@steerable/agent-shell 0.6.72 → 0.6.73

package/dist/host/runtime.js

@@ -32,7 +32,7 @@ import { createAskUserBridge } from '../sidecar/reverse-ask-user.js';
 import { startHostSidecar, shutdownHostSidecar } from '../sidecar/boot.js';
 import { createVisibleTerminalExec } from './visible-terminal-exec.js';
 import { createJsonStore } from '../json-store.js';
-import { bindWorkspaceSkillRoots } from '../local-backend/skill-loader.js';
+import { bindWorkspaceSkillRoots, listSkillRoots } from '../local-backend/skill-loader.js';
 import { collectPackExecWritableRoots } from '../local-backend/pack-turn-hooks.js';
 import { getChatAttachmentsDir } from '../attachments.js';
 import { ensureChatWorkspace } from '../project-home.js';
@@ -41,6 +41,20 @@ import { llmService } from '../llm/index.js';
 import { isProductLlmLocked, resolveRuntimeLlmSettings } from '../host-tools-runtime.js';
 import { getPackAssemblies, } from './pack-assembly.js';
 import { registerPackHttpRoutes } from './http-routes.js';
+/**
+ * spill 目录作为只读根：工具输出超过内联上限时 sidecar 会把全文落到
+ * ``STEERABLE_SPILL_DIR``（BS 宿主由 run-bs-server.mjs 设为
+ * ``<userDataDir>/sidecar/steerable-spill``），并告诉模型去哪读全文。
+ * 只把它加进 shell 沙箱而不加进文件工具读根，模型就会「读自己刚被指到的
+ * 文件」而报路径越界——实测事故里正是如此。只读，不授予写入。
+ *
+ * 未设置该 env 时返回空表：sidecar 的回退目录是系统临时目录，把它整片
+ * 开给文件工具得不偿失，那种部署继续走 shell cat。
+ */
+function spillReadRoots() {
+    const dir = process.env.STEERABLE_SPILL_DIR?.trim();
+    return dir ? [dir] : [];
+}
 export async function createHostRuntime(options) {
     const { broadcast, hasWindow, onLog } = options;
     const broadcastMain = options.broadcastMain ?? broadcast;
@@ -242,14 +256,24 @@ export async function createHostRuntime(options) {
                 store: defaultStore,
                 toolRouter,
                 resolveProjectRoot: async (chatId) => localBackendRouter.resolveChatWorkspaceRoot(chatId),
-                // 写：源文件夹、包声明的可写根，以及各自的子目录。附件目录保持只读。
+                // 读：附件目录、源文件夹、包声明的可写根，以及只读参考面（技能根 /
+                // spill 根）。凡运行时"会写进去、模型需要读回来"的目录都必须可读；
+                // 否则 local_read_file 一律「路径越界」，模型只能退回 shell cat 绕行。
+                // 读集合不越出模型本就能读/本就被允许写入的范围。
                 resolveAdditionalReadRoots: async (chatId) => {
                     const project = await localBackendRouter.resolveChatProject(chatId);
                     return [
                         getChatAttachmentsDir(chatId),
                         ...(project?.sourceFolders ?? []),
+                        ...collectPackExecWritableRoots(chatId),
+                        // 技能根：workflows/references/templates 是只读参考，模型必须能读
+                        // （spec_lock_reference.md 定义 pptx_layouts 怎么写，正是它被拒过）。
+                        ...listSkillRoots(),
+                        // spill 根：工具输出过大时 sidecar 落到这里，模型要读回全文。
+                        ...spillReadRoots(),
                     ];
                 },
+                // 写：源文件夹、包声明的可写根，以及各自的子目录。附件目录保持只读。
                 resolveAdditionalWriteRoots: async (chatId) => {
                     const project = await localBackendRouter.resolveChatProject(chatId);
                     return [

package/dist/local-backend/agent-capability.d.ts

@@ -11,7 +11,8 @@
  * 三个互相独立的执行点，任何一处漂移都会让「限制」变成假象：
  *
  *   1. 系统提示词注入   —— prompt-builder 的 `excludeSkillNames` / `pinnedSkillNames`
- *   2. sidecar 技能目录 —— `SkillTurnContext.exclude`
+ *   2. sidecar 技能面   —— `SkillTurnContext.exclude`（硬排除）+
+ *                          `SkillTurnContext.pinned`（目录去重但仍可按需加载）
  *   3. 工具面           —— 每轮 `turnTools`、`tool_search` 结果、反向通道分发复检
  *
  * 多个智能体配置按「最宽松」合并（父代理自身、或显式传入的列表）。

package/dist/local-backend/agent-capability.js

@@ -11,7 +11,8 @@
  * 三个互相独立的执行点，任何一处漂移都会让「限制」变成假象：
  *
  *   1. 系统提示词注入   —— prompt-builder 的 `excludeSkillNames` / `pinnedSkillNames`
- *   2. sidecar 技能目录 —— `SkillTurnContext.exclude`
+ *   2. sidecar 技能面   —— `SkillTurnContext.exclude`（硬排除）+
+ *                          `SkillTurnContext.pinned`（目录去重但仍可按需加载）
  *   3. 工具面           —— 每轮 `turnTools`、`tool_search` 结果、反向通道分发复检
  *
  * 多个智能体配置按「最宽松」合并（父代理自身、或显式传入的列表）。

