@steerable/agent-shell 0.7.2 → 0.8.0

package/dist/local-backend/router.js

@@ -16,7 +16,7 @@ import { buildAmbientDelegateRoster, buildDelegateDispatchInstruction, buildDele
 import { resolveMentionedAgentIds } from './mention-targets.js';
 import { presentToolCall } from '../tool-presentation.js';
 import { readSidecarHistoryEntries, timelineFromHistoryEntries, } from './task-process.js';
-import { appendTimelineDelta, freezeTimelineReasoning, sealLastTimelineBlock, syncTimelineTools, } from './turn-timeline.js';
+import { appendTimelineDelta, dropAttemptBlocks, freezeTimelineReasoning, sealLastTimelineBlock, syncTimelineTools, } from './turn-timeline.js';
 import { turnDurationMs } from './turn-duration.js';
 import { DEFAULT_SYSTEM_PROMPT, telemetryEnabled } from '../storage/index.js';
 import { isSkillPinned, isToolAllowed, mergeAgentCapabilities, normalizeToolPolicy, resolveSkillExcludes, } from './agent-capability.js';
@@ -27,6 +27,7 @@ import { sanitizeCompatOverrides, sanitizePresetsChoice, sanitizeLlmProvider, sa
 import { setDefaultExecTimeoutMs } from '../local-executor.js';
 import { allowEgressForBaseUrl, getActiveEgressBroker, getEgressPosture } from '../sidecar/egress-proxy.js';
 import { buildExecSandbox, parseExecPolicy } from '../sidecar/exec-sandbox.js';
+import { storedAskResult } from '../sidecar/reverse-ask-user.js';
 import { clampExecPolicy } from '../host-tools.js';
 import { getResolvedHostTools, isProductLlmLocked, resolveRuntimeLlmSettings, resolveTurnApproval, resolveTurnChatMode, resolveTurnOrchestration, } from '../host-tools-runtime.js';
 import { SidecarSupervisor } from '../sidecar/index.js';
@@ -43,8 +44,9 @@ import { formatHistoryForSummary, truncateMiddle, } from './context-compactor.js
 import { planRegenerateTruncate, resolveRegenerateContext, resolveRegenerateForkOrdinal, } from './regenerate-helper.js';
 import { resolveBranchActivation } from './branch-helper.js';
 import { detectInterruptedTurn } from './interrupted-helper.js';
+import { resumableTurn } from './resumable-turn.js';
 import { handlePortableRequest } from './portable-service.js';
-import { getProductConfig, isPortableProduct } from '../product-config.js';
+import { getProductConfig, isPortableProduct, productConfigDirectConnection, } from '../product-config.js';
 import { dropCurrentUserMessage } from './history-helper.js';
 import { parseImageAttachments, processImageAttachments } from '../image-attachment.js';
 import { chatAttachmentsDirPath, isValidChatAttachmentsKey } from '../attachments.js';
@@ -151,23 +153,27 @@ function downloadMimeForPath(filePath) {
     return DOWNLOAD_MIME_BY_EXT[path.extname(filePath).toLowerCase()] ?? 'application/octet-stream';
 }
 /**
- * 把 CoreLoop/LLM 的底层错误翻译成适合直接显示在助手消息里的中文提示。
- * 原始错误仍保存在 messageMetadata.completionReason 里，便于排查。
+ * Reads the structured failure detail off a rejected stream.
+ *
+ * `streamCoreLoopTurn` annotates its rejection; anything else (an abort, a
+ * router-level error) carries none, which the renderer shows as its generic
+ * card. Returns undefined rather than an empty object so the persisted
+ * metadata omits the field entirely.
  */
-export function userFacingCoreLoopFailure(reason) {
-    if (reason.includes('HTTP 401') || reason.includes('HTTP 403')) {
-        return '[回复失败] 模型服务认证失败，请检查 API Key 配置。';
-    }
-    if (reason.includes('HTTP 404')) {
-        return '[回复失败] 模型服务或模型名不存在（HTTP 404），请检查 baseUrl 与 model 配置。';
-    }
-    if (reason.includes('ECONNREFUSED') ||
-        reason.includes('ENOTFOUND') ||
-        reason.includes('ETIMEDOUT') ||
-        reason.includes('fetch failed')) {
-        return '[回复失败] 无法连接模型服务，请检查网络或 baseUrl 配置。';
-    }
-    return `[回复失败] ${reason}`;
+export function readTurnFailureInfo(err) {
+    const info = err?.failureInfo;
+    if (!info || typeof info !== 'object')
+        return undefined;
+    const record = info;
+    const pick = (key) => typeof record[key] === 'string' && record[key] ? record[key] : undefined;
+    const pickNumber = (key) => typeof record[key] === 'number' ? record[key] : undefined;
+    const out = {
+        errorKind: pick('errorKind'),
+        proxy: pick('proxy'),
+        attempts: pickNumber('attempts'),
+        statusCode: pickNumber('statusCode'),
+    };
+    return Object.values(out).some((value) => value !== undefined) ? out : undefined;
 }
 /**
  * Parses a pagination-style query param (`?page=`, `?limit=`) into a finite
@@ -250,6 +256,44 @@ function isRoundBoundaryHook(notice) {
