refactor(runtime): move permission planning to Agent Runtime

AGENTS-CN.md

@@ -9,9 +9,9 @@ BitFun 是一个由 Rust workspace 与 React 前端组成的项目。
 ## 快速开始
 
 1. 在修改架构敏感代码前，先阅读 `README.md` 和 `CONTRIBUTING.md`。
-2. 桌面端开发优先使用 `pnpm run desktop:dev` — 提供完整热更新（Vite HMR + Rust 自动重编译并重启）。仅在需要更快冷启动且只迭代前端时使用 `pnpm run desktop:preview:debug`（Rust 改动不会自动重编译）。
+2. 日常开发使用下方主要产品循环；surface 专属的替代命令由最近的应用指南维护。
 3. 修改 Rust 文件后，优先使用 `pnpm run fmt:rs`，只格式化已改动或已暂存的 `.rs` 文件。只有在你明确需要更大范围格式化时才使用 `cargo fmt`。
-4. 改完后按下方表格执行与改动范围匹配的最小验证。
+4. 改完后从离改动最近的 `AGENTS.md` 选择 focused 验证命令；下方仓库级验证章节只维护跨模块检查原则。
 5. Rust workspace 依赖应在根清单中统一版本，而由消费 crate 按自身职责声明所需 feature；仅测试所需的 feature 应放入 `dev-dependencies`，受 crate feature 控制的服务能力应只在对应 feature 中启用。禁止使用 `tokio/full` 绕过依赖边界设计。
 
