@turmind/halo 1.5.4 → 1.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@turmind/halo",
-  "version": "1.5.4",
+  "version": "1.5.6",
   "description": "Halo — multi-agent collaborative workspace. CLI + TUI + HTTP/WS server in one package.",
   "type": "module",
   "license": "MIT",

package/templates/agents/default/agent.yaml

@@ -47,4 +47,5 @@ skills:
   - web-search
   - cron
   - acp
+  - extension
   - halo

package/templates/config.yaml

@@ -7,6 +7,7 @@
 #   server.cors_origins       → HALO_CORS_ORIGINS  (comma-separated)
 #   timeout.shell_exec        → HALO_SHELL_TIMEOUT
 #   timeout.web_fetch         → HALO_WEB_FETCH_TIMEOUT
+#   timeout.model_request     → HALO_MODEL_TIMEOUT
 #   timeout.session_grace     → HALO_SESSION_GRACE
 #   timeout.terminal_grace    → HALO_TERMINAL_GRACE
 #   logging.max_file_size     → HALO_LOG_MAX_SIZE
@@ -45,6 +46,11 @@ timeout:
     default: 10000
     description: "web_fetch tool timeout (ms)."
     description_zh: "web_fetch 工具的超时（毫秒)。"
+  model_request:
+    value: 600000
+    default: 600000
+    description: "Per model-call timeout (ms). Streaming providers reset it on any received data, so it acts as an idle timeout; on expiry the call aborts and the agent loop retries."
+    description_zh: "单次模型调用的超时（毫秒）。流式 provider 每收到数据就重新计时，相当于空闲超时；超时后中止本次调用，由 agent 循环重试。"
   session_grace:
     value: 300000
     default: 300000

package/templates/skills/extension/SKILL.md

@@ -1,18 +1,19 @@
 ---
 name: extension
-description: Install / list / remove admin preview extensions (`~/.halo/global/extensions/<id>/`) — static viewers the admin editor loads for file types it has no built-in preview for (e.g. `.glb`). `/extension install <id|zip|url>` pulls the latest `<id>-v*` release from turmind/halo-hub by default. Activate when the user wants to preview a file type the editor can't open, or asks to install / update / remove an extension.
+description: Install / list / remove admin preview extensions (`~/.halo/global/extensions/<id>/`) — static viewers the admin editor loads for file types it has no built-in preview for (e.g. `.glb`). `/extension install <id|zip|url>` pulls the latest `<id>-v*` release from the configured hub (default turmind/halo-hub). Activate when the user wants to preview a file type the editor can't open, or asks to install / update / remove an extension.
 command: /extension
 requiresAccess: full
 verbs:
-  - { name: install, desc: "Install or upgrade an extension from halo-hub (by id), a local zip path, or a zip URL" }
+  - { name: install, desc: "Install or upgrade an extension from the hub (by id), a local zip path, or a zip URL" }
   - { name: list,    desc: List installed extensions with version and status }
   - { name: remove,  desc: Remove an installed extension by id }
 ---
 
 # extension
 
-The requested action is **`$1`**; the rest of the line is the payload. With
-natural language ("install the glb viewer"), infer both.
+The requested action is **`$1`**; everything after it is the payload
+(`$ARGUMENTS` minus the first token). With natural language ("install the glb
+viewer"), infer both.
 
 Preview extensions are static bundles the admin editor loads in a sandboxed
 iframe to preview file types it has no built-in viewer for (e.g. `.glb`).
@@ -30,23 +31,33 @@ Pick EXT = the first that exists, then:
 
 ## install
 
-`bash EXT install <source>` where `<source>` is one of:
-- an extension id (e.g. `glb`) → downloads the newest `glb-v*` release asset
-  (`glb-<version>.zip`) from https://github.com/turmind/halo-hub/releases;
+When the payload names a source, run the install right away — no confirmation,
+no explanation first. Ask only when no source was given.
+
+`HALO_HUB_REPO='{{params.hub_repo}}' bash EXT install <source>` — keep
+`{{params.hub_repo}}` exactly as-is (the system substitutes it at runtime), where
+`<source>` is one of:
+- an extension id (e.g. `glb`) → the newest `glb-v*` release zip from the hub
+  (a GitHub / Gitea / Forgejo / GitLab repo), or the newest `glb-v<x.y.z>` tag
+  when the hub is any other git URL / local repo;
 - a local `.zip` path;
 - an `https://…zip` URL.
 
