feat(permissions): add model approval

Evaluate permission asks with a configured chat or Jev model, then route uncertain results through the existing approval policy.

Expose model, endpoint, credential, and timeout settings across Desktop, CLI, and remote config surfaces.

Author: wsp

Cargo.lock

@@ -27,9 +27,9 @@ OpenBitFun Playbook currently contains **22 features**, **22 settings pages**, a
 - Generated per-item interaction audit: `docs/interactive-capabilities/technical/product-control-open-audit.json`
 - Generated low-level audit map: `docs/interactive-capabilities/technical/tauri-command-map.json`
 
-说明书、网站、搜索和智能体只看“功能 + 设置 + 子能力”。每项子能力都必须引用已注册 Tauri Command 或可解析的源码标记；这些证据不会进入公开目录。当前 **699** 个 Tauri 命令只用于实现覆盖审计。产品 UI 交互源码会在生成和检查时扫描并校验，但不会保存成随普通 UI 改动频繁变化的版本化快照。
+说明书、网站、搜索和智能体只看“功能 + 设置 + 子能力”。每项子能力都必须引用已注册 Tauri Command 或可解析的源码标记；这些证据不会进入公开目录。当前 **702** 个 Tauri 命令只用于实现覆盖审计。产品 UI 交互源码会在生成和检查时扫描并校验，但不会保存成随普通 UI 改动频繁变化的版本化快照。
 
-Docs, website, search, and agents see only features, settings, and documented sub-capabilities. Every sub-capability must reference a registered Tauri command or a resolvable source marker; evidence is stripped from public projections. The **699** Tauri commands remain implementation-audit evidence only. Product UI interaction sources are scanned and validated during generation and checks, but are not stored as a versioned snapshot that churns with ordinary UI changes.
+Docs, website, search, and agents see only features, settings, and documented sub-capabilities. Every sub-capability must reference a registered Tauri command or a resolvable source marker; evidence is stripped from public projections. The **702** Tauri commands remain implementation-audit evidence only. Product UI interaction sources are scanned and validated during generation and checks, but are not stored as a versioned snapshot that churns with ordinary UI changes.
 