package/dist/local-backend/coreloop-stream.d.ts

@@ -57,11 +57,17 @@ export interface SkillTurnContext {
     /** 活跃条件串(tool:* / has-tools / plan-mode),与提示词拼装同源。 */
     conditions: string[];
     /**
-     * 目录里不出现的技能:模式级排除(plan 模式排掉执行类技能)、智能体关闭
-     * 「允许其他技能」时的未勾选项、以及已随系统提示词常驻的勾选项(避免
-     * 模型再调 `skill` 工具加载第二遍)。
+     * 硬排除:模式级排除(plan 模式排掉执行类技能)、智能体关闭「允许其他
+     * 技能」时的未勾选项。sidecar 的 `skill` 工具会直接用
+     * `not available in this mode` 拒绝这些名字。
      */
     exclude: string[];
+    /**
+     * 已由宿主 eager 注入正文的 pinned 技能。sidecar 不应再把它们列进
+     * catalog(避免重复),但 `skill` 工具仍必须能按需加载完整正文——
+     * 大技能可能被 system prompt cap 截断,模型重载是合法恢复路径。
+     */
+    pinned: string[];
     /** 智能体的「加载全部技能」:catalog 无视条件全量列出。 */
     ignoreConditions: boolean;
 }

package/dist/local-backend/router.d.ts

@@ -133,6 +133,11 @@ export declare class LocalBackendRouter {
      * `Documents/<应用名>/conversations/<chatId>/` 建对话工作区。
      */
     resolveChatWorkspaceRoot(chatId: string): Promise<string>;
+    /**
+     * 回合产物下载。只允许本会话 `turnFiles` 元数据里列出的文件，或落在
+     * 本会话工作区内的文件；验证通过后按 base64 返回，前端落 Blob 下载。
+     */
+    private handleLocalFileDownload;
     /**
      * 解析本轮生效的智能体：人设前言、技能勾选、工具策略同源于这一次解析。
      *

