feat(web): add a per-agent shortcut into CLI proxy settings

Settings → Execution → Local CLI hides per-agent proxy and custom-path
configuration behind a collapsed "Advanced: proxy & custom paths"
disclosure below the agent grid. Users routing Claude Code or Codex
through a third-party endpoint had no signpost telling them those fields
exist, so the common BYOK/proxy setup was effectively undiscoverable.

Add a quiet shortcut to each installed agent card that opens that
disclosure and scrolls it into view.

Two properties are deliberate and are covered by tests:

- It renders whether or not an endpoint is already configured. Gating it
  on "configured" inverts its own purpose, because the user who needs to
  find the proxy fields is exactly the one who has not filled them in.
  Configured state only changes how the shortcut reads, never whether it
  appears.
- It is not Claude-specific. Claude and Codex both declare a base URL,
  auth keys and custom paths, so visibility is derived from
  AGENT_CLI_ENV_FIELDS rather than an agent id, and any agent that gains
  CLI env fields picks the shortcut up for free.

Configured detection reads every stored key for the agent instead of the
known field list, so values written out-of-band by `od` still count --
the daemon accepts ANTHROPIC_AUTH_TOKEN, which the panel has no field for.

Presented as quiet inline text rather than a second pill: the card's
action row already owns one affordance in Test, and Test performs work
while this only navigates, so equal visual weight would read as two peer
actions. It stays a real <button> outside the card-selection control,
which is what keeps keyboard and assistive-technology activation working.

i18n: replace the Claude-specific strings with settings.cliEnvShortcut and
settings.cliEnvShortcutConfigured across all 19 locales, deriving each
locale's wording from its own cliEnvTitle so the shortcut and the
disclosure it opens read as the same thing.

Author: chopll

apps/web/src/components/SettingsDialog.tsx

@@ -1673,6 +1673,20 @@ export function SettingsDialog({
   const settingsContentRef = useRef<HTMLDivElement | null>(null);
   // AMR-card focus, driven by the failed-run nudge (`initialHighlight==='amr'`).
   const amrCardRef = useRef<HTMLDivElement | null>(null);
+  // CLI env disclosure focus, driven by the per-agent card shortcut.
+  const agentCliEnvDetailsRef = useRef<HTMLDetailsElement | null>(null);
+  // Opens the "Advanced: proxy & custom paths" disclosure and brings it into
+  // view. The disclosure is a plain uncontrolled <details>, so `open` is set on
+  // the DOM node rather than through React state; scrolling waits a frame so it
+  // measures the expanded height instead of the collapsed one.
+  const revealAgentCliEnvSection = useCallback(() => {
+    const details = agentCliEnvDetailsRef.current;
+    if (!details) return;
+    details.open = true;
+    requestAnimationFrame(() => {
+      details.scrollIntoView({ block: 'nearest', behavior: 'smooth' });
+    });
+  }, []);
   // Card pulse: a brief attention flash that auto-clears after a few seconds.
   const [amrHighlightActive, setAmrHighlightActive] = useState(false);
   // Coachmark: persists (unlike the card pulse) until the real pointer reaches
@@ -4728,6 +4742,34 @@ export function SettingsDialog({
                             hoveredAgentCardId === a.id &&
                             !amrCardSignedIn &&
                             amrCardStatus?.loginInFlight === true;
+                          // Shortcut into the "Advanced: proxy & custom paths"
+                          // disclosure. Two things this must not do:
+                          //
+                          // 1. Gate on "already configured" — that inverted its
+                          //    own purpose, since the user who needs to *find*
+                          //    the proxy fields is exactly the one who has not
+                          //    filled them in yet.
+                          // 2. Single out one agent. Claude and Codex are
+                          //    structurally identical here (both declare a base
+                          //    URL, auth keys, and custom paths), so visibility
+                          //    is derived from the field table rather than an
+                          //    agent id — any agent that gains CLI env fields
+                          //    gets the shortcut for free.
+                          const showCliEnvShortcut =
+                            active &&
+                            AGENT_CLI_ENV_FIELDS.some(
+                              (field) => field.agentId === a.id,
+                            );
+                          // Configured only changes how the shortcut reads
+                          // (offer vs. status), never whether it renders. Reads
+                          // every stored key rather than the known field list so
+                          // values written out-of-band by `od` (e.g. the daemon
+                          // also accepts ANTHROPIC_AUTH_TOKEN) still count.
+                          const hasCliEnvOverrides =
+                            showCliEnvShortcut &&
+                            Object.values(cfg.agentCliEnv?.[a.id] ?? {}).some(
+                              (value) => Boolean(value),
+                            );
                           const cardEl = (
                             <div
                               key={a.id}
@@ -4973,6 +5015,48 @@ export function SettingsDialog({
                                     />
                                   )
                                 ) : null}
+                                {showCliEnvShortcut ? (
+                                  <Button
+                                    variant="ghost"
+                                    className={
+                                      'agent-card-cli-env-link' +
+                                      (hasCliEnvOverrides
+                                        ? ' agent-card-cli-env-link--configured'
+                                        : '')
+                                    }
+                                    // Not `settings-agent-card-*`: that prefix
+                                    // is the agent cards' own namespace and is
+                                    // enumerated by regex elsewhere.
+                                    data-testid={`settings-cli-env-shortcut-${a.id}`}
+                                    data-configured={
+                                      hasCliEnvOverrides ? 'true' : 'false'
+                                    }
+                                    onClick={(e) => {
+                                      e.stopPropagation();
+                                      revealAgentCliEnvSection();
+                                    }}
+                                  >
+                                    {/* The label carries the hover underline on
+                                        its own: text and chevron are separate
+                                        flex items, so underlining the whole
+                                        control leaves a visible break across
+                                        the gap between them. */}
+                                    <span className="agent-card-cli-env-link__label">
+                                      {t('settings.cliEnvShortcut')}
+                                    </span>
+                                    {hasCliEnvOverrides ? (
+                                      <VisuallyHidden>
+                                        {`, ${t('settings.cliEnvShortcutConfigured')}`}
+                                      </VisuallyHidden>
+                                    ) : null}
+                                    <span
+                                      className="agent-card-cli-env-link__chevron"
+                                      aria-hidden="true"
+                                    >
+                                      ›
+                                    </span>
+                                  </Button>
+                                ) : null}
                                 {active && !isAmrAgent ? (
                                   <button
                                     type="button"
@@ -5313,6 +5397,7 @@ export function SettingsDialog({
                 if (cliEnvFields.length === 0) return null;
                 return (
                   <details
+                    ref={agentCliEnvDetailsRef}
                     className="agent-cli-env"
                     data-testid="settings-cli-env"
                   >

