@steerable/agent-shell 0.6.31 → 0.6.33

package/dist/host/runtime.js

@@ -28,8 +28,10 @@ import { createVisibleTerminalExec } from './visible-terminal-exec.js';
 import { createJsonStore } from '../json-store.js';
 import { bindWorkspaceSkillRoots } from '../local-backend/skill-loader.js';
 import { getChatAttachmentsDir } from '../attachments.js';
+import { ensureChatWorkspace } from '../project-home.js';
 import { recordInsightTurn } from '../insights/record.js';
 import { llmService } from '../llm/index.js';
+import { isProductLlmLocked, resolveRuntimeLlmSettings } from '../host-tools-runtime.js';
 import { getPackAssemblies, } from './pack-assembly.js';
 export async function createHostRuntime(options) {
     const { broadcast, hasWindow, onLog } = options;
@@ -64,15 +66,14 @@ export async function createHostRuntime(options) {
     // 生效，这里负责进程重启后的恢复）。
     {
         const persistedLlmSettings = await defaultStore.getLlmSettings();
-        setDefaultExecTimeoutMs(persistedLlmSettings?.execTimeoutSeconds
-            ? persistedLlmSettings.execTimeoutSeconds * 1000
+        const runtimeLlmSettings = resolveRuntimeLlmSettings(persistedLlmSettings);
+        if (isProductLlmLocked()) {
+            await defaultStore.setLlmSettings(runtimeLlmSettings);
+        }
+        setDefaultExecTimeoutMs(runtimeLlmSettings.execTimeoutSeconds
+            ? runtimeLlmSettings.execTimeoutSeconds * 1000
             : null);
-        llmService.initialize(persistedLlmSettings ?? {
-            provider: 'ollama',
-            model: 'llama3.1:8b',
-            baseUrl: 'http://127.0.0.1:11434',
-            temperature: 0.3,
-        }, {
+        llmService.initialize(runtimeLlmSettings, {
             setLlmSettings: (settings) => defaultStore.setLlmSettings(settings),
         });
     }
@@ -150,6 +151,12 @@ export async function createHostRuntime(options) {
         toolRouter,
         worktreeService,
         resolveChatProject: resolveChatProjectRoot,
+        resolveChatWorkspaceRoot: async (chatId) => {
+            const project = await resolveChatProjectRoot(chatId);
+            if (project)
+                return project.folderPath;
+            return ensureChatWorkspace(chatId);
+        },
         broadcast,
     });
     toolRouter.setTaskServices({ taskService, worktreeService });
@@ -204,7 +211,7 @@ export async function createHostRuntime(options) {
             void startHostSidecar({
                 store: defaultStore,
                 toolRouter,
-                resolveProjectRoot: async (chatId) => (await localBackendRouter.resolveChatProject(chatId))?.folderPath ?? null,
+                resolveProjectRoot: async (chatId) => localBackendRouter.resolveChatWorkspaceRoot(chatId),
                 // 项目模式下文件读写被围栏在项目目录内；会话附件目录是额外放行的
                 // 只读根，保证用户上传的文件即使在项目会话里也能被 agent 读回。
                 resolveAdditionalReadRoots: async (chatId) => {

package/dist/host/visible-terminal-exec.js

@@ -5,6 +5,7 @@
  */
 import log from 'electron-log';
 import { GUI_LAUNCH_WAIT_MS, getConfiguredExecTimeoutMs, isGuiLaunchCommand, rewriteExeCommandIfNeeded, } from '../local-executor.js';
+import { getResolvedHostTools } from '../host-tools-runtime.js';
 /**
  * Map a raw PTY shell binary name (e.g. `powershell.exe`, `cmd.exe`, `zsh`) to
  * the {@link LocalExecResult} `shell` enum so the agent sees the *real* dialect
@@ -33,6 +34,9 @@ export function mapSessionShell(shell) {
 export function createVisibleTerminalExec(deps) {
     const { localExecutor, terminalManager } = deps;
     return async function maybeExecInTerminal(req) {
+        if (!getResolvedHostTools().terminal.chrome) {
+            return null;
+        }
         if (req.command) {
             req.command = rewriteExeCommandIfNeeded(req.command);
         }

package/dist/host-tools-runtime.d.ts

@@ -0,0 +1,10 @@
+import { buildHostApproval, type ChatModeId, type ResolvedHostTools } from './host-tools.js';
+import { type LlmSettings } from './storage/llm-settings.js';
+export declare function getResolvedHostTools(): ResolvedHostTools;
+export declare function isProductApprovalEnabled(): boolean;
+export declare function resolveTurnApproval(storePath?: string): ReturnType<typeof buildHostApproval>;
+export declare function assertHostIpcAllowed(channel: string): void;
+export declare function resolveTurnChatMode(requested: unknown): ChatModeId;
+export declare function isProductLlmLocked(): boolean;
+/** 设置页开着走已存/出厂默认；关掉则钉死 product.json 的 llm。 */
+export declare function resolveRuntimeLlmSettings(persisted: LlmSettings | null): LlmSettings;

package/dist/host-tools-runtime.js

@@ -0,0 +1,44 @@
+/**
+ * 把产品注入的 hostTools / approval 接到解析器。
+ * host-tools.ts 保持无 node 依赖，供测试与渲染层复用解析规则。
+ */
+import os from 'node:os';
+import path from 'node:path';
+import { getProductConfig } from './product-config.js';
+import { buildHostApproval, clampChatMode, isHostIpcAllowed, resolveChatModes, resolveHostTools, resolveSettingsChrome, } from './host-tools.js';
+import { DEFAULT_LLM_SETTINGS, resolveLockedLlmSettings, } from './storage/llm-settings.js';
+export function getResolvedHostTools() {
+    return resolveHostTools(getProductConfig().hostTools);
+}
+export function isProductApprovalEnabled() {
+    return (buildHostApproval({
+        productApproval: getProductConfig().approval,
+        envApproval: process.env.STEERABLE_APPROVAL,
+        storePath: 'unused',
+    }) !== undefined);
+}
+export function resolveTurnApproval(storePath = path.join(os.homedir(), '.steerable', 'approvals.json')) {
+    return buildHostApproval({
+        productApproval: getProductConfig().approval,
+        envApproval: process.env.STEERABLE_APPROVAL,
+        storePath,
+    });
+}
+export function assertHostIpcAllowed(channel) {
+    if (!isHostIpcAllowed(channel, getResolvedHostTools())) {
+        throw new Error(`${channel} is disabled for this product`);
+    }
+}
+export function resolveTurnChatMode(requested) {
+    return clampChatMode(requested, resolveChatModes(getProductConfig().chatModes));
+}
+export function isProductLlmLocked() {
+    return !resolveSettingsChrome(getProductConfig().settings).llm;
+}
+/** 设置页开着走已存/出厂默认；关掉则钉死 product.json 的 llm。 */
+export function resolveRuntimeLlmSettings(persisted) {
+    if (!isProductLlmLocked()) {
+        return persisted ?? DEFAULT_LLM_SETTINGS;
+    }
+    return resolveLockedLlmSettings(getProductConfig().llm, process.env, persisted);
+}