package/dist/local-backend/router.js

@@ -1,6 +1,7 @@
 import { randomUUID } from 'crypto';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
+import { readFile, realpath, stat } from 'node:fs/promises';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import os from 'node:os';
 import { getAppRootDir, getUserDataDir, shellOpenPath } from '../runtime.js';
@@ -45,7 +46,7 @@ import { handlePortableRequest } from './portable-service.js';
 import { isPortableProduct } from '../product-config.js';
 import { dropCurrentUserMessage } from './history-helper.js';
 import { parseImageAttachments, processImageAttachments } from '../image-attachment.js';
-import { chatAttachmentsDirPath } from '../attachments.js';
+import { chatAttachmentsDirPath, isValidChatAttachmentsKey } from '../attachments.js';
 import { loadProjectRuleFiles } from '../project-rules.js';
 import { allocateProjectHome, ensureChatWorkspace, ensureProjectHome, expandUserPath, } from '../project-home.js';
 import { registerLiveStream, getLiveStream, removeLiveStream } from './live-stream.js';
@@ -84,6 +85,71 @@ function readProjectOrderIds(value) {
     }
     return ids;
 }
+/** 回合产物下载上限：base64 走 localBackend JSON 通道，过大文件先拒绝。 */
+const MAX_LOCAL_DOWNLOAD_BYTES = 128 * 1024 * 1024;
+/** `target` 是否位于 `root` 内部（含 root 本身）。 */
+function isPathInsideRoot(root, target) {
+    const rel = path.relative(path.resolve(root), path.resolve(target));
+    return rel === '' || (rel !== '..' &&
+        !rel.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(rel));
+}
+/** 从一条消息的 `messageMetadata` 里取出本回合产物的绝对路径。 */
+function turnFilePathsFromMetadata(raw) {
+    if (typeof raw !== 'string' || !raw)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return [];
+    const files = parsed.turnFiles;
+    if (!Array.isArray(files))
+        return [];
+    const paths = [];
+    for (const item of files) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const filePath = item.path;
+        if (typeof filePath === 'string' && filePath)
+            paths.push(filePath);
+    }
+    return paths;
+}
+const DOWNLOAD_MIME_BY_EXT = {
+    '.doc': 'application/msword',
+    '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    '.xls': 'application/vnd.ms-excel',
+    '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    '.ppt': 'application/vnd.ms-powerpoint', // shell-neutral:allow — Office 扩展名 / MIME，不是产品品牌
+    '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation', // shell-neutral:allow — Office 扩展名 / MIME，不是产品品牌
+    '.pdf': 'application/pdf',
+    '.csv': 'text/csv',
+    '.txt': 'text/plain',
+    '.md': 'text/markdown',
+    '.json': 'application/json',
+    '.html': 'text/html',
+    '.htm': 'text/html',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.webp': 'image/webp',
+    '.svg': 'image/svg+xml',
+    '.mp3': 'audio/mpeg',
+    '.mp4': 'video/mp4',
+    '.zip': 'application/zip',
+    '.7z': 'application/x-7z-compressed',
+    '.tar': 'application/x-tar',
+    '.gz': 'application/gzip',
+};
+function downloadMimeForPath(filePath) {
+    return DOWNLOAD_MIME_BY_EXT[path.extname(filePath).toLowerCase()] ?? 'application/octet-stream';
+}
 /**
  * 把 CoreLoop/LLM 的底层错误翻译成适合直接显示在助手消息里的中文提示。
  * 原始错误仍保存在 messageMetadata.completionReason 里，便于排查。
@@ -126,6 +192,19 @@ function coreLoopBudgetTokensFromEnv() {
     const n = Number(raw);
     return Number.isFinite(n) && n > 0 ? Math.trunc(n) : undefined;
 }
+/**
+ * ``trace.fetch`` 的单次 RPC 超时。原来硬编码 5s：长跑的 trace 动辄几十 MB
+ * （实测 259 轮 → 161111 条事件 ≈ 39 MB），5s 必然超时，整条 trace 被静默丢弃
+ * ——偏偏最需要排查的长跑一条现场都不留。侧车侧已改成分片返回
+ * （``_handle_trace_fetch``，默认 ≤5 万条事件），这里再给足传输余量。
+ */
+function traceFetchTimeoutMs() {
+    const raw = process.env.DEEPPATH_TRACE_FETCH_TIMEOUT_MS;
+    if (!raw)
+        return 60_000;
+    const n = Number(raw);
+    return Number.isFinite(n) && n > 0 ? Math.trunc(n) : 60_000;
+}
 const LOCAL_USER_BASE = {
     id: 'local',
     email: 'local@localhost',
@@ -1617,13 +1696,6 @@ export class LocalBackendRouter {
         // Bearer、Anthropic x-api-key、Google x-goog-api-key），再与 models.dev
         // 能力表 join。refresh=1 绕过 60s 缓存。凭证随设置显式下发。
         if (method === 'GET' && pathname === '/api/v2/llm/models') {
-            const supervisor = await whenSidecarSupervisor();
-            if (!supervisor) {
-                return {
-                    status: 503,
-                    data: { error: 'sidecar 未就绪', models: [], catalogStatus: 'offline' },
-                };
-            }
             const settings = llmService.getSettings();
