@armadra/agent 0.10.0 → 0.11.0

package/dist/modes/commands-core.d.ts

@@ -58,8 +58,15 @@ export interface CommandInfo {
     name: string;
     args?: string;
     description: string;
+    /** 只在该能力可用时列出（`/help`、补全、RPC `get_commands`）；输入时照常分派。 */
+    requires?: "memory" | "task";
 }
 export declare const BUILTIN_COMMANDS: readonly CommandInfo[];
+/**
+ * 能力关闭的命令不列出（capability-off.test.ts 锁定）：memory = 记忆工具已注册（`memory.enabled`）；
+ * task = 模型能直接调 `task`，或能经 codemode 脚本调（`task` 已注册且 codemode 在活动集）。
+ */
+export declare function availableCommands(runtime: Pick<Runtime, "tools">, session: Pick<AgentSession, "getTools">, list?: readonly CommandInfo[]): CommandInfo[];
 export declare function parseSlash(line: string): {
     name: string;
     args: string;

package/dist/modes/commands-core.js

@@ -66,7 +66,9 @@ export const BUILTIN_COMMANDS = [
     command("cache", "cache", "[warm off|streaming|idle | fingerprint]"),
     command("statusline", "statusline", "[full|compact]"),
     command("plan", "plan", { key: "planArgs" }),
-    command("tasks", "tasks", "[id] | stop <id> | bg [id]"),
+    Object.assign(command("tasks", "tasks", "[id] | stop <id> | bg [id]"), {
+        requires: "task",
+    }),
     command("agents", "agents"),
     command("paste", "paste"),
     command("interrupt", "interrupt", { key: "interruptArgs" }),
@@ -74,8 +76,24 @@ export const BUILTIN_COMMANDS = [
     // [W6-C0] 第六波（W6-S / W6-T1 / W6-M 实现）
     command("config", "config", "[key=value]"),
     command("trace", "trace", { key: "traceArgs" }),
-    command("memory", "memory", { key: "memoryArgs" }),
+    Object.assign(command("memory", "memory", { key: "memoryArgs" }), {
+        requires: "memory",
+    }),
 ];
+/**
+ * 能力关闭的命令不列出（capability-off.test.ts 锁定）：memory = 记忆工具已注册（`memory.enabled`）；
+ * task = 模型能直接调 `task`，或能经 codemode 脚本调（`task` 已注册且 codemode 在活动集）。
+ */
+export function availableCommands(runtime, session, list = BUILTIN_COMMANDS) {
+    const active = new Set(session.getTools().map((t) => t.name));
+    const registered = new Set(runtime.tools.list());
+    const has = (requires) => requires === "memory"
+        ? registered.has("memory")
+        : requires === "task"
+            ? active.has("task") || (active.has("codemode") && registered.has("task"))
+            : true;
+    return list.filter((c) => has(c.requires));
+}
 const ALIASES = { quit: "exit", q: "exit", "?": "help" };
 export function parseSlash(line) {
     const m = /^\/([A-Za-z?][\w-]*)(?:\s+([\s\S]*))?$/.exec(line.trim());
@@ -84,8 +102,8 @@ export function parseSlash(line) {
     const raw = m[1].toLowerCase();
     return { name: ALIASES[raw] ?? raw, args: (m[2] ?? "").trim() };
 }
-function helpText() {
-    const lines = BUILTIN_COMMANDS.map((c) => `/${c.name}${c.args !== undefined ? ` ${c.args}` : ""}  ${c.description}`);
+function helpText(ctx) {
+    const lines = availableCommands(ctx.runtime, ctx.session()).map((c) => `/${c.name}${c.args !== undefined ? ` ${c.args}` : ""}  ${c.description}`);
     const m = msg().report.commands;
     return [...lines, m.skillLine, m.templateLine].join("\n");
 }
@@ -142,7 +160,7 @@ export async function runSlashCommand(line, ctx) {
     const session = ctx.session();
     switch (name) {
         case "help":
-            return { kind: "handled", message: helpText() };
+            return { kind: "handled", message: helpText(ctx) };
         case "exit":
             return { kind: "exit" };
         case "new": {