 ## 分层模块索引
@@ -44,61 +44,23 @@ Stable Contracts and Security Control Plane 的边界以
 
 ## 常用命令
 
-这些是命令参考，不是 PR 前置检查清单。预检请按下方“验证”表选择最小本地检查；
-大范围测试和构建主要用于复现 CI 或验证构建相关改动。
+这里只保留稳定的仓库级入口。具体 surface/crate 的测试命令由最近的本地 `AGENTS.md` 维护，
+不要在根文档重复抄写。
 
 ```bash
-# 安装
+# 安装与主要产品开发循环
 pnpm install
-
-# 开发
 pnpm run desktop:dev               # 完整热更新：Vite HMR + Rust 自动重编译并重启
-pnpm run desktop:preview:debug     # 复用预构建二进制 + Vite HMR；无 Rust 自动重编译
-pnpm run dev:web                   # 纯浏览器前端
-pnpm run cli:dev                   # CLI 运行时
-pnpm run cli:install               # release 编译并安装 bitfun（Windows/macOS/Linux；含废弃兼容入口 bitfun-cli）
-
-# 检查
-pnpm run fmt:rs                     # 只格式化已改动 / 已暂存的 Rust 文件
-pnpm run lint:web
-pnpm run type-check:web
-pnpm --dir src/mobile-web run type-check
-pnpm run i18n:contract:test          # 仅 i18n contract / resources
-pnpm run i18n:audit                  # 仅 i18n contract / resources
-pnpm run product:check               # 默认产品定义
-pnpm run check:repo-hygiene
-pnpm run check:github-config
-cargo check --workspace
-
-# 测试（本地优先用精确测试路径；大范围测试由 CI 兜底）
-pnpm run product:test
-pnpm --dir src/web-ui run test:run      # 大范围测试；本地优先用精确测试路径
-cargo test --workspace                  # 大范围测试；CI 兜底
-
-# 构建（仅构建相关改动或复现 CI 时运行）
-cargo build -p bitfun-desktop           # 构建相关改动 / 复现 CI
-pnpm run build:web                      # 构建相关改动 / 复现 CI
-pnpm run build:mobile-web               # 构建相关改动 / 复现 CI
-
-# 快速构建（手动构建 / 调试流程）
-pnpm run desktop:build:fast           # debug 构建，不打包
-pnpm run desktop:build:release-fast   # release 但降低 LTO
-pnpm run desktop:build:nsis:fast      # Windows 安装器，release-fast profile
-```
-
-完整脚本列表见 [`package.json`](package.json)。
-
-### 构建逃生口
 
-开发/构建链路以一部分灵活性换取速度,必要时可覆盖:
-
-| 变量 / 参数 | 使用场景 |
-| --- | --- |
-| `CARGO_PROFILE_DEV_DEBUG=2` | 需要完整调试信息打断点。dev profile 默认 `line-tables-only`(panic 回溯仍带行号,PDB 体积大幅减小)。 |
-| `BITFUN_MOBILE_WEB_FORCE_BUILD=1` 或 `node scripts/mobile-web-build.cjs --force` | 源码看起来没变但需要强制重建 mobile-web。当 `src/mobile-web/dist` 新于所有输入时构建会被跳过。 |
-| `VITE_USE_POLLING=1` | Vite dev 监听不到文件变化——通常发生在网络盘或 WSL 挂载上。默认使用原生文件事件。 |
+# 仓库级检查
+pnpm run fmt:rs                    # 只格式化已改动 / 已暂存的 Rust 文件
+pnpm run check:repo-hygiene        # 仓库内容与文件名规则
+pnpm run check:github-config       # GitHub workflow / 配置规则
+pnpm run check:core-boundaries     # Cargo / 模块 owner 边界
+```
 
-`pnpm run build:web` 会并发执行类型检查与 Vite 构建,因此类型错误与打包错误出现的先后顺序不固定;两者的输出都带前缀(`[type-check]` / `[vite-build]`)。
+Web UI、mobile、CLI、Desktop、Installer、打包及 focused test 命令由最近的本地指南维护；
+完整脚本注册表仍见 [`package.json`](package.json)。
 
 ## 全局规则
 
@@ -248,24 +210,18 @@ OpenCode 兼容或目标项目治理的变更，先阅读
 
 ## 验证
 
-按触及文件选择最小本地预检。完整构建和大范围测试默认由 CI 保护；只有改动直接影响构建、
-打包，或 CI 无法覆盖对应路径时，才在本地运行更重的命令。
-
-| 改动类型 | 最低验证要求 |
-|---|---|
-| 不涉及 i18n 资源/契约的前端 UI、状态或适配层 | `pnpm run type-check:web`；行为变化时再加最近的 focused test |
-| 仅 locale 资源改动 | `pnpm run i18n:audit` |
-| Locale contract 或 shared terms | `pnpm run i18n:generate && pnpm run i18n:contract:test && pnpm run i18n:audit` |
-| Web UI i18n runtime、namespace loading 或直接 `i18nService.t(...)` 调用 | `pnpm run i18n:contract:test && pnpm run type-check:web && pnpm --dir src/web-ui run test:run src/infrastructure/i18n/core/I18nService.test.ts` |
-| Mobile web UI、状态、配对、断开或重连行为 | `pnpm --dir src/mobile-web run type-check`；行为变化还需要在 PR 中说明手动配对 / 重连验证 |
-| 产品定义、schema、resolver 或 Desktop/CLI 产品构建 adapter | `pnpm run product:test`，并对默认定义运行 `pnpm run product:check` |
-| `core`、`transport`、adapter 或共享服务中的 Rust 逻辑 | `cargo check --workspace`；行为变化时再加最近的 focused `cargo test` |
-| 桌面端集成、Tauri API、browser/computer-use 或桌面专属行为 | `cargo check -p bitfun-desktop`；行为变化时再加 focused desktop tests |
-| 被桌面端 smoke/functional 流覆盖的行为 | 优先运行最近的 focused E2E/smoke check；除非改动影响构建，否则 broad build/test 交给 CI |
-| `src/crates/adapters/ai-adapters` | 运行上面相关 Rust 检查；只有 stream contract 改动时再加 `cargo test -p bitfun-agent-stream` |
-| 不涉及打包的安装器前端或 i18n runtime | `pnpm --dir BitFun-Installer run type-check` |
-| 安装器 Tauri/Rust 改动 | `cargo check --manifest-path BitFun-Installer/src-tauri/Cargo.toml` |
-| 安装器打包、payload、安装/卸载流程或 native bundling | `pnpm run installer:build` |
+验证范围由 owner 决定，不在根文档维护全仓测试矩阵：
+
+1. 阅读离改动最近的本地 `AGENTS.md`，运行能够覆盖该行为的最窄命令。
+2. 优先选择单 package、单 test target 或 module filter，并使用最小 feature；不要把
+   `product-full`、`all-features` 或 workspace 全量测试当成捷径。
+3. 只有对应契约变化时才运行仓库级检查：布局/内容规则使用 repository hygiene，
+   workflow 变更使用 GitHub config，Cargo feature、依赖方向或 test-target 布局使用 core boundaries。
+4. 大范围 build、workspace suite、打包和平台矩阵默认交给现有 CI；只有改动影响这些路径或需要复现
+   CI 故障时才在本地运行。
+
+如果某个模块缺少有效的 focused 命令，应补充到该模块自己的指南，而不是继续扩张根文档。
+不要预先对齐所有模块的 test 清单；只有真实开发流程需要时才记录命令。
 
 ## Agent 文档优先级
 

AGENTS.md

@@ -9,9 +9,12 @@ Repository rule: **keep product logic platform-agnostic, then expose it through
 ## Quick start
 
 1. Read `README.md` and `CONTRIBUTING.md` before architecture-sensitive changes.
-2. For desktop development, prefer `pnpm run desktop:dev` — it provides full hot-reload (Vite HMR + Rust auto-rebuild & restart). Use `pnpm run desktop:preview:debug` only when you need a faster cold-start for frontend-only iteration (Rust changes are not auto-rebuilt).
+2. Use the primary product loop below for normal development. Surface-specific
+   alternatives belong in the nearest app guide.
 3. After Rust file changes, prefer `pnpm run fmt:rs` to format only changed or staged `.rs` files. Use `cargo fmt` only when you intentionally want broader formatting coverage.
-4. After changes, run the smallest matching verification from the table below.
+4. After changes, use the nearest local `AGENTS.md` for the focused verification
+   command. The repository-level verification section below only covers
+   cross-cutting checks.
 5. Workspace Rust dependencies own compatible versions, not broad capability
    unions. Each crate must select the dependency features it actually uses;
    keep test-only features in dev-dependencies and attach feature-gated service
@@ -50,64 +53,24 @@ Boundary rules:
 
 ## Common commands
 
-These are command references, not a pre-PR checklist. Use the Verification table
-to choose the smallest local precheck; broad suites and builds are mainly for CI
-reproduction or build-impacting changes.
+Keep this list to stable repository entry points. Surface- and crate-specific
+test commands belong in the nearest local `AGENTS.md` and must not be copied here.
 