package/dist/host-tools.d.ts

@@ -0,0 +1,73 @@
+/**
+ * 宿主工具族：产品声明引入哪些工具，服务端按同一份配置钳死围栏 / 路由 / 工具面。
+ * 渲染层只投影 chrome；缺省（中性 shell、未声明的族）全开，兼容存量产品。
+ */
+export declare const HOST_TOOL_FAMILY_IDS: readonly ["terminal", "local-fs", "projects", "background-tasks", "mcp", "web", "plugins"];
+export type HostToolFamilyId = (typeof HOST_TOOL_FAMILY_IDS)[number];
+export interface HostToolFamilySurface {
+    /** 模型可见工具 + 围栏 / 服务端能力。 */
+    capability: boolean;
+    /** 用户入口：按钮、菜单、项目分组、点路径打开、附件上传、可见 PTY。 */
+    chrome: boolean;
+}
+/** 产品声明：`true` 两边开，`false` 两边关，对象可拆 chrome / capability。 */
+export type HostToolsConfig = Partial<Record<HostToolFamilyId, boolean | {
+    capability?: boolean;
+    chrome?: boolean;
+}>>;
+export type ResolvedHostTools = Record<HostToolFamilyId, HostToolFamilySurface>;
+export type ApprovalMode = 'host' | 'off';
+export declare const CHAT_MODE_IDS: readonly ["agent", "plan"];
+export type ChatModeId = (typeof CHAT_MODE_IDS)[number];
+/** 产品声明的对话模式。缺省 Agent + Plan；空/非法回落 Agent。 */
+export declare function resolveChatModes(value?: unknown): ChatModeId[];
+export declare function clampChatMode(requested: unknown, modes?: readonly ChatModeId[]): ChatModeId;
+/** 设置入口：侧栏页 + 综合设置分段。缺省全开；`false` 只藏入口。 */
+export declare const SETTINGS_ITEM_IDS: readonly ["agents", "skills", "mcp", "appearance", "llm", "web-search", "usage", "diagnose", "security", "insights", "telemetry"];
+export type SettingsItemId = (typeof SETTINGS_ITEM_IDS)[number];
+export declare const GENERAL_SETTINGS_ITEM_IDS: readonly ["appearance", "llm", "web-search", "usage", "diagnose", "security", "insights", "telemetry"];
+export type SettingsChromeConfig = Partial<Record<SettingsItemId, boolean>>;
+export type ResolvedSettingsChrome = Record<SettingsItemId, boolean>;
+/**
+ * 产品 `settings`：未声明的项全开。关了的宿主工具族会一并藏对应设置段
+ * （skills←plugins、mcp、web-search←web）。
+ */
+export declare function resolveSettingsChrome(value?: unknown, tools?: ResolvedHostTools): ResolvedSettingsChrome;
+export declare function hasGeneralSettingsChrome(chrome?: ResolvedSettingsChrome): boolean;
+export declare const LOCAL_FS_TOOL_NAMES: readonly ["local_exec_shell", "local_read_file", "local_write_file", "local_edit_file", "local_open_path", "local_run_snippet", "local_list_scripts", "local_run_script"];
+export declare function resolveHostToolSurface(value: boolean | {
+    capability?: boolean;
+    chrome?: boolean;
+} | undefined): HostToolFamilySurface;
+/**
+ * 对象声明必须显式 `chrome: true` 才开入口。
+ * `capability` 缺省为 true——只关入口写成 `{ chrome: false }` 即可。
+ */
+export declare function resolveHostTools(config?: HostToolsConfig | null): ResolvedHostTools;
+export declare function resolveApprovalMode(value: unknown): ApprovalMode;
+/**
+ * 产品 `approval: "off"` 或 STEERABLE_APPROVAL=0 时本轮不挂 host 审批。
+ * 环境变量是调试逃生口；产品字段是装配真源。
+ */
+export declare function isApprovalEnabled(input?: {
+    productApproval?: unknown;
+    envApproval?: string;
+}): boolean;
+export declare function clampExecPolicy(requested: unknown, tools?: ResolvedHostTools): 'workspace' | 'full';
+export declare function familyForHostToolName(name: string): HostToolFamilyId | null;
+export declare function isHostToolCapabilityEnabled(name: string, tools?: ResolvedHostTools): boolean;
+export declare function isHostRouteAllowed(pathname: string, tools?: ResolvedHostTools): boolean;
+export declare function sanitizeRightPanelKind(kind: string | null | undefined, tools?: ResolvedHostTools): string | null;
+/** Electron IPC 通道与 HTTP `/host/*` 用同一套 chrome / capability 规则。 */
+export declare function isHostIpcAllowed(channel: string, tools?: ResolvedHostTools): boolean;
+/** 本轮是否挂 host 审批对象；关掉时返回 undefined（sidecar 不弹询问）。 */
+export declare function buildHostApproval(input: {
+    productApproval?: unknown;
+    envApproval?: string;
+    storePath: string;
+    timeoutMs?: number;
+}): {
+    mode: 'host';
+    timeoutMs: number;
+    storePath: string;
+} | undefined;

