From 1dc2f7dc211fe70bda3273c2c71bd12b6d1346c8 Mon Sep 17 00:00:00 2001
From: host <host@test.local>
Date: Fri, 30 Oct 2026 01:03:20 +0800
Subject: [PATCH] =?UTF-8?q?egress:=20=E7=99=BD=E5=90=8D=E5=8D=95=E5=8A=A0?=
 =?UTF-8?q?=E4=B8=80=E7=BA=A7=E6=97=B6=E9=97=B4/=E5=A4=A9=E6=B0=94?=
 =?UTF-8?q?=E5=9F=9F=E5=90=8D=EF=BC=8C=E4=BE=9B=20live-info=20fetch=20?=
 =?UTF-8?q?=E6=A0=B8=E6=95=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

2026-10-30 端到端再测：web_search 已通，但 web_fetch
4 次全败于 Tinyproxy 403 Filtered——模型要 fetch 的
一级来源域名都不在白名单里，搜索摘要又无可靠数字，
故按技能规则未报数字。加：worldtimeapi.org、timeapi.io
（时间 API）、open-meteo.com（免费天气 API，无 key）、
weather.com.cn（中国气象局英文站）、meteoblue.com、
accuweather.com（搜索结果里的天气一级来源）。
刻意不加 time.is/time.org.cn/time.ms（次级时间站）与
任何新闻/社交域名，白名单仍 fail-closed。
主机 /etc/tinyproxy/tinyproxy-filter 须同步此文件并
reload tinyproxy 才能生效，仓库文件是下次部署不被
revert 的依据。
---
 deploy/egress/tinyproxy-filter | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/deploy/egress/tinyproxy-filter b/deploy/egress/tinyproxy-filter
index 9f70c14..3f9447a 100644
--- a/deploy/egress/tinyproxy-filter
+++ b/deploy/egress/tinyproxy-filter
@@ -31,3 +31,17 @@
 ^\(.*\.\)*search\.brave\.com$
 ^\(.*\.\)*duckduckgo\.com$
 ^searx\.diante\.me$
+# live-info primary sources (2026-10-30, user-approved): time
+# APIs + weather primary sources only, so web_fetch can verify
+# numbers instead of failing 403 Filtered. Deliberately NOT
+# included: time.is / time.org.cn / time.ms (commercial or
+# secondary time sites; worldtimeapi + timeapi cover time),
+# and no general news/social domains -- the whitelist stays
+# fail-closed, these are the only fetch destinations live-info
+# needs. Each line is domain + subdomains, same BASIC form.
+^\(.*\.\)*worldtimeapi\.org$
+^\(.*\.\)*timeapi\.io$
+^\(.*\.\)*open-meteo\.com$
+^\(.*\.\)*weather\.com\.cn$
+^\(.*\.\)*meteoblue\.com$
+^\(.*\.\)*accuweather\.com$