 ```bash
-# Install
+# Setup and primary product loop
 pnpm install
-
-# Dev
 pnpm run desktop:dev               # full hot-reload: Vite HMR + Rust auto-rebuild & restart
-pnpm run desktop:preview:debug     # reuse pre-built binary + Vite HMR; no Rust auto-rebuild
-pnpm run dev:web                   # browser-only frontend
-pnpm run cli:dev                   # CLI runtime
-pnpm run cli:install               # build release + install bitfun (Windows/macOS/Linux; deprecated bitfun-cli included)
-
-# Check
-pnpm run fmt:rs                     # format only changed / staged Rust files
-pnpm run lint:web
-pnpm run type-check:web
-pnpm --dir src/mobile-web run type-check
-pnpm run i18n:contract:test          # i18n contract / resources only
-pnpm run i18n:audit                  # i18n contract / resources only
-pnpm run product:check               # default product definition
-pnpm run check:repo-hygiene
-pnpm run check:github-config
-cargo check --workspace
-
-# Test (prefer focused paths locally; broad suites are CI-backed)
-pnpm run product:test
-pnpm --dir src/web-ui run test:run      # broad suite; prefer focused paths locally
-cargo test --workspace                  # broad suite; CI-backed
-
-# Build (only for build-impacting changes or CI reproduction)
-cargo build -p bitfun-desktop           # build-impacting changes / CI reproduction
-pnpm run build:web                      # build-impacting changes / CI reproduction
-pnpm run build:mobile-web               # build-impacting changes / CI reproduction
-
-# Fast builds (manual build/debug flows)
-pnpm run desktop:build:fast           # debug build, no bundling
-pnpm run desktop:build:release-fast   # release with reduced LTO
-pnpm run desktop:build:nsis:fast      # Windows installer, release-fast profile
-```
-
-For the full script list, see [`package.json`](package.json).
 
