Shared-base Web fetch default
共享 base 的 Web 抓取默认值
Every shipped full agent product accepts anonymous public Web fetch, but `dsh-base` disabled `web_fetch` and required each application bundle to repeat the same override. The repeated configuration omitted ACP, made new base-backed profiles search-only unless their authors noticed the exception, and forced otherwise identical snapshot headers to split by product.
English
Problem
Every shipped full agent product accepts anonymous public Web fetch, but dsh-base disabled web_fetch and required each application bundle to repeat the same override. The repeated configuration omitted ACP, made new base-backed profiles search-only unless their authors noticed the exception, and forced otherwise identical snapshot headers to split by product.
Decision
packages/bundle/base/cordis.patch.yml mounts dsh-tool-web with fetch: true and the shipped 60-second search timeout. Headless, full SDK, ACP, and custom base-only profiles inherit both web_search and web_fetch without application-level overrides. The Web app disables the base tool row and composes the same pair per agent preset. The standalone sdk-minimal profile remains independent of base.
The base HTTP provider permits anonymous http: and https: requests only to validated public destinations. Fetch executes outside shell and filesystem sandbox or approval presets and requires no per-call approval; public-destination validation does not prevent public data egress. A product that requires a different network policy overrides the complete tool-web config in a later bundle or profile patch.
Alternatives considered
Keep fetch disabled in base and enable it in each product. Rejected because every shipped full product selects the same capability, so the repeated rows encode no product difference and can omit future base-backed profiles.
Add only an ACP override. Rejected because it repairs the current omission while retaining three redundant application-level settings and the same failure mode for future profiles.
Consequences
Base-backed model requests expose the fetch schema and prompt guidance by default, including ACP automation and custom profiles that name only dsh-base. Restricted deployments must opt out explicitly. Headless, SDK, and ACP can share the same model-header snapshot sources, while focused real-profile tests pin the shipped tool roster.
中文
问题
所有随附的完整 agent 产品都接受匿名公开 Web 抓取，但 dsh-base 会禁用 web_fetch，要求每个应用组合包重复相同的覆盖。重复配置遗漏了 ACP，使新的 base-backed profile 默认只有搜索能力，除非作者注意到这个例外，还迫使产品之间原本相同的 snapshot header 分开维护。
决策
packages/bundle/base/cordis.patch.yml 以 fetch: true 和随附的 60 秒搜索超时挂载 dsh-tool-web。Headless、完整 SDK、ACP 与仅使用 base 的自定义 profile 会继承 web_search 和 web_fetch，无需应用级覆盖。Web app 会禁用 base 工具配置项，并按 agent preset 组合相同的一对工具。独立的 sdk-minimal profile 不使用 base，因此保持不变。
base HTTP 提供方只允许匿名请求经过验证的公开 http: 与 https: 目的地址。抓取在 shell 和文件系统 sandbox 或审批 preset 之外执行，无需逐次审批；公开目的地址校验不会阻止向公网发送数据。需要不同网络策略的产品应在后续组合包或 profile patch 中覆盖完整的 tool-web 配置。
考虑过的替代方案
在 base 中禁用抓取，再由每个产品分别启用。 不予采纳：所有随附的完整产品都选择相同能力，重复配置没有表达产品差异，还可能遗漏未来的 base-backed profile。
只增加 ACP 覆盖。 不予采纳：这种方式能修复当前遗漏，但会保留三处重复的应用级设置，也会让未来 profile 面临相同问题。
后果
基于 base 的模型请求默认暴露抓取 schema 与 prompt 指引，包括 ACP 自动化和只列出 dsh-base 的自定义 profile。受限部署必须显式关闭。Headless、SDK 与 ACP 可以共享相同的模型 header snapshot 来源，聚焦的真实 profile 测试会固定随附工具集合。