+The hub is set in Settings → Skills → extension → `hub_repo`; empty means
+https://github.com/turmind/halo-hub.
+
 The script unpacks to a temp dir, pre-checks `halo-extension.json` (id matches,
 entry exists), then atomically replaces `~/.halo/global/extensions/<id>/`.
 Reinstalling the same id upgrades (or downgrades) it. Relay the script's last
 line to the user (`installed glb 1.0.0` / the error). Never edit files inside an
 installed extension — reinstall instead.
 
-If the download fails with "no release for <id>" the GitHub API may be
-rate-limited (60 unauthenticated requests/hour) or the id may not exist: point
-the user at https://github.com/turmind/halo-hub/releases to download the zip by
-hand, then `install <path>`. Setting `GITHUB_TOKEN` in the environment lifts
-the limit.
+On failure relay the script's hint. "release API failed" → rate-limited
+(GitHub: 60 anonymous requests/hour), private, or a wrong `hub_repo`; setting
+`GITHUB_TOKEN` / `GITLAB_TOKEN` / `GITEA_TOKEN` in the server environment helps.
+"no release for <id>" → the id isn't on that hub. "needs a build step" → that
+extension can't be installed from git tags; get its release zip. Either way the
+user can download the zip by hand and run `install <path>`.
 
 ## list
 
@@ -63,8 +74,8 @@ the user first if they didn't name the id explicitly.
 
 - Extensions are global (all workspaces on this server). Say so if the user
   asks "install it for this project".
-- To find what's available, point the user at https://github.com/turmind/halo-hub
-  (the `extensions/` directory); do not scrape it.
+- Mention the configured hub (its `extensions/` directory) only when the user
+  asks what extensions exist or an install fails; do not scrape it.
 - The script only pre-checks the required fields; the server's scanner is the
   authority. A package it rejects shows up in `list` (and the admin) as
   `ERROR` with the reason.

package/templates/skills/extension/config.yaml

@@ -0,0 +1,9 @@
+displayName_zh: 预览扩展
+description: Install / list / remove admin preview extensions.
+description_zh: 安装 / 列出 / 删除管理后台的预览扩展。
+
+params:
+  - key: hub_repo
+    description: "Hub that `install <id>` pulls from: a GitHub / Gitea / Forgejo / GitLab repo URL (newest `<id>-v*` release zip), `owner/repo` for GitHub, or any git URL / local repo path (newest `<id>-v<x.y.z>` tag). Empty = https://github.com/turmind/halo-hub."
+    description_zh: "`install <id>` 的来源仓库：GitHub / Gitea / Forgejo / GitLab 仓库地址（取最新的 `<id>-v*` release zip），GitHub 可简写为 `owner/repo`；也可以是任意 git 地址或本地仓库路径（取最新的 `<id>-v<x.y.z>` 标签）。留空 = https://github.com/turmind/halo-hub。"
+    default: https://github.com/turmind/halo-hub

package/templates/skills/extension/templates/ext.sh

@@ -9,17 +9,18 @@
 #   ext.sh list
 #   ext.sh remove <id>
 #
-# Needs curl + unzip + node. No `gh`: releases are read through the public API
-# (GITHUB_TOKEN, if set, is sent to lift the 60 req/h anonymous limit).
+# `install <id>` reads the hub in $HALO_HUB_REPO (the skill's hub_repo param;
+# empty → https://github.com/turmind/halo-hub). GitHub / Gitea-Forgejo / GitLab
+# hubs go through their public release API (GITHUB_TOKEN / GITEA_TOKEN /
+# GITLAB_TOKEN, if set, are sent — lifts GitHub's 60 req/h anonymous limit);
+# any other git URL or local repo installs from `<id>-v<semver>` tags.
+# Needs curl + unzip + node (+ git for tag-based hubs). No `gh`.
 set -euo pipefail
 
 ROOT="$HOME/.halo/global/extensions"
-REPO="turmind/halo-hub"
+DEFAULT_HUB="https://github.com/turmind/halo-hub"
 ID_RE='^[a-z0-9][a-z0-9_-]{0,63}$'   # keep in sync with server extensions/registry.ts ID_RE
 