package/dist/host-tools.js

@@ -0,0 +1,195 @@
+/**
+ * 宿主工具族：产品声明引入哪些工具，服务端按同一份配置钳死围栏 / 路由 / 工具面。
+ * 渲染层只投影 chrome；缺省（中性 shell、未声明的族）全开，兼容存量产品。
+ */
+export const HOST_TOOL_FAMILY_IDS = [
+    'terminal',
+    'local-fs',
+    'projects',
+    'background-tasks',
+    'mcp',
+    'web',
+    'plugins',
+];
+export const CHAT_MODE_IDS = ['agent', 'plan'];
+const DEFAULT_CHAT_MODES = ['agent', 'plan'];
+/** 产品声明的对话模式。缺省 Agent + Plan；空/非法回落 Agent。 */
+export function resolveChatModes(value) {
+    if (!Array.isArray(value))
+        return [...DEFAULT_CHAT_MODES];
+    const allowed = CHAT_MODE_IDS.filter((id) => value.includes(id));
+    return allowed.length > 0 ? allowed : ['agent'];
+}
+export function clampChatMode(requested, modes = resolveChatModes()) {
+    return requested === 'plan' && modes.includes('plan') ? 'plan' : 'agent';
+}
+/** 设置入口：侧栏页 + 综合设置分段。缺省全开；`false` 只藏入口。 */
+export const SETTINGS_ITEM_IDS = [
+    'agents',
+    'skills',
+    'mcp',
+    'appearance',
+    'llm',
+    'web-search',
+    'usage',
+    'diagnose',
+    'security',
+    'insights',
+    'telemetry',
+];
+export const GENERAL_SETTINGS_ITEM_IDS = [
+    'appearance',
+    'llm',
+    'web-search',
+    'usage',
+    'diagnose',
+    'security',
+    'insights',
+    'telemetry',
+];
+function settingsFollowsHostTool(id, tools) {
+    if (id === 'skills')
+        return tools.plugins.chrome;
+    if (id === 'mcp')
+        return tools.mcp.chrome;
+    if (id === 'web-search')
+        return tools.web.chrome;
+    return true;
+}
+/**
+ * 产品 `settings`：未声明的项全开。关了的宿主工具族会一并藏对应设置段
+ * （skills←plugins、mcp、web-search←web）。
+ */
+export function resolveSettingsChrome(value, tools = resolveHostTools()) {
+    const config = value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+    const out = {};
+    for (const id of SETTINGS_ITEM_IDS) {
+        out[id] = config[id] !== false && settingsFollowsHostTool(id, tools);
+    }
+    return out;
+}
+export function hasGeneralSettingsChrome(chrome = resolveSettingsChrome()) {
+    return GENERAL_SETTINGS_ITEM_IDS.some((id) => chrome[id]);
+}
+export const LOCAL_FS_TOOL_NAMES = [
+    'local_exec_shell',
+    'local_read_file',
+    'local_write_file',
+    'local_edit_file',
+    'local_open_path',
+    'local_run_snippet',
+    'local_list_scripts',
+    'local_run_script',
+];
+const FAMILY_TOOL_PREFIX = {
+    terminal: [],
+    projects: [],
+    'local-fs': LOCAL_FS_TOOL_NAMES,
+    'background-tasks': [
+        'task_run',
+        'task_send',
+        'task_status',
+        'task_result',
+        'worktree_create',
+        'worktree_list',
+        'worktree_remove',
+    ],
+    mcp: ['mcp_list_tools', 'mcp_tool_exec'],
+    web: ['web_search', 'web_fetch'],
+    plugins: ['plugin_list', 'plugin_enable', 'plugin_disable', 'plugin_reload'],
+};
+const ALL_ON = { capability: true, chrome: true };
+const ALL_OFF = { capability: false, chrome: false };
+export function resolveHostToolSurface(value) {
+    if (value === undefined)
+        return { ...ALL_ON };
+    if (value === true)
+        return { ...ALL_ON };
+    if (value === false)
+        return { ...ALL_OFF };
+    return {
+        capability: value.capability !== false,
+        chrome: value.chrome === true,
+    };
+}
+/**
+ * 对象声明必须显式 `chrome: true` 才开入口。
+ * `capability` 缺省为 true——只关入口写成 `{ chrome: false }` 即可。
+ */
+export function resolveHostTools(config) {
+    const out = {};
+    for (const id of HOST_TOOL_FAMILY_IDS) {
+        out[id] = resolveHostToolSurface(config?.[id]);
+    }
+    return out;
+}
+export function resolveApprovalMode(value) {
+    return value === 'off' ? 'off' : 'host';
+}
+/**
+ * 产品 `approval: "off"` 或 STEERABLE_APPROVAL=0 时本轮不挂 host 审批。
+ * 环境变量是调试逃生口；产品字段是装配真源。
+ */
+export function isApprovalEnabled(input = {}) {
+    if (input.envApproval === '0')
+        return false;
+    return resolveApprovalMode(input.productApproval) === 'host';
+}
+export function clampExecPolicy(requested, tools = resolveHostTools()) {
+    if (!tools['local-fs'].chrome)
+        return 'workspace';
+    return requested === 'full' ? 'full' : 'workspace';
+}
+export function familyForHostToolName(name) {
+    if (name.startsWith('mcp__'))
+        return 'mcp';
+    for (const id of HOST_TOOL_FAMILY_IDS) {
+        if (FAMILY_TOOL_PREFIX[id].includes(name))
+            return id;
+    }
+    return null;
+}
+export function isHostToolCapabilityEnabled(name, tools = resolveHostTools()) {
+    const family = familyForHostToolName(name);
+    return family == null ? true : tools[family].capability;
+}
+export function isHostRouteAllowed(pathname, tools = resolveHostTools()) {
+    if (pathname.startsWith('/host/terminal'))
+        return tools.terminal.chrome;
+    if (pathname === '/host/attachments/save' || pathname === '/host/local/open-path') {
+        return tools['local-fs'].chrome;
+    }
+    if (pathname.startsWith('/host/local/'))
+        return tools['local-fs'].capability;
+    return true;
+}
+export function sanitizeRightPanelKind(kind, tools = resolveHostTools()) {
+    if (!kind)
+        return null;
+    if (kind === 'terminal')
+        return tools.terminal.chrome ? 'terminal' : null;
+    return kind;
+}
+/** Electron IPC 通道与 HTTP `/host/*` 用同一套 chrome / capability 规则。 */
+export function isHostIpcAllowed(channel, tools = resolveHostTools()) {
+    if (channel.startsWith('terminal:'))
+        return tools.terminal.chrome;
+    if (channel === 'local:open-path' || channel === 'attachments:save') {
+        return tools['local-fs'].chrome;
+    }
+    if (channel.startsWith('local:'))
+        return tools['local-fs'].capability;
+    return true;
+}
+/** 本轮是否挂 host 审批对象；关掉时返回 undefined（sidecar 不弹询问）。 */
+export function buildHostApproval(input) {
+    if (!isApprovalEnabled(input))
+        return undefined;
+    return {
+        mode: 'host',
+        timeoutMs: input.timeoutMs ?? 120_000,
+        storePath: input.storePath,
+    };
+}

package/dist/local-backend/router.d.ts

@@ -98,16 +98,19 @@ export declare class LocalBackendRouter {
     private runTitleGenInBackground;
     /**
      * 解析当前对话绑定的项目（项目模式）。chat 没绑项目、项目已被删除、或
-     * 注册表未注入时都返回 null（= 不沙箱，行为同旧版本）。
-     *
-     * Public: main.ts 的反向通道（reverse-tools.ts）经它给 CoreLoop 路径的
-     * 工具调用补上 projectRoot 围栏。
+     * 注册表未注入时都返回 null。无项目对话的可写根见
+     * {@link LocalBackendRouter.resolveChatWorkspaceRoot}。
      */
     resolveChatProject(chatId: string): Promise<{
         name: string;
         folderPath: string;
         sourceFolders: string[];
     } | null>;
+    /**
+     * 本对话的可写根：绑了项目用项目家目录，否则在
+     * `Documents/<应用名>/conversations/<chatId>/` 建对话工作区。
+     */
+    resolveChatWorkspaceRoot(chatId: string): Promise<string>;
     /**
      * 解析本轮生效的智能体：人设前言、技能勾选、工具策略同源于这一次解析。
      *