package/dist/modes/interactive/approval-dialog.js

@@ -25,7 +25,7 @@ import { msg } from "../../i18n/index.js";
 import { autoLayerText, isPermissionMode, permissionModeLabel } from "../../permissions/modes.js";
 import { previewDisplayLines } from "../../permissions/preview.js";
 import { Box, defaultKeybindings, matchesKey, padToWidth, truncateToWidth, visibleWidth, wrapTextWithAnsi, } from "../../tui.js";
-import { displayPath, flat } from "./tool-summary.js";
+import { displayPath, fetchHost, flat } from "./tool-summary.js";
 import { toolSummary } from "./tool-view.js";
 const COMMAND_LINES = 8;
 const EDIT_LINES = 3;
@@ -130,6 +130,13 @@ export function describeRequest(request, theme, options = {}) {
         if (hidden > 0)
             out.push(more(hidden));
     }
+    else if (request.toolName === "web_fetch" && typeof input["url"] === "string") {
+        // 完整 URL（含协议与查询串），按 72 列折行，不截断
+        const { shown, hidden } = lines(input["url"].replace(/(.{72})/g, "$1\n"), COMMAND_LINES);
+        out.push(...shown.map((l) => theme.fg("code", l)));
+        if (hidden > 0)
+            out.push(more(hidden));
+    }
     else if (request.toolName === "write" && typeof input["content"] === "string") {
         const count = lines(input["content"], Number.MAX_SAFE_INTEGER).shown.length;
         out.push(`${toolSummary("write", input, options.cwd)}  ${theme.fg("dim", m.writeLines(count))}`);
@@ -293,10 +300,14 @@ class ApprovalDialog {
         const { theme } = this.host;
         const g = theme.glyphs;
         const keyWidth = compact ? 1 : Math.max(...APPROVAL_OPTIONS.map((o) => o.keys.length));
+        const host = fetchHost(this.request.toolName, this.request.input);
         return APPROVAL_OPTIONS.map((option, i) => {
             const selected = i === this.selected;
             const keys = compact ? option.keys.slice(0, 1) : option.keys;
-            const left = `${selected ? g.prompt : " "} ${i + 1}. ${option.label}`;
+            const text = option.decision === "allow_session" && host !== undefined
+                ? msg().approval.option.allowSessionHost(host)
+                : option.label;
+            const left = `${selected ? g.prompt : " "} ${i + 1}. ${text}`;
             const right = keys.padEnd(keyWidth);
             const room = Math.max(1, width - visibleWidth(right) - 1);
             const label = selected ? theme.fg("accent", theme.bold(left)) : left;
@@ -361,8 +372,10 @@ export function approvalOutcomeText(request, outcome, taskAgent) {
     switch (outcome) {
         case "allow":
             return m.allow(what);
-        case "allow_session":
-            return m.allowSession(what);
+        case "allow_session": {
+            const host = fetchHost(request.toolName, request.input);
+            return host === undefined ? m.allowSession(what) : m.allowSessionHost(what, host);
+        }
         case "deny":
             return m.deny(what);
         case "cancelled":

package/dist/modes/interactive/commands.d.ts

@@ -27,6 +27,8 @@ import { type PickerSpec } from "./pickers.js";
 export declare const INTERACTIVE_COMMANDS: readonly CommandInfo[];
 /** 补全与 /help 用的完整命令表。 */
 export declare const ALL_COMMANDS: readonly CommandInfo[];
+/** 补全用：完整命令表去掉能力关闭的（`availableCommands`）。 */
+export declare function completionCommands(runtime: Pick<Runtime, "tools">, session: Pick<AgentSession, "getTools">): CommandInfo[];
 /** `/help` 末尾的按键说明（多行）。 */
 export declare function keyHints(): string;
 export interface CommandUi {

package/dist/modes/interactive/commands.js

@@ -22,7 +22,7 @@ import { THINKING_LEVELS } from "../../ai/thinking.js";
 import { listSessions } from "../../cli/compose-store.js";
 import { hideFakeProvider } from "../../cli/fake-visibility.js";
 import { autoLayerText, permissionModeLabel } from "../../permissions/modes.js";
-import { BUILTIN_COMMANDS, parseSlash, runSlashCommand, } from "../commands-core.js";
+import { BUILTIN_COMMANDS, availableCommands, parseSlash, runSlashCommand, } from "../commands-core.js";
 import { contextPanel } from "../context-report.js";
 import { contentText } from "./message-view.js";
 import { cachePanel, permissionsPanel, sessionPanel } from "./panels.js";
@@ -42,6 +42,10 @@ export const INTERACTIVE_COMMANDS = [
 ];
 /** 补全与 /help 用的完整命令表。 */
 export const ALL_COMMANDS = [...BUILTIN_COMMANDS, ...INTERACTIVE_COMMANDS];
+/** 补全用：完整命令表去掉能力关闭的（`availableCommands`）。 */
+export function completionCommands(runtime, session) {
+    return availableCommands(runtime, session, ALL_COMMANDS);
+}
 /** `/help` 末尾的按键说明（多行）。 */
 export function keyHints() {
     return msg().interactive.commands.keyHints;

