parallel functional modules: a security management module 110, a memory management module 120, a conversation and log management module 130, a skill and personality management module 140, and a privacy protection processing module 160; all of the above modules are communicatively connected to the central storage system 150. A typical application scenario provided by this application embodiment is a multi-tenant intelligent agent service platform. Specifically, in a multi-tenant environment, intelligent agents are managed from the aspects of data security, operation process, memory management, skills, and personality. Users can access the system described in this application through mainstream office software such as Lark and WeChat Work, or independent clients, and initiate dialogues or operation requests. Administrators configure, monitor, and adjust policies of the system through the management backend interface 143; human auditors review and check the selected memories generated by multiple intelligent agents through the human review interface 123 to ensure that the memories stored in the long-term memory bank are accurate and efficient. Specifically:

[0076] 1. The specific implementation method of the security management module is as follows:

[0077] The security management module 110 includes a dangerous command feature library 111, a manual interruption control unit 112, a monitoring dashboard unit 113, and a content security inspection unit 114. The dangerous command feature library 111 is established to automatically match and identify user-input commands.

[0078] Manual one-click interruption process:

[0079] The monitoring dashboard unit 113 collects task status parameters (such as task ID, current execution stage, etc.) of all active agents in real time. When the administrator detects abnormal behavior (such as an agent getting stuck in an API infinite loop), they can trigger an operation by clicking the "Force Kill" control for the corresponding task. After secondary confirmation, the manual interruption control unit 112 receives the force kill command and immediately sends a forced interrupt signal to the execution engine. Upon receiving the signal, the engine immediately blocks network requests or destroys the underlying thread, rolls back intermediate state data, and finally updates the dashboard status to "idle and ready".

[0080] In this embodiment, the interruption method includes: during the execution of a task by the agent, a monitoring dashboard displays the status of all ongoing tasks in real time; in response to an interruption command triggered by a user with authorization on the monitoring dashboard for a specific task, an interruption signal is generated; the agent's execution engine receives the interruption signal, uses the unique task identifier in the task's lifecycle as a tracking beacon, and the gateway pushes an emergency termination command to the edge node of the target task via WebSocket, locking and intervening in the specified running task. System-level process group intervention: the process manager sends a process group-level system kill signal to forcibly terminate child processes spawned during shell execution; atomic task termination status checkpoints are implanted in the agent's inference loop and asynchronous tool call path, and the execution flow is interrupted upon detection of the termination flag; simultaneously, the memory data structure of the task user ID mapping table is cleared, and for asynchronous callback requests sent before the kill but not yet received, callback data that cannot match a valid task status is silently discarded by verifying the task user ID mapping table; at the same time, the output content is processed by the privacy agent to restore the privacy data stream.

[0081] Instruction injection prevention and output auditing specifically include:

[0082] When a user inputs a command, the matching engine first compares the command content with the dangerous command feature library 111 (such as rules containing system-level deletion commands or unauthorized requests). After the comparison is completed, the content security inspection unit 114 performs a secondary verification on the generated response in terms of political content, pornography, and privacy leaks. Violating content will be replaced with preset security language, forming a two-way closed-loop prevention and control system. Specifically, the intelligent agent's skill parsing and encapsulation is configured to parse the metadata of open-source tool files, extract tool descriptions and execution parameters, and encapsulate them into standard skill objects that are common to the system. For security defense, a proxy layer is set up in the skill call chain. When an illegal call request for sensitive information is detected, the request is intercepted and redirected to the document viewing process to block execution.

[0083] 2. Specific Implementation of the Privacy Protection Processing Module

[0084] like Figure 3As shown, the privacy protection processing module 160 (relying on a lightweight multimodal large model deployed locally in the enterprise, with a preferred number of parameters of 700 million to 10 billion) performs the following "de-sensitization-processing-restoration" closed-loop operation: The privacy protection processing steps include: S401, the local privacy protection intelligent agent receives the multimodal request input by the user, and the request information includes sensitive text, images, documents, etc.;

[0085] S402. Identify sensitive information input by the user. The privacy protection intelligent agent scans the multimodal data input by the user and identifies the sensitive information contained therein. The sensitive information includes customer privacy data, trade secrets, internal document identifiers or employee personal information. The sensitive information is then subjected to image analysis, semantic understanding, etc.

[0086] S403. Perform structured desensitization processing, desensitize the identified sensitive information, including text generalization, image blurring, field erasure, etc., generate desensitized alternative data, and establish a mapping relationship table between the original sensitive information and the desensitized alternative data, the mapping relationship table being stored in a local secure environment;

[0087] S404. Distribute the de-identified task requests, and send the task requests containing the de-identified replacement data to the external business intelligence agent and the external API.

[0088] S405. Carrying de-identified data for external processing, the business intelligence agent calls an external API to execute a task. The complex task includes fault diagnosis, business data analysis, or cross-system process orchestration, etc. The business intelligence agent receives the returned business processing result (including the de-identified identifier); the privacy protection intelligence agent receives the returned business processing result.

[0089] S406. Result restoration: The privacy protection intelligent agent receives the processing result returned by the external business intelligent agent and restores the de-identified replacement data in the result to the original sensitive information.

[0090] S407, Seamlessly return the complete business results after restoration;

[0091] S408. Perform security cleanup. After the task is completed, clear or archive the mapping relationship table according to the preset strategy.

[0092] Example scenario: A business person requests to check the bank card business permissions of a customer in a certain image. The image contains an ID card and a handwritten bank card number.

[0093] Identification and De-identification (S402-S403): The privacy-preserving intelligent agent identifies the ID card area and the bank card number "62221234". It then blurs the ID card area and replaces the card number text with the generalized identifier "BANK_CARD_001". Simultaneously, a mapping table with expiration times is generated locally (e.g., mapping ID: map_20240521_001).