package/dist/local-backend/router.js

@@ -22,6 +22,8 @@ import { sanitizeCompatOverrides, sanitizePresetsChoice, sanitizeLlmProvider, sa
 import { setDefaultExecTimeoutMs } from '../local-executor.js';
 import { allowEgressForBaseUrl, getActiveEgressBroker, getEgressPosture } from '../sidecar/egress-proxy.js';
 import { buildExecSandbox, parseExecPolicy } from '../sidecar/exec-sandbox.js';
+import { clampExecPolicy } from '../host-tools.js';
+import { getResolvedHostTools, isProductLlmLocked, resolveRuntimeLlmSettings, resolveTurnApproval, resolveTurnChatMode, } from '../host-tools-runtime.js';
 import { SidecarSupervisor } from '../sidecar/index.js';
 import { diagnoseLlmConnection } from './llm-diagnose.js';
 import { brandSkillVars, buildSystemPrompt, buildForcedSkillMessage, conditionsFromTools, } from './prompt-builder.js';
@@ -38,7 +40,7 @@ import { detectInterruptedTurn } from './interrupted-helper.js';
 import { dropCurrentUserMessage } from './history-helper.js';
 import { parseImageAttachments, processImageAttachments } from '../image-attachment.js';
 import { loadProjectRuleFiles } from '../project-rules.js';
-import { allocateProjectHome, ensureProjectHome } from '../project-home.js';
+import { allocateProjectHome, ensureChatWorkspace, ensureProjectHome, expandUserPath, } from '../project-home.js';
 import { registerLiveStream, getLiveStream, removeLiveStream } from './live-stream.js';
 import { beginPackTurnObservers, collectPackExecWritableRoots, collectPackForcedSkillVars, collectPackWorldState, } from './pack-turn-hooks.js';
 import { matchPackBackendRoute } from './pack-backend-routes.js';
@@ -48,7 +50,9 @@ import { getAuthProvider } from '../auth/index.js';
 function parseSourceFolders(value) {
     if (!Array.isArray(value))
         return [];
-    return value.filter((item) => typeof item === 'string' && item.trim() !== '');
+    return value
+        .filter((item) => typeof item === 'string' && item.trim() !== '')
+        .map(expandUserPath);
 }
 /**
  * 把 CoreLoop/LLM 的底层错误翻译成适合直接显示在助手消息里的中文提示。
@@ -391,6 +395,9 @@ export class LocalBackendRouter {
             const projectId = typeof payload.projectId === 'string' && payload.projectId.trim()
                 ? payload.projectId.trim()
                 : null;
+            if (projectId && !getResolvedHostTools().projects.capability) {
+                return { status: 403, data: { detail: 'Projects are disabled for this product' } };
+            }
             if (projectId) {
                 const project = this.toolRouter.projectRegistry?.get(projectId);
                 if (!project) {
@@ -426,6 +433,10 @@ export class LocalBackendRouter {
         // ───── 项目模式：projects CRUD ─────
         // 项目记录存 electron-store（agent-projects.json），chat.project_id 存
         // SQLite。删除项目不删会话——会话降级为无项目对话。
+        if ((pathname === '/api/v2/projects' || pathname.startsWith('/api/v2/projects/')) &&
+            !getResolvedHostTools().projects.capability) {
+            return { status: 403, data: { error: 'Projects are disabled for this product' } };
+        }
         if (pathname === '/api/v2/projects') {
             const registry = this.toolRouter.projectRegistry;
             if (!registry) {
@@ -439,7 +450,7 @@ export class LocalBackendRouter {
                 try {
                     const name = String(payload.name || '');
                     const sourceFolders = parseSourceFolders(payload.sourceFolders);
-                    let folderPath = typeof payload.folderPath === 'string' ? payload.folderPath.trim() : '';
+                    let folderPath = typeof payload.folderPath === 'string' ? expandUserPath(payload.folderPath) : '';
                     if (!folderPath) {
                         folderPath = allocateProjectHome(name);
                         ensureProjectHome(folderPath);
@@ -471,7 +482,7 @@ export class LocalBackendRouter {
                 try {
                     const project = registry.update(projectId, {
                         name: typeof payload.name === 'string' ? payload.name : undefined,
-                        folderPath: typeof payload.folderPath === 'string' ? payload.folderPath : undefined,
+                        folderPath: typeof payload.folderPath === 'string' ? expandUserPath(payload.folderPath) : undefined,
                         sourceFolders: payload.sourceFolders === undefined
                             ? undefined
                             : parseSourceFolders(payload.sourceFolders),
@@ -679,6 +690,9 @@ export class LocalBackendRouter {
             // （必须真实存在，防止把会话挂到幽灵项目上）。
             let projectIdUpdate;
             if ('projectId' in payload) {
+                if (!getResolvedHostTools().projects.capability) {
+                    return { status: 403, data: { detail: 'Projects are disabled for this product' } };
+                }
                 if (payload.projectId === null) {
                     projectIdUpdate = null;
                 }
@@ -1463,10 +1477,13 @@ export class LocalBackendRouter {
             if (method === 'GET') {
                 return {
                     status: 200,
-                    data: await this.store.getLlmSettings(),
+                    data: resolveRuntimeLlmSettings(await this.store.getLlmSettings()),
                 };
             }
             if (method === 'POST') {
+                if (isProductLlmLocked()) {
+                    return { status: 403, data: { error: 'LLM settings are product-locked' } };
+                }
                 const payload = this.toRecord(request.body);
                 const saved = await llmService.setSettings({
                     provider: sanitizeLlmProvider(payload.provider),
@@ -1749,7 +1766,7 @@ export class LocalBackendRouter {
         }
         // 正文里提到的路径能否点击打开：渲染层把行内代码里「像路径」的字面量
         // 批量送来，这里落地成绝对路径并 stat 验证，只有真实存在的才回。相对
-        // 路径按对话绑定的项目根解析，无项目时按 home（同 exec 缺省 cwd 的回落）。
+        // 路径按对话绑定的项目根解析，无项目时按对话工作区。
         if (method === 'POST' && pathname === '/api/v2/local/resolve-paths') {
             const payload = this.toRecord(request.body);
             const candidates = Array.isArray(payload.candidates)
@@ -1759,7 +1776,9 @@ export class LocalBackendRouter {
                 return { status: 200, data: { resolved: [] } };
             }
             const chatId = typeof payload.chatId === 'string' ? payload.chatId : '';
-            const baseDir = (chatId ? (await this.resolveChatProject(chatId))?.folderPath : null) ?? os.homedir();
+            const baseDir = chatId
+                ? await this.resolveChatWorkspaceRoot(chatId)
+                : os.homedir();
             const resolved = await resolveMentionedPaths({ candidates, baseDir });
             return { status: 200, data: { resolved } };
         }
@@ -2018,7 +2037,7 @@ export class LocalBackendRouter {
         }
         // Plan 模式（类 Cursor "先出计划"）：仅暴露只读工具给模型，引导它先调研、
         // 再输出结构化计划，不做任何写操作/执行。其余值一律视为常规 agent 模式。
-        const chatMode = payload.mode === 'plan' ? 'plan' : 'agent';
+        const chatMode = resolveTurnChatMode(payload.mode);
         // 本轮生效的智能体：人设、技能勾选、工具策略同源。必须先解析——工具
         // 策略决定工具列表，工具列表又决定技能的触发条件。
         const turnAgents = await this.resolveTurnAgents(chatId, payload, mentionedAgentIds);
@@ -2190,10 +2209,8 @@ export class LocalBackendRouter {
     }
     /**
      * 解析当前对话绑定的项目（项目模式）。chat 没绑项目、项目已被删除、或
-     * 注册表未注入时都返回 null（= 不沙箱，行为同旧版本）。
-     *
-     * Public: main.ts 的反向通道（reverse-tools.ts）经它给 CoreLoop 路径的
-     * 工具调用补上 projectRoot 围栏。
+     * 注册表未注入时都返回 null。无项目对话的可写根见
+     * {@link LocalBackendRouter.resolveChatWorkspaceRoot}。
      */
     async resolveChatProject(chatId) {
         const projectId = (await this.store.getChat(chatId))?.projectId;
@@ -2208,6 +2225,16 @@ export class LocalBackendRouter {
             sourceFolders: project.sourceFolders ?? [],
         };
     }
+    /**
+     * 本对话的可写根：绑了项目用项目家目录，否则在
+     * `Documents/<应用名>/conversations/<chatId>/` 建对话工作区。
+     */
+    async resolveChatWorkspaceRoot(chatId) {
+        const project = await this.resolveChatProject(chatId);
+        if (project)
+            return project.folderPath;
+        return ensureChatWorkspace(chatId);
+    }
     /**
      * 解析本轮生效的智能体：人设前言、技能勾选、工具策略同源于这一次解析。
      *
@@ -2396,6 +2423,9 @@ export class LocalBackendRouter {
         // 都追加）。硬围栏在 ToolRouter/LocalExecutor，这里让模型事先知道边界，
         // 减少越界尝试。
         const chatProject = await this.resolveChatProject(chatId);
+        const workspaceRoot = chatProject
+            ? chatProject.folderPath
+            : await this.resolveChatWorkspaceRoot(chatId);
         if (chatProject) {
             systemPrompt +=
                 `\n\n【项目模式】当前对话绑定项目「${chatProject.name}」，家目录：${chatProject.folderPath}\n` +
@@ -2423,6 +2453,14 @@ export class LocalBackendRouter {
                 }
             }
         }
+        else {
+            systemPrompt +=
+                `\n\n【对话工作区】当前对话没有绑定项目。工作区：${workspaceRoot}\n` +
+                    `你的文件写入（local_write_file）和命令执行（local_exec_shell）都被限制在该目录内：` +
+                    `写入路径越界会被拒绝；命令默认在工作区下运行，显式指定的 cwd 越界也会被拒绝。` +
+                    `请一律使用工作区内的路径（相对路径按工作区解析）。` +
+                    `用户若要把对话绑到已有项目，可在输入框上方选择项目。`;
+        }
         // @引用的历史对话（payload.referencedChatIds）：把被引用对话的最近消息
         // 摘录注入为 user 消息，放在本对话历史之前。
         const referencedChatMessages = await this.buildReferencedChatContextMessages(payload, chatId);
@@ -2877,29 +2915,25 @@ export class LocalBackendRouter {
         // spec (default.harness.yaml) is the single source of truth for
         // maxRounds / maxToolErrors, and an explicit request param overrides it.
         // W4-2: per-exec sandbox for shell tool calls, default-on. Writable
-        // roots = the chat's project root (project mode) — unbound chats get an
-        // empty list, so writes confine to system scratch dirs only.
+        // roots = 项目家目录，或无项目时 Documents/<应用>/conversations/<chatId>。
         // `execPolicy: 'full'`（输入框「完整权限」）关闭这一层，让 mkdir
-        // Downloads 这类项目外写入不再被 Seatbelt 拦成 Operation not permitted。
+        // Downloads 这类工作区外写入不再被 Seatbelt 拦成 Operation not permitted。
         const chatProject = await this.resolveChatProject(chatId);
+        const workspaceRoot = chatProject
+            ? chatProject.folderPath
+            : await this.resolveChatWorkspaceRoot(chatId);
         const execSandbox = buildExecSandbox([
             // 场景包声明的每会话可写根（如文档包在项目根之外落盘产物的
             // 工作区）。
             ...collectPackExecWritableRoots(chatId),
-            ...(chatProject ? [chatProject.folderPath] : []),
-        ], { policy: parseExecPolicy(payload.execPolicy) });
+            workspaceRoot,
+        ], { policy: clampExecPolicy(parseExecPolicy(payload.execPolicy), getResolvedHostTools()) });
         // W4-1: approval algebra, host mode — every tool call is gated by the
         // Electron approval UI over the reverse channel. The durable scope
         // (allow_always / deny_always) persists per tool category under
-        // ~/.steerable (writable inside the layer-1 sandbox). STEERABLE_APPROVAL=0
-        // restores the legacy ungated behavior.
-        const approval = process.env.STEERABLE_APPROVAL === '0'
-            ? undefined
-            : {
-                mode: 'host',
-                timeoutMs: 120_000,
-                storePath: path.join(os.homedir(), '.steerable', 'approvals.json'),
-            };
+        // ~/.steerable (writable inside the layer-1 sandbox). 产品
+        // approval:"off" 或 STEERABLE_APPROVAL=0 本轮不挂审批。
+        const approval = resolveTurnApproval();
         let assistantText = '';
         const executedActions = [];
         const timeline = [];
@@ -2929,7 +2963,7 @@ export class LocalBackendRouter {
         const turnStartedAtMs = Date.now();
         const turnFileRoots = [
             ...collectPackExecWritableRoots(chatId),
-            ...(chatProject ? [chatProject.folderPath] : []),
+            workspaceRoot,
         ];
         try {
             const coreLoopOptions = {
@@ -3219,7 +3253,7 @@ export class LocalBackendRouter {
                 roots: turnFileRoots,
                 sinceMs: turnStartedAtMs,
                 actions: executedActions,
-                projectRoot: chatProject?.folderPath ?? null,
+                projectRoot: workspaceRoot,
             });
         }
         catch (turnFilesErr) {

