safe-bash integration: hidden User-Agent policy makes curl downloads look like network failures

[kamilio]

The supplied September 9 giraffe-download session repeatedly returned 000/empty stderr for curl commands using -A, leading the assistant to infer that Wikimedia endpoints or file writes were blocked.

Ownership: this is a Poe integration usability issue, tracked here as requested for safe-bash follow-up. The rejecting policy lives in poe2/projects/agent-service/src/execute-shell-network.ts, not in safe-bash's curl parser. Do not weaken safe-bash network authorization or change normal curl -s semantics to fix it.

Validated against poe2 51aa5c1ab3f95a13c600075529232720751e7840, using its installed @poe-platform/safe-bash@0.1.470 and tests/execute-shell-network-harness.ts with a fake fetch returning new Response("image"):

curl -s -o /dev/null -w '%{http_code}\n' -A Mozilla/5.0 https://example.com/image
# stdout: 000\n; stderr: empty; exit 7; fetch called 0 times

curl -sS -o /dev/null -w '%{http_code}\n' -A Mozilla/5.0 https://example.com/image
# stdout: 000\n; exit 7; fetch called 0 times
# stderr: curl: (7) Network access denied by host policy: request header is not permitted

curl -s -o /dev/null -w '%{http_code}\n' https://example.com/image
# stdout: 200\n; stderr: empty; exit 0; fetch called 1 time

assertDownloadRequest permits only exact accept: */* and user-agent: virtual-bash-curl/0.0. All custom User-Agent values fail before any fetch. The tool description currently only says Execute Bash commands. and provides no guidance about this policy. A subsequent successful command also masks curl's exit status normally (curl -s -A Mozilla/5.0 URL; echo done exits 0); the transcript's aggregate exit 0 is not evidence of a curl exit-status bug.

Suggested resolution in the owning integration: expose the download policy in agent-facing tool guidance, including avoiding custom headers/User-Agent and using -sS to diagnose failures. If custom User-Agent support is desired, make a deliberate narrowly validated host-policy change with tests; do not enable arbitrary headers or credentials. Preserve redirect checks and request restrictions.

Acceptance: exercise the real execute_shell path with and without -A, verify fetch-call counts and diagnostic visibility, and verify agent-facing guidance communicates the restriction. This deterministic reproduction does not establish whether the original remote endpoints had additional failures.