             const draftBase = url.searchParams.get('baseUrl');
             const draftKey = url.searchParams.get('apiKey');
@@ -1638,7 +1710,16 @@ export class LocalBackendRouter {
                 }
                 // 设置页验的是用户当场填的地址，通常还没保存，所以不在 boot 时派生的
                 // 代理白名单上。放行它，否则每次「测试」都被自己的代理 403。
+                // plain-http（本机 Ollama）放不进 CONNECT 代理，这里会重启 sidecar；
+                // 必须在重启之后再取 supervisor，否则 listModels 打到已退出的进程。
                 await allowEgressForBaseUrl(baseUrl);
+                const supervisor = await whenSidecarSupervisor();
+                if (!supervisor) {
+                    return {
+                        status: 503,
+                        data: { error: 'sidecar 未就绪', models: [], catalogStatus: 'offline' },
+                    };
+                }
                 const catalog = await supervisor.listModels({
                     baseUrl,
                     apiKey,
@@ -2018,6 +2099,12 @@ export class LocalBackendRouter {
             }
             return { status: 200, data: { success: true } };
         }
+        // 回合产物「下载」：浏览器模式（团队版 / BS）没有系统应用可打开，
+        // 由宿主读回文件字节，前端落成 Blob 下载。路径必须来自本会话的回合
+        // 产物元数据或会话工作区，避免变成任意文件读取。
+        if (method === 'GET' && pathname === '/api/v2/local/download') {
+            return this.handleLocalFileDownload(url.searchParams.get('chatId') ?? '', url.searchParams.get('path') ?? '');
+        }
         // 正文里提到的路径能否点击打开：渲染层把行内代码里「像路径」的字面量
         // 批量送来，这里落地成绝对路径并 stat 验证，只有真实存在的才回。相对
         // 路径按对话绑定的项目根解析，无项目时按对话工作区。
@@ -2590,6 +2677,100 @@ export class LocalBackendRouter {
             return project.folderPath;
         return ensureChatWorkspace(chatId);
     }
+    /**
+     * 回合产物下载。只允许本会话 `turnFiles` 元数据里列出的文件，或落在
+     * 本会话工作区内的文件；验证通过后按 base64 返回，前端落 Blob 下载。
+     */
+    async handleLocalFileDownload(chatIdRaw, targetRaw) {
+        if (!getResolvedHostTools()['local-fs'].capability) {
+            return { status: 403, data: { detail: '本地文件能力已关闭' } };
+        }
+        const chatId = chatIdRaw.trim();
+        if (!chatId || !isValidChatAttachmentsKey(chatId)) {
+            return { status: 400, data: { detail: 'chatId 无效' } };
+        }
+        const chat = await this.store.getChat(chatId);
+        if (!chat) {
+            return { status: 404, data: { detail: 'chat not found' } };
+        }
+        const target = targetRaw.trim();
+        if (!target || target.includes('\0') || !path.isAbsolute(target)) {
+            return { status: 400, data: { detail: '需要文件的绝对路径' } };
+        }
+        let realPath;
+        let fileStat;
+        try {
+            realPath = await realpath(target);
+            fileStat = await stat(realPath);
+        }
+        catch {
+            return { status: 404, data: { detail: '找不到这个文件' } };
+        }
+        if (!fileStat.isFile()) {
+            return { status: 404, data: { detail: '找不到这个文件' } };
+        }
+        if (fileStat.size > MAX_LOCAL_DOWNLOAD_BYTES) {
+            return {
+                status: 413,
+                data: {
+                    detail: `文件太大，无法直接下载（上限 ${Math.round(MAX_LOCAL_DOWNLOAD_BYTES / 1024 / 1024)}MB）`,
+                },
+            };
+        }
+        const wanted = new Set([path.resolve(target), path.resolve(realPath)]);
+        let allowed = false;
+        const teamUserRoot = process.env.DEEPPATH_TEAM_USER_DATA_ROOT?.trim();
+        if (teamUserRoot) {
+            // 团队版是同一台机器上的多租户宿主：下载根必须落在当前用户数据目录
+            // 或绑定项目内。只信任 turnFiles 元数据不够——符号链接可以指向别的
+            // 用户目录，realpath 必须在这些根里才放行。
+            const roots = [getUserDataDir()];
+            try {
+                const project = await this.resolveChatProject(chatId);
+                if (project)
+                    roots.push(project.folderPath, ...project.sourceFolders);
+            }
+            catch {
+                // 项目注册表未就绪时只认用户数据目录。
+            }
+            allowed = roots.some((root) => isPathInsideRoot(root, realPath));
+        }
+        else {
+            const messages = await this.store.listMessages(chatId, 1000);
+            for (const message of messages) {
+                for (const listed of turnFilePathsFromMetadata(message.messageMetadata)) {
+                    if (wanted.has(path.resolve(listed))) {
+                        allowed = true;
+                        break;
+                    }
+                }
+                if (allowed)
+                    break;
+            }
+            if (!allowed) {