-### Build escape hatches
-
-The dev/build pipeline trades some flexibility for speed. Override when needed:
-
-| Variable / flag | Use when |
-| --- | --- |
-| `CARGO_PROFILE_DEV_DEBUG=2` | You need full debug info for breakpoints. The dev profile ships `line-tables-only` (panic backtraces keep line numbers, PDBs stay small). |
-| `BITFUN_MOBILE_WEB_FORCE_BUILD=1` or `node scripts/mobile-web-build.cjs --force` | mobile-web must rebuild even though its sources look unchanged. The build is skipped when `src/mobile-web/dist` is newer than every input. |
-| `VITE_USE_POLLING=1` | The Vite dev watcher misses changes — typically on a network drive or a WSL mount. Native file events are the default. |
+# Repository checks
+pnpm run fmt:rs                    # format only changed / staged Rust files
+pnpm run check:repo-hygiene        # repository content and filename rules
+pnpm run check:github-config       # GitHub workflow/configuration rules
+pnpm run check:core-boundaries     # Cargo/module ownership boundaries
+```
 
-`pnpm run build:web` runs the type-check and the Vite build concurrently, so a
-type error and a bundling error can surface in either order; both are prefixed
-(`[type-check]` / `[vite-build]`) in the output.
+For Web UI, mobile, CLI, Desktop, Installer, packaging, and focused test
+commands, use the nearest local guide. The full script registry remains in
+[`package.json`](package.json).
 
 ## Global rules
 
@@ -286,27 +249,22 @@ cost-aware, and auditable.
 
 ## Verification
 
-Run the smallest local precheck that matches the touched files. CI is expected to
-cover full builds and broad test suites; run heavier local commands only when the
-change directly affects build, packaging, or CI cannot protect the path.
-
-| Change type | Minimum verification |
-|---|---|
-| Frontend UI, state, or adapters without i18n resource/contract changes | `pnpm run type-check:web`, plus the nearest focused test when behavior changed |
-| Locale resource-only changes | `pnpm run i18n:audit` |
-| Locale contract or shared terms | `pnpm run i18n:generate && pnpm run i18n:contract:test && pnpm run i18n:audit` |
-| Web UI i18n runtime, namespace loading, or direct `i18nService.t(...)` usage | `pnpm run i18n:contract:test && pnpm run type-check:web && pnpm --dir src/web-ui run test:run src/infrastructure/i18n/core/I18nService.test.ts` |
-| Mobile web UI, state, pairing, disconnect, or reconnect behavior | `pnpm --dir src/mobile-web run type-check`; include manual pairing / reconnect notes when behavior changes |
-| Product definition, schema, resolver, or Desktop/CLI product build adapter | `pnpm run product:test`, plus `pnpm run product:check` for the default definition |
-| Cargo manifests, features, test targets, or crate dependency boundaries | `pnpm run check:core-boundaries:test && pnpm run check:core-boundaries`; add the smallest affected `cargo check -p <owner> --no-default-features --features <feature>` or focused target test when the compiled path changes |
-| Shared Rust logic in `core`, `transport`, adapters, or services | `cargo check --workspace`, plus the nearest focused `cargo test` when behavior changed |
-| Desktop integration, Tauri APIs, browser/computer-use, or desktop-only behavior | `cargo check -p bitfun-desktop`, plus focused desktop tests when behavior changed |
-| Behavior covered by desktop smoke/functional flows | Prefer the nearest focused E2E/smoke check; rely on CI for broad build/test coverage unless build behavior changed |
-| `src/crates/adapters/ai-adapters` | Relevant Rust checks above; add `cargo test -p bitfun-agent-stream` only when stream contracts changed |
-| Installer frontend or i18n runtime without packaging changes | `pnpm --dir BitFun-Installer run type-check` |
-| Installer Tauri/Rust changes | `cargo check --manifest-path BitFun-Installer/src-tauri/Cargo.toml` |
-| Installer packaging, payload, install/uninstall flow, or native bundling | `pnpm run installer:build` |
-| Build scripts or prerequisite changes | `pnpm run check:build-prereqs`, plus `node --test scripts/check-build-prereqs.test.mjs` when the check logic changed |
+Choose verification at the owner, not from a repository-wide test matrix:
+
+1. Read the nearest local `AGENTS.md` and run its narrowest command that covers
+   the changed behavior.
+2. Prefer one package, one test target or module filter, and the minimum feature
+   set. Do not use `product-full`, `all-features`, or a workspace-wide suite as a
+   shortcut.
+3. Run a repository check only when its contract changed: repository hygiene for
+   layout/content rules, GitHub config for workflow changes, and core boundaries
+   for Cargo features, dependency direction, or test-target layout.
+4. Leave broad builds, workspace suites, packaging, and platform matrices to
+   existing CI unless the change affects those paths or reproduces a CI failure.
+
+If a module lacks a useful focused command, add it to that module's guide rather
+than expanding this file. Do not pre-emptively align every module's test list;
+document a command only when a real workflow needs it.
 
