feat(h5): web 联网能力、实时查询路由与 session Finish 对齐

- 新增 web 能力并挂载 platform/web（web_search/fetch_url）
- 实时查询强制 web skill，router fallback 与 await session Finish
- Session Broker 覆盖率/指标、stream replay 与相关单测/E2E 脚本

Co-authored-by: Cursor <cursoragent@cursor.com>

capabilities.test.mjs

@@ -33,6 +33,32 @@ test('resolveSandboxMcpNodeExecPath honors container-path override without host
   assert.equal(resolveSandboxMcpNodeExecPath(''), process.execPath);
 });
 
+test('web capability mounts platform web extension with search tools', () => {
+  const caps = applyPoliciesToCapabilities(
+    { ...DEFAULT_USER_CAPABILITIES, web: true },
+    { network_egress: 'allow' },
+  );
+  const policy = buildAgentExtensionPolicy(caps, {
+    policies: { network_egress: 'allow', goose_mode: 'auto' },
+  });
+  const web = policy.extensionOverrides.find((ext) => ext.name === 'web');
+  assert.ok(web);
+  assert.equal(web.type, 'platform');
+  assert.deepEqual(web.available_tools, ['web_search', 'fetch_url']);
+});
+
+test('web capability is stripped when network egress is denied', () => {
+  const caps = applyPoliciesToCapabilities(
+    { ...DEFAULT_USER_CAPABILITIES, web: true },
+    { network_egress: 'deny' },
+  );
+  assert.equal(caps.web, false);
+  const policy = buildAgentExtensionPolicy(caps, {
+    policies: { network_egress: 'deny', goose_mode: 'auto' },
+  });
+  assert.equal(policy.extensionOverrides.some((ext) => ext.name === 'web'), false);
+});
+
 test('default user policy blocks dangerous capabilities', () => {
   assert.equal(DEFAULT_USER_CAPABILITIES.shell, false);
   assert.equal(DEFAULT_USER_CAPABILITIES.filesystem, false);
@@ -43,6 +69,7 @@ test('default user policy blocks dangerous capabilities', () => {
   assert.equal(DEFAULT_USER_CAPABILITIES.memory_store, true);
   assert.equal(DEFAULT_USER_CAPABILITIES.skills, true);
   assert.equal(DEFAULT_USER_CAPABILITIES.chat_recall, true);
+  assert.equal(DEFAULT_USER_CAPABILITIES.web, true);
   assert.equal(DEFAULT_USER_CAPABILITIES.aider, false);
   assert.equal(DEFAULT_USER_CAPABILITIES.openhands, false);
 });