feat: 加固 Agent CLI 执行边界并更新模型目录

收紧 SSH 命令护栏、权限校验与远程执行会话，并同步主流大模型供应商列表。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/controller/agent_cli.go

@@ -523,12 +523,13 @@ func (ac *agentConn) buildTargetInfo() string {
 
 // confirmFn 高危命令确认回调：推 confirm 事件并阻塞等前端回传 // Logan.Li
 func (ac *agentConn) confirmFn(toolName string, args map[string]interface{}, risk tools.RiskLevel) (bool, error) {
+	safeArgs := guardrail.SanitizeMap(args)
 	confirmID := fmt.Sprintf("cf-%d", time.Now().UnixNano())
-	cmd, _ := args["command"].(string)
+	cmd, _ := safeArgs["command"].(string)
 	if cmd == "" && (toolName == "kubernetes_action" || toolName == "k8s_action") {
-		cmd = fmt.Sprintf("%v %v", args["action"], args["name"])
+		cmd = fmt.Sprintf("%v %v", safeArgs["action"], safeArgs["name"])
 	}
-	ac.write(wsEvent{Type: "confirm", Phase: core.PhaseApproval, Summary: "等待用户确认", ConfirmID: confirmID, ToolName: toolName, Command: cmd, Risk: risk.Display(), ToolArgs: args})
+	ac.write(wsEvent{Type: "confirm", Phase: core.PhaseApproval, Summary: "等待用户确认", ConfirmID: confirmID, ToolName: toolName, Command: cmd, Risk: risk.Display(), ToolArgs: safeArgs})
 
 	ch := make(chan bool, 1)
 	ac.cfMu.Lock()
@@ -537,7 +538,7 @@ func (ac *agentConn) confirmFn(toolName string, args map[string]interface{}, ris
 
 	select {
 	case approved := <-ch:
-		ac.recordConfirmSpan(toolName, args, risk, approved)
+		ac.recordConfirmSpan(toolName, safeArgs, risk, approved)
 		return approved, nil
 	case <-ac.taskCtx.Done():
 		ac.delConfirm(confirmID)