         return false;
     return notice.action === 'retry' || notice.action === 'narrate';
 }
+/**
+ * Extracts the fields a "reconnecting" indicator needs from a retry notice.
+ *
+ * The loop announces every retry as a `hook_action`; only attempts on the
+ * same model request are a wait the user notices, so the round and delay are
+ * carried through. Returns null for any other hook action so the caller can
+ * keep its round-boundary handling unchanged.
+ */
+/**
+ * `completionStatus` of a persisted assistant message, or null.
+ *
+ * Only the terminal assistant message's status decides whether Continue is
+ * offered, so this reads the field and leaves the meaning to
+ * `resumableTurn`. A message without metadata (older builds) yields null,
+ * which refuses — resuming a turn whose end state is unknown could append a
+ * reply to a conversation that already finished.
+ */
+export function readCompletionStatus(message) {
+    const raw = message?.messageMetadata;
+    if (typeof raw !== 'string' || !raw)
+        return null;
+    try {
+        const status = JSON.parse(raw).completionStatus;
+        return typeof status === 'string' && status ? status : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function readRetryNotice(notice) {
+    if (notice?.kind !== 'hook_action' || notice.action !== 'retry')
+        return null;
+    return {
+        ...(typeof notice.round === 'number' ? { round: notice.round } : {}),
+        ...(typeof notice.delayMs === 'number' ? { delayMs: notice.delayMs } : {}),
+        ...(typeof notice.reason === 'string' && notice.reason ? { reason: notice.reason } : {}),
+    };
+}
 function buildLocalAgent() {
     const now = new Date().toISOString();
     return {
@@ -320,6 +364,7 @@ export class LocalBackendRouter {
     broadcast;
     /** 4.6a/4.6c：任务面板的路由入口（列表 + 合并/丢弃）。未注入时任务路由 503。 */
     taskService;
+    takeAskReplay = null;
     constructor(toolRouter, options) {
         this.toolRouter = toolRouter;
         this.defaultStore = options.store;
@@ -331,6 +376,10 @@ export class LocalBackendRouter {
             this.broadcast?.('goal-changed', { chatId, goal });
         });
     }
+    /** The host records each answered ask; the following tool row stores that text. */
+    setAskReplay(take) {
+        this.takeAskReplay = take;
+    }
     get store() {
         return this.storeContext.getStore() ?? this.defaultStore;
     }
@@ -2034,6 +2083,14 @@ export class LocalBackendRouter {
                 data: await this.store.getUsageSummary(days),
             };
         }
+        // 二期 R4：网络失败统计。窗口默认 7 天（设置页「最近 7 天」那一块）。
+        if (method === 'GET' && pathname === '/api/v2/usage/reliability') {
+            const days = parsePositiveIntParam(url.searchParams.get('days'), 7);
+            return {
+                status: 200,
+                data: await this.store.getReliabilitySummary(days),
+            };
+        }
         if (method === 'POST' && pathname.match(/^\/api\/v2\/chats\/[^/]+\/suggest-replies$/)) {
             return {
                 status: 200,
@@ -2448,25 +2505,42 @@ export class LocalBackendRouter {
                 });
             }
             else if (isResume) {
-                // W7-1: 继续被中断的 turn —— 不追加新用户消息（记录里已有），而是让
-                // sidecar 回放 durable record 的投影作为循环种子。只在检测确为
-                // interrupted 时接受：对一个已正常完结的 turn 续跑只会给完整对话
-                // 凭空多接一段回复。
+                // 继续上一轮 —— 不追加新用户消息（记录里已有），而是让 sidecar 回放
+                // durable record 的投影作为循环种子。允许续跑的三种终态见
+                // `resumable-turn.ts`：崩溃中断、失败、用户停止。正常完成的回合拒绝，
+                // 否则会给完整对话凭空多接一段回复。
                 const prior = await this.store.listMessages(chatId, 200);
-                const interrupted = detectInterruptedTurn({
-                    turnActive: await this.store.getTurnActive(chatId) !== null,
+                const lastAssistant = prior.find((m) => m.role === 'assistant');
+                const reason = resumableTurn({
+                    turnActive: (await this.store.getTurnActive(chatId)) !== null,
                     streamActive: getActiveCoreLoopStreamId(chatId) !== undefined,
                     lastMessageRole: prior[0]?.role ?? null,
+                    lastAssistantStatus: readCompletionStatus(lastAssistant),
                 });
                 const lastUser = prior.find(m => m.role === 'user');
-                if (!interrupted || !lastUser) {
-                    emit(this.sse('error', { message: '没有可继续的中断回复' }));
+                if (!reason || !lastUser) {