-cmd=${1:?usage: ext.sh install <id|zip|url> | list | remove <id>}
-shift || true
-
 # Print `<id> <version> <name>` for the extension dir $1, or fail with the
 # reason. $2 (optional) = the id the directory / request claims.
 precheck() {
@@ -38,44 +39,175 @@ precheck() {
   ' "$1" "${2:-}"
 }
 
-# Echo the path of a local zip for source $1 (path, https URL, or hub id).
+# ── Hub source ──────────────────────────────────────────────────────────────
+# Self-contained hub_* functions (no globals besides DEFAULT_HUB) so a later
+# `/skill install` / `/workspace import` can lift them out unchanged.
+
+# Normalize a hub setting: empty / unsubstituted `{{…}}` → default,
+# `owner/repo` → GitHub, an existing dir → absolute path, drop trailing `/`.
+# A `.git` suffix stays (git mode clones the URL as given); the API helpers
+# below drop it.
+hub_url() {
+  local h=${1:-}
+  if [[ -z $h || $h == '{{'* ]]; then h=$DEFAULT_HUB; fi
+  if [[ $h =~ ^[A-Za-z0-9][A-Za-z0-9_.-]*/[A-Za-z0-9_.-]+$ ]]; then h="https://github.com/$h"
+  elif [[ -d $h ]]; then h=$(cd "$h" && pwd)
+  fi
+  echo "${h%/}"
+}
+
+# curl with the platform's optional token header.
+hub_curl() {
+  local p=$1; shift
+  case $p in
+    github) curl -fsSL ${GITHUB_TOKEN:+-H "Authorization: Bearer $GITHUB_TOKEN"} "$@" ;;
+    gitlab) curl -fsSL ${GITLAB_TOKEN:+-H "PRIVATE-TOKEN: $GITLAB_TOKEN"} "$@" ;;
+    gitea)  curl -fsSL ${GITEA_TOKEN:+-H "Authorization: token $GITEA_TOKEN"} "$@" ;;
+  esac
+}
+
+# Repo endpoint of <platform>'s API for hub URL $2.
+hub_repo_api() {
+  [[ $2 =~ ^(https?://[^/]+)/(.+)$ ]] || return 1
+  local base=${BASH_REMATCH[1]} path=${BASH_REMATCH[2]%.git}
+  case $1 in
+    github) echo "https://api.github.com/repos/$path" ;;
+    gitea)  echo "$base/api/v1/repos/$path" ;;
+    gitlab) echo "$base/api/v4/projects/${path//\//%2F}" ;;
+  esac
+}
+
+hub_releases_api() {
+  local q='per_page=100'
+  if [[ $1 == gitea ]]; then q='limit=50'; fi
+  echo "$(hub_repo_api "$1" "$2")/releases?$q"
+}
+
+# 0 when the host answers <platform>'s repo endpoint for $2 with JSON.
+hub_probe() {
+  local api ct
+  api=$(hub_repo_api "$1" "$2") || return 1
+  ct=$(hub_curl "$1" --max-time 10 -o /dev/null -w '%{content_type}' "$api" 2>/dev/null) || return 1
+  [[ $ct == application/json* ]]
+}
+
+# github | gitlab | gitea | git (= tag-based fallback) for a normalized hub URL.
+hub_platform() {
+  if [[ ! $1 =~ ^https?://([^/]+)/[^/]+/.+$ ]]; then echo git; return; fi
+  case ${BASH_REMATCH[1]} in
+    github.com) echo github ;;
+    *gitlab*) echo gitlab ;;
+    codeberg.org|*gitea*|*forgejo*) echo gitea ;;
+    *) if hub_probe gitea "$1"; then echo gitea
+       elif hub_probe gitlab "$1"; then echo gitlab
+       else echo git; fi ;;
+  esac
+}
+
+hub_releases_page() {
+  if [[ $1 == gitlab ]]; then echo "${2%.git}/-/releases"; else echo "${2%.git}/releases"; fi
+}
+
+# stdin = <platform>'s release list (newest-first); print the first `.zip`
+# asset URL of the newest non-draft / non-prerelease / non-upcoming release
+# tagged `<id>-v*`, exit 2 if there is none.
+hub_pick_release() {
+  node -e '
+    let s = ""; process.stdin.on("data", (d) => s += d).on("end", () => {
+      const [platform, id] = process.argv.slice(1)
+      // "<id>-v<digit>", so id glb never matches a glb-viewer-v… tag.
+      const r = JSON.parse(s).find((r) => new RegExp("^" + id + "-v\\d").test(r.tag_name) && !r.draft && !r.prerelease && !r.upcoming_release)
+      const assets = !r ? [] : platform === "gitlab"
+        ? ((r.assets && r.assets.links) || []).map((l) => ({ name: l.name, url: l.direct_asset_url || l.url }))
+        : (r.assets || []).map((a) => ({ name: a.name, url: a.browser_download_url }))
+      const a = assets.find((a) => String(a.name).endsWith(".zip"))
+      if (!a) process.exit(2)
+      console.log(a.url)
+    })' "$1" "$2"
+}
+
+# stdin = `git ls-remote --tags --refs`; print the highest `<id>-vX.Y.Z` tag
+# (prerelease `-…` suffixes skipped), nothing if there is none.
+hub_pick_tag() {
