From fee236fe5646812634b0058208b07199a3ea8633 Mon Sep 17 00:00:00 2001
From: justme <mr.toing@outlook.com>
Date: Thu, 22 Oct 2026 07:36:29 +0800
Subject: [PATCH] web: explain the public-only default when an agent refuses a
 target [CI]

---
 web/shared/targets.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/shared/targets.ts b/web/shared/targets.ts
index 8aef619..d2f1f48 100644
--- a/web/shared/targets.ts
+++ b/web/shared/targets.ts
@@ -11,7 +11,7 @@ export const TARGET_STATUS: Record<TargetDto['status'], { label: string; tone: '
 
 /** Agent 拒绝任务的原因，翻成人话。 */
 export const REJECT_REASONS: Record<string, string> = {
-  policy_denied: '本机不允许这个目标：把它所在的网段加进 agent.json 的 limits.allowed_target_cidrs',
+  policy_denied: '本机不允许这个目标：默认只允许公网地址（目标在内网、回环或链路本地）；如果配置过 agent.json 的 limits.allowed_target_cidrs，则只允许其中列出的网段',
   budget_exceeded: '超出本机的速率预算',
   unsupported: '这个 Agent 不支持这种采集方法',
   invalid_params: '参数不合法',