+                try {
+                    const workspaceRoot = await this.resolveChatWorkspaceRoot(chatId);
+                    allowed = isPathInsideRoot(workspaceRoot, realPath);
+                }
+                catch {
+                    allowed = false;
+                }
+            }
+        }
+        if (!allowed) {
+            return { status: 404, data: { detail: '这个文件不属于当前对话' } };
+        }
+        const buffer = await readFile(realPath);
+        return {
+            status: 200,
+            data: {
+                fileName: path.basename(realPath),
+                mime: downloadMimeForPath(realPath),
+                size: buffer.length,
+                base64: buffer.toString('base64'),
+            },
+        };
+    }
     /**
      * 解析本轮生效的智能体：人设前言、技能勾选、工具策略同源于这一次解析。
      *
@@ -2765,15 +2946,15 @@ export class LocalBackendRouter {
                     ...conditionsFromTools(toolNames),
                     ...(chatMode === 'plan' ? ['plan-mode'] : []),
                 ],
-                // 勾选的技能正文已随系统提示词常驻，目录里不再重复列出——否则模型
-                // 会再调一次 `skill` 工具把同一份正文加载第二遍。
-                exclude: [
-                    ...new Set([
-                        ...excludeSkillNames,
-                        ...built.modules
-                            .filter((m) => isSkillPinned(m, capability.pinnedSkills))
-                            .map((m) => m.dirName || m.name),
-                    ]),
+                // 硬排除只放模式级/白名单排除。pinned 技能单独走 `pinned`：
+                // sidecar 不把它列进 catalog（宿主已 eager 注入正文），但仍允许
+                // `skill` 工具按需加载完整正文；否则大技能被 system prompt cap
+                // 截断后，模型重载会被误报成“not available in this mode”。
+                exclude: [...new Set(excludeSkillNames)],
+                pinned: [
+                    ...new Set(built.modules
+                        .filter((m) => isSkillPinned(m, capability.pinnedSkills))
+                        .map((m) => m.dirName || m.name)),
                 ],
                 ignoreConditions: capability.loadAllSkills,
             };
@@ -3715,8 +3896,18 @@ export class LocalBackendRouter {
             // 只有最后一趟携带本轮终态;之前每一趟都是撞墙截停才有下一趟。
             const passStatus = index === passTraceIds.length - 1 ? completionStatus : 'budget_exhausted';
             try {
-                const fetched = await supervisor.call('trace.fetch', { traceId }, { timeoutMs: 5_000 });
+                const fetched = await supervisor.call('trace.fetch', { traceId }, { timeoutMs: traceFetchTimeoutMs() });
                 const sidecarTrace = fetched.trace ?? {};
+                if (fetched.eventsTruncated) {
+                    // 侧车把超长 trace 截成 头+尾（见 _handle_trace_fetch）。留痕，
+                    // 否则被截断的 trace 会被当成完整现场读。
+                    console.warn('[local-backend] coreloop trace truncated for storage', {
+                        chatId,
+                        traceId,
+                        eventsReturned: (fetched.events ?? []).length,
+                        eventsTotal: fetched.eventsTotal,
+                    });
+                }
                 const durationMs = typeof sidecarTrace.durationMs === 'number'
                     ? sidecarTrace.durationMs
                     : null;
@@ -3732,11 +3923,27 @@ export class LocalBackendRouter {
                         trace: sidecarTrace,
                         spans: fetched.spans ?? [],
                         events: fetched.events ?? [],
+                        ...(fetched.eventsTruncated
+                            ? {
+                                eventsTruncated: true,
+                                eventsTotal: fetched.eventsTotal,
+                            }
+                            : {}),
                     },
                 });
             }
             catch (err) {
-                console.warn('[local-backend] coreloop trace persist failed', err);
+                // 丢了 trace 就没有现场：这条日志必须带够可定位信息，且措辞直白
+                // 到能直接 grep（历史事故里 259 轮/token 量最大的三个 run 全因此
+                // 没有任何 trace 可查）。
+                console.warn('[local-backend] coreloop trace persist failed', {
+                    chatId,
+                    traceId,
+                    passStatus,
+                    pass: index + 1,
+                    of: passTraceIds.length,
+                    err: err instanceof Error ? err.message : String(err),
+                });
             }
             // W6-6 遥测合规化:若用户配置了 OTLP collector,把这条 trace 按所选
             // 隐私档位导出(默认 metadata——只出结构/时延/状态,不出内容)。