+  local v
+  v=$(sed -n "s|.*refs/tags/$1-v\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\)$|\1|p" | sort -t. -k1,1n -k2,2n -k3,3n | tail -1)
+  if [[ -n $v ]]; then echo "$1-v$v"; fi
+}
+
+# Tag-based hub: shallow-clone the newest `<id>-v<semver>` tag and echo
+# `extensions/<id>/` minus the build inputs scripts/pack.mjs leaves out of a
+# release zip. A package with a build step is refused — its output isn't in git.
+hub_git_package() {
+  local hub=$1 id=$2 tmp=$3 url=$1 refs tag dir
+  if [[ $url == /* ]]; then url="file://$url"; fi   # a plain path makes git ignore --depth
+  refs=$(git ls-remote --tags --refs "$url") || { echo "cannot list tags of $hub (git ls-remote failed)" >&2; exit 1; }
+  tag=$(printf '%s\n' "$refs" | hub_pick_tag "$id")
+  [[ -n $tag ]] || { echo "no release for $id in $hub (no $id-v<x.y.z> tag)" >&2; exit 1; }
+  git -c advice.detachedHead=false clone -q --depth 1 --branch "$tag" "$url" "$tmp/repo" || { echo "git clone of $tag from $hub failed" >&2; exit 1; }
+  dir="$tmp/repo/extensions/$id"
+  [[ -d $dir ]] || { echo "$hub tag $tag has no extensions/$id/" >&2; exit 1; }
+  if [[ -e $dir/fetch-deps.sh || -e $dir/build.sh ]]; then
+    echo "$id needs a build step — install it from a release zip (install <path/to.zip> or <https://…zip>)" >&2; exit 1
+  fi
+  rm -rf "$dir/node_modules" "$dir/src" "$dir/package.json" "$dir/package-lock.json"
+  echo "$dir"
+}
+
+# Fetch hub package <id> from hub URL $1 into $3: echo a zip path (release
+# API) or the package dir (git tags). API errors never fall back to git — a
+# git checkout of a build-step package would install broken.
+hub_fetch() {
+  local hub=$1 id=$2 tmp=$3 platform api url token page
+  platform=$(hub_platform "$hub")
+  if [[ $platform == git ]]; then hub_git_package "$hub" "$id" "$tmp"; return; fi
+  api=$(hub_releases_api "$platform" "$hub")
+  page=$(hub_releases_page "$platform" "$hub")
+  case $platform in github) token=GITHUB_TOKEN ;; gitlab) token=GITLAB_TOKEN ;; *) token=GITEA_TOKEN ;; esac
+  hub_curl "$platform" "$api" -o "$tmp/releases.json" \
+    || { echo "$platform release API failed for $hub — rate-limited, private or wrong repo? set $token, or download the zip from $page and run: install <path>" >&2; exit 1; }
+  url=$(hub_pick_release "$platform" "$id" <"$tmp/releases.json") \
+    || { echo "no release for $id in $hub — check the id, or download the zip from $page and run: install <path>" >&2; exit 1; }
+  # No token here: asset links redirect to other hosts and curl -L would
+  # forward a custom header like PRIVATE-TOKEN there.
+  curl -fsSL "$url" -o "$tmp/pkg.zip" || { echo "download failed: $url" >&2; exit 1; }
+  echo "$tmp/pkg.zip"
+}
+
+# Echo a local zip or an unpacked package dir for source $1 (path, https URL, or hub id).
 resolve_source() {
-  local src=$1 url
+  local src=$1
   if [[ -f $src ]]; then echo "$src"; return; fi
   if [[ $src =~ ^https?:// ]]; then curl -fsSL "$src" -o "$TMP/pkg.zip"; echo "$TMP/pkg.zip"; return; fi
   [[ $src =~ $ID_RE ]] || { echo "invalid id or missing file: $src" >&2; exit 1; }
-  # Newest non-draft, non-prerelease release tagged "<id>-v*" (API is newest-first).
-  url=$(curl -fsSL ${GITHUB_TOKEN:+-H "Authorization: Bearer $GITHUB_TOKEN"} \
-        "https://api.github.com/repos/$REPO/releases?per_page=100" \
-    | node -e '
-        let s = ""; process.stdin.on("data", (d) => s += d).on("end", () => {
-          const id = process.argv[1]
-          const r = JSON.parse(s).find((r) => r.tag_name.startsWith(id + "-v") && !r.draft && !r.prerelease)
-          const a = r && r.assets.find((a) => a.name.endsWith(".zip"))
-          if (!a) process.exit(2)
-          console.log(a.browser_download_url)
-        })' "$src") \
-    || { echo "no release for $src in $REPO — download the zip from https://github.com/$REPO/releases and run: install <path>" >&2; exit 1; }
-  curl -fsSL "$url" -o "$TMP/pkg.zip"
-  echo "$TMP/pkg.zip"
+  hub_fetch "$(hub_url "${HALO_HUB_REPO:-}")" "$src" "$TMP"
 }
 