package/dist/local-backend/task-service.d.ts

@@ -55,6 +55,11 @@ export interface TaskServiceDeps {
         name: string;
         folderPath: string;
     } | null>;
+    /**
+     * 无项目对话的可写根（Documents/<应用>/conversations/<chatId>）。
+     * 测试可不传，围栏回落为仅 scratch。
+     */
+    resolveChatWorkspaceRoot?: (chatId: string) => Promise<string>;
     /** 任务终态 / 推理过程广播（renderer 任务面板与右侧过程栏）。 */
     broadcast?: (eventName: 'task-updated' | 'task-process', payload: Record<string, unknown>) => void;
     /** 测试缝：替换真实流驱动（默认 streamCoreLoopTurn）。 */

package/dist/local-backend/task-service.js

@@ -24,12 +24,12 @@
  * 没有 `task_run`，任务不能再派生任务（任务里仍可 delegate_subagent）。
  */
 import path from 'node:path';
-import os from 'node:os';
 import { llmService, getSidecarSupervisor } from '../llm/index.js';
 import { sidecarWireProvider } from '../storage/llm-settings.js';
 import { buildWorldState, streamCoreLoopTurn, } from './coreloop-stream.js';
 import { builtinSubagentParam } from './subagent-profiles.js';
 import { buildExecSandbox } from '../sidecar/exec-sandbox.js';
+import { resolveTurnApproval } from '../host-tools-runtime.js';
 import { readSidecarHistoryEntries, timelineFromHistoryEntries, } from './task-process.js';
 import { appendTimelineDelta, syncTimelineTools, } from './turn-timeline.js';
 /** 任务回合的系统提示词：自包含、汇报结果、不假装执行。 */
@@ -272,16 +272,14 @@ export class TaskService {
         const settings = llmService.getSettings();
         const project = await this.deps.resolveChatProject(chatId);
         // 4.6b 整合：worktree 任务的围栏根 = worktree 路径（更紧——任务摸不到
-        // 主检出）；否则沿用项目根。writableRoots 同理收窄。
-        const fenceRoot = worktreePath ?? project?.folderPath ?? null;
+        // 主检出）；否则项目家目录，再否则对话工作区。
+        const fenceRoot = worktreePath ??
+            project?.folderPath ??
+            (this.deps.resolveChatWorkspaceRoot
+                ? await this.deps.resolveChatWorkspaceRoot(chatId)
+                : null);
         const execSandbox = buildExecSandbox(fenceRoot ? [fenceRoot] : []);
-        const approval = process.env.STEERABLE_APPROVAL === '0'
-            ? undefined
-            : {
-                mode: 'host',
-                timeoutMs: 120_000,
-                storePath: path.join(os.homedir(), '.steerable', 'approvals.json'),
-            };
+        const approval = resolveTurnApproval();
         // depth-1：任务回合没有 task_run（不能再派生任务），其余工具面与
         // 普通回合一致；task_status / task_result 保留（任务可以自查/互查）。
         const tools = this.deps.toolRouter

