From af141845ed4de4da6b7b9c472c103ef72425b9d9 Mon Sep 17 00:00:00 2001
From: wuyang <5700876+banisherwy@user.noreply.gitee.com>
Date: Sun, 26 Jul 2026 16:03:59 +0800
Subject: [PATCH] fix: bound Work model generation

---
 agent_platform/runtime/provider.py | 2 ++
 docs/operations.md                 | 7 +++++++
 tests/test_provider.py             | 4 +++-
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/agent_platform/runtime/provider.py b/agent_platform/runtime/provider.py
index bf8c449..1c93da7 100644
--- a/agent_platform/runtime/provider.py
+++ b/agent_platform/runtime/provider.py
@@ -9,6 +9,7 @@ from agent_platform.config import Settings
 
 TRANSIENT_COMPLETE_STATUS_CODES = frozenset({408, 425, 429, 500, 502, 503, 504, 524})
 COMPLETE_MAX_ATTEMPTS = 2
+COMPLETE_MAX_TOKENS = 4096
 MAX_RETRY_DELAY_SECONDS = 5.0
 
 
@@ -152,6 +153,7 @@ class ModelProvider:
             "model": model,
             "messages": messages,
             "stream": True,
+            "max_tokens": COMPLETE_MAX_TOKENS,
         }
         if tools:
             payload["tools"] = tools
diff --git a/docs/operations.md b/docs/operations.md
index 92451b1..d95c205 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -7,6 +7,8 @@
 - Public host port: `12004`
 - Execution provider: `ssh-docker`
 - Execution host Docker root: `/srv/k1412-data/docker`
+- Runtime model API route: `http://172.31.0.1:3000` (NAS host gateway
+  from the `k1412-agent_egress` network, bypassing the public proxy)
 - Execution host workspace volumes: Docker volumes named
   `k1412-ws-data-<hashed-user-id>`
 
@@ -32,6 +34,11 @@ Copy `deploy/docker-compose.yml`, `deploy/docker-compose.override.yml`, and
 tags and non-secret settings in the protected `.env`, validate with
 `docker compose config`, pull, and recreate.
 
+On the NAS deployment, set `MODEL_API_BASE_URL` to the internal model API route
+listed above. `https://api.k1412.top` remains the external API entrypoint, but
+Runtime must not send long-running Agent inference through the public reverse
+proxy.
+
 The SSH override removes `/var/run/docker.sock` from Gateway and mounts the
 dedicated SSH directory read-only at `/root/.ssh`.
 
diff --git a/tests/test_provider.py b/tests/test_provider.py
index 28ed69b..bfc5263 100644
--- a/tests/test_provider.py
+++ b/tests/test_provider.py
@@ -136,7 +136,9 @@ async def test_complete_aggregates_streamed_tool_call(settings: Settings) -> Non
     body = "".join(f"data: {json.dumps(chunk)}\n\n" for chunk in chunks) + "data: [DONE]\n\n"
 
     def handler(request: httpx.Request) -> httpx.Response:
-        assert json.loads(request.content)["stream"] is True
+        request_payload = json.loads(request.content)
+        assert request_payload["stream"] is True
+        assert request_payload["max_tokens"] == 4096
         return httpx.Response(
             200,
             request=request,