package/dist/modes/interactive/interactive-mode.js

@@ -33,7 +33,7 @@ import { BYPASS_MODE, createBypassGate } from "../../permissions/bypass.js";
 import { onTerminationSignals } from "../shared.js";
 import { AgentUi, agentCommandHooks } from "./agent-ui.js";
 import { approvalOverlayHooks, createApprovalUi } from "./approval-ui.js";
-import { ALL_COMMANDS, runInteractiveCommand } from "./commands.js";
+import { completionCommands, runInteractiveCommand } from "./commands.js";
 import { memoryPanelFor } from "./memory-panel.js";
 import { InteractiveCompletion } from "./completion.js";
 import { confirmBypass } from "./confirm-dialog.js";
@@ -114,7 +114,7 @@ export function runInteractiveMode(runtime, context, options = {}) {
         ? undefined
         : (options.historyFile ?? join(runtime.paths.dataDir, "history"));
     const completion = new InteractiveCompletion({
-        commands: () => ALL_COMMANDS,
+        commands: () => completionCommands(runtime, session),
         prompts: () => runtime.resources.prompts,
         skills: () => runtime.resources.skills,
         cwd: () => session.state.cwd,

package/dist/modes/interactive/tool-summary.d.ts

@@ -44,3 +44,5 @@ export interface SummaryInput {
 }
 /** 完成后的一行结果摘要（已着色，不含 `⎿`）。 */
 export declare function resultSummary(input: SummaryInput, theme: Theme): string;
+/** web_fetch 请求的主机名（审批「本会话允许该主机」用）；不是 web_fetch 或 URL 不合法返回 undefined。 */
+export declare function fetchHost(toolName: string, input: unknown): string | undefined;

package/dist/modes/interactive/tool-summary.js

@@ -12,6 +12,7 @@ import { msg } from "../../i18n/index.js";
 import { isAbsolute, relative } from "node:path";
 import { stripAnsi } from "../../tui.js";
 import { formatTokens } from "./status-bar.js";
+import { formatSize } from "../../tools/truncate.js";
 /** 工具输出 → 可安全显示的行。 */
 export function cleanLines(text) {
     const clean = stripAnsi(text)
@@ -60,6 +61,8 @@ export function toolSummary(name, args, cwd) {
         }
         case "task":
             return flat(str("description") ?? str("prompt") ?? "");
+        case "web_fetch":
+            return flat((str("url") ?? "").replace(/^https?:\/\//i, ""));
         default:
             if (path !== undefined)
                 return displayPath(path, cwd);
@@ -216,7 +219,31 @@ export function resultSummary(input, theme) {
                 : [];
             return muted([m.done, duration, ...tokens].join(" · "));
         }
+        case "web_fetch": {
+            const finalUrl = details["finalUrl"];
+            if (num(details["bytes"]) === 0 &&
+                typeof finalUrl === "string" &&
+                lines[0]?.startsWith("Redirected"))
+                return muted(m.fetchRedirect(finalUrl));
+            const title = typeof details["title"] === "string" ? flat(details["title"], 60) : undefined;
+            const format = typeof details["format"] === "string" ? details["format"] : "";
+            return muted(m.fetched(title, formatSize(num(details["bytes"]) ?? 0), format));
+        }
         default:
             return muted(count === 0 ? m.done : m.outputLines(count));
     }
 }
+/** web_fetch 请求的主机名（审批「本会话允许该主机」用）；不是 web_fetch 或 URL 不合法返回 undefined。 */
+export function fetchHost(toolName, input) {
+    if (toolName !== "web_fetch")
+        return undefined;
+    const raw = record(input)["url"];
+    if (typeof raw !== "string")
+        return undefined;
+    try {
+        return new URL(raw.trim()).hostname.replace(/^\[|\]$/g, "").toLowerCase() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/modes/rpc/commands.js