+# Sourced (tests, later reuse of the hub_* functions): definitions only.
+if [[ ${BASH_SOURCE[0]} != "$0" ]]; then return 0; fi
+
+cmd=${1:?usage: ext.sh install <id|zip|url> | list | remove <id>}
+shift || true
+
 case $cmd in
   install)
     src=${1:?usage: ext.sh install <id|zip|url>}
     TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT
-    zip=$(resolve_source "$src")
-    # Same refusals as the server's zip installer: no `..`, no absolute paths,
-    # no symlinks (zipinfo mode column starts with `l`).
-    if unzip -Z1 "$zip" | grep -Eq '(^|/)\.\.(/|$)|^/'; then echo "zip contains ../ or absolute entries" >&2; exit 1; fi
-    if unzip -Z "$zip" | grep -q '^l'; then echo "zip contains symlinks" >&2; exit 1; fi
-    mkdir -p "$TMP/x"
-    unzip -q "$zip" -d "$TMP/x"
-    # `zip -r glb.zip glb/` wraps everything in one directory — descend into it.
-    dir="$TMP/x"
-    if [[ ! -f $dir/halo-extension.json ]]; then
-      only=$(find "$dir" -mindepth 1 -maxdepth 1 | head -2)
-      if [[ $(printf '%s\n' "$only" | wc -l) -eq 1 && -f $only/halo-extension.json ]]; then dir=$only; fi
+    pkg=$(resolve_source "$src")
+    if [[ -d $pkg ]]; then
+      dir=$pkg
+    else
+      # Same refusals as the server's zip installer: no `..`, no absolute paths,
+      # no symlinks (zipinfo mode column starts with `l`).
+      if unzip -Z1 "$pkg" | grep -Eq '(^|/)\.\.(/|$)|^/'; then echo "zip contains ../ or absolute entries" >&2; exit 1; fi
+      if unzip -Z "$pkg" | grep -q '^l'; then echo "zip contains symlinks" >&2; exit 1; fi
+      mkdir -p "$TMP/x"
+      unzip -q "$pkg" -d "$TMP/x"
+      # `zip -r glb.zip glb/` wraps everything in one directory — descend into it.
+      dir="$TMP/x"
+      if [[ ! -f $dir/halo-extension.json ]]; then
+        only=$(find "$dir" -mindepth 1 -maxdepth 1 | head -2)
+        if [[ $(printf '%s\n' "$only" | wc -l) -eq 1 && -f $only/halo-extension.json ]]; then dir=$only; fi
+      fi
     fi
     expect=""
     if [[ $src =~ $ID_RE && ! -f $src ]]; then expect=$src; fi