package/dist/main.js

@@ -11,6 +11,7 @@ import log from 'electron-log';
 import { getBrand } from './brand.js';
 import { getPreloadPath } from './runtime.js';
 import { getProductConfig } from './product-config.js';
+import { assertHostIpcAllowed, getResolvedHostTools } from './host-tools-runtime.js';
 import { createJsonStore } from './json-store.js';
 import { getUserDataDir } from './runtime.js';
 import { saveAttachmentFiles } from './attachments.js';
@@ -428,19 +429,23 @@ function createMenu() {
         {
             label: '视图',
             submenu: [
-                {
-                    label: '打开终端',
-                    accelerator: 'CmdOrCtrl+T',
-                    click: () => {
-                        // 终端内嵌在主窗口的 /terminal 路由——通知 renderer 导航过去。
-                        if (mainWindow && !mainWindow.isDestroyed()) {
-                            mainWindow.show();
-                            mainWindow.focus();
-                            mainWindow.webContents.send('menu:open-terminal');
-                        }
-                    },
-                },
-                { type: 'separator' },
+                ...(getResolvedHostTools().terminal.chrome
+                    ? [
+                        {
+                            label: '打开终端',
+                            accelerator: 'CmdOrCtrl+T',
+                            click: () => {
+                                // 终端内嵌在主窗口的 /terminal 路由——通知 renderer 导航过去。
+                                if (mainWindow && !mainWindow.isDestroyed()) {
+                                    mainWindow.show();
+                                    mainWindow.focus();
+                                    mainWindow.webContents.send('menu:open-terminal');
+                                }
+                            },
+                        },
+                        { type: 'separator' },
+                    ]
+                    : []),
                 { role: 'reload', label: '重新加载' },
                 { role: 'forceReload', label: '强制重新加载' },
                 { type: 'separator' },
@@ -558,6 +563,7 @@ function setupIpcHandlers() {
     });
     // 会话附件：把渲染进程给出的源路径（Electron）或 base64 字节（BS）落盘。
     ipcMain.handle('attachments:save', async (_event, input) => {
+        assertHostIpcAllowed('attachments:save');
         const chatId = typeof input?.chatId === 'string' ? input.chatId : '';
         const files = Array.isArray(input?.files)
             ? input.files.filter((f) => f && (typeof f.path === 'string' || typeof f.data === 'string'))
@@ -612,7 +618,10 @@ function setupIpcHandlers() {
     });
     ipcMain.handle('local:read-file', async (_event, request) => localExecutor.readLocalFile(request));
     ipcMain.handle('local:write-file', async (_event, request) => localExecutor.writeLocalFile(request));
-    ipcMain.handle('local:open-path', async (_event, request) => localExecutor.openLocalTarget(request));
+    ipcMain.handle('local:open-path', async (_event, request) => {
+        assertHostIpcAllowed('local:open-path');
+        return localExecutor.openLocalTarget(request);
+    });
     ipcMain.handle('local:list-scripts', async () => localScriptRegistry.list());
     ipcMain.handle('local:add-script', async (_event, input) => localScriptRegistry.create(input));
     ipcMain.handle('local:update-script', async (_event, payload) => localScriptRegistry.update(payload.id, payload.updates));
@@ -748,11 +757,16 @@ function setupIpcHandlers() {
     // ---------------------------------------------------------------------------
     // Terminal IPC: visible PTY embedded in the main window's /terminal route
     // ---------------------------------------------------------------------------
-    ipcMain.handle('terminal:list', async () => terminalManager.list());
+    ipcMain.handle('terminal:list', async () => {
+        assertHostIpcAllowed('terminal:list');
+        return terminalManager.list();
+    });
     ipcMain.handle('terminal:spawn', async (_event, options = {}) => {
+        assertHostIpcAllowed('terminal:spawn');
         return terminalManager.spawn(options);
     });
     ipcMain.handle('terminal:ensure', async (event, options = {}) => {
+        assertHostIpcAllowed('terminal:ensure');
         const session = terminalManager.ensurePrimary(options);
         // Replay any output buffered before the renderer was attached, so the
         // window doesn't look empty if the agent kicked off a command before the
@@ -770,13 +784,19 @@ function setupIpcHandlers() {
         return session;
     });
     ipcMain.handle('terminal:write', async (_event, payload) => {
+        assertHostIpcAllowed('terminal:write');
         return terminalManager.write(payload.id, payload.data);
     });
     ipcMain.handle('terminal:resize', async (_event, payload) => {
+        assertHostIpcAllowed('terminal:resize');
         return terminalManager.resize(payload.id, payload.cols, payload.rows);
     });
-    ipcMain.handle('terminal:kill', async (_event, id) => terminalManager.kill(id));
+    ipcMain.handle('terminal:kill', async (_event, id) => {
+        assertHostIpcAllowed('terminal:kill');
+        return terminalManager.kill(id);
+    });
     ipcMain.handle('terminal:exec', async (_event, payload) => {
+        assertHostIpcAllowed('terminal:exec');
         let id = payload.id;
         if (!id) {
             const session = terminalManager.ensurePrimary();

package/dist/native-folder-dialog.d.ts

@@ -0,0 +1,14 @@
+export interface NativeFolderDialogResult {
+    canceled: boolean;
+    filePaths: string[];
+}
+export interface NativeFolderDialogOptions {
+    title?: string;
+}
+export interface NativeFolderDialogDeps {
+    platform?: NodeJS.Platform;
+    run?: (cmd: string, args: readonly string[]) => Promise<{
+        stdout: string;
+    }>;
+}
+export declare function selectNativeDirectory(options?: NativeFolderDialogOptions, deps?: NativeFolderDialogDeps): Promise<NativeFolderDialogResult>;

package/dist/native-folder-dialog.js

@@ -0,0 +1,62 @@
+/**
+ * BS 宿主没有 Electron `dialog.showOpenDialog`（`ELECTRON_RUN_AS_NODE=1`）。
+ * 本模块用各平台系统选择器弹出「选文件夹」，返回与 preload
+ * `local.selectDirectory` 相同的 `{ canceled, filePaths }`。
+ *
+ * 取消、无 DISPLAY、命令不存在都记为 canceled，让 UI 走手动输入路径。
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+function sanitizePrompt(title) {
+    const raw = (title ?? '选择文件夹').replace(/[\r\n]+/g, ' ').slice(0, 80);
+    return raw.replace(/["\\]/g, '');
+}
+function picked(stdout) {
+    const folder = stdout.trim().replace(/[/\\]+$/, '');
+    return folder ? { canceled: false, filePaths: [folder] } : { canceled: true, filePaths: [] };
+}
+export async function selectNativeDirectory(options = {}, deps = {}) {
+    const platform = deps.platform ?? process.platform;
+    const run = deps.run ?? ((cmd, args) => execFileAsync(cmd, [...args]));
+    const title = sanitizePrompt(options.title);
+    try {
+        if (platform === 'darwin') {
+            const { stdout } = await run('osascript', [
+                '-e',
+                `POSIX path of (choose folder with prompt "${title}")`,
+            ]);
+            return picked(stdout);
+        }
+        if (platform === 'win32') {
+            const escaped = title.replace(/'/g, "''");
+            const script = [
+                'Add-Type -AssemblyName System.Windows.Forms',
+                '$d = New-Object System.Windows.Forms.FolderBrowserDialog',
+                `$d.Description = '${escaped}'`,
+                'if ($d.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) { $d.SelectedPath }',
+            ].join('; ');
+            const { stdout } = await run('powershell.exe', ['-NoProfile', '-Command', script]);
+            return picked(stdout);
+        }
+        try {
+            const { stdout } = await run('zenity', [
+                '--file-selection',
+                '--directory',
+                `--title=${title}`,
+            ]);
+            return picked(stdout);
+        }
+        catch {
+            const { stdout } = await run('kdialog', [
+                '--getexistingdirectory',
+                process.env.HOME || '/',
+                title,
+            ]);
+            return picked(stdout);
+        }
+    }
+    catch {
+        return { canceled: true, filePaths: [] };
+    }
+}

package/dist/product-config.d.ts

@@ -33,6 +33,41 @@ export interface ProductConfig {
      * 数据；中性 shell 缺省 'agent-shell.db'。
      */
     dbFileName?: string;
+    /**
+     * 宿主工具族：产品声明引入哪些工具。缺省全开。
+     * 形状由 host-tools 解析；本模块只存声明、不依赖解析器。
+     */
+    hostTools?: Record<string, boolean | {
+        capability?: boolean;
+        chrome?: boolean;
+    }>;
+    /**
+     * 命令安全询问：host = 弹宿主审批；off = 本轮不挂审批。缺省 host。
+     * STEERABLE_APPROVAL=0 仍是调试逃生口。
+     */
+    approval?: 'host' | 'off';
+    /**
+     * 对话模式。缺省 `['agent','plan']`。只留一种时渲染层不显示切换。
+     */
+    chatModes?: Array<'agent' | 'plan'>;
+    /**
+     * 设置入口。缺省全开。`false` 藏对应侧栏页或综合设置分段。
+     */
+    settings?: Record<string, boolean>;
+    /**
+     * 产品钉死的大模型。`settings.llm === false` 时必填，运行时用这份，
+     * 不再读设置页。密钥用 `apiKeyEnv` 指向环境变量，不要把 key 写进仓库。
+     */
+    llm?: {
+        provider?: string;
+        vendorId?: string;
+        model?: string;
+        baseUrl?: string;
+        apiKey?: string;
+        apiKeyEnv?: string;
+        temperature?: number;
+        maxTotalTokens?: number;
+    };
 }
 /**
  * 注入产品配置（产品组装根在第一个 import 时调用）。重复注入抛错
@@ -41,3 +76,5 @@ export interface ProductConfig {
 export declare function setProductConfig(config: ProductConfig): void;
 /** 读取已注入的产品配置；未注入返回空对象（中性框架行为）。 */
 export declare function getProductConfig(): ProductConfig;
+/** 测试用：清掉已注入的产品配置，避免用例互相污染。 */
+export declare function resetProductConfigForTests(): void;