@@ -24,7 +24,7 @@ import { switchSession } from "../../cli/compose-session.js";
 import { AmaError } from "../../errors.js";
 import { isPermissionMode } from "../../permissions/modes.js";
 import { PERMISSION_MODES_STRICT_FIRST } from "../../permissions/types.js";
-import { BUILTIN_COMMANDS } from "../commands-core.js";
+import { availableCommands } from "../commands-core.js";
 import { msg } from "../../i18n/index.js";
 import { sessionTrace } from "../../trace/query-session.js";
 /** 审批 broker：等客户端 `permission_response`。 */
@@ -144,9 +144,9 @@ async function availableModels(runtime) {
     }
     return out;
 }
-function commands(runtime) {
+function commands(runtime, session) {
     return [
-        ...BUILTIN_COMMANDS.map((c) => ({
+        ...availableCommands(runtime, session).map((c) => ({
             name: c.name,
             description: c.description,
             source: "builtin",
@@ -308,7 +308,7 @@ export const handlers = {
         ctx.session().setPermissionMode(p.mode);
         return { mode: p.mode };
     },
-    get_commands: async (_p, ctx) => ({ commands: commands(ctx.runtime) }),
+    get_commands: async (_p, ctx) => ({ commands: commands(ctx.runtime, ctx.session()) }),
     get_skills: async (_p, ctx) => ({ skills: ctx.runtime.resources.skills }),
     // [W5-F] 计划 / 任务命令（docs/history/wave5-plan.md §6.5、§7.5）
     plan_response: async (p, ctx) => {

package/dist/permissions/classifier.js

@@ -25,7 +25,7 @@ export const CLASSIFIER_SYSTEM_PROMPT = [
     "- it stays inside the project directory;",
     "- it is read-only, or a routine and easily reversible development step (build, test, lint, format, generate code, run a project script);",
     "- it does not read or change secrets, credentials, keys or VCS internals;",
-    "- it does not use the network, install software, publish, deploy, push, or delete data the user may need;",
+    "- it does not use the network, install software, publish, deploy, push, or delete data the user may need (a web_fetch of a public documentation or package-registry page is routine; answer ask when its query string looks like a key or a long random token);",
     "- it plausibly serves the user's latest request.",
     'Otherwise answer "ask". When unsure, answer "ask".',
     "",

package/dist/permissions/network-class.d.ts

@@ -0,0 +1,28 @@
+/**
+ * 权限类 `network`（`web_fetch` 用；docs/guides/permissions.md「网络类」）。照 `memory-class.ts` 的写法
+ * 折成已有的类走真值表：
+ *
+ * - 按 `execute` 判：default / auto-edit 询问（审批第三项「本会话允许该主机」）、allowlist 只放行 allow 规则
+ *   命中的、full-auto 放行、auto 交分类器；
+ * - plan 例外：**询问**（只读但可外泄；plan 的调研常要看文档），无人值守照常 ask → deny；
+ * - auto 规则层：URL 静态校验不过（非 http(s)、userinfo、本机名、私网 / 元数据 IP 字面量）直接 deny；
+ *   解析后的地址检查在执行层（url-guard.ts），这里不查 DNS。
+ *
+ * 规则 `web_fetch(<pattern>)` 对 `host/path`（不含协议、端口与查询串，主机名小写）匹配：
+ * - 不含 `/` 的 pattern 只比主机：裸域名 `example.com` 命中它自己与全部子域；带 `*` 时按 glob
+ *   （`*.example.com`），任意路径；
+ * - 含 `/` 的 pattern 对整个 `host/path` 做 glob：`*` 不跨 `/`，`**` 跨（`docs.example.com/api/**`）。
+ */
+import type { ToolPermission } from "../tools/types.js";
+/** `network` 类在真值表里按哪一类判定（plan 例外由管线处理）。 */
+export declare function networkEffectivePermission(): Exclude<ToolPermission, "memory" | "network">;
+/** 输入里的 URL（`url` 字段，能解析的 http(s)）；没有返回 undefined。 */
+export declare function inputUrl(input: unknown): URL | undefined;
+/** 规则匹配的对象：`host/path`（主机名小写、无端口与查询串）。 */
+export declare function urlSubject(url: URL): string;
+/** `web_fetch(<pattern>)` 是否命中这次调用。 */
+export declare function networkRuleMatches(pattern: string, input: unknown): boolean;
+/** 会话记忆「本会话允许该主机」的归一化前缀：小写主机名。 */
+export declare function networkGrantHost(input: unknown): string | undefined;
+/** auto 规则层：URL 静态校验不过时的拒绝原因（不查 DNS）。 */
+export declare function networkBlockReason(input: unknown): string | undefined;

