Add files via upload

internal/config/config.go

@@ -670,6 +670,8 @@ type AgentConfig struct {
 // tool_whitelist 可在侧栏「应用」时合并写入 config.yaml 并立即生效。
 // audit_agent_prompt / audit_agent_prompt_review_edit 可在人机协同页编辑并立即生效；空则使用内置默认。
 type HitlConfig struct {
+	// AuditModel 审计 Agent 专用模型；字段留空时继承 OpenAI 主配置，便于用小模型做审批。
+	AuditModel OpenAIConfig `yaml:"audit_model,omitempty" json:"audit_model,omitempty"`
 	// ToolWhitelist 全局免审批工具名（与白名单内工具不触发 HITL 审批）。
 	ToolWhitelist []string `yaml:"tool_whitelist,omitempty" json:"tool_whitelist,omitempty"`
 	// AuditAgentPrompt 审批模式（approval）下审计 Agent 系统提示词。
@@ -703,6 +705,28 @@ func (h HitlConfig) RetentionDaysEffective() int {
 	return *h.RetentionDays
 }
 
+// AuditModelEffective returns the audit-agent model config with empty fields inherited from the main model config.
+func (h HitlConfig) AuditModelEffective(main OpenAIConfig) OpenAIConfig {
+	out := main
+	am := h.AuditModel
+	if strings.TrimSpace(am.Provider) != "" {
+		out.Provider = strings.TrimSpace(am.Provider)
+	}
+	if strings.TrimSpace(am.BaseURL) != "" {
+		out.BaseURL = strings.TrimSpace(am.BaseURL)
+	}
+	if strings.TrimSpace(am.APIKey) != "" {
+		out.APIKey = strings.TrimSpace(am.APIKey)
+	}
+	if strings.TrimSpace(am.Model) != "" {
+		out.Model = strings.TrimSpace(am.Model)
+	}
+	if am.MaxTotalTokens > 0 {
+		out.MaxTotalTokens = am.MaxTotalTokens
+	}
+	return out
+}
+
 const hitlAuditAgentPromptBase = `你是 CyberStrikeAI 人机协同审计 Agent。审查 Agent 即将执行的工具调用是否会对系统造成实质性损害。
 
 你会收到 JSON，包含 hitlMode、toolName、arguments/argumentsObj、userMessage、thinking、reasoningChain、planning 等字段。

internal/config/config_test.go

@@ -71,3 +71,23 @@ func TestPersistAuthPasswordDoesNotTreatQuotedHashAsComment(t *testing.T) {
 		t.Fatalf("old quoted password fragment was incorrectly preserved as a comment:\n%s", data)
 	}
 }
+
+func TestHitlAuditModelEffectiveFallsBackToMainConfig(t *testing.T) {
+	main := OpenAIConfig{
+		Provider: "openai",
+		BaseURL:  "https://api.example.com/v1",
+		APIKey:   "main-key",
+		Model:    "large-model",
+	}
+
+	got := (HitlConfig{
+		AuditModel: OpenAIConfig{Model: "small-reviewer"},
+	}).AuditModelEffective(main)
+
+	if got.Provider != main.Provider || got.BaseURL != main.BaseURL || got.APIKey != main.APIKey {
+		t.Fatalf("expected provider/base_url/api_key to inherit main config, got %+v", got)
+	}
+	if got.Model != "small-reviewer" {
+		t.Fatalf("expected audit model override, got %q", got.Model)
+	}
+}