package/dist/product-config.js

@@ -24,3 +24,7 @@ export function setProductConfig(config) {
 export function getProductConfig() {
     return productConfig ?? {};
 }
+/** 测试用：清掉已注入的产品配置，避免用例互相污染。 */
+export function resetProductConfigForTests() {
+    productConfig = null;
+}

package/dist/project-home.d.ts

@@ -5,6 +5,8 @@
  * 家目录由本模块分配并创建。用户另加的源文件夹是附加只读根，
  * 不替代这个家目录。
  */
+/** 把 `~` / `~/…` 展开成绝对路径；其它输入原样（已 trim）。 */
+export declare function expandUserPath(folder: string): string;
 export declare function sanitizeProjectDirName(name: string): string;
 /** `Documents/<应用显示名>`：该应用下所有托管项目的父目录。 */
 export declare function appProjectsRoot(options?: {
@@ -21,3 +23,18 @@ export declare function allocateProjectHome(projectName: string, options?: {
     exists?: (folderPath: string) => boolean;
 }): string;
 export declare function ensureProjectHome(folderPath: string): void;
+/** 无项目对话的工作区子目录名（与托管项目家目录并列，避免撞名）。 */
+export declare const CHAT_WORKSPACES_DIR = "conversations";
+/**
+ * 无项目对话的工作区路径：`Documents/<应用名>/conversations/<chatId>/`。
+ * 不落盘；调用方用 {@link ensureChatWorkspace} 创建。
+ */
+export declare function chatWorkspacePath(chatId: string, options?: {
+    documentsDir?: string;
+    appFolderName?: string;
+}): string;
+/** 确保无项目对话工作区存在，返回绝对路径。 */
+export declare function ensureChatWorkspace(chatId: string, options?: {
+    documentsDir?: string;
+    appFolderName?: string;
+}): string;

package/dist/project-home.js

@@ -6,10 +6,21 @@
  * 不替代这个家目录。
  */
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { getBrand } from './brand.js';
 import { getDocumentsDir } from './runtime.js';
 const UNSAFE_DIR_CHARS = /[\\/:*?"<>|]/g;
+/** 把 `~` / `~/…` 展开成绝对路径；其它输入原样（已 trim）。 */
+export function expandUserPath(folder) {
+    const trimmed = folder.trim();
+    if (trimmed === '~')
+        return os.homedir();
+    if (trimmed.startsWith('~/') || trimmed.startsWith('~\\')) {
+        return path.join(os.homedir(), trimmed.slice(2));
+    }
+    return trimmed;
+}
 export function sanitizeProjectDirName(name) {
     const trimmed = name
         .trim()
@@ -45,3 +56,19 @@ export function allocateProjectHome(projectName, options) {
 export function ensureProjectHome(folderPath) {
     fs.mkdirSync(folderPath, { recursive: true });
 }
+/** 无项目对话的工作区子目录名（与托管项目家目录并列，避免撞名）。 */
+export const CHAT_WORKSPACES_DIR = 'conversations';
+/**
+ * 无项目对话的工作区路径：`Documents/<应用名>/conversations/<chatId>/`。
+ * 不落盘；调用方用 {@link ensureChatWorkspace} 创建。
+ */
+export function chatWorkspacePath(chatId, options) {
+    const id = sanitizeProjectDirName(chatId);
+    return path.join(appProjectsRoot(options), CHAT_WORKSPACES_DIR, id);
+}
+/** 确保无项目对话工作区存在，返回绝对路径。 */
+export function ensureChatWorkspace(chatId, options) {
+    const folderPath = chatWorkspacePath(chatId, options);
+    ensureProjectHome(folderPath);
+    return folderPath;
+}

package/dist/server/http-server.js

@@ -34,7 +34,10 @@ import { getSidecarSupervisor } from '../llm/index.js';
 import { matchPackHttpRoute } from '../host/http-routes.js';
 import { getBrand } from '../brand.js';
 import { saveAttachmentFiles } from '../attachments.js';
+import { selectNativeDirectory } from '../native-folder-dialog.js';
 import { getAuthProvider } from '../auth/index.js';
+import { isHostRouteAllowed } from '../host-tools.js';
+import { getResolvedHostTools } from '../host-tools-runtime.js';
 /** 与 router.handleStream 内部的路由正则保持一致——只有这些路径是流式。 */
 const STREAM_PATH_PATTERNS = [
     /^\/api\/v2\/chats\/[^/]+\/(send|run|agent)$/,
@@ -152,6 +155,10 @@ export function createBsServer(deps) {
     async function handleHost(req, res, pathname) {
         const body = asRecord(await readJsonBody(req));
         const method = req.method ?? 'GET';
+        if (!isHostRouteAllowed(pathname, getResolvedHostTools())) {
+            sendJson(res, 403, { detail: 'Host route is disabled for this product' });
+            return;
+        }
         if (method === 'GET' && pathname === '/host/info') {
             const brand = getBrand();
             sendJson(res, 200, {
@@ -250,6 +257,11 @@ export function createBsServer(deps) {
             return;
         }
         // ─── local（对齐 local:* IPC） ───
+        if (method === 'POST' && pathname === '/host/local/select-directory') {
+            const title = typeof body.title === 'string' ? body.title : undefined;
+            sendJson(res, 200, await selectNativeDirectory({ title }));
+            return;
+        }
         if (method === 'POST' && pathname === '/host/local/exec-shell') {
             const request = body;
             const viaTerminal = await maybeExecInTerminal(request);
@@ -324,6 +336,7 @@ export function createBsServer(deps) {
             sendJson(res, 200, await saveAttachmentFiles(chatId, files));
             return;
         }
+        log.warn(`[bs] ${method} ${pathname} -> 404`);
         sendJson(res, 404, { detail: `Unknown host endpoint: ${method} ${pathname}` });
     }
     /** 静态托管 + index.html 注入 BS 标记（前端据此切换 http-bridge）。 */

package/dist/sidecar/boot.d.ts

@@ -5,7 +5,7 @@ import type { SidecarReverseHandler } from './types.js';
 export interface HostSidecarDeps {
     store: ScopedStore;
     toolRouter: ToolRouter;
-    /** W4-2 项目模式围栏：chatId → 项目根（无项目对话返回 null）。 */
+    /** W4-2 围栏：chatId → 项目家目录或无项目对话工作区。 */
     resolveProjectRoot: (chatId: string) => Promise<string | null>;
     /**
      * 项目模式之外额外放行的只读根（会话附件目录等）。文件写入仍只受

package/dist/sidecar/reverse-tools.d.ts

@@ -16,7 +16,7 @@ export interface ReverseToolDeps {
     }) => void;
     /**
      * 项目模式：按 chatId 解析项目根（绝对路径），无绑定/已删除返回 null。
-     * main.ts 注入 LocalBackendRouter.resolveChatProject 的适配；未注入时
+     * main.ts 注入对话可写根（项目家目录或无项目对话工作区）；未注入时
      * 项目围栏不生效（CLI/test 场景）。
      */
     resolveProjectRoot?: (chatId: string) => Promise<string | null>;