package/dist/permissions/network-class.js

@@ -0,0 +1,91 @@
+/**
+ * 权限类 `network`（`web_fetch` 用；docs/guides/permissions.md「网络类」）。照 `memory-class.ts` 的写法
+ * 折成已有的类走真值表：
+ *
+ * - 按 `execute` 判：default / auto-edit 询问（审批第三项「本会话允许该主机」）、allowlist 只放行 allow 规则
+ *   命中的、full-auto 放行、auto 交分类器；
+ * - plan 例外：**询问**（只读但可外泄；plan 的调研常要看文档），无人值守照常 ask → deny；
+ * - auto 规则层：URL 静态校验不过（非 http(s)、userinfo、本机名、私网 / 元数据 IP 字面量）直接 deny；
+ *   解析后的地址检查在执行层（url-guard.ts），这里不查 DNS。
+ *
+ * 规则 `web_fetch(<pattern>)` 对 `host/path`（不含协议、端口与查询串，主机名小写）匹配：
+ * - 不含 `/` 的 pattern 只比主机：裸域名 `example.com` 命中它自己与全部子域；带 `*` 时按 glob
+ *   （`*.example.com`），任意路径；
+ * - 含 `/` 的 pattern 对整个 `host/path` 做 glob：`*` 不跨 `/`，`**` 跨（`docs.example.com/api/**`）。
+ */
+import { bareHostname, checkFetchUrl } from "../tools/web/url-guard.js";
+/** `network` 类在真值表里按哪一类判定（plan 例外由管线处理）。 */
+export function networkEffectivePermission() {
+    return "execute";
+}
+/** 输入里的 URL（`url` 字段，能解析的 http(s)）；没有返回 undefined。 */
+export function inputUrl(input) {
+    const raw = typeof input === "object" && input !== null
+        ? input["url"]
+        : undefined;
+    if (typeof raw !== "string")
+        return undefined;
+    try {
+        const url = new URL(raw.trim());
+        return url.protocol === "http:" || url.protocol === "https:" ? url : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** 规则匹配的对象：`host/path`（主机名小写、无端口与查询串）。 */
+export function urlSubject(url) {
+    return `${bareHostname(url)}${url.pathname === "" ? "/" : url.pathname}`;
+}
+function globRegExp(pattern) {
+    let body = "";
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === "*" && pattern[i + 1] === "*") {
+            body += ".*";
+            i++;
+        }
+        else if (ch === "*")
+            body += "[^/]*";
+        else if (ch === "?")
+            body += "[^/]";
+        else
+            body += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+    return new RegExp(`^${body}$`, "i");
+}
+/** `web_fetch(<pattern>)` 是否命中这次调用。 */
+export function networkRuleMatches(pattern, input) {
+    const url = inputUrl(input);
+    if (url === undefined)
+        return false;
+    const p = pattern
+        .trim()
+        .replace(/^https?:\/\//i, "")
+        .toLowerCase();
+    if (p === "*" || p === "**")
+        return true;
+    const host = bareHostname(url);
+    if (!p.includes("/")) {
+        if (p.includes("*") || p.includes("?"))
+            return globRegExp(p).test(host);
+        const bare = p.replace(/\.$/, "");
+        return host === bare || host.endsWith(`.${bare}`);
+    }
+    return globRegExp(p).test(urlSubject(url));
+}
+/** 会话记忆「本会话允许该主机」的归一化前缀：小写主机名。 */
+export function networkGrantHost(input) {
+    const url = inputUrl(input);
+    return url === undefined ? undefined : bareHostname(url);
+}
+/** auto 规则层：URL 静态校验不过时的拒绝原因（不查 DNS）。 */
+export function networkBlockReason(input) {
+    const raw = typeof input === "object" && input !== null
+        ? input["url"]
+        : undefined;
+    if (typeof raw !== "string")
+        return "url is missing";
+    const checked = checkFetchUrl(raw);
+    return checked.ok ? undefined : checked.reason;
+}

package/dist/permissions/pipeline.d.ts

@@ -60,7 +60,7 @@ export declare const UNATTENDED_MESSAGE = "This tool call requires approval, but
 export declare const ALLOWLIST_MESSAGE = "Not in the allowlist: permission mode \"allowlist\" only runs read-only tools and calls matched by an allow rule, and never asks.";
 interface SessionGrant {
     toolName: string;
-    kind: "command" | "dir" | "any";
+    kind: "command" | "dir" | "host" | "any";
     prefix: string;
 }
 export declare function sessionGrantFor(toolName: string, input: unknown, cwd: string): SessionGrant;