package/dist/sidecar/boot.js

@@ -16,7 +16,7 @@ import { deriveEgressAllowListFromBaseUrl, probeExecSandboxCapability, } from '.
 import { createToolInvokeHandler } from './reverse-tools.js';
 import { createProcessSpawnHandler } from './reverse-spawn.js';
 import { collectAmbientProxyEndpoints } from './proxy-detect.js';
-import { buildEgressProxyPlan, decideEgressProxy, ensureEgressProxyExecutable, deriveWebEgressHosts, pickFreePort, recordEgressPosture, startEgressProxy, } from './egress-proxy.js';
+import { buildEgressProxyPlan, decideEgressProxy, ensureEgressProxyExecutable, deriveWebEgressHosts, pickFreePort, recordEgressPosture, seatbeltHostEntry, seatbeltProfileCoversBaseUrl, setPlainEndpointRestarter, startEgressProxy, } from './egress-proxy.js';
 import { WEB_TOOL_RPC_TIMEOUT_MS, webToolsEnabled } from '../tool-router.js';
 import { sidecarWebSearchEnv } from '../storage/web-search-settings.js';
 import { executeHostedWebSearch } from '../hosted-web-search.js';
@@ -24,6 +24,67 @@ import { getProductConfig } from '../product-config.js';
 let egressProxyRef = null;
 let supervisorRef = null;
 let sidecarGeneration = 0;
+let hostSidecarDeps = null;
+/** plain-http 端点。spawn 名单里没有它时，重启前写在这里，下一次 profile 带上。 */
+let admittedPlainBaseUrl;
+let spawnEgress = null;
+let restartInFlight = null;
+let restarting = false;
+function withAdmittedPlain(hosts) {
+    if (!hosts)
+        return hosts;
+    const extra = seatbeltHostEntry(admittedPlainBaseUrl);
+    if (!extra || hosts.includes(extra))
+        return hosts;
+    return [...hosts, extra];
+}
+async function restartHostSidecar() {
+    const deps = hostSidecarDeps;
+    if (!deps)
+        return;
+    if (restartInFlight) {
+        await restartInFlight;
+        return;
+    }
+    const run = (async () => {
+        restarting = true;
+        try {
+            await shutdownHostSidecar();
+            await startHostSidecar(deps);
+        }
+        finally {
+            restarting = false;
+        }
+    })();
+    restartInFlight = run;
+    try {
+        await run;
+    }
+    finally {
+        if (restartInFlight === run)
+            restartInFlight = null;
+    }
+}
+setPlainEndpointRestarter(async (baseUrl) => {
+    if (!hostSidecarDeps || !spawnEgress)
+        return false;
+    if (seatbeltProfileCoversBaseUrl(baseUrl, spawnEgress.hosts, spawnEgress.webEgress)) {
+        return false;
+    }
+    const extra = seatbeltHostEntry(baseUrl);
+    if (!extra)
+        return false;
+    admittedPlainBaseUrl = baseUrl;
+    log.info(`[sidecar] restarting to admit ${extra}`);
+    try {
+        await restartHostSidecar();
+    }
+    catch (err) {
+        log.warn('[sidecar] restart for plain endpoint failed', err);
+        return false;
+    }
+    return seatbeltProfileCoversBaseUrl(baseUrl, spawnEgress?.hosts, spawnEgress?.webEgress ?? false);
+});
 async function deriveSidecarEgressAllowList() {
     const envList = (process.env.STEERABLE_SIDECAR_SANDBOX_ALLOWED_HOSTS ?? '')
         .split(',')
@@ -31,7 +92,7 @@ async function deriveSidecarEgressAllowList() {
         .filter(Boolean);
     if (envList.length > 0)
         return envList;
-    const derived = deriveEgressAllowListFromBaseUrl(llmService.getSettings().baseUrl);
+    const derived = deriveEgressAllowListFromBaseUrl(llmService.getSettings().baseUrl) ?? [];
     // W4-8: the sidecar's httpx stack honors ambient proxies (env vars, and
     // the macOS system proxy via getproxies). A configured proxy is an
     // effective egress point — without it in the allow-list, the sandbox
@@ -39,7 +100,7 @@ async function deriveSidecarEgressAllowList() {
     // system proxy 127.0.0.1:7890 hijacked even 127.0.0.1:11434 because
     // getproxies() does not surface the system bypass list).
     const proxies = await collectAmbientProxyEndpoints();
-    const merged = [...new Set([...(derived ?? []), ...proxies])];
+    const merged = withAdmittedPlain([...new Set([...derived, ...proxies])]) ?? [];
     if (merged.length === 0) {
         log.warn('[sidecar] cannot derive egress allow-list from provider baseUrl; outbound stays open');
         return undefined;
@@ -196,6 +257,7 @@ export async function wirePluginRegistry(supervisor, toolRouter) {
  * et al.) can await it via whenSidecarSupervisor().
  */
 export async function startHostSidecar(deps) {
+    hostSidecarDeps = deps;
     const generation = ++sidecarGeneration;
     const pythonRunner = process.env.STEERABLE_PYTHON?.trim();
     const runCodeEnabled = true;
@@ -305,6 +367,14 @@ export async function startHostSidecar(deps) {
             // profile already allows writes to; userData would be denied.
             // Path is per-flavor / env-overridable — see resolveSidecarStoragePath.
             const storagePath = resolveSidecarStoragePath();
+            // W4-3: sandbox default-on. This list is fixed at spawn. HTTPS hosts
+            // are added at runtime via allowEgressForBaseUrl. plain-http (Ollama)
+            // cannot, so that path restarts the sidecar with the new host appended.
+            const sandboxAllowedHosts = withAdmittedPlain(egressProxy?.sandboxAllowedHosts ?? (await deriveSidecarEgressAllowList()));
+            // egress-proxy 模式下不开 web-egress（*:80/443 会架空代理的按主机
+            // 名单）：web 工具改走代理（HTTPS_PROXY），代理白名单与 sidecar
+            // 应用层域名名单同源（3.1b/3.1d）。
+            const sandboxWebEgress = webToolsEnabled() && !egressProxy;
             const supervisor = await SidecarSupervisor.start({
                 args: [
                     '--storage-path',
@@ -314,16 +384,8 @@ export async function startHostSidecar(deps) {
                 // 测试 tmpdir、显式 STEERABLE_SIDECAR_STORAGE_PATH）时，沙箱必须显式
                 // 授予该目录写权限，否则 sidecar 打不开 sessions.db/sessions.lock。
                 sandboxWritableRoots: [path.dirname(storagePath)],
-                // W4-3: sandbox default-on. This list is fixed at spawn (the sandbox
-                // profile cannot be edited afterwards), so a provider change reaches it
-                // only on restart — plain-http endpoints therefore still need one. The
-                // proxy's own CONNECT list does track the setting at runtime, via
-                // allowEgressForBaseUrl.
-                sandboxAllowedHosts: egressProxy?.sandboxAllowedHosts ?? (await deriveSidecarEgressAllowList()),
-                // egress-proxy 模式下不开 web-egress（*:80/443 会架空代理的按主机
-                // 名单）：web 工具改走代理（HTTPS_PROXY），代理白名单与 sidecar
-                // 应用层域名名单同源（3.1b/3.1d）。
-                sandboxWebEgress: webToolsEnabled() && !egressProxy,
+                sandboxAllowedHosts,
+                sandboxWebEgress,
                 // 3.1b：代理模式下 web_fetch 的 SSRF 预检仍在沙箱内做 DNS（抓取
                 // 本身走代理隧道），所以只放行解析器 socket——无 IP 可达性。
                 sandboxAllowResolver: webToolsEnabled() && Boolean(egressProxy),
@@ -356,6 +418,7 @@ export async function startHostSidecar(deps) {
                     void created.shutdown();
                 }
             });
+            spawnEgress = { hosts: sandboxAllowedHosts, webEgress: sandboxWebEgress };
             await wireSupervisor(supervisor);
             return supervisor;
         }
@@ -375,6 +438,15 @@ export async function startHostSidecar(deps) {
 /** 宿主退出钩子：停 supervisor + egress proxy。幂等。 */
 export async function shutdownHostSidecar() {
     sidecarGeneration += 1;
+    // Drop the resolved boot promise before the process exits so waiters do
+    // not observe the supervisor being stopped. A restart keeps the admitted
+    // plain-http endpoint so the next spawn's profile includes it.
+    setSidecarSupervisorPending(null);
+    if (!restarting) {
+        admittedPlainBaseUrl = undefined;
+        spawnEgress = null;
+        hostSidecarDeps = null;
+    }
     if (supervisorRef) {
         const supervisor = supervisorRef;
         supervisorRef = null;