[0094] Distribution and Processing (S404-S405): The de-identified data is encapsulated and distributed to the cloud-based business intelligence agent. The business intelligence agent calls the external financial API for processing and returns a result containing the de-identified identifier (such as "BANK_CARD_001 requires ID verification").

[0095] Restoration and Cleanup (S406-S408): The privacy-preserving intelligent agent intercepts the result, uses the local mapping table to restore the identifier to the specific bank card last digit and business semantics, returns the final readable information to the user, and destroys the mapping table according to the policy.

[0096] 3. Specific Implementation of the Memory Management Module

[0097] The memory management module 120 includes a memory selection unit 121 and a memory erasure unit 122. Combined with... Figure 2 The focus is on explaining the multi-agent debate mechanism, including the steps:

[0098] S301. Obtain the original memory, read the JSNOL format dialogue record from the long-term memory bank, and receive the original dialogue record, which includes at least the interaction content and timestamp;

[0099] S302. Receive a preset memory selection strategy optimization configuration instruction. The memory selection strategy is defined by natural language prompt words. Its strategy types include: simplification strategy: requiring multi-agent debate to generate response memories with shorter text length and less token consumption; professional enhancement strategy: requiring multi-agent debate to improve the domain professionalism and data accuracy of the response content; multi-perspective comprehensive strategy: requiring multi-agent debate from conflicting or complementary perspectives to generate a comprehensive optimal response.

[0100] S303. Establish a multi-agent debate mechanism, wherein the multi-agent instances are configured with different model parameters, different prompt word templates, or different role settings to provide debate input from multiple perspectives; for example: A is a concise expert, B is a domain expert, and C is a quality reviewer.

[0101] S304, Multi-agent debate: Agents with different roles evaluate, refute, and correct candidate memories through multiple rounds of debate. The interaction process of each round of debate is recorded as a structured debate log and stored in a central storage system to form a traceable optimization link, converging to a high-quality memory. The number of iterations is set by the user or automatically and dynamically determined by the system based on the complexity and quality score of the target dialogue record.

[0102] S305. Output the memory data optimized through debate and send it for manual review;

[0103] S306. The manual reviewer performs a quality review on the memory data. If the review is passed, proceed to the next step; if it fails, return to step S304 to continue iteratively optimizing the memory data.

[0104] S307. Archive and store updated memory data that has passed manual review, store it in JSNOL format, retain debate logs and back up the original files.

[0105] To address the token waste caused by long text memory, the memory selection unit 121 reads the original dialogue records in a structured format (such as JSONL format) from the long-term memory 151.

[0106] Taking a redundant password reset dialogue (originally consuming 77 tokens) as an example, after receiving the selected strategy of "generating a concise FAQ", the system launches three agent instances:

[0107] Agent A (Simplified Expert): Advocates for extreme information compression.

[0108] Agent B (Domain Expert): Advocates for retaining complete IT support workflow steps.

[0109] Agent C (Quality Reviewer): Responsible for judging and integration.

[0110] After a predetermined number of iterative debates, agent C adopted and corrected agent B's output, generating the final memory: "Password reset steps: 1. Trigger the reset email; 2. Check the spam folder; 3. If not received, contact IT via corporate email, or try a different personal email address." The optimized JSONL memory token consumption was reduced to 28 (saving approximately 64%), and it was re-added to the database, significantly reducing the computational overhead for future retrievals.

[0111] Meanwhile, the memory erasure unit 122 supports responding to the user's request for the "right to be forgotten" and physically clearing characteristic memory fragments within a specified time period.

[0112] 4. Specific implementation of the conversation and log, skills and personality management modules.

[0113] Session and log isolation: The session and log management module 130 assigns a globally unique session ID in the central storage system 150. The central storage system 150 includes a long-term memory bank 151 and a session and log storage area 152. The log storage area 152 is used to persistently store task-level streaming logs and system-level audit logs, and respond to front-end query and playback requests. The session and log storage area 152 includes a short-term memory bank, a long-term rule of thumb bank, a task log bank, and an audit data table. The short-term memory bank and the long-term rule of thumb bank respectively store the short-term working memory and long-term rule of thumb set in the agent's dual-track memory management method. When a user switches between a PC and a mobile device, the system uses this ID to seamlessly retrieve the context. Simultaneously, the entire lifecycle of the system (including LLM calls, interrupt operations, etc.) is written to the log bank in append-only mode through hard-coded data entry, ensuring audit reliability.

[0114] The session and log management module 130 includes a session synchronization unit 131, which is used to execute the ReAct state real-time synchronization step in the multi-channel session management and full-duplex communication method, and is responsible for pushing the agent's thinking content and tool calling process to the front end in a streaming manner.

[0115] It includes a hard-coded log unit 132, which is used to perform the task-level streaming log recording step in the two-layer logging and auditing method, and is responsible for recording the fragmented buffer assembly results of the large model call requests and responses, and the standard output stream and standard error stream of the tool execution.

[0116] Hot-swappable capabilities: The Skills and Personality Management module 140 allows administrators to upload API packages for new skills or update system prompt configuration files via the console. The management engine employs server-side push or heartbeat polling mechanisms, enabling distributed agent instances to dynamically mount new skills or switch personalities without interrupting current services. The Skills and Personality Management module 140 includes a Skill Management unit 141, which executes the polymorphic skill management and dynamic mounting methods, specifically responsible for skill detection, loading, physical isolation execution, dynamic hot mounting, meta-skill delegation and access control, and instruction manual downgrade invocation.

[0117] It includes a personality management unit 142, which is used to execute the personality management and one-click injection method, specifically responsible for personality template definition, personality injection, and generation and display of personality visual identifiers.