+                    emit(this.sse('error', { message: '没有可继续的回复' }));
                     return { status: 409 };
                 }
                 // 触发轮的用户消息仍在库里（崩溃只丢了回复）——取其原文喂给
                 // buildConversationMessages，让 mode  preamble / deferred-exec 检测
                 // 仍然基于真实诉求。发给 sidecar 的 messages 为空（见下方调用点）。
                 userMessageText = lastUser.content;
+                // 在原先失败/停止的那条回复上记下「已从这里继续」：界面据此把整张
+                // 失败卡片收成一行历史记录，重启后仍然是这一行，而不是又一次失败。
+                if (lastAssistant && reason !== 'interrupted') {
+                    // 记不下来只会让卡片多留一张，不值得让续跑失败——所以吞掉异常，
+                    // 但用 try/catch 而不是 `.catch()`：store 实现可以是同步的。
+                    try {
+                        await this.store.patchMessageMetadata(chatId, lastAssistant.id, {
+                            continuedAt: new Date().toISOString(),
+                            continuedReason: reason,
+                        });
+                    }
+                    catch (patchErr) {
+                        console.warn('[local-backend] continue: metadata patch failed', patchErr);
+                    }
+                }
             }
             else {
                 userMessageText = String(payload.message || '').trim();
@@ -3654,12 +3728,33 @@ export class LocalBackendRouter {
         // approval:"off" 或 STEERABLE_APPROVAL=0 本轮不挂审批。
         const approval = resolveTurnApproval();
         let assistantText = '';
+        // Text this attempt streamed (reset on restart) and the timeline length
+        // when the attempt began, so a retry can withdraw exactly its own output.
+        let streamedText = '';
+        let attemptBlockStart = 0;
+        // A retry notice arrived and no output followed yet: the turn is waiting
+        // on the network, not on the model. `stream_restart` clears it because the
+        // retry has begun producing again.
+        let retrying = false;
+        // Reliability accounting for this turn (R4). A model request is either a
+        // pass (a fresh loop run) or a retry inside one (the sidecar re-issuing
+        // the same request), so attempts = passes + retries. The retry and direct
+        // flags are sticky: one retry anywhere in the turn is what the statistic
+        // asks about.
+        let turnPasses = 0;
+        let turnRetries = 0;
+        let retriedThisTurn = false;
+        let directThisTurn = false;
         const executedActions = [];
         const timeline = [];
         // 编排子代理生命周期事件累积（切回后用于重建 currentTurnChildren）。
         const children = [];
         let completionStatus = 'completed';
         let completionReason = '';
+        // Provider classification of the failing request (see TurnFailureInfo).
+        // Stays empty for a clean sidecar-reported failure, which carries its own
+        // `completionReason` but no per-request detail.
+        let failureInfo;
         let outcomeTraceId;
         // Every pass records its own sidecar trace; all of them are persisted
         // against the one assistant message this turn produces.
@@ -3674,6 +3769,9 @@ export class LocalBackendRouter {
         // 实时快照：executedActions / timeline / children 传引用（原地 mutate），
         // content 由 onText 逐段更新。切走再切回的 renderer 靠 GET /live-stream 读它。
         const live = registerLiveStream(chatId, { executedActions, timeline, children });
+        live.notify = () => {
+            emit(this.sseData({ type: 'executed_actions', actions: [...executedActions] }));
+        };
         // 场景包的回合观察器（如识别包技能调用并广播产物更新）。
         const packObservers = beginPackTurnObservers({ chatId, broadcast: this.broadcast ?? undefined });
         // 回合产物文件列表（回合收尾时收集）：扫描根与 exec 沙箱可写根同源
@@ -3726,6 +3824,9 @@ export class LocalBackendRouter {
                 provider: sidecarWireProvider(settings.provider),
                 model: overrideModel || settings.model,
                 reasoningEffort,
+                // 产品声明模型服务是否直连（跳过系统代理）。只在产品显式打开时下发，
+                // 未声明的产品线上字节与旧版完全一致。
+                ...(productConfigDirectConnection() ? { directConnection: true } : {}),
                 // W2.2.2 凭证代理：broker 活跃且命中 provider 主机时，baseUrl 改写
                 // 为 http（代理解析绝对 URI 后注入凭证转发 https），apiKey 不再下
                 // 发——sidecar 进程（沙箱内、可被 agent 行为影响）永远拿不到真实
@@ -3792,8 +3893,32 @@ export class LocalBackendRouter {
                     assistantText += delta;
                     appendTimelineDelta(timeline, 'text', delta);
                     live.content = assistantText;