 ## Agent-doc priority
 

docs/architecture/agent-runtime-services-design.md

@@ -441,6 +441,11 @@ model-round cancellation token、结构化 AgentInput 或更复杂的事件游
 兼容边界：
 
 - `bitfun-agent-runtime` 只能依赖稳定接口、工具运行时、运行时服务接口和注入的提供方。
+- 权限规划按纯决策与产品编排分层：
+  - Agent Runtime 持有 `PermissionIntent` 的策略、约束层与记忆授权判定；
+  - Core 产品管线持有 workspace/remote scope 投影、平台大小写事实、grant store IO、native Hook 顺序、
+    交互请求投影、等待/取消和具体 Tool 执行；
+  - 该边界不建立第二套 Permission DTO、公开 SDK 接口或产品 feature。
 - 具体调度器生命周期、会话元数据存储、token 订阅器、事件投递、产品 `Tool`
   handler、具体提示组装、workspace / remote / config IO、自定义子智能体文件 IO 和平台适配器
   在行为等价未证明前不得下沉到运行时内核。
@@ -745,8 +750,11 @@ Rust Runtime SDK，不注册未实现的 `RuntimeServices` 能力，也不宣称
 `doctor` 与 `health` 校验真实组装结果及必需注册完整性；
 Core 的 Network、Git 和 MCP Catalog 当前仍含兼容 marker，因此该诊断不等于对这些外部服务做实时探活。
 
-该切换仍是 `product-full` 兼容组装，不是 owner 迁移。协调器、调度器、持久化、工具管线和 Agentic Event Queue
-仍由 Core 唯一持有；CLI 与 ACP 不复制这些状态。ACP 服务端通过 Rust Runtime SDK 处理会话创建/列举、轮次、取消、交互响应和事件订阅，
+该切换仍是 `product-full` 兼容组装，不是完整 ToolPipeline owner 迁移。
+协调器、调度器、持久化、工具管线和 Agentic Event Queue 仍由 Core 唯一持有。
+唯一已迁移的部分是无 IO 的权限意图策略规划；scope、Hook、请求生命周期和实际执行继续归 Core。
+
+CLI 与 ACP 不复制这些状态。ACP 服务端通过 Rust Runtime SDK 处理会话创建/列举、轮次、取消、交互响应和事件订阅，
 但完整持久化历史回放、模型/模式目录与提供方配置和 MCP 仍走单一 Core 兼容接口；会话模型/模式写入通过 Agent Runtime API 回到同一 Core 归属模块。ACP stdio、连接和协议转换仍在
 `interfaces/acp`。Desktop 复用同一 Core owner 构造一个窄口径 Rust Runtime SDK，主界面的轮次提交/取消、工具确认/拒绝和
 用户问题回答与会话模型更新已通过 Rust Runtime SDK；会话 CRUD/恢复视图、MCP、MiniApp、Cron、远程连接、Tauri 窗口与平台资源

docs/architecture/product-customization-blueprint.md

@@ -62,6 +62,13 @@ manifest。相同输入必须产生相同摘要；非默认产品使用 digest-s
 解释来源、localized 名称、技术 identity 与摘要。binary/bundle identity 不作为可见名称，产品 locale 必须符合共享
 i18n locale 集合和 key parity。
 
+### 0.2 修改与验证
+
+- 只修改默认产品定义或资源引用时运行 `pnpm run product:check`；非默认定义运行
+  `pnpm run product:check -- --product-config <path>`，确保校验实际改动的产品；
+- 修改 schema、resolver 或 Desktop/CLI build adapter 行为时，再运行 `pnpm run product:test`；
+- 打包和平台矩阵只在变更触及对应交付路径时运行，不作为产品定义的默认本地预检。
+
 ## 1. 设计结论
 
 产品定制只需要四类对象：