package/templates/skills/web-search/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: web-search
-description: Real-time web search with two gears. Fast (default, Amazon Nova grounding, ~3s, cheap) — current events, news, prices, any routine lookup. Deep (--deep, OpenAI GPT-5.6 web_search via Bedrock Mantle, ~20-40s, token-expensive) — multi-round retrieval with first-hand sources and per-claim citations, for verifying facts behind important decisions or double-checking weak/contradictory fast results. Default to fast; escalate to deep only when the question deserves depth. For AWS documentation, service announcements or regional availability, use the aws-knowledge skill instead.
+description: Real-time web search on AWS Bedrock (needs AWS credentials with Bedrock access) with two gears. Fast (default, Amazon Nova grounding, ~3s, cheap) — current events, news, prices, any routine lookup. Deep (--deep, OpenAI GPT-5.6 web_search via Bedrock Mantle, ~20-40s, token-expensive) — multi-round retrieval with first-hand sources and per-claim citations, for verifying facts behind important decisions or double-checking weak/contradictory fast results. Default to fast; escalate to deep only when the question deserves depth. For AWS documentation, service announcements or regional availability, use the aws-knowledge skill instead.
 user-invocable: false
 ---
 # Web Search
@@ -22,12 +22,18 @@ searches against official sites), leans toward authoritative first-hand sources
 Use `<workspace>/.halo/skills/web-search/search.py` if that exists, else
 `~/.halo/global/skills/web-search/search.py`.
 
+Always prefix the call with the two region variables, keeping
+`{{params.fast_region}}` / `{{params.deep_region}}` exactly as written (the
+system substitutes them at runtime; unset = built-in defaults):
+
 ```bash
 # fast (default) — everyday lookups
-python3 ~/.halo/global/skills/web-search/search.py "What are the latest news about the China A-share market today?"
+WEB_SEARCH_FAST_REGION='{{params.fast_region}}' WEB_SEARCH_DEEP_REGION='{{params.deep_region}}' \
+  python3 ~/.halo/global/skills/web-search/search.py "What are the latest news about the China A-share market today?"
 
 # deep — verify facts that must be right
-python3 ~/.halo/global/skills/web-search/search.py --deep "What did the US Federal Reserve announce most recently about interest rates?"
+WEB_SEARCH_FAST_REGION='{{params.fast_region}}' WEB_SEARCH_DEEP_REGION='{{params.deep_region}}' \
+  python3 ~/.halo/global/skills/web-search/search.py --deep "What did the US Federal Reserve announce most recently about interest rates?"
 ```
 
 - Output: answer text + a `Sources:` URL list (gear/model/token usage on stderr).
@@ -40,8 +46,16 @@ python3 ~/.halo/global/skills/web-search/search.py --deep "What did the US Feder
   English works best; Chinese works too — deep gear rewrites queries bilingually.
 - Search output is still a lead, not gospel: for critical figures, `web_fetch`
   the cited source URL and confirm before acting on it.
-- Auth is automatic in both gears (machine AWS credentials — no API key to
-  configure or rotate). Deep gear needs the `aws-bedrock-token-generator` pip
-  package (one-time: `pip3 install --user aws-bedrock-token-generator`).
+- Both gears run on AWS Bedrock with the machine's AWS credentials (no API key):
+  fast = Amazon Nova 2 Lite + web grounding (`bedrock:InvokeModel` +
+  `bedrock:InvokeTool` on `amazon.nova_grounding`, US regions only); deep =
+  OpenAI GPT-5.6 on Bedrock Mantle (`bedrock-mantle:CreateInference` +
+  `bedrock-mantle:CallWithBearerToken`). Deep gear needs the
+  `aws-bedrock-token-generator` pip package (one-time:
+  `pip3 install --user aws-bedrock-token-generator`). An AccessDenied /
+  credentials error means this machine lacks that access — say so, don't retry.
+- Regions are set in Settings → Skills → web-search (`fast_region` default
+  us-east-1; `deep_region` default us-west-2 for luna, us-east-1 for sol — sol
+  isn't offered in us-west-2).
 - A deep call can take 40 s — be patient in shell_exec. One clear question per
   call; don't fan out parallel calls.