apps/web/src/i18n/locales/ar.ts

@@ -609,6 +609,8 @@ export const ar: Dict = {
   'settings.modelPickerLiveCatalogOnlyHint': 'تم تحديث النماذج من CLI المثبت.',
   'settings.modelPickerFallbackHint': 'يتم عرض الإعدادات الافتراضية المضمنة. انقر على إعادة المسح لجلب النماذج المباشرة من CLI.',
   'settings.cliEnvTitle': 'متقدّم: الوكيل والمسارات المخصّصة',
+  'settings.cliEnvShortcut': 'الوكيل والمسارات المخصّصة',
+  'settings.cliEnvShortcutConfigured': 'مُهيّأ',
   'settings.cliEnvHint': 'استخدم هذه الخيارات لتجاوز بيئة CLI المحدّد: مفاتيح API، وعناوين base URL للوكيل، ومجلدات home المخصّصة، أو مسارات تنفيذ غير قياسية. عند عدم ضبط base URL، يستخدم CLI نقطة النهاية الافتراضية الخاصة به. تبقى الأسرار في إعدادات التطبيق المحلية ولا يراها سوى CLI المحدّد.',
   'settings.cliEnvClaudeConfigDir': 'دليل إعدادات Claude Code',
   'settings.cliEnvClaudeBaseUrl': 'Base URL لوكيل Claude',

apps/web/src/i18n/locales/de.ts

@@ -609,6 +609,8 @@ export const de: Dict = {
   'settings.modelPickerLiveCatalogOnlyHint': 'Modelle wurden aus der installierten CLI aktualisiert.',
   'settings.modelPickerFallbackHint': 'Integrierte Standardwerte werden angezeigt. Klicken Sie auf Neu scannen, um Live-Modelle aus der CLI abzurufen.',
   'settings.cliEnvTitle': 'Erweitert: Proxy und benutzerdefinierte Pfade',
+  'settings.cliEnvShortcut': 'Proxy und benutzerdefinierte Pfade',
+  'settings.cliEnvShortcutConfigured': 'Konfiguriert',
   'settings.cliEnvHint': 'Nutze diese Felder, um die Umgebung der ausgewählten CLI zu überschreiben: API-Keys, Proxy-Base-URLs, eigene Homes oder nicht standardmäßige Binary-Pfade. Ohne Base URL nutzt die CLI ihren Standard-Endpunkt. Secrets bleiben in der lokalen App-Konfiguration und werden nur an die ausgewählte CLI weitergegeben.',
   'settings.cliEnvClaudeConfigDir': 'Claude Code-Konfigurationsverzeichnis',
   'settings.cliEnvClaudeBaseUrl': 'Claude-Proxy-Base-URL',