+                    // Track what this attempt emitted so a retry can take exactly it
+                    // back: the host has already handed these bytes to the renderer.
+                    streamedText += delta;
                     emit(this.sseData({ content: delta }));
                 },
+                onRestart: () => {
+                    // The sidecar is re-issuing this request. Withdraw the attempt's
+                    // text and reasoning — persisted, live, and renderer views — so the
+                    // retry's reply does not arrive after a half sentence the model
+                    // never finished. Tool blocks stay: those calls ran.
+                    if (streamedText) {
+                        assistantText = assistantText.slice(0, assistantText.length - streamedText.length);
+                        streamedText = '';
+                    }
+                    // The retry is producing again; a Stop from here on is not a stop
+                    // "during reconnection".
+                    retrying = false;
+                    live.content = assistantText;
+                    dropAttemptBlocks(timeline, attemptBlockStart);
+                    attemptBlockStart = timeline.length;
+                    emit(this.sseData({
+                        type: 'stream_restart',
+                        content: assistantText,
+                        blocks: timeline,
+                    }));
+                },
                 onReasoning: (delta) => {
                     appendTimelineDelta(timeline, 'reasoning', delta);
                     emit(this.sseData({ type: 'reasoning', content: delta }));
@@ -3817,13 +3942,15 @@ export class LocalBackendRouter {
                     const idx = action.id
                         ? executedActions.findIndex((row) => row.id === action.id)
                         : -1;
+                    const replay = action.tool === 'ask_user' ? this.takeAskReplay?.(args.chatId) : undefined;
+                    const result = replay ? storedAskResult(replay) : action.result;
                     const row = {
                         id: action.id,
                         tool: action.tool,
                         mode: chatMode,
                         arguments: action.arguments,
-                        view: presentToolCall(action.tool, action.arguments, action.result),
-                        result: action.result,
+                        view: presentToolCall(action.tool, action.arguments, result),
+                        result,
                         success: action.success,
                         error: action.error,
                         durationMs: action.durationMs,
@@ -3845,6 +3972,17 @@ export class LocalBackendRouter {
                     }
                 },
                 onNotice: (kind, notice) => {
+                    // A retry is a wait the user can feel: connection backoff runs for
+                    // seconds. Announce it so the turn can show "reconnecting" instead
+                    // of looking stuck, and so the wait itself is visible before the
+                    // next attempt starts. Not persisted — history keeps outcomes only.
+                    const retry = readRetryNotice(notice);
+                    if (retry) {
+                        retrying = true;
+                        retriedThisTurn = true;
+                        turnRetries += 1;
+                        emit(this.sseData({ type: 'turn_retry', ...retry }));
+                    }
                     if (kind === 'budget_exhausted') {
                         // 预算维度（rounds/tokens）在 notice.budget；notice.kind 是信封
                         // 类型（loop 事件 data 里的 budget 键经 sidecar 透传）。message
@@ -3909,6 +4047,7 @@ export class LocalBackendRouter {
                 afterPass: async (outcome) => {
                     if (outcome.traceId)
                         passTraceIds.push(outcome.traceId);
+                    turnPasses += 1;
                     // W6-9 用量归因:落一条 chat 用量事件(含成本估算,无单价模型 costUsd=null)。
                     // 每趟各落一条——续跑的花费是真实发生的，不该被合并掉。
                     if (outcome.usage) {
@@ -3954,11 +4093,16 @@ export class LocalBackendRouter {
         catch (err) {
             if (err instanceof DOMException && err.name === 'AbortError') {
                 completionStatus = 'cancelled';
-                completionReason = 'aborted_by_user';
+                // Stop lands for two very different reasons, and the card says which:
+                // while waiting out a retry (almost always impatience with a slow
+                // reconnect) or while the model was writing (a deliberate stop).
+                // Recorded here because only the host saw whether a retry was pending.
+                completionReason = retrying ? 'aborted_during_retry' : 'aborted_by_user';
             }
             else {
                 completionStatus = 'failed';
                 completionReason = err instanceof Error ? err.message : String(err);
+                failureInfo = readTurnFailureInfo(err);
                 emit(this.sse('error', { message: completionReason }));
             }
             // streamCoreLoopTurn attaches the sidecar trace id to failures — the
@@ -3969,6 +4113,72 @@ export class LocalBackendRouter {
                 passTraceIds.push(failureTraceId);
             }
         }
+        // 可靠性统计（R4）：一回合一条终态记录，与 token 用量分开记——用量
+        // 是每趟各一条（自动续跑的花费是真实发生的），终态只有一个。
+        // `usedDirect` 取产品当前配置：直连是产品级开关，不是每回合的决定。
+        try {
+            await this.store.recordUsageEvent({
+                chatId,
+                kind: 'turn',
+                provider: settings.provider,
+                model: overrideModel || settings.model,
+                promptTokens: 0,
+                completionTokens: 0,
+                totalTokens: 0,
+                outcome: completionStatus === 'failed'
+                    ? 'failed'
+                    : completionStatus === 'cancelled'
+                        ? 'cancelled'
+                        : 'completed',
+                failureKind: completionStatus === 'failed' ? (failureInfo?.errorKind ?? 'unknown') : null,
+                attempts: turnPasses + turnRetries || null,
+                retried: retriedThisTurn,
+                usedDirect: directThisTurn || productConfigDirectConnection(),
+            });
+        }
+        catch (reliabilityErr) {
+            // 统计写不进去不该影响回合收尾——消息已经落库，用户看到的是结果。
+            console.warn('[local-backend] record turn outcome failed', reliabilityErr);
+        }
+        // 配了遥测就把这一回合的终态作为计数上报（R4）。指标只有类别与次数，
+        // 没有对话内容，所以 `metadata` 档位也可以发；没配 endpoint 就一条不发。
+        // 失败不阻断：回合已经完成，投递不了是收集端的事。
+        // 取遥测设置：读不到只意味着这一回合不上报，不该影响回合收尾。用
+        // try/catch 而不是 `.catch()`——store 实现是同步返回时没有 thenable，
+        // 链式 `.catch` 会直接抛。
+        let telemetryForTurn = null;
+        try {
+            telemetryForTurn = await this.store.getTelemetrySettings();
+        }
+        catch (telemetryReadErr) {
+            console.warn('[local-backend] read telemetry settings failed', telemetryReadErr);
+        }
+        if (telemetryEnabled(telemetryForTurn) && telemetryForTurn?.endpoint) {
+            void supervisor
+                ?.call('metrics.export', {
+                // 一个端点同时收 trace 与 metric 时，把 /v1/traces 换成 /v1/metrics。
+                endpoint: telemetryForTurn.endpoint.replace(/\/v1\/traces$/, '/v1/metrics'),
+                serviceName: telemetryForTurn.serviceName,
+                samples: [
+                    {
+                        outcome: completionStatus === 'failed'
+                            ? 'failed'
+                            : completionStatus === 'cancelled'
+                                ? 'cancelled'
+                                : 'completed',
+                        ...(completionStatus === 'failed'
+                            ? { failureKind: failureInfo?.errorKind ?? 'unknown' }
+                            : {}),
+                        attempts: turnPasses + turnRetries,
+                        retried: retriedThisTurn,
+                        usedDirect: directThisTurn || productConfigDirectConnection(),
+                    },
+                ],
+            }, { timeoutMs: 10_000 })
+                .catch((err) => {
+                console.warn('[local-backend] telemetry metrics export failed', err);
+            });
+        }
         const durationMs = turnDurationMs((await this.store.getTurnActive(chatId))?.startedAt, Date.now());
         // 回合产物文件列表（成功/失败/取消都收集——半截回合写出的文件同样是
         // 产物）。收集失败只记日志，永远不该拖垮回合收尾。
@@ -3999,6 +4209,7 @@ export class LocalBackendRouter {
             ...(durationMs != null ? { durationMs } : {}),
             ...(autoContinuations > 0 ? { autoContinuations } : {}),
             ...(turnFiles.length > 0 ? { turnFiles } : {}),
+            ...(failureInfo ? { failure: failureInfo } : {}),
         }));
         try {
             await recordInsightTurn(this.store, {