package/dist/permissions/pipeline.js

@@ -36,6 +36,7 @@
 import { dirname, sep } from "node:path";
 import { isBackgroundJobQuery } from "../tools/background-jobs.js";
 import { memoryEffectivePermission } from "./memory-class.js";
+import { networkBlockReason, networkEffectivePermission, networkGrantHost, } from "./network-class.js";
 import { findAllowRule, findDenyRule, inputCommand, inputPath, normalizeCommand, splitShellSegments, } from "./rules.js";
 import { collectNestedCommands, matchDangerous } from "./dangerous.js";
 import { analyzeBashForAuto, secretReferenceReason } from "./auto-safe.js";
@@ -110,7 +111,7 @@ function auditSummary(toolName, input) {
     const command = inputCommand(input);
     const raw = command ??
         (typeof input === "object" && input !== null
-            ? input["path"]
+            ? (input["path"] ?? input["url"])
             : undefined);
     const text = typeof raw === "string" ? raw.replace(/\s+/g, " ").trim() : toolName;
     return text.length > 80 ? `${text.slice(0, 79)}…` : text;
@@ -118,6 +119,9 @@ function auditSummary(toolName, input) {
 export function sessionGrantFor(toolName, input, cwd) {
     if (toolName === "memory")
         return { toolName, kind: "any", prefix: "" }; // [W6-M] 本会话允许全部写命令
+    const host = networkGrantHost(input); // web_fetch：本会话允许该主机
+    if (host !== undefined)
+        return { toolName, kind: "host", prefix: host };
     const command = inputCommand(input);
     if (command !== undefined) {
         const words = normalizeCommand(command).split(" ").slice(0, 2);
@@ -133,6 +137,8 @@ function grantCovers(grant, toolName, input, cwd) {
         return false;
     if (grant.kind === "any")
         return true;
+    if (grant.kind === "host")
+        return networkGrantHost(input) === grant.prefix;
     if (grant.kind === "command") {
         const command = inputCommand(input);
         if (command === undefined || /\$\(|`/.test(command))
@@ -218,9 +224,13 @@ export class PermissionPipeline {
     }
     evaluate(raw) {
         // [W6-C0] 权限类 memory 按命令折成 read / execute（memory-class.ts）
+        // network（web_fetch）按 execute 判，plan 例外为询问、auto 规则层先做 URL 静态校验（network-class.ts）
+        const network = raw.permission === "network";
         const input = raw.permission === "memory"
             ? { ...raw, permission: memoryEffectivePermission(raw.input) }
-            : raw;
+            : network
+                ? { ...raw, permission: networkEffectivePermission() }
+                : raw;
         const { toolName, permission } = input;
         // ① deny
         const layers = layeredInputs(toolName, input.input);
@@ -265,13 +275,15 @@ export class PermissionPipeline {
             return verdict;
         }
         if (this.currentMode === "auto")
-            return this.evaluateAuto(input, layers, command);
+            return this.evaluateAuto(input, layers, command, network);
         if (this.currentMode === "allowlist")
             return this.evaluateAllowlist(input, layers);
         // ③ 模式（plan 细化见 planDecision）
-        const plan = this.currentMode === "plan"
-            ? planDecision(input, this.planBashMode, this.cwd, this.projectRoot)
-            : undefined;
+        const plan = this.currentMode !== "plan"
+            ? undefined
+            : network
+                ? { decision: "ask" }
+                : planDecision(input, this.planBashMode, this.cwd, this.projectRoot);
         const byMode = plan?.decision ?? modeDecision(this.currentMode, permission);
         if (byMode === "deny") {
             return {
@@ -387,12 +399,17 @@ export class PermissionPipeline {
         }
         return {};
     }
-    evaluateAuto(input, layers, command) {
+    evaluateAuto(input, layers, command, network = false) {
         const rule = (decision, reason) => ({
             layer: "rule",
             decision,
             reason,
         });
+        const blocked = network ? networkBlockReason(input.input) : undefined;
+        if (blocked !== undefined) {
+            const message = `Auto mode refuses this fetch: ${blocked}`;
+            return { decision: "deny", step: "auto-rule", message, auto: rule("deny", blocked) };
+        }
         const checked = this.autoRuleReason(input, command);
         if (checked.ask !== undefined) {
             return {