[0118] Example 1: Automatic kill scenario based on billing budget exhaustion

[0119] This embodiment describes a complete process for automatically triggering a forced termination of an agent task when the billing probe detects that the model budget has been exhausted.

[0120] (i) The gateway layer issues a "force kill" command.

[0121] When the billing probe deployed on the gateway detects that a tenant's budget quota has been exhausted, the probe automatically calls the gateway service's kill interface (POST / agents / :agentId / kill / :taskId).

[0122] Upon receiving the request, the gateway service's internal agentManager component immediately retrieves the WebSocket long-lived connection instance corresponding to the agentId from memory. Because this system employs an asynchronous "gateway messenger" architecture, the gateway service does not wait for the command's execution result but directly sends a very lightweight JSON command through the long-lived connection: { type: 'EMERGENCY_KILL', processMessageId: 'task_12345'}.

[0123] While sending the instruction, the gateway service forcibly sets the target agent's state to busy:false in memory and asynchronously writes a red ERROR-level audit log to the database, recording "the task was automatically killed due to budget exhaustion".

[0124] (ii) Edge node response and state preemption

[0125] Upon receiving the aforementioned WebSocket message, the agent process located on the physical machine immediately enters the handleEmergencyKill processing flow.

[0126] First, the node forcibly deletes the entry corresponding to processMessageId: 'task_12345' from its maintained taskUserIdMap (a mapping table between tasks and users). This operation is equivalent to stripping the task of its identity, making it an "unregistered" user in subsequent logical checks.

[0127] Secondly, the node immediately calls the MemoryManager interface to write a system message to the task's short-term memory: "Task (task_12345) has been forcibly terminated by the administrator / system." This ensures that the task's memory flow can still form a perfect closed loop before abnormal interruption.

[0128] (III) Dual-track and dual-detection of the core engine

[0129] This is the key step in achieving "instant kill" without leaving any lingering problems. This embodiment demonstrates the specific implementation of "dual-kill" (hardware and software):

[0130] "Hard kill" (forcefully killing the physical process group):

[0131] To prevent a large model from executing an infinitely looping Python script or a blocking ping command, the node calls `processManager.killProcessGroup('task_12345')`. This method leverages the process group feature of the Linux operating system, sending a SIGKILL signal to the process group ID (i.e., -PID) to achieve a "cascading kill" of the entire task process tree (parent process and all its child processes). This ensures that even if a high-risk command is running, it can be completely terminated without leaving any zombie processes consuming CPU resources.

[0132] "Soft kill" (ReAct cyclic circuit breaker):

[0133] Meanwhile, within the while loop of the handleTaskExecution function, which handles the large model's "think-act" loop (ReActLoop), multiple circuit breaker probes are pre-deployed. For example:

[0134] Before making an HTTP request to the large model, check: if (processManager.isKilled('task_12345')) { break;}

[0135] Upon receiving the tool invocation instruction returned by the large model, before executing the tool, check the following: if (!taskUserIdMap.has('task_12345')) { finalReply = "The task has been terminated."; break;}

[0136] Perform the same checks as above before reorganizing the prompt after the tool returns from execution.

[0137] Since the entries in taskUserIdMap have been deleted in step (ii), when the code runs to any checkpoint, it will immediately detect the abnormal task status, thereby breaking out of the while loop and preventing any subsequent large model requests or tool calls, thus achieving fast circuit breaking at the logical level.

[0138] (iv) The ultimate fallback strategy (Finally block)

[0139] Forced termination is also a form of exit, but it's crucial to ensure a clean environment and prevent contamination of the next task. In the Worker execution engine's try...catch...finally structure, the code within the finally block guarantees execution regardless of how the task ends.

[0140] Through the close coordination of the above four stages, this embodiment achieves precise, rapid and thorough remote termination of remote agent tasks, solving the technical problems of high latency, resource residue and state pollution in traditional solutions, and truly realizing the white-box operation and refined management of intelligent agents.

[0141] Example 2: Intelligent Agent Task Execution Scenario Based on Dual-Track Memory

[0142] This embodiment describes how an edge agent, when initiating a task, uses a dual-track memory mechanism of "short-term working memory + long-term subconscious retrieval" to achieve a complete process that ensures both dialogue continuity and self-evolution capabilities.

[0143] (a) Technical problem statement

[0144] Traditional intelligent agent memory management schemes have the following drawbacks:

[0145] Context explosion: Directly cramming all historical dialogues into a large model results in huge token consumption and increased inference latency.

[0146] Attention dilution: Key experiences are submerged in massive amounts of dialogue, and the attention mechanism of large models struggles to focus on truly important historical lessons.

[0147] Unable to evolve: The agent cannot "learn" anything from past tasks, and the same mistakes will be repeated.

[0148] The dual-track memory scheme proposed in this invention is precisely designed to solve the above-mentioned problems.

[0149] (II) System Architecture Overview

[0150] The memory system in this embodiment adopts a distributed architecture of "centralized storage at the gateway + on-demand retrieval at the edge":

[0151] Gateway layer: Deploys the Memory Service, which is responsible for the persistent storage of short-term memory and the maintenance and refinement of long-term rules of thumb.

[0152] Edge Worker Layer: Integrates a MemoryManager unit, which is responsible for fetching memory on demand before task execution and reporting new experiences to the gateway after task execution.

[0153] (III) Specific Implementation Process

[0154] Step 1: Loading Short-Term Working Memory

[0155] When user_zhang initiates a new task request to agent_bilibili_downloader, the MemoryManager on the edge worker node first performs short-term memory loading:

[0156] The loading operation retrieves the raw dialogue content of the most recent 10 rounds (user-assistant alternation pairs) from the short-term memory of the gateway memory service in reverse chronological order, without performing any semantic compression or summarization processing. This ensures that the agent can fully understand what the user just said and what it previously replied when processing the current task, thus achieving smooth multi-turn dialogue transitions.