package/dist/sidecar/egress-proxy.d.ts

@@ -65,6 +65,22 @@ export declare function egressAllowEntry(baseUrl: string | undefined): {
     port: string;
     proxied: boolean;
 } | null;
+/**
+ * `host` or `host:port` for `baseUrl`, or null when it cannot be written
+ * into a Seatbelt profile.
+ */
+export declare function seatbeltHostEntry(baseUrl: string | undefined): string | null;
+/**
+ * Whether a Seatbelt profile spawned with this allow-list can already open
+ * `baseUrl`.
+ *
+ * `allowedHosts === undefined` is the open-outbound profile. Loopback is not
+ * covered by `*:80` / `*:443`: Seatbelt's `*` does not match `localhost`, so
+ * a local runtime on `127.0.0.1:11434` needs its own `localhost:11434` rule.
+ * A remote host with no port degrades to 443 and 80 for every non-loopback
+ * target, matching the profile builder.
+ */
+export declare function seatbeltProfileCoversBaseUrl(baseUrl: string | undefined, allowedHosts: readonly string[] | undefined, webEgress: boolean): boolean;
 /**
  * 从 provider baseUrl 构建代理计划。https 端点进代理名单；http 端点留在
  * 直连列表。派生不出任何代理条目（无 https 端点且无 web 域名）时返回
@@ -166,6 +182,8 @@ export declare function decideEgressProxy(options: {
 };
 export declare function getEgressPosture(): EgressPosture | null;
 export declare function getActiveEgressProxyEndpoint(): string | null;
+/** boot 注册。plain-http 端点改不了已启动的 Seatbelt profile，只能重启 sidecar。 */
+export declare function setPlainEndpointRestarter(restarter: ((baseUrl: string) => Promise<boolean>) | null): void;
 /**
  * 把 `baseUrl` 的主机加进运行中代理的会话白名单。
  *
@@ -181,9 +199,12 @@ export declare function getActiveEgressProxyEndpoint(): string | null;
  * 放行是会话域的（代理进程退出即失效），条目形态与 `buildEgressProxyPlan`
  * 的派生一致，两处语义不会分叉。
  *
- * @returns 已放行为 true；无可放行之处为 false——代理没在跑、URL 解析不了，
- * 或端点是 plain-http（那类端点不进代理，由 spawn 时的沙箱 profile 钉死，
- * 运行期改不了，仍需重启）。
+ * plain-http 不进 CONNECT 代理。Seatbelt profile 在 spawn 时钉死，这类端点
+ * 只能靠 boot 注册的 restarter 重启 sidecar，把主机写进新 profile。
+ *
+ * @param baseUrl 要放行的 provider 地址。
+ * @returns 已放行或已重启 sidecar 为 true。代理没在跑、URL 解析不了、端点
+ * 是 plain-http，且没有 restarter（或名单已经覆盖）时为 false。
  */
 export declare function allowEgressForBaseUrl(baseUrl: string | undefined): Promise<boolean>;
 export interface EgressProxyHandle {