package/dist/local-backend/turn-timeline.d.ts

@@ -17,6 +17,20 @@ export type PersistedTurnBlock = {
     actions: Array<Record<string, unknown>>;
 };
 export declare function appendTimelineDelta(blocks: PersistedTurnBlock[], type: 'text' | 'reasoning', delta: string, now?: number): void;
+/**
+ * Withdraw a discarded attempt's streamed text and reasoning.
+ *
+ * A retry after partial output restarts the reply from nothing, so the blocks
+ * this attempt produced must not survive into the persisted turn: the retry's
+ * own text would otherwise be appended after text the model never finished
+ * saying. Tool blocks are kept — a tool call that already ran is a fact, and
+ * the retry does not repeat it.
+ *
+ * @param blocks Timeline to prune in place.
+ * @param sinceLength `blocks.length` recorded when the attempt started; only
+ *   entries at or after that index are candidates.
+ */
+export declare function dropAttemptBlocks(blocks: PersistedTurnBlock[], sinceLength: number): void;
 /**
  * Close the current reasoning/text segment so the next same-kind delta
  * starts a new block. Mirrors apps/web `sealLastBlock`.

package/dist/local-backend/turn-timeline.js

@@ -25,6 +25,27 @@ export function appendTimelineDelta(blocks, type, delta, now = Date.now()) {
     }
     blocks.push({ type, content: delta });
 }
+/**
+ * Withdraw a discarded attempt's streamed text and reasoning.
+ *
+ * A retry after partial output restarts the reply from nothing, so the blocks
+ * this attempt produced must not survive into the persisted turn: the retry's
+ * own text would otherwise be appended after text the model never finished
+ * saying. Tool blocks are kept — a tool call that already ran is a fact, and
+ * the retry does not repeat it.
+ *
+ * @param blocks Timeline to prune in place.
+ * @param sinceLength `blocks.length` recorded when the attempt started; only
+ *   entries at or after that index are candidates.
+ */
+export function dropAttemptBlocks(blocks, sinceLength) {
+    for (let index = blocks.length - 1; index >= sinceLength; index -= 1) {
+        const block = blocks[index];
+        if (block && (block.type === 'text' || block.type === 'reasoning')) {
+            blocks.splice(index, 1);
+        }
+    }
+}
 /**
  * Close the current reasoning/text segment so the next same-kind delta
  * starts a new block. Mirrors apps/web `sealLastBlock`.