[0157] For example, if a user said "Help me download this video from Bilibili: BV1xx411A7xx" in the previous round, and then says "Use the highest quality" in this round, short-term working memory allows the agent to remember the target "BV1xx411A7xx", thus correctly performing parameter completion.

[0158] Old conversations that have lasted more than 10 rounds are automatically discarded, effectively controlling token consumption.

[0159] Step Two: Long-term rule of thumb for data retrieval

[0160] While loading short-term memory, MemoryManager concurrently sends another HTTP request to the gateway memory service:

[0161] GET / api / memory / rules / active?userId=user_zhang&agentId=agent_bilibili_downloader

[0162] This interface returns all active long-term rules of thumb associated with the user and the agent combination. These rules are not the original dialogue, but rather structured rules generated after processing by a separate "experience refinement service".

[0163] For example, suppose user_zhang previously encountered a download failure (Bilibili returned a 403 Forbidden error) when using agent_bilibili_downloader because the --cookie parameter was not included. After that failure was logged by the system, the experience refinement service automatically generated the following rules by analyzing the error patterns in the logs:

[0164] json

[0165] {

[0166] "ruleId": "rule_bilibili_cookie_001",

[0167] "type": "negative_constraint",

[0168] "trigger": "The task involves downloading the bilibili.com domain",

[0169] "content": "When downloading Bilibili videos, a valid --cookie parameter must be included in the command; otherwise, access will be denied due to the anti-hotlinking mechanism."

[0170] "priority": 9

[0171] }

[0172] For example, if a user has previously successfully downloaded a high-bitrate video, the purification service can extract positive rules from the successful download trajectory:

[0173] json

[0174] {

[0175] "ruleId": "rule_bilibili_quality_002",

[0176] "type": "positive_guidance",

[0177] "trigger": "User requests 'highest quality' or '4K'",

[0178] "content": "The --quality=112 parameter (for 4K quality) should be used instead of the default 80 (for 1080P). "

[0179] "priority": 8

[0180] }

[0181] Step 3: Injection of System-Level Laws

[0182] This is another innovative aspect of the invention. MemoryManager doesn't simply feed the above rules to the large model as ordinary historical messages; instead, it injects them into the prompt words with the highest weight and a system role.

[0183] const systemRulesPrompt = `

[0184] [System-mandated constraints: Refinement experience derived from past history]

[0185] As an intelligent agent, you must absolutely abide by the following long-standing laws derived from past tasks.

[0186] These rules take precedence over any regular instructions and must not be violated:

[0187] 1. [Mandatory Rule] When downloading Bilibili videos, you must include a valid --cookie parameter in the command; otherwise, access will be denied due to the anti-hotlinking mechanism.

[0188] 2. [Recommended Rule] When a user requests 'highest quality' or '4K', the --quality=112 parameter (corresponding to 4K quality) should be used instead of the default 80 (corresponding to 1080P).

[0189] Note: The above rules are based on experience from past missions, and violating them may result in mission failure.

[0190] / / List of request messages for assembling the final large model

[0191] const messages = [

[0192] { role: "system", content: systemRulesPrompt}, / / Highest weight

[0193] ...shortTermMemory, / / Short-term working memory

[0194] { role: "user", content: currentUserInput} / / Current user input ];

[0196] In the Attention mechanism of large models, messages from the system role are at the beginning of the sequence and have a special label, so their instruction weights are naturally higher than those of subsequent user and assistant messages. This is equivalent to imprinting a "thought imprint" on the agent—no matter how the user asks questions or what interference information is in short-term memory, these long-term rules of thumb will be followed as the highest guiding principles.

[0197] (iv) Verification of technical effects

[0198] In the above scenario, when the user issues the command "Download BV1xx411A7xx for me, highest quality" again:

[0199] Without the solution of this invention: the agent may directly execute youtube-dl https: / / bilibili.com / video / BV1xx..., which results in a 403 error because it does not carry cookies, and the image quality parameters use the default values, so the user gets a low-quality file.

[0200] The solution adopted in this invention is as follows: In the ReAct loop of the agent, the system prompts already include the mandatory rules of "cookies must be carried" and "highest quality with --quality=112". Therefore, the agent will plan the correct command: youtube-dl --cookie cookies.txt --quality 112 https: / / bilibili.com / video / BV1xx..., and successfully complete the task in one go.

[0201] (V) Experience Refinement and Self-Evolution

[0202] The dual-track memory system of this invention is not static but possesses self-evolution capabilities: After each task is completed, the Worker reports the complete trajectory of the task (including user input, agent thinking, tool calls, and final results) to the gateway memory service. Asynchronous refinement processing: An independent experience refinement service (which can be deployed as an offline Spark task or an online stream processing service) analyzes these trajectories: If a task fails, the failure node is located (e.g., a tool call returns a 403 error), the cause of failure is extracted, and negative constraint rules are generated. If a task succeeds and yields excellent results, key decision points are analyzed, and positive guidance rules are generated. Rule review and activation: Newly generated rules, after undergoing confidence evaluation (e.g., the same pattern appears more than 3 times), are written into the long-term experience base and marked as active for subsequent tasks to retrieve.

[0203] Through this mechanism, the agent learns every time it performs a task, and each use by the user makes the agent "smarter".

[0204] Example 3: Multi-channel session management and full-duplex real-time communication scenario

[0205] This embodiment describes the complete process of how the system achieves unified identity mapping, full-duplex message routing, and real-time synchronization of ReAct status when a user interacts with the intelligent agent through different external channels (Web console, Lark, WeChat Work, etc.).

[0206] (a) Technical problem statement

[0207] Traditional intelligent agent interaction schemes have the following drawbacks:

[0208] Channel fragmentation: Conversations between users on the Web console and Lark cannot be communicated, and the same agent appears as multiple "split" instances on different channels.