apps/web/src/i18n/locales/en.ts

@@ -609,6 +609,8 @@ export const en: Dict = {
   'settings.modelPickerLiveCatalogOnlyHint': 'Model list comes from this CLI.',
   'settings.modelPickerFallbackHint': 'Showing built-in defaults. Click Rescan to pull live models from the CLI.',
   'settings.cliEnvTitle': 'Advanced: proxy & custom paths',
+  'settings.cliEnvShortcut': 'Proxy & custom paths',
+  'settings.cliEnvShortcutConfigured': 'Configured',
   'settings.cliEnvHint': 'Use these to override the selected CLI environment: API keys, proxy base URLs, custom homes, or non-standard binary paths. Without a base URL, the CLI uses its default endpoint. Secrets stay in local app config and only the selected CLI sees them.',
   'settings.cliEnvClaudeConfigDir': 'Claude Code config directory',
   'settings.cliEnvClaudeBaseUrl': 'Claude proxy base URL',

apps/web/src/i18n/locales/es-ES.ts

@@ -609,6 +609,8 @@ export const esES: Dict = {
   'settings.modelPickerLiveCatalogOnlyHint': 'Los modelos se actualizaron desde la CLI instalada.',
   'settings.modelPickerFallbackHint': 'Mostrando valores predeterminados integrados. Pulsa Reescanear para obtener modelos en vivo desde la CLI.',
   'settings.cliEnvTitle': 'Avanzado: proxy y rutas personalizadas',
+  'settings.cliEnvShortcut': 'Proxy y rutas personalizadas',
+  'settings.cliEnvShortcutConfigured': 'Configurado',
   'settings.cliEnvHint': 'Usa estos campos para sobrescribir el entorno de la CLI seleccionada: API keys, base URLs de proxy, homes personalizados o rutas de binarios no estándar. Sin base URL, la CLI usa su endpoint predeterminado. Los secretos permanecen en la configuración local de la app y solo los ve la CLI seleccionada.',
   'settings.cliEnvClaudeConfigDir': 'Directorio de configuración de Claude Code',
   'settings.cliEnvClaudeBaseUrl': 'Base URL del proxy de Claude',

apps/web/src/i18n/locales/fa.ts

@@ -609,6 +609,8 @@ export const fa: Dict = {
   'settings.modelPickerLiveCatalogOnlyHint': 'مدل‌ها از CLI نصب‌شده به‌روزرسانی شدند.',
   'settings.modelPickerFallbackHint': 'پیش‌فرض‌های داخلی نمایش داده می‌شوند. برای دریافت مدل‌های زنده از CLI روی اسکن مجدد کلیک کنید.',
   'settings.cliEnvTitle': 'پیشرفته: پراکسی و مسیرهای سفارشی',
+  'settings.cliEnvShortcut': 'پراکسی و مسیرهای سفارشی',
+  'settings.cliEnvShortcutConfigured': 'پیکربندی‌شده',
   'settings.cliEnvHint': 'از این گزینه‌ها برای بازنویسی محیط CLI انتخاب‌شده استفاده کنید: API key، base URL پراکسی، home سفارشی یا مسیر اجرایی غیر استاندارد. اگر base URL تنظیم نشود، CLI از endpoint پیش‌فرض خودش استفاده می‌کند. اطلاعات محرمانه در تنظیمات محلی برنامه می‌مانند و فقط CLI انتخاب‌شده آن‌ها را می‌بیند.',
   'settings.cliEnvClaudeConfigDir': 'پوشه پیکربندی Claude Code',
   'settings.cliEnvClaudeBaseUrl': 'Base URL پروکسی Claude',