package/dist/product-config.d.ts

@@ -132,9 +132,26 @@ export interface ProductConfig {
      * 超过则接口返回 413，不创建新会话。
      */
     forkWorkspaceMaxBytes?: number;
+    /**
+     * 模型请求是否跳过系统代理直连。缺省关（跟随系统代理）。
+     *
+     * 打开后这一端点的请求不经过用户在系统里配置的代理。用于国内常见
+     * 「开着 Clash，但模型服务本来就在直连规则里」的情形：代理多转一手
+     * 只会用更短的超时把本来能连上的请求断掉。
+     *
+     * 要求流量必须经过公司代理的环境（例如企业产品）应保持关闭。
+     */
+    directModelConnection?: boolean;
 }
 /** shell 内置智能体：只有产品显式 `true` 才开。 */
 export declare function isShellBuiltinAgentEnabled(id: 'local-assistant' | 'all-round-assistant', config?: ProductConfig): boolean;
+/**
+ * 模型请求是否直连（不经过系统代理）。只有产品显式 `true` 才开。
+ *
+ * 企业产品可能要求所有出网流量经过公司代理，所以缺省是关：产品不声明
+ * 就保持跟随系统代理的旧行为。
+ */
+export declare function productConfigDirectConnection(config?: ProductConfig): boolean;
 /** 对话与配置能否导出/导入。缺省关，产品必须显式打开。 */
 export declare function isPortableProduct(config?: ProductConfig): boolean;
 /** shell 内置技能：`true` 全开；否则只有对象里显式 `true` 的目录开。 */

package/dist/product-config.js

@@ -13,6 +13,15 @@
 export function isShellBuiltinAgentEnabled(id, config = getProductConfig()) {
     return config.builtinAgents?.[id] === true;
 }
+/**
+ * 模型请求是否直连（不经过系统代理）。只有产品显式 `true` 才开。
+ *
+ * 企业产品可能要求所有出网流量经过公司代理，所以缺省是关：产品不声明
+ * 就保持跟随系统代理的旧行为。
+ */
+export function productConfigDirectConnection(config = getProductConfig()) {
+    return config.directModelConnection === true;
+}
 /** 对话与配置能否导出/导入。缺省关，产品必须显式打开。 */
 export function isPortableProduct(config = getProductConfig()) {
     return config.portable === true;

package/dist/sidecar/reverse-approval.d.ts

@@ -5,9 +5,11 @@
  *
  * Fail-closed by construction: no window, no listener, a renderer error,
  * or an invalid reply all become `deny_once` — never a hang, never an
- * auto-allow. An explicit `timeoutMs` on the approval config still fails
- * closed as `timed_out`; the desktop omits it, so the prompt waits until
- * the user decides.
+ * auto-allow. A command on the dangerous-command list is the exception:
+ * the bridge returns `allow_once` without a card so the executor can
+ * reject it with the blocked-command error. An explicit `timeoutMs` on
+ * the approval config still fails closed as `timed_out`; the desktop
+ * omits it, so the prompt waits until the user decides.
  *
  * The renderer answers via the `approval:decide` invoke with the requestId
  * echoed back; decisions are validated against the algebra's kind set
@@ -68,6 +70,19 @@ export interface ApprovalBridgeDeps {
         arguments: Record<string, unknown>;
         chatId?: string;
     }) => boolean | 'project' | 'workspace' | Promise<boolean | 'project' | 'workspace'>;
+    /**
+     * Pattern that will block this command in the executor.
+     * When set, the bridge does not show a card.
+     */
+    blockedCommand?: (toolName: string, args: Record<string, unknown>) => string | null;
+    /**
+     * An allowed network_egress grant is not a tool result. The host stores it
+     * on the running turn so the row survives reopening the chat.
+     */
+    recordEgressGrant?: (prompt: ApprovalPromptRequest, decision: {
+        kind: ApprovalDecisionKind;
+        reason: string;
+    }) => void;
 }
 export interface ApprovalBridge {
     /** Reverse-channel handler for the sidecar's `approval.request`. */