[0209] Message delay: The use of HTTP polling to obtain agent responses results in poor real-time performance and high server load.

[0210] State black box: Users can only see the final result, but cannot observe the agent's thinking process and tool call details, making it difficult to understand the agent's behavior and detect problems in a timely manner.

[0211] The multi-channel session management and full-duplex communication scheme proposed in this invention is precisely designed to solve the above-mentioned problems.

[0212] (II) System Architecture Overview

[0213] In this embodiment, the session module adopts a separate architecture of "unified gateway access + edge worker execution":

[0214] Gateway layer: Maintains the WebSocket long connection manager, identity mapper (IdentityManager), and message router.

[0215] Edge Worker Layer: Responsible for executing tasks and pushing status updates through the gateway.

[0216] (III) Specific Implementation Process

[0217] Step 1: Unified Mapping of Multi-Channel Identity

[0218] When user Zhang San sends the message "Please check my order status" to the intelligent agent customer_service_agent on WeChat Work, the WeChat Work callback interface forwards the original message to the gateway. The message body contains the WeChat Work user ID (e.g., zhangsan_corp_001).

[0219] After receiving this message, the IdentityManager in the gateway layer performs identity mapping:

[0220] / / Channel type + raw ID → global user ID

[0221] const globalUserId = identityManager.map({

[0222] channel: 'wecom', / / Enterprise WeChat channel

[0223] originalId: 'zhangsan_corp_001',

[0224] tenantId: 'tenant_abc'

[0225] });

[0226] / / Output: 'user_8723647e-9a4b-4c2f-b81e-5a6f8c9d2e1a'

[0227] If the same user logs in through the web console, their JWT token will already contain the same globalUserId. This ensures that regardless of which channel the user initiates the conversation from, the system can identify them as the same user, guaranteeing that the conversation context is not cross-platform and that the historical messages seen by the user are consistent across all channels.

[0228] Step 2: Full-duplex session establishment and message routing

[0229] When a user opens the web console and selects a smart agent, the frontend establishes a long-lived WebSocket connection with the gateway, carrying the userId and agentId with it. The gateway's SessionManager maintains the following mapping table 1:

[0230] Table 1

[0231]

[0232] When a user sends a message on WeChat Work, the gateway layer executes the following routing logic: it maps the WeChat Work user ID to globalUserId through IdentityManager; it looks up the corresponding WebSocket connection from the mapping table based on globalUserId and agentId specified in the message; if the user also has a page open in the web console, it pushes the message in real time through this connection to achieve multi-device synchronization; at the same time, the gateway finds the edge worker node (e.g., worker_node_03) currently running for the agent based on agentId and forwards the user message to it through the worker's HTTP interface.

[0233] Step 4: Real-time synchronization of ReAct status

[0234] After receiving a user message, the edge worker node initiates the task execution process. Within the agent's larger ReAct model loop, the worker pushes the status of each step in real time via the gateway's WebSocket connection.

[0235] / / Worker side: Push status during execution

[0236] await gatewayPush({

[0237] type: 'THOUGHT',

[0238] taskId: 'task_12345',

[0239] Content: 'To check the order status, I need to first call the order query tool with the parameter orderId=123456'

[0240] });

[0241] / / Actual tool call

[0242] await gatewayPush({

[0243] type: 'ACTION',

[0244] taskId: 'task_12345',

[0245] toolName: 'query_order',

[0246] params: { orderId: '123456'}

[0247] });

[0248] / / Tool returns results

[0249] await gatewayPush({

[0250] type: 'OBSERVATION',

[0251] taskId: 'task_12345',

[0252] Content: 'Order status: Shipped, tracking number SF1234567890'

[0253] });

[0254] After receiving these messages, the front end displays the thought process word by word in the chat box with a typewriter animation effect, allowing users to clearly see each step of the agent's decision. This "white-box" display method not only enhances users' trust but also facilitates quick problem location when tasks fail (e.g., discovering that the agent has called the wrong tool parameters).

[0255] (iv) Verification of technical effects

[0256] The solution adopted in this embodiment:

[0257] After a user initiates a conversation on Lark, they can open the Web console to see the complete conversation history and the agent's thought process. When the agent performs a task, the user can see real-time statuses such as "thinking...", "calling the order query tool...", and "query results returned...", resulting in a significantly improved waiting experience. The gateway maintains long connections instead of polling, reducing server resource consumption by approximately 80%.

[0258] Example 4: Two-layer logging and auditing module scenario;

[0259] This embodiment describes how the system achieves enterprise-level compliance requirements of task reproducibility and operation traceability through a two-layer design of "task-level streaming logs + system-level audit logs".

[0260] (a) Technical problem statement

[0261] Traditional logging schemes for intelligent agent systems have the following drawbacks:

[0262] Log mix-up: User operation logs and system low-level logs are mixed together, making them difficult to distinguish and retrieve.

[0263] Fragment loss: The output of the underlying process is returned in fragments. Simple splicing may result in out-of-order or frame loss, affecting log readability.

[0264] No security audit: There is no dedicated audit link for high-risk operations (such as forced termination of tasks, heavy-load configuration), which fails to meet the enterprise's compliance requirements.

[0265] (II) System Architecture Overview

[0266] This embodiment adopts a two-layer log architecture of "edge recording + gateway aggregation":

[0267] Worker layer (task level): TaskLogger is responsible for recording the detailed execution process of a single task, including large model interactions and tool output.

[0268] Gateway layer (system level): AuditLogger is responsible for recording all critical operation events across tasks and users.

[0269] (III) Specific Implementation Process

[0270] Step 1: Task-level streaming log recording and fragmented buffer assembly

[0271] When a worker executes a task involving an underlying process group (such as executing a Python script), the process group produces multiple lines of standard output / standard error output, which are returned in fragments.