package/dist/permissions/preview.js

@@ -444,6 +444,9 @@ export function previewAction(request, options) {
         else if (kind === "edit" && typeof input["path"] === "string") {
             previewEdit(input, request, c);
         }
+        else if (request.toolName === "web_fetch" && typeof input["url"] === "string") {
+            c.lines.push(`GET ${input["url"].replace(/\s+/g, "").slice(0, 2048)}`);
+        }
         else if (kind === "other") {
             const key = SUMMARY_KEYS.find((k) => typeof input[k] === "string" && input[k] !== "");
             if (key !== undefined)

package/dist/permissions/rules.d.ts

@@ -6,6 +6,7 @@
  * - 带 `path` 的工具（read / write / edit / ls / grep / glob 及宿主工具）：对路径做 glob（`**`）。
  *   相对模式匹配 cwd 内的相对路径；以 `**` 开头的模式也匹配绝对路径（例如 .ssh 目录规则命中 ~/.ssh 下的文件）；
  *   绝对模式（`/…`、`~/…`）匹配绝对路径。缺 path 的调用以 cwd 为路径。
+ * - 带 `url` 的工具（web_fetch）：对 `host/path` 匹配，裸域名含子域（network-class.ts）；
  * - 其它工具带 pattern 的规则不匹配（无可比对的对象）。
  *
  * bash 复合命令：deny 规则命中整条或**任一**段即生效；allow 规则要求**每一**段都被某条 allow 覆盖，

package/dist/permissions/rules.js

@@ -6,6 +6,7 @@
  * - 带 `path` 的工具（read / write / edit / ls / grep / glob 及宿主工具）：对路径做 glob（`**`）。
  *   相对模式匹配 cwd 内的相对路径；以 `**` 开头的模式也匹配绝对路径（例如 .ssh 目录规则命中 ~/.ssh 下的文件）；
  *   绝对模式（`/…`、`~/…`）匹配绝对路径。缺 path 的调用以 cwd 为路径。
+ * - 带 `url` 的工具（web_fetch）：对 `host/path` 匹配，裸域名含子域（network-class.ts）；
  * - 其它工具带 pattern 的规则不匹配（无可比对的对象）。
  *
  * bash 复合命令：deny 规则命中整条或**任一**段即生效；allow 规则要求**每一**段都被某条 allow 覆盖，
@@ -19,6 +20,7 @@ import { PERMISSION_MODES_STRICT_FIRST } from "./types.js";
 import { globBody } from "../tools/glob.js";
 import { expandHome, resolvePath, toPosix } from "../tools/paths.js";
 import { memoryRuleMatches } from "./memory-class.js";
+import { networkRuleMatches } from "./network-class.js";
 /** 内置缺省 deny 表（用户可经 `builtinDeny` 选项移除）。 */
 export const BUILTIN_DENY_RULES = [
     "write(**/.git/**)",
@@ -153,7 +155,9 @@ function matchesSubject(rule, toolName, input, cwd, command) {
     if (command !== undefined)
         return wildcardToRegExp(rule.pattern).test(command);
     const abs = inputPath(toolName, input, cwd);
-    return abs !== undefined && pathMatches(rule.pattern, abs, cwd);
+    if (abs !== undefined)
+        return pathMatches(rule.pattern, abs, cwd);
+    return networkRuleMatches(rule.pattern, input);
 }
 /** 第一条命中的 deny 规则。 */
 export function findDenyRule(rules, toolName, input, cwd) {

package/dist/tools/presets.d.ts

@@ -3,7 +3,7 @@
  *
  * | 预设          | 模型直接看到                              |
  * | ------------- | ----------------------------------------- |
- * | `default`     | read、edit、write、bash、grep、glob       |
+ * | `default`     | read、edit、write、bash、grep、glob、web_fetch |
  * | `minimal`     | read、edit、write、bash                   |
  * | `codemode-only` | 只有 codemode（其余工具在脚本里调用）   |
  * | `coordinator` | read + 宿主注册的工具                     |

package/dist/tools/presets.js

@@ -3,7 +3,7 @@
  *
  * | 预设          | 模型直接看到                              |
  * | ------------- | ----------------------------------------- |
- * | `default`     | read、edit、write、bash、grep、glob       |
+ * | `default`     | read、edit、write、bash、grep、glob、web_fetch |
  * | `minimal`     | read、edit、write、bash                   |
  * | `codemode-only` | 只有 codemode（其余工具在脚本里调用）   |
  * | `coordinator` | read + 宿主注册的工具                     |
@@ -35,7 +35,7 @@ export const CODEMODE_TOOL = "codemode";
 /** 各预设下模型直接看到的内置工具（codemode-only 预设见 `resolvePreset`）。 */
 export const PRESET_TOOLS = Object.freeze({
     // D20：todo 不在 default（W5-Z 复测未过门，见文件头）
-    default: ["bash", "edit", "glob", "grep", "read", "write"],
+    default: ["bash", "edit", "glob", "grep", "read", "web_fetch", "write"],
     minimal: ["bash", "edit", "read", "write"],
     "codemode-only": [CODEMODE_TOOL],
     coordinator: ["read"],