package/templates/skills/web-search/config.yaml

@@ -0,0 +1,13 @@
+displayName_zh: 联网搜索
+description: Real-time web search on AWS Bedrock — needs AWS credentials with Bedrock access.
+description_zh: 基于 AWS Bedrock 的实时联网搜索，需要有 Bedrock 权限的 AWS 凭证。
+
+params:
+  - key: fast_region
+    description: "AWS region for the fast gear (Amazon Nova 2 Lite + web grounding, US regions only: us-east-1 / us-east-2 / us-west-2). Empty = us-east-1."
+    description_zh: "快速档（Amazon Nova 2 Lite + Web Grounding）使用的 AWS 区域，仅限美国区域：us-east-1 / us-east-2 / us-west-2。留空 = us-east-1。"
+    default: us-east-1
+  - key: deep_region
+    description: "AWS region for the deep gear (OpenAI GPT-5.6 on Bedrock Mantle). Luna: us-east-1 / us-east-2 / us-west-2; Sol: us-east-1 / us-east-2. Empty = us-west-2 for Luna, us-east-1 for Sol."
+    description_zh: "深度档（Bedrock Mantle 上的 OpenAI GPT-5.6）使用的 AWS 区域。Luna：us-east-1 / us-east-2 / us-west-2；Sol：us-east-1 / us-east-2。留空 = Luna 用 us-west-2，Sol 用 us-east-1。"
+    default: us-west-2

package/templates/skills/web-search/search.py

@@ -12,27 +12,44 @@ Usage:
 Auth is automatic in both gears (machine AWS credentials): fast uses boto3's
 default credential chain; deep mints a 12-hour bearer token on every call via
 aws-bedrock-token-generator — no API key to configure or rotate.
+
+Regions: WEB_SEARCH_FAST_REGION / WEB_SEARCH_DEEP_REGION override the defaults
+below (the skill passes its fast_region / deep_region params through them).
 """
 import json
+import os
 import sys
 import urllib.error
 import urllib.request
 
-MANTLE_URL = "https://bedrock-mantle.us-east-2.api.aws/openai/v1/responses"
 MODELS = {"luna": "openai.gpt-5.6-luna", "sol": "openai.gpt-5.6-sol"}
+# Nova web grounding is US-only; us-east-1 / us-east-2 / us-west-2 all verified.
+FAST_REGION = "us-east-1"
+# bedrock-mantle: Luna is in us-east-1 / us-east-2 / us-west-2, Sol only in
+# us-east-1 / us-east-2. us-west-2 answered 3-8x faster than us-east-1 in
+# 2026-10-04 tests, so Luna defaults there; Sol takes us-east-1.
+DEEP_REGION = {"openai.gpt-5.6-luna": "us-west-2", "openai.gpt-5.6-sol": "us-east-1"}
 # luna (default) runs effort=max to squeeze out its retrieval planning; sol's
 # retrieval is already exhaustive at medium (measured 48 search queries on one
 # question), so it gets xhigh to avoid pointless token doubling — max over
 # xhigh measured only ~6% more reasoning tokens.
 EFFORTS = {"openai.gpt-5.6-luna": "max", "openai.gpt-5.6-sol": "xhigh"}
+SOL_REGIONS = ("us-east-1", "us-east-2")
+
+
+def env_region(name: str) -> str:
+    """Region from env; empty or an unsubstituted `{{…}}` skill-param placeholder = unset."""
+    v = os.environ.get(name, "").strip()
+    return "" if v.startswith("{{") else v
 
 
 def fast_search(question: str) -> None:
     import boto3
     from botocore.config import Config
 
+    region = env_region("WEB_SEARCH_FAST_REGION") or FAST_REGION
     bedrock = boto3.client(
-        "bedrock-runtime", region_name="us-east-1", config=Config(read_timeout=60)
+        "bedrock-runtime", region_name=region, config=Config(read_timeout=60)
     )
     response = bedrock.converse(
         modelId="us.amazon.nova-2-lite-v1:0",
@@ -55,13 +72,17 @@ def fast_search(question: str) -> None:
         for u in sources:
             print(" -", u)
     usage = response.get("usage", {})
-    print(f"\n[gear=fast model=nova-2-lite total_tokens={usage.get('totalTokens')}]", file=sys.stderr)
+    print(f"\n[gear=fast model=nova-2-lite region={region} total_tokens={usage.get('totalTokens')}]", file=sys.stderr)
 
 
 def deep_search(question: str, model: str) -> None:
     from aws_bedrock_token_generator import provide_token
 
