diff --git a/agent/provider.go b/agent/provider.go
index 6c1c8b5..6011ada 100644
--- a/agent/provider.go
+++ b/agent/provider.go
@@ -31,8 +31,9 @@ type Config struct {
 	BaseURL string
 	APIKey  string
 	Model   string
-	// Proxy routes all LLM requests through the given proxy URL (http/https/socks5).
-	// Empty falls back to the standard *_PROXY environment variables.
+	// Proxy routes all LLM requests through the given proxy URL (http/https/socks5,
+	// optionally with user:pass@ credentials). Empty means direct — it does NOT
+	// fall back to the standard *_PROXY environment variables.
 	Proxy string
 	// RatePerSecond / RatePerMinute cap the shared request rate across ALL agents
 	// using the provider (0 = that window unlimited).
@@ -268,7 +269,7 @@ func quotaAwareHTTPClient(proxy string) (*http.Client, error) {
 	transport := http.DefaultTransport.(*http.Transport).Clone()
 	proxy = strings.TrimSpace(proxy)
 	if proxy == "" {
-		transport.Proxy = http.ProxyFromEnvironment
+		transport.Proxy = nil // 留空=直连,不回退 HTTP_PROXY/HTTPS_PROXY 环境变量
 	} else {
 		proxyURL, err := url.Parse(proxy)
 		if err != nil {
diff --git a/web/src/app/(main)/system/llm/page.tsx b/web/src/app/(main)/system/llm/page.tsx
index 5ac1e28..2a5db5b 100644
--- a/web/src/app/(main)/system/llm/page.tsx
+++ b/web/src/app/(main)/system/llm/page.tsx
@@ -522,12 +522,12 @@ function ProfileSheet({
             <Input
               id="p-proxy"
               className="font-mono"
-              placeholder="http://127.0.0.1:8080 · socks5://127.0.0.1:1080"
+              placeholder="socks5://user:pass@127.0.0.1:1080 · http://127.0.0.1:8080"
               value={proxy}
               onChange={(e) => setProxy(e.target.value)}
             />
             <p className="text-muted-foreground text-xs">
-              仅 LLM 出站请求走此代理，支持 http/https/socks5；留空则用环境变量（HTTP_PROXY/HTTPS_PROXY）。
+              仅 LLM 出站请求走此代理，支持 http/https/socks5，可带账号密码（如 socks5://user:pass@host:port，密码含特殊字符需 URL 编码）；留空表示不使用代理（直连）。
             </p>
           </div>