package/dist/storage/index.d.ts

@@ -12,7 +12,7 @@ export interface ChatSessionRecord {
     title: string;
     userId: string;
     agentId: string | null;
-    /** 项目模式：绑定的项目 id（ProjectRegistry）。null = 无项目对话（不沙箱）。 */
+    /** 项目模式：绑定的项目 id（ProjectRegistry）。null = 无项目对话（用对话工作区）。 */
     projectId: string | null;
     createdAt: string;
     updatedAt: string;

package/dist/storage/llm-settings.d.ts

@@ -81,6 +81,21 @@ export declare function llmSettingsCarryExpiredBakedKey(s: LlmSettings): boolean
 export declare const OLLAMA_DEFAULTS: LlmSettings;
 export declare function sanitizeLlmProvider(raw: unknown): LlmProvider;
 export declare function sanitizeVendorId(raw: unknown): string | undefined;
+export interface ProductLlmConfig {
+    provider?: string;
+    vendorId?: string;
+    model?: string;
+    baseUrl?: string;
+    apiKey?: string;
+    apiKeyEnv?: string;
+    temperature?: number;
+    maxTotalTokens?: number;
+}
+/**
+ * `settings.llm` 关掉后，产品必须声明 `llm.model`。密钥优先 product.apiKey，
+ * 其次 `apiKeyEnv` 指向的环境变量，再回落已存 key（升级前用户填过的）。
+ */
+export declare function resolveLockedLlmSettings(value: unknown, env?: Record<string, string | undefined>, persisted?: LlmSettings | null): LlmSettings;
 /** Sidecar `agent.chat.stream` 的 provider 字段。 */
 export declare function sidecarWireProvider(provider: LlmProvider): string;
 export declare function usesOpenAiCompatExtras(provider: LlmProvider): boolean;

package/dist/storage/llm-settings.js

@@ -67,6 +67,34 @@ export function sanitizeVendorId(raw) {
     const id = raw.trim();
     return id || undefined;
 }
+/**
+ * `settings.llm` 关掉后，产品必须声明 `llm.model`。密钥优先 product.apiKey，
+ * 其次 `apiKeyEnv` 指向的环境变量，再回落已存 key（升级前用户填过的）。
+ */
+export function resolveLockedLlmSettings(value, env = {}, persisted = null) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('[product-llm] settings.llm is off; product.json must declare llm');
+    }
+    const raw = value;
+    const model = typeof raw.model === 'string' ? raw.model.trim() : '';
+    if (!model) {
+        throw new Error('[product-llm] llm.model is required when settings.llm is off');
+    }
+    const fromProduct = typeof raw.apiKey === 'string' && raw.apiKey.trim() ? raw.apiKey.trim() : undefined;
+    const envName = typeof raw.apiKeyEnv === 'string' ? raw.apiKeyEnv.trim() : '';
+    const fromEnv = envName ? env[envName]?.trim() || undefined : undefined;
+    const fromPersisted = persisted?.apiKey?.trim() || undefined;
+    return mergeLlmSettings({
+        provider: sanitizeLlmProvider(raw.provider ?? persisted?.provider ?? 'openai-compat'),
+        vendorId: sanitizeVendorId(raw.vendorId),
+        model,
+        baseUrl: typeof raw.baseUrl === 'string' ? raw.baseUrl : persisted?.baseUrl,
+        apiKey: fromProduct || fromEnv || fromPersisted,
+        temperature: typeof raw.temperature === 'number' ? raw.temperature : undefined,
+        maxTotalTokens: typeof raw.maxTotalTokens === 'number' ? raw.maxTotalTokens : persisted?.maxTotalTokens,
+        execTimeoutSeconds: persisted?.execTimeoutSeconds,
+    });
+}
 /** Sidecar `agent.chat.stream` 的 provider 字段。 */
 export function sidecarWireProvider(provider) {
     switch (provider) {

package/dist/tool-router.js

@@ -5,6 +5,8 @@ import { mcpExecutor } from './mcp-executor.js';
 import { rankTools, resolveMaxResults, TOOL_SEARCH_DEFAULT_MAX_RESULTS, } from './tool-search-rank.js';
 import { maybeAutoInstallWrittenSkill } from './local-backend/skill-install.js';
 import { filterToolsByPolicy, isToolAllowed, } from './local-backend/agent-capability.js';
+import { isHostToolCapabilityEnabled } from './host-tools.js';
+import { getResolvedHostTools } from './host-tools-runtime.js';
 /** 已注册 MCP 服务的动态工具名前缀：`mcp__<serverKey>__<toolName>`。 */
 export const MCP_DYNAMIC_TOOL_PREFIX = 'mcp__';
 /**
@@ -608,7 +610,8 @@ export class ToolRouter {
      */
     listModelSchemas(policy) {
         const effective = policy ?? { mode: 'all', tools: [] };
-        const all = filterToolsByPolicy(this.listSchemas(), effective);
+        const tools = getResolvedHostTools();
+        const all = filterToolsByPolicy(this.listSchemas(), effective).filter((s) => isHostToolCapabilityEnabled(s.name, tools));
         const hasDeferred = all.some(s => s.exposure === 'deferred');
         return all.filter(s => {
             if ((s.exposure ?? 'direct') !== 'direct')
@@ -630,6 +633,9 @@ export class ToolRouter {
         if (toolPolicy && !isToolAllowed(toolPolicy, call.name)) {
             throw new Error(`工具 ${call.name} 被当前智能体的工具策略拒绝（智能体管理 → 工具权限）`);
         }
+        if (!isHostToolCapabilityEnabled(call.name, getResolvedHostTools())) {
+            throw new Error(`工具 ${call.name} 未在本产品引入`);
+        }
         if (call.name.startsWith(MCP_DYNAMIC_TOOL_PREFIX)) {
             return await this.executeRegisteredMcpTool(call.name, args);
         }
@@ -883,7 +889,8 @@ export class ToolRouter {
      */
     executeToolSearch(args, policy) {
         const cap = resolveMaxResults(args.max_results);
-        const deferred = filterToolsByPolicy(this.listSchemas().filter(s => s.exposure === 'deferred'), policy ?? { mode: 'all', tools: [] });
+        const tools = getResolvedHostTools();
+        const deferred = filterToolsByPolicy(this.listSchemas().filter(s => s.exposure === 'deferred'), policy ?? { mode: 'all', tools: [] }).filter((s) => isHostToolCapabilityEnabled(s.name, tools));
         const ranked = rankTools(deferred, String(args.query ?? ''));
         const matches = ranked.slice(0, cap).map(schema => ({
             name: schema.name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steerable/agent-shell",
-  "version": "0.6.31",
+  "version": "0.6.33",
   "description": "Steerable framework — product-neutral desktop/headless agent host (Tier 5). Electron main + preload + headless HTTP server (BS) sharing one storage/sidecar/tooling core; scenario packs extend it through the @steerable/pack-sdk contract and are composed at build time by the consuming product.",
   "license": "Apache-2.0",
   "homepage": "https://steerableframework.com/",
@@ -15,6 +15,10 @@
   "type": "module",
   "main": "dist/runtime.js",
   "exports": {
+    "./host-tools": {
+      "types": "./dist/host-tools.d.ts",
+      "default": "./dist/host-tools.js"
+    },
     "./auth": {
       "types": "./dist/auth/index.d.ts",
       "default": "./dist/auth/index.js"
@@ -49,9 +53,9 @@
     "electron-store": "^8.1.0",
     "he": "^1.2.0",
     "node-pty": "^1.1.0",
-    "@steerable/agent-harness": "0.6.31",
-    "@steerable/pack-sdk": "0.6.31",
-    "@steerable/agent-protocol": "0.6.31"
+    "@steerable/agent-harness": "0.6.33",
+    "@steerable/pack-sdk": "0.6.33",
+    "@steerable/agent-protocol": "0.6.33"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",