@yachiyo-5i/xlyra-agent 1.4.0 → 1.5.0

package/README.md

@@ -204,6 +204,8 @@ For OpenAI-compatible Chat Completions endpoints, `chat_completions.max_tokens_f
 `max_steps` caps a single run's steps (one model reply plus its tool executions), default `200`, maximum `1000`. The budget is declared in the system prompt and reported at 50/80/95% milestones; when the runner detects repeated identical calls or near-identical tool outputs it injects a nudge message (and emits `stall_detected` / `budget_notice` SSE events) instead of hard-stopping the run.
 Session requests accept up to four attachments, with a 16 MiB limit per attachment and 32 MiB total; the HTTP request body is capped at 36 MiB.
 
+Network tools are registered by default. `web_search` uses DuckDuckGo out of the box; add the top-level `web_search` section only to switch providers — `brave` and `tavily` require `api_key` (supports `${ENV_VAR}`). `web_fetch` returns cleaned, bounded body text (long pages are explicitly marked as truncated) with SSRF protection; private/loopback addresses are rejected unless `agent.web_fetch_allow_private_network: true` is set. Web content is reference material only and must not be treated as instructions; both tools are marked as network capabilities in the system prompt's capability map. Network-tool settings and provider credentials take effect on the next run after `PUT /config`. The SSRF guard resolves and validates the hostname before each request, while the connection itself performs a second, independent DNS resolution — DNS rebinding is therefore a theoretical gap; the guard keeps the model from being steered to internal addresses and does not replace network-level isolation. `duckduckgo` is a free web endpoint with no stability guarantee (it may be rate-limited or change layout; the tool reports an explicit error when hit) — for production use, configure `brave` or `tavily`.
+
 ### Start the Server
 
 ```bash
@@ -275,6 +277,8 @@ The runtime injects a capability map into the system prompt. Every tool keeps it
 | `exec_command` | Execute an argv-based local command and manage long-running processes |
 | `write_stdin` | Poll a command session or write data to its standard input |
 | `load_skill` | Activate a discovered Agent Skill by name (registered only when skills exist) |
+| `web_search` | Search the web and return formatted title, URL, and provider excerpts (not model summaries) |
+| `web_fetch` | Fetch a page and return cleaned, bounded body text with SSRF protection by default |
 
 ## AGENTS.md and Agent Skills
 
@@ -309,7 +313,7 @@ Activated skill bodies carry retention markers so context compaction re-injects
 
 File tools are restricted to the configured workspace by default. The sandbox checks resolved paths and symlinks. Access outside the workspace can be approved for the current session.
 
-Command execution is declared to the model but is not pre-authorized unless `enableCommandExecution: true` or `agent.enable_command_execution: true` is configured. Commands are launched directly from argv without an implicit shell, with workspace-checked cwd, bounded output, timeout, and AbortSignal cancellation. Child processes still inherit the operating-system permissions of the current user; production deployments should additionally use containers, a dedicated OS user, or another OS-level sandbox.
+Command execution is declared to the model but is not pre-authorized unless `enableCommandExecution: true` or `agent.enable_command_execution: true` is configured. Like other agent flags, this switch is re-read for each run, so changing it via `PUT /config` takes effect on the next run. Commands are launched directly from argv without an implicit shell, with workspace-checked cwd, bounded output, timeout, and AbortSignal cancellation. Child processes still inherit the operating-system permissions of the current user; production deployments should additionally use containers, a dedicated OS user, or another OS-level sandbox.
 
 ## Persistence and Recovery