apps/web/src/i18n/locales/fr.ts

@@ -609,6 +609,8 @@ export const fr: Dict = {
   'settings.modelPickerLiveCatalogOnlyHint': 'Les modèles ont été actualisés depuis la CLI installée.',
   'settings.modelPickerFallbackHint': 'Valeurs par défaut intégrées affichées. Cliquez sur Réanalyser pour récupérer les modèles en direct depuis la CLI.',
   'settings.cliEnvTitle': 'Avancé : proxy et chemins personnalisés',
+  'settings.cliEnvShortcut': 'Proxy et chemins personnalisés',
+  'settings.cliEnvShortcutConfigured': 'Configuré',
   'settings.cliEnvHint': 'Utilisez ces champs pour remplacer l’environnement de la CLI sélectionnée : clés API, base URLs de proxy, homes personnalisés ou chemins de binaires non standard. Sans base URL, la CLI utilise son endpoint par défaut. Les secrets restent dans la configuration locale de l’app et seule la CLI sélectionnée les voit.',
   'settings.cliEnvClaudeConfigDir': 'Dossier de configuration Claude Code',
   'settings.cliEnvClaudeBaseUrl': 'URL de base du proxy Claude',

apps/web/src/i18n/locales/hu.ts

@@ -609,6 +609,8 @@ export const hu: Dict = {
   'settings.modelPickerLiveCatalogOnlyHint': 'A modellek frissültek a telepített CLI-ből.',
   'settings.modelPickerFallbackHint': 'A beépített alapértékek láthatók. Kattints az Újraellenőrzésre az élő CLI-modellek lekéréséhez.',
   'settings.cliEnvTitle': 'Speciális: proxy és egyéni útvonalak',
+  'settings.cliEnvShortcut': 'Proxy és egyéni útvonalak',
+  'settings.cliEnvShortcutConfigured': 'Beállítva',
   'settings.cliEnvHint': 'Ezekkel írhatod felül a kiválasztott CLI környezetét: API-kulcsok, proxy base URL-ek, egyéni home-ok vagy nem szabványos bináris útvonalak. Base URL nélkül a CLI a saját alapértelmezett endpointját használja. A titkok a helyi alkalmazás-konfigurációban maradnak, és csak a kiválasztott CLI kapja meg őket.',
   'settings.cliEnvClaudeConfigDir': 'Claude Code konfigurációs könyvtár',
   'settings.cliEnvClaudeBaseUrl': 'Claude proxy Base URL',

apps/web/src/i18n/locales/id.ts

@@ -609,6 +609,8 @@ export const id: Dict = {
   'settings.modelPickerLiveCatalogOnlyHint': 'Model diperbarui dari CLI yang terpasang.',
   'settings.modelPickerFallbackHint': 'Menampilkan default bawaan. Klik Pindai ulang untuk mengambil model langsung dari CLI.',
   'settings.cliEnvTitle': 'Lanjutan: proxy & path kustom',
+  'settings.cliEnvShortcut': 'Proxy & path kustom',
+  'settings.cliEnvShortcutConfigured': 'Terkonfigurasi',
   'settings.cliEnvHint': 'Gunakan ini untuk menimpa environment CLI yang dipilih: API key, proxy base URL, home kustom, atau path binary non-standar. Tanpa base URL, CLI memakai endpoint defaultnya. Secret tetap berada di konfigurasi app lokal dan hanya dilihat oleh CLI yang dipilih.',
   'settings.cliEnvClaudeConfigDir': 'Direktori konfigurasi Claude Code',
   'settings.cliEnvClaudeBaseUrl': 'Base URL proxy Claude',

apps/web/src/i18n/locales/it.ts

@@ -609,6 +609,8 @@ export const it: Dict = {
   'settings.modelPickerLiveCatalogOnlyHint': 'I modelli sono stati aggiornati dalla CLI installata.',
   'settings.modelPickerFallbackHint': 'Mostra i valori predefiniti integrati. Clicca su Rianalizza per recuperare i modelli live dalla CLI.',
   'settings.cliEnvTitle': 'Avanzate: proxy e percorsi personalizzati',
+  'settings.cliEnvShortcut': 'Proxy e percorsi personalizzati',
+  'settings.cliEnvShortcutConfigured': 'Configurato',
   'settings.cliEnvHint': 'Usa questi campi per sovrascrivere l’ambiente della CLI selezionata: API key, base URL proxy, home personalizzate o percorsi di binari non standard. Senza base URL, la CLI usa il proprio endpoint predefinito. I segreti restano nella configurazione locale dell’app e li vede solo la CLI selezionata.',
   'settings.cliEnvClaudeConfigDir': 'Directory di configurazione Claude Code',
   'settings.cliEnvClaudeBaseUrl': 'Base URL del proxy Claude',