[0272] TaskLogger has a built-in fragment buffer assembly algorithm:

[0273] class OutputBuffer {

[0274] private buffer: Map<number, string> = new Map(); / / Sequence number → Fragment

[0275] private expectedSeq: number = 0;

[0276] onChunk(seq: number, chunk: string) {

[0277] this.buffer.set(seq, chunk);

[0278] this.flushCompleteLines();

[0279] }

[0280] private flushCompleteLines() {

[0281] while (this.buffer.has(this.expectedSeq)) {

[0282] const chunk = this.buffer.get(this.expectedSeq);

[0283] this.buffer.delete(this.expectedSeq);

[0284] / / Split by lines and write to the log

[0285] const lines = chunk.split('\n');

[0286] for (const line of lines) {

[0287] if (line.trim()) {

[0288] this.writeToLog(line);

[0289] }

[0290] }

[0291] this.expectedSeq++;

[0292] }

[0293] }

[0294] }

[0295] This algorithm ensures that regardless of the order in which the fragments arrive, the final log entries are rows that are completely assembled in chronological order, thus avoiding issues such as "garbled characters" or "wrong lines".

[0296] For example, if a user executes `ping -c 3 google.com`, the output fragments may arrive out of order:

[0297] First received fragment 3: rtt min / avg / max / mdev = 14.3

[0298] Later received fragment 1: PING google.com (142.250.185.46)

[0299] Received fragment 2: 64 bytes from ...

[0300] The buffer assembly algorithm first caches fragment 3, and after fragments 1 and 2 arrive, it writes them to the log in the correct order 1→2→3, so that the log seen by the end user is complete and correct.

[0301] Step 2: System-level audit log capture and real-time push

[0302] At the gateway layer, all critical operations are intercepted and logged by the AuditLogger. The following is a typical scenario:

[0303] Scenario A: Billing-based circuit breaker forced termination

[0304] When the billing probe detects that the budget has been exhausted and automatically triggers EMERGENCY_KILL, the gateway records:

[0305] json

[0306] {

[0307] "eventId": "evt_20260402_001",

[0308] "eventType": "EMERGENCY_KILL",

[0309] "timestamp": "2026-04-02T10:35:22.123Z",

[0310] "triggerSource": "finops_budget_exhausted",

[0311] "userId": "user_8723647e-...",

[0312] "agentId": "agent_bilibili_downloader",

[0313] "taskId": "task_12345",

[0314] "details": {

[0315] "budgetLimit": 100.00,

[0316] "currentCost": 100.05,

[0317] "action": "force_terminate"

[0318] }

[0319] }

[0320] Scenario B: Administrator configures hot reload

[0321] After the operations and maintenance personnel modified the security policy configuration in the backend and clicked "hot reload", the gateway recorded:

[0322] json

[0323] {

[0324] "eventId": "evt_20260402_002",

[0325] "eventType": "CONFIG_RELOAD",

[0326] "timestamp": "2026-04-02T11:20:15.678Z",

[0327] "triggerSource": "admin_console",

[0328] "operatorId": "admin_li",

[0329] "details": {

[0330] "configType": "security_policy",

[0331] "version": "v2.3.1",

[0332] "affectedAgents": ["agent_bilibili_downloader", "agent_file_processor"]

[0333] }

[0334] }

[0335] Scenario C: High-risk command interception

[0336] When the security policy engine detects that a user intends to execute dangerous commands such as `rm -rf / `, the Worker will report this to the gateway after interception.

[0337] json

[0338] {

[0339] "eventId": "evt_20260402_003",

[0340] "eventType": "COMMAND_BLOCKED",

[0341] "timestamp": "2026-04-02T14:05:30.001Z",

[0342] "userId": "user_malicious",

[0343] "taskId": "task_67890",

[0344] "details": {

[0345] "blockedCommand": "rm -rf / ",

[0346] "blockReason": "regex_pattern_matched: 'rm -rf / '",

[0347] "policyId": "sec_policy_high_risk_001"

[0348] }

[0349] }

[0350] Step 3: Displaying Real-Time Log Streams on the Front End

[0351] The aforementioned audit logs are simultaneously pushed to the "Live Terminal" component of the operations and maintenance dashboard via the gateway's WebSocket connection.

[0352] Operations and maintenance personnel can see scrolling log entries on the large screen, with different types of logs identified by different colors:

[0353] Red: EMERGENCY_KILL - Need to be followed immediately

[0354] Yellow: COMMAND_BLOCKED - Security Alert

[0355] Blue: CONFIG_RELOAD - Configuration Change

[0356] Meanwhile, the system automatically aggregates and generates monitoring charts based on eventType, such as: "Today's Strong Kill Event Trend Chart" which displays the number of circuit breakers by hour, "High-Risk Command Interception TOP List" which displays the most frequently intercepted command patterns, and "Configuration Change Record Table" for audit traceability.

[0357] (iv) Verification of technical effects

[0358] Through the dual-layer logging scheme in this embodiment, compliance is ensured: enterprise auditors can directly query the system-level audit log table to confirm that all high-risk operations are recorded and cannot be tampered with. Reproducibility is enhanced: when users encounter task failures, they can view complete task-level streaming logs, including the agent's thought process, every parameter and return value of the tool call, and the complete output of the underlying process, facilitating precise problem localization. Real-time monitoring is provided: the real-time log stream on the operations and maintenance dashboard allows operations and maintenance personnel to detect problems in the first second of a failure (such as a forced shutdown triggered by budget exhaustion) and intervene promptly.

[0359] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. For those skilled in the art, any equivalent substitutions, structural combinations, or algorithmic tweaks made without departing from the core mechanism and principles of the present invention should be included within the patent protection scope of the present invention.

