fix agent networking

sandbox/agent

@@ -133,9 +133,18 @@ done < <(jq -rs "$MERGE | .filesystem.allowWrite[]? | strings" "${ours[@]}")
 # temp files then fail, and GTK aborts. /tmp is writable in every profile.
 export CLAUDE_CODE_TMPDIR=/tmp
 
+# srt tells the agent to connect directly to private addresses (192.168.x.x
+# and so on), but the sandbox has no network to do it with, so a server on
+# your local network that the config allows by IP, e.g. an Ollama server from
+# `configure ai-servers`, couldn't be reached. Only loopback is direct here;
+# everything else goes through the proxy, which still allows only the config's
+# domains and addresses.
+NO_PROXY_DIRECT=localhost,127.0.0.1,::1
+direct=(env "NO_PROXY=$NO_PROXY_DIRECT" "no_proxy=$NO_PROXY_DIRECT")
+
 # Hermes' terminal reaches its gateway, in another sandbox, through a relay
 case "$profile" in
-  hermes) exec "$srt" --settings "$settings" -- bash "$SANDBOX/hermes-bridge" "$real" "$@" ;;
+  hermes) exec "$srt" --settings "$settings" -- "${direct[@]}" bash "$SANDBOX/hermes-bridge" "$real" "$@" ;;
 esac
-exec "$srt" --settings "$settings" -- "$real" "$@"
+exec "$srt" --settings "$settings" -- "${direct[@]}" "$real" "$@"
 }