-    token = provide_token(region="us-east-2")
+    region = env_region("WEB_SEARCH_DEEP_REGION") or DEEP_REGION[model]
+    if model == MODELS["sol"] and region not in SOL_REGIONS:
+        print(f"[sol is not offered in {region}; using {DEEP_REGION[model]}]", file=sys.stderr)
+        region = DEEP_REGION[model]
+    token = provide_token(region=region)
     body = json.dumps(
         {
             "model": model,
@@ -71,7 +92,7 @@ def deep_search(question: str, model: str) -> None:
         }
     ).encode()
     req = urllib.request.Request(
-        MANTLE_URL,
+        f"https://bedrock-mantle.{region}.api.aws/openai/v1/responses",
         data=body,
         headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"},
         method="POST",
@@ -101,7 +122,7 @@ def deep_search(question: str, model: str) -> None:
         for u in sources:
             print(" -", u)
     usage = data.get("usage", {})
-    print(f"\n[gear=deep model={model} total_tokens={usage.get('total_tokens')}]", file=sys.stderr)
+    print(f"\n[gear=deep model={model} region={region} total_tokens={usage.get('total_tokens')}]", file=sys.stderr)
 
 
 def main() -> None:

package/templates/skills/workspace/share.md

@@ -62,6 +62,7 @@ Prompts: all=global-fallback, root=global-fallback
 
 Redactions:
   • 1 secret field auto-replaced with {{...params.api_key}} placeholder
+  • settings.yaml: 2 secret values cleared
   • 0 unambiguous leaks redacted in markdown
   • 2 suspicious strings flagged for review (see below)
 
@@ -69,7 +70,7 @@ Excluded:
   • USER.md (3 files — personal profile)
   • memory/ (12 files)
   • assets/ (84 files)
-  • sessions/, logs/, tmp/, *.db, settings.yaml — always
+  • sessions/, logs/, tmp/, *.db, ~/.halo/secrets/settings.yaml — always
 ```
 
 Lead with the most important callouts: anything in the **redactions** section, anything in
@@ -148,13 +149,17 @@ To share: send the zip. Receiver unzips into their project root, then fills in a
 - Skills that are **referenced by an included agent's `skills:` list**. Workspace skill wins;
   otherwise global skill (if not disabled).
 - `prompts/{bootstrap,all,root}/` — workspace dir if it exists, else global fallback.
+- `<ws>/.halo/settings.yaml` (if present) — values under any `secrets` map or a secret-named
+  key (`api_key`, `token`, …) are cleared to `""`; `<<ENV>>` placeholders stay. The receiver
+  fills them in. Unparseable files are skipped (`excluded.settings_skipped`).
 
 **Excluded (always):**
 - Every `USER.md` (workspace, agent dirs, anywhere) — personal profile, never share.
 - `memory/`, `assets/` — workspace-specific knowledge / data.
 - `sessions/`, `logs/`, `tmp/`, `*.db`, `*.db-shm`, `*.db-wal` — runtime state.
-- `~/.halo/secrets/settings.yaml` — secrets are redacted into agent.yaml/SKILL.md as
-  `{{<id>.params.<key>}}` placeholders; the receiver fills them in their own `settings.yaml`.
+- `~/.halo/secrets/settings.yaml` — global settings, never bundled. Secrets in agent.yaml /
+  SKILL.md are redacted to `{{<id>.params.<key>}}` placeholders; the receiver fills them in
+  their own `settings.yaml`.
 - Agents with `internal: true` in their `agent.yaml` (`__evo_agent__`, `__score__`,
   `__apply_agent__`, etc.) — these are platform-internal, force-overwritten by the
   receiver's own server on startup, so bundling them is redundant and can leak
@@ -166,6 +171,9 @@ To share: send the zip. Receiver unzips into their project root, then fills in a
   `api_key`, `secret`, `token`, `password`, `access_key`, `aws_secret_access_key`, `bot_token`,
   `client_secret` (case-insensitive) get their values replaced with `{{<id>.params.<field>}}`
   if the value is a literal (not already a `{{...}}` or `<<ENV>>` placeholder).
+- **Workspace settings.yaml (auto):** secret values cleared to `""` (see Included); other
+  strings get the markdown leak scan below. Each cleared value is listed in
+  `redactions.settings`.
 - **Markdown auto-redact:** AWS access key formats (`AKIA…`, `ASIA…`) are replaced with
   `[REDACTED:<type>]`.
 - **Markdown flag-only:** Emails, bearer-style headers, and long base64-ish tokens are