Claims

1. A white-box operation and management method for intelligent agents, characterized in that, Including the following methods: Security management includes risk identification of instructions or actions during user-agent interaction and agent tool invocation, and provides an interruption response mechanism that allows authorized users to interrupt ongoing agent tasks in real time. Simultaneously, an offline risk control agent is used to review the responses generated by the large language model during the interaction process and filter responses containing sensitive or harmful information. Privacy protection includes a privacy protection intelligent agent, which is configured to identify and de-identify sensitive information, and send the de-identified information to a business intelligent agent to call an external API to execute business tasks; After receiving the processing result from the business intelligence agent, the information of the processing result is restored according to the mapping relationship established during the de-identification, and the restored result is returned to the corresponding user. The privacy-protecting intelligent agent is deployed on a local server or edge node, forming a collaborative architecture with the business intelligent agent deployed locally, in the cloud, or on an external network and calling external APIs. Memory management, including a dual-track memory management method for intelligent agents, which includes a short-term working memory loading step, a long-term rule of experience retrieval step, and a system-level rule injection step; Session management includes using a multi-channel session management and full-duplex communication method to manage the session of an agent. The multi-channel session management and full-duplex communication method includes a multi-channel identity unified mapping step, a full-duplex session establishment and message routing step, and a ReAct state real-time synchronization step. Log management includes using a two-layer logging and auditing approach to manage the logs of intelligent agents, specifically including task-level streaming log recording steps and system-level audit log recording steps; Skill and personality management includes using polymorphic skill management and dynamic mounting methods to manage the skills and personality of intelligent agents. Specifically, this includes polymorphic skill sniffing and loading steps, physical isolation execution steps, dynamic skill hot mounting steps, meta-skill delegation and permission control steps, and instruction manual downgrade calling steps. It also includes personality management and one-click injection methods, specifically including personality template definition steps, personality injection steps, and personality visual identification steps.

2. The method for white-box operation and management of an intelligent agent according to claim 1, characterized in that, The interruption response mechanism in the security management is implemented through the front-end console, including the following steps: The gateway layer receives a forced termination command, locates the target connection, and issues an asynchronous termination signal. When the management terminal triggers a forced termination event, the gateway service locates the corresponding long connection instance from the memory registry based on the target agent's identifier. An emergency termination signal containing the task identifier is sent asynchronously through the long connection instance. At the same time, the gateway service updates the state of the agent in memory to non-busy and records the audit log. The edge node receives a signaling message, which includes execution right revocation and status marking. After receiving the emergency termination signaling message, the intelligent agent process of the edge node parses the task identifier; deletes the association between the task identifier and the execution context from the task mapping table in memory, revoking its execution right; and writes a system message indicating task termination to the memory management unit. The core engine performs dual killing: physical process killing and logical loop circuit breaking. Physical killing: The process management unit is invoked to find and terminate all process groups corresponding to the task identifier. Logical circuit breaking: In the loop iteration of the task execution engine, the task identifier is checked at a preset checkpoint to see if it still exists in the task mapping table. If it does not exist, the loop is exited and the task logic is terminated. If it exists, the task continues to be executed. During the resource cleanup phase, fallback unbinding and status reset are performed. In the final stage of the task execution process, resource cleanup operations are performed, including: deleting the task identifier from the task mapping table; unbinding the task identifier from the streaming log output; and clearing the termination status record of the task identifier in the process management unit. Meanwhile, the output content is processed by a privacy-preserving intelligent agent, specifically by using feature library matching technology and a multi-verification mechanism that combines independent local large models for semantic cross-review to intercept the output stream in real time. The audit in the aforementioned security management includes: An offline risk control agent is used to perform content security reviews on responses generated by a large language model. The review dimensions include at least detection of political, pornographic, violent, and privacy-related content. If unsafe content is detected, the response is blocked and a preset security warning message is used to replace it in the output.

3. The method for white-box operation and management of an intelligent agent according to claim 1, characterized in that, The privacy protections include: Sensitive information identification: The privacy protection intelligent agent scans the multimodal data input by the user to identify the sensitive information contained therein, including customer privacy data, trade secrets, internal document identifiers, or employee personal information; The process involves desensitizing the identified sensitive information, generating desensitized alternative data, and establishing a mapping table between the original sensitive information and the desensitized alternative data. The mapping table is stored in a local secure environment. Task distribution involves sending a task request containing the de-identified replacement data to the business intelligence agent. External processing: The business intelligence agent calls external APIs to execute complex tasks, including fault diagnosis, business data analysis, or cross-system process orchestration. Result restoration: The privacy protection agent receives the processing result returned by the business agent and restores the de-identified replacement data in the result to the original sensitive information according to the mapping relationship table; After the task is completed, the mapping table is cleared or archived according to a preset strategy.

4. The method for white-box operation and management of an intelligent agent according to claim 3, characterized in that, The desensitization process sub-step includes: For sensitive information in text-type data, desensitization methods such as entity replacement, generalization, or encryption are used. For sensitive information in image-type data, desensitization methods such as image region blurring, target replacement, or text erasure are used; For sensitive information in document-type data, desensitization methods such as structured field desensitization or full-text intelligent recognition and replacement are used. The desensitization process hides sensitive information while maintaining the business semantics and structural integrity of the original data.

5. A method for the white-box operation and management of an intelligent agent according to claim 1 or 4, characterized in that, The privacy-preserving intelligent agent employs a lightweight multimodal large language model, which possesses the following capabilities: Image understanding ability: Recognizing text, faces, objects, and scene elements in images; Document parsing capabilities: Parses documents in various formats and extracts sensitive fields; Semantic comprehension ability: Judging whether information is sensitive information based on the context; De-identification generation capability: Generate de-identified alternative data that conforms to the contextual business logic; The parameters of the lightweight multimodal large language model are between 700 million and 10 billion.