package/dist/tools/registry.d.ts

@@ -15,6 +15,7 @@ import type { ToolDefinition, ToolExecutionMode, ToolRegistryApi, ToolSource } f
 import { type ReadToolOptions } from "./read.js";
 import { type BashToolOptions } from "./bash.js";
 import { type TaskToolOptions } from "./task.js";
+import { type WebFetchOptions } from "./web/fetch.js";
 /** [W5-C0] 主工具 → 随它出现 / 消失的伴随工具。 */
 export declare const TOOL_COMPANIONS: Readonly<Record<string, readonly string[]>>;
 /** 按 `TOOL_COMPANIONS` 配对：有主工具就带上（已注册的）伴随工具，没有就去掉。 */
@@ -40,8 +41,9 @@ export interface BuiltinToolOptions {
     read?: ReadToolOptions;
     bash?: BashToolOptions;
     task?: TaskToolOptions;
+    webFetch?: WebFetchOptions;
 }
-/** 全部内置工具（read / write / edit / bash / grep / glob / ls / todo / task / task_ctl）。 */
+/** 全部内置工具（read / write / edit / bash / grep / glob / ls / todo / task / task_ctl / web_fetch）。 */
 export declare function builtinTools(options?: BuiltinToolOptions): ToolDefinition[];
 /** 新建注册表并登记全部内置工具；`disabled` 来自 config.tools.disabled。 */
 export declare function createToolRegistry(options?: BuiltinToolOptions & {

package/dist/tools/registry.js

@@ -23,6 +23,7 @@ import { createLsTool } from "./ls.js";
 import { createTodoTool } from "./todo.js";
 import { createTaskTool } from "./task.js";
 import { TASK_CTL_TOOL, createTaskCtlTool } from "./task-ctl.js";
+import { createWebFetchTool } from "./web/fetch.js";
 /** [W5-C0] 主工具 → 随它出现 / 消失的伴随工具。 */
 export const TOOL_COMPANIONS = Object.freeze({
     task: [TASK_CTL_TOOL],
@@ -49,7 +50,7 @@ export function validateToolDefinition(tool) {
     if (typeof tool.name !== "string" || !TOOL_NAME_RE.test(tool.name)) {
         throw new AmaError("invalid_arguments", `Invalid tool name "${String(tool.name)}"`);
     }
-    if (!["read", "write", "execute", "memory"].includes(tool.permission)) {
+    if (!["read", "write", "execute", "memory", "network"].includes(tool.permission)) {
         throw new AmaError("invalid_arguments", `Tool ${tool.name}: invalid permission`);
     }
     if (typeof tool.execute !== "function") {
@@ -102,7 +103,7 @@ export class ToolRegistry {
         this.activeNames = new Set(pairCompanions(names, (n) => this.entries.has(n) && !this.disabled.has(n)));
     }
 }
-/** 全部内置工具（read / write / edit / bash / grep / glob / ls / todo / task / task_ctl）。 */
+/** 全部内置工具（read / write / edit / bash / grep / glob / ls / todo / task / task_ctl / web_fetch）。 */
 export function builtinTools(options = {}) {
     const tools = [
         createReadTool(options.read),
@@ -115,6 +116,7 @@ export function builtinTools(options = {}) {
         createTodoTool(),
         createTaskTool(options.task),
         createTaskCtlTool(),
+        createWebFetchTool(options.webFetch),
     ];
     return tools;
 }

package/dist/tools/types.d.ts

@@ -27,7 +27,10 @@ export type { JsonSchema } from "../ai/types.js";
 /**
  * [W6-C0] `memory`：记忆工具专用（`permissions/memory-class.ts`）——`view` 按 read、写命令按 execute 判定。
  */
-export type ToolPermission = "read" | "write" | "execute" | "memory";
+/**
+ * `network`：联网读取（`web_fetch`，`permissions/network-class.ts`）——按 execute 判定，plan 下询问。
+ */
+export type ToolPermission = "read" | "write" | "execute" | "memory" | "network";
 export type ToolExecutionMode = "sequential" | "parallel";
 export interface ToolAnnotations {
     readOnly?: boolean;