package/dist/sidecar/egress-proxy.js

@@ -51,6 +51,67 @@ export function egressAllowEntry(baseUrl) {
         proxied: url.protocol === 'https:',
     };
 }
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+const DEFAULT_REMOTE_PORTS = [443, 80];
+/** Same alphabet as the Seatbelt profile builder. Anything else is not a host entry. */
+const HOST_ENTRY_RE = /^[A-Za-z0-9._-]+(?::[0-9]+)?$/;
+/**
+ * `host` or `host:port` for `baseUrl`, or null when it cannot be written
+ * into a Seatbelt profile.
+ */
+export function seatbeltHostEntry(baseUrl) {
+    const target = egressAllowEntry(baseUrl);
+    if (!target || !HOST_ENTRY_RE.test(target.entry))
+        return null;
+    return target.entry;
+}
+function parseSeatbeltEntry(entry) {
+    const trimmed = entry.trim();
+    if (!HOST_ENTRY_RE.test(trimmed))
+        return null;
+    const colon = trimmed.lastIndexOf(':');
+    const portText = colon > 0 ? trimmed.slice(colon + 1) : '';
+    const hasPort = /^\d+$/.test(portText);
+    const host = hasPort ? trimmed.slice(0, colon) : trimmed;
+    const port = hasPort ? Number(portText) : null;
+    if (port !== null && (port < 1 || port > 65535))
+        return null;
+    return {
+        loopback: LOOPBACK_HOSTS.has(host),
+        ports: port === null ? DEFAULT_REMOTE_PORTS : [port],
+    };
+}
+/**
+ * Whether a Seatbelt profile spawned with this allow-list can already open
+ * `baseUrl`.
+ *
+ * `allowedHosts === undefined` is the open-outbound profile. Loopback is not
+ * covered by `*:80` / `*:443`: Seatbelt's `*` does not match `localhost`, so
+ * a local runtime on `127.0.0.1:11434` needs its own `localhost:11434` rule.
+ * A remote host with no port degrades to 443 and 80 for every non-loopback
+ * target, matching the profile builder.
+ */
+export function seatbeltProfileCoversBaseUrl(baseUrl, allowedHosts, webEgress) {
+    if (allowedHosts === undefined)
+        return true;
+    const target = egressAllowEntry(baseUrl);
+    if (!target || !HOST_ENTRY_RE.test(target.entry))
+        return true;
+    const port = target.port ? Number(target.port) : target.proxied ? 443 : 80;
+    if (port < 1 || port > 65535)
+        return true;
+    const loopback = LOOPBACK_HOSTS.has(target.host);
+    if (!loopback && webEgress && (port === 80 || port === 443))
+        return true;
+    for (const entry of allowedHosts) {
+        const parsed = parseSeatbeltEntry(entry);
+        if (!parsed || !parsed.ports.includes(port))
+            continue;
+        if (loopback ? parsed.loopback : !parsed.loopback)
+            return true;
+    }
+    return false;
+}
 /**
  * 从 provider baseUrl 构建代理计划。https 端点进代理名单；http 端点留在
  * 直连列表。派生不出任何代理条目（无 https 端点且无 web 域名）时返回
@@ -369,6 +430,16 @@ export function getActiveEgressProxyEndpoint() {
  * 主进程内存，与下发给 sidecar 的是同一个值。
  */
 let activeControl = null;
+let plainEndpointRestarter = null;
+/** boot 注册。plain-http 端点改不了已启动的 Seatbelt profile，只能重启 sidecar。 */
+export function setPlainEndpointRestarter(restarter) {
+    plainEndpointRestarter = restarter;
+}
+async function restartForUnproxied(baseUrl) {
+    if (!baseUrl || !plainEndpointRestarter)
+        return false;
+    return plainEndpointRestarter(baseUrl);
+}
 /**
  * 把 `baseUrl` 的主机加进运行中代理的会话白名单。
  *
@@ -384,17 +455,20 @@ let activeControl = null;
  * 放行是会话域的（代理进程退出即失效），条目形态与 `buildEgressProxyPlan`
  * 的派生一致，两处语义不会分叉。
  *
- * @returns 已放行为 true；无可放行之处为 false——代理没在跑、URL 解析不了，
- * 或端点是 plain-http（那类端点不进代理，由 spawn 时的沙箱 profile 钉死，
- * 运行期改不了，仍需重启）。
+ * plain-http 不进 CONNECT 代理。Seatbelt profile 在 spawn 时钉死，这类端点
+ * 只能靠 boot 注册的 restarter 重启 sidecar，把主机写进新 profile。
+ *
+ * @param baseUrl 要放行的 provider 地址。
+ * @returns 已放行或已重启 sidecar 为 true。代理没在跑、URL 解析不了、端点
+ * 是 plain-http，且没有 restarter（或名单已经覆盖）时为 false。
  */
 export async function allowEgressForBaseUrl(baseUrl) {
     const control = activeControl;
     if (!control)
-        return false;
+        return restartForUnproxied(baseUrl);
     const target = egressAllowEntry(baseUrl);
     if (!target || !target.proxied)
-        return false;
+        return restartForUnproxied(baseUrl);
     const entry = target.entry;
     try {
         const response = await fetch(`http://127.0.0.1:${control.port}/allow`, {

package/dist/sidecar/types.d.ts

@@ -383,7 +383,17 @@ export interface SidecarChatStreamRequest {
     skills?: {
         roots: string[];
         conditions?: string[];
+        /**
+         * Hard mode/whitelist exclusions. Sidecar's skill tool refuses these
+         * names with `not available in this mode`.
+         */
         exclude?: string[];
+        /**
+         * Host-injected/eager skills. Suppressed from the sidecar catalog (the
+         * host already put the body in the system prompt) but still loadable by
+         * the skill tool, so truncation or a model re-load never dead-ends.
+         */
+        pinned?: string[];
         ignoreConditions?: boolean;
         mode?: 'layered' | 'eager';
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steerable/agent-shell",
-  "version": "0.6.72",
+  "version": "0.6.73",
   "description": "Steerable framework — product-neutral Node HostRuntime and headless HTTP server shared by Tauri desktop and browser deployments; scenario packs extend it through @steerable/pack-sdk.",
   "license": "Apache-2.0",
   "homepage": "https://steerableframework.com/",
@@ -53,9 +53,9 @@
     "jpeg-js": "^0.4.4",
     "node-pty": "^1.1.0",
     "pngjs": "^7.0.0",
-    "@steerable/agent-harness": "0.6.72",
-    "@steerable/agent-protocol": "0.6.72",
-    "@steerable/pack-sdk": "0.6.72"
+    "@steerable/agent-harness": "0.6.73",
+    "@steerable/agent-protocol": "0.6.73",
+    "@steerable/pack-sdk": "0.6.73"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",