6. The method for white-box operation and management of an intelligent agent according to claim 1, characterized in that, The aforementioned dual-track memory management method for intelligent agents specifically includes the following steps: Short-term working memory loading steps: During the task execution initialization phase, the memory management unit loads the most recent N rounds of dialogue context from the short-term memory bank according to the user identifier and agent identifier, constructs it as a sliding window memory, and injects it into the agent's working memory space; where N is a configurable window size hyperparameter. The long-term rule of thumb retrieval step involves the memory management unit sending a request to the gateway memory service to obtain a set of long-term rules of thumb that have been refined and associated with the user identifier and the agent identifier. The long-term rules of thumb are an abstract and structured expression of successful or failed experiences during the execution of historical tasks. The system-level rule injection step involves assembling the retrieved long-term empirical rules into the header of the large model call request message list in the form of system role messages. The instruction weight of the system role messages is higher than that of user messages and assistant messages, and they are used to impose mandatory constraints on the behavior of the intelligent agent.

7. The method for white-box operation and management of an intelligent agent according to claim 1, characterized in that, The multi-channel session management and full-duplex communication method specifically includes the following steps: Multi-channel identity unified mapping steps: The gateway layer receives raw messages from different external channels; through the identity manager, the heterogeneous identity identifiers of each channel are uniformly replaced with the global user identifiers within the system, so that cross-channel dialogue contexts do not interfere with each other. Full-duplex session establishment and message routing steps: The gateway layer establishes a WebSocket long connection with the front end and maintains the mapping relationship between edge worker nodes and front end sessions; When a user message is received, the gateway layer routes the message to the corresponding edge worker node through the long connection according to the target agent identifier. The ReAct state is synchronized in real time; during task execution, the edge worker node pushes the agent's thought process, tool calls, and results to the front end in real time via the WebSocket long connection; the front end displays the thought and call process in a streaming manner, forming a typewriter animation effect.

8. The method for white-box operation and management of an intelligent agent according to claim 1, characterized in that, The two-layer logging and auditing method specifically includes the following steps: Task-level streaming logging steps; On the edge worker node, the task logger is responsible for recording the entire process of the current task, including: large model call requests and responses, fragmented buffering and assembly results of the standard output stream and standard error stream of tool execution; The task-level logs are indexed by task identifiers, allowing users to query and replay them on the front end. The system-level audit log recording steps are as follows: At the gateway layer, the audit log recorder captures and records all system-level critical events, including: circuit breaker forced termination events, configuration hot reload operations, high-risk command interception events, user login and permission changes; The system-level audit log is indexed by the global user identifier and the intelligent agent identifier, written to the audit data table, and pushed to the real-time log stream and monitoring charts of the front-end dashboard in real time.

9. The method for white-box operation and management of an intelligent agent according to claim 1, characterized in that, The method for managing and dynamically mounting polymorphic skills specifically includes the following steps: Polymorphic skill sniffing and loading steps: The skill manager automatically scans and loads skill definitions from the target directory according to a preset priority order, which is: manifest.json manifest file > .py Python script > .js JavaScript script > .sh Shell script; For successfully sniffed skills, their name, description, input parameter scheme and executable path are extracted and registered to the skill registry; Physical isolation execution steps: When an agent decides to invoke any entity skill, the process manager creates an independent operating system process group to execute the skill; the invocation parameters are passed to the child process in structured JSON format through environment variables, and the environment variables are named SKILL_INPUT; after the skill is executed, the process manager reclaims the process group resources and captures standard output and standard error as the execution result and returns them. Dynamic skill hot-mounting steps: Receive a dynamic skill mounting request from the management terminal, the request including the skill name and code snippet; Mount the code snippet as a memory module to the agent runtime, enabling the new skill without restarting the service; The steps for meta-skill decentralization and permission control include: encapsulating the system's underlying capabilities into meta-skills, which include: run_skill, list_skills, and execute_linux_command; and granting or depriving different agents or user roles of execution permissions for the meta-skills through permission tag configuration in the UI layer, thereby controlling the dangerous operation boundaries of each agent. The instruction manual outlines the downgraded invocation steps: When an agent attempts to invoke a target skill that cannot be directly executed, the skill manager automatically loads the instruction manual file corresponding to the skill; the content of the instruction manual is injected into the agent's context, guiding the agent to indirectly invoke the skill through a standard command-line interface.

10. The method for white-box operation and management of an intelligent agent according to claim 1, characterized in that, The personality management and one-click injection method specifically includes the following steps: Steps for defining a personality template: Define the personality template data structure, which includes: a unique personality identifier, a personality name, system prompt words, and a whitelist of associated skills; the system prompt words are used to define the agent's role positioning, behavioral style, and response paradigm; the whitelist of associated skills is used to limit the set of skills that the personality can access; Personality Injection Steps: In response to the "Inject Personality" operation on the target agent by the management terminal, the following sub-steps are performed: the system prompt words in the personality template are overwritten into the runtime configuration of the target agent; according to the associated skill whitelist, the corresponding skills are automatically mounted to the agent's large model tool list in standard JSON Schema format; the agent's metadata is updated, and the currently active personality identifier is marked; The steps for visually identifying personalities are as follows: In the agent management interface, display a personality identification label for each agent: if the agent has been infused with a personality, display a label with a purple background; if the agent has not been infused with a personality, display a label with a gray background.

11. A non-volatile computer-readable storage medium, characterized in that, The non-volatile computer-readable storage medium stores computer instructions for causing the computer to execute the agent white-box operation and management method as described in any one of claims 1 to 10.

12. An electronic device, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the at least one processor to implement the agent white-box operation and management method as described in any one of claims 1 to 10.

Images