package/dist/sidecar/reverse-approval.js

@@ -5,9 +5,11 @@
  *
  * Fail-closed by construction: no window, no listener, a renderer error,
  * or an invalid reply all become `deny_once` — never a hang, never an
- * auto-allow. An explicit `timeoutMs` on the approval config still fails
- * closed as `timed_out`; the desktop omits it, so the prompt waits until
- * the user decides.
+ * auto-allow. A command on the dangerous-command list is the exception:
+ * the bridge returns `allow_once` without a card so the executor can
+ * reject it with the blocked-command error. An explicit `timeoutMs` on
+ * the approval config still fails closed as `timed_out`; the desktop
+ * omits it, so the prompt waits until the user decides.
  *
  * The renderer answers via the `approval:decide` invoke with the requestId
  * echoed back; decisions are validated against the algebra's kind set
@@ -38,15 +40,19 @@ export function createApprovalBridge(deps) {
             if (!toolName) {
                 return { kind: 'deny_once', reason: 'malformed approval request (no toolName)' };
             }
+            const args = p.arguments && typeof p.arguments === 'object'
+                ? p.arguments
+                : {};
+            if (deps.blockedCommand?.(toolName, args)) {
+                deps.onLog?.(`approval: ${toolName} matches the dangerous-command list; no card`);
+                return { kind: 'allow_once', reason: '' };
+            }
             if (!deps.hasWindow()) {
                 deps.onLog?.(`approval: no renderer window; denying ${toolName} once`);
                 return deny('no renderer window available to approve the call');
             }
             const requestId = randomUUID();
             const chatId = typeof p.chatId === 'string' && p.chatId ? p.chatId : undefined;
-            const args = p.arguments && typeof p.arguments === 'object'
-                ? p.arguments
-                : {};
             const category = typeof p.category === 'string' ? p.category : toolName;
             const categoryLabel = deps.categoryLabel?.(toolName, category);
             const fence = deps.outsideWorkspace
@@ -91,10 +97,17 @@ export function createApprovalBridge(deps) {
                 entry.resolve(deny(`renderer returned an invalid decision kind: ${String(p.kind)}`));
                 return { ok: true };
             }
-            entry.resolve({
-                kind,
-                reason: typeof p.reason === 'string' ? p.reason : '',
-            });
+            const reason = typeof p.reason === 'string' ? p.reason : '';
+            entry.resolve({ kind, reason });
+            if (entry.prompt.toolName === 'network_egress'
+                && (kind === 'allow_once' || kind === 'allow_for_session' || kind === 'allow_always')) {
+                try {
+                    deps.recordEgressGrant?.(entry.prompt, { kind, reason });
+                }
+                catch (err) {
+                    deps.onLog?.(`approval: failed to store egress grant: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
             return { ok: true };
         },
     };

package/dist/sidecar/reverse-ask-user.d.ts

@@ -19,6 +19,13 @@ export interface AskUserPromptRequest {
     /** 发起提问的对话。renderer 只在这条会话的输入框展示卡片。 */
     chatId?: string;
 }
+/** One answered ask, kept so the tool row can store the full text. */
+export interface ResolvedAsk {
+    intro: string;
+    questions: Array<Record<string, unknown>>;
+    answers: Record<string, string | string[]>;
+    unattended?: boolean;
+}
 export interface AskUserBridgeDeps {
     broadcast: (channel: 'ask-user:request', payload: AskUserPromptRequest) => void;
     /** 是否有能应答的窗口/浏览器连接；没有则立即空答。 */
@@ -34,5 +41,17 @@ export interface AskUserBridge {
     answer: (payload: unknown) => {
         ok: boolean;
     };
+    /**
+     * The next answered ask for this chat. The tool result that follows only
+     * carries a short preview, so the turn stores this instead.
+     */
+    takeResolved: (chatId: string) => ResolvedAsk | undefined;
 }
+/** The tool-row result stored in place of the truncated preview. */
+export declare function storedAskResult(ask: ResolvedAsk): {
+    intro: string;
+    questions: Array<Record<string, unknown>>;
+    answers: Record<string, string | string[]>;
+    unattended?: true;
+};
 export declare function createAskUserBridge(deps: AskUserBridgeDeps): AskUserBridge;