 ## 控制边界 / Control boundary
 

docs/interactive-capabilities/README.md

@@ -4,7 +4,7 @@
   "title": "OpenBitFun Playbook",
   "origin": "https://playbook.openbitfun.com",
   "source": "src/shared/interactive-capabilities/catalog.json",
-  "digest": "5370adbf2ff3746a6d89704d38498047e3430850234e4abc1cd6bb5eea2aac49",
+  "digest": "778506ae9a8c979c4cea4de5c575be1bde0517def6ee5854dba203665098fa29",
   "ownerDigest": "31d6371f7765bde7bee88e22a6a4f03c2c5370e138cf49975bdc88f3c5eeb052",
   "searchAcceptance": [
     {
@@ -29394,7 +29394,7 @@
         "JSON repair"
       ],
       "highlightsZh": [
-        "询问、自动批准与完全访问策略",
+        "询问、自动审批与完全访问策略",
         "子智能体并行度和工具超时",
         "Computer Use、浏览器连接与工具参数修复"
       ],
@@ -29406,8 +29406,8 @@
       "items": [
         {
           "id": "permission-mode",
-          "titleZh": "选择询问、自动批准或完全访问权限模式，并确认高风险警告",
-          "titleEn": "Choose Ask, Auto-approve, or Full Access permission mode and acknowledge high-risk warnings",
+          "titleZh": "选择询问、自动审批或完全访问权限模式，并确认高风险警告",
+          "titleEn": "Choose Ask, Automatic approval, or Full Access permission mode and acknowledge high-risk warnings",
           "destination": {
             "kind": "settings",
             "pageId": "tools.execution",
@@ -29416,8 +29416,8 @@
           "control": {
             "kind": "open",
             "reasonCode": "unstructuredInteraction",
-            "reasonZh": "“选择询问、自动批准或完全访问权限模式，并确认高风险警告”由多个实时状态相关步骤组成，目前没有一个能确定完成整个流程的单一结构化 Command；智能体会打开精确入口，并把后续交互保留在用户可见界面。",
-            "reasonEn": "“Choose Ask, Auto-approve, or Full Access permission mode and acknowledge high-risk warnings” spans multiple live-state-dependent steps and currently has no single structured Command that can deterministically complete the whole workflow; the Agent opens the exact entry and keeps the remaining interaction visible to the user."
+            "reasonZh": "“选择询问、自动审批或完全访问权限模式，并确认高风险警告”由多个实时状态相关步骤组成，目前没有一个能确定完成整个流程的单一结构化 Command；智能体会打开精确入口，并把后续交互保留在用户可见界面。",
+            "reasonEn": "“Choose Ask, Automatic approval, or Full Access permission mode and acknowledge high-risk warnings” spans multiple live-state-dependent steps and currently has no single structured Command that can deterministically complete the whole workflow; the Agent opens the exact entry and keeps the remaining interaction visible to the user."
           }
         },
         {
@@ -29844,14 +29844,14 @@
         "computer use",
         "browser control",
         "JSON repair",
-        "询问、自动批准与完全访问策略",
+        "询问、自动审批与完全访问策略",
         "子智能体并行度和工具超时",
         "Computer Use、浏览器连接与工具参数修复",
         "Ask, auto-approve, and full-access policies",
         "Subagent concurrency and tool timeouts",
         "Computer Use, browser connection, and tool-argument repair",
-        "选择询问、自动批准或完全访问权限模式，并确认高风险警告",
-        "Choose Ask, Auto-approve, or Full Access permission mode and acknowledge high-risk warnings",
+        "选择询问、自动审批或完全访问权限模式，并确认高风险警告",
+        "Choose Ask, Automatic approval, or Full Access permission mode and acknowledge high-risk warnings",
         "控制权限模式选择器是否显示在聊天输入框下方",
         "Choose whether the permission-mode selector appears below the chat composer",
         "创建、排序和保存全局或项目级 Allow、Ask、Deny 规则",

docs/interactive-capabilities/capabilities.json

@@ -17,8 +17,8 @@ Manage agent tool permissions, presentation mode, concurrency, timeouts, deferre
 
 ## 完整功能清单 / Everything included
 
-- **智能体可定位入口，需交互完成 / Agent opens; interaction required** · 选择询问、自动批准或完全访问权限模式，并确认高风险警告
-  - Choose Ask, Auto-approve, or Full Access permission mode and acknowledge high-risk warnings
+- **智能体可定位入口，需交互完成 / Agent opens; interaction required** · 选择询问、自动审批或完全访问权限模式，并确认高风险警告
+  - Choose Ask, Automatic approval, or Full Access permission mode and acknowledge high-risk warnings
 - **智能体可直接控制 / Direct Agent control** · 控制权限模式选择器是否显示在聊天输入框下方
   - Choose whether the permission-mode selector appears below the chat composer
 - **智能体可定位入口，需交互完成 / Agent opens; interaction required** · 创建、排序和保存全局或项目级 Allow、Ask、Deny 规则

docs/interactive-capabilities/capabilities/setting.tools.execution.md

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "generatedFrom": "src/shared/interactive-capabilities/catalog.json",
-  "catalogDigest": "5370adbf2ff3746a6d89704d38498047e3430850234e4abc1cd6bb5eea2aac49",
+  "catalogDigest": "778506ae9a8c979c4cea4de5c575be1bde0517def6ee5854dba203665098fa29",
   "count": 196,
   "reasonCounts": {
     "externalAuth": 4,
@@ -2780,11 +2780,11 @@
     {
       "capabilityId": "setting.tools.execution",
       "itemId": "permission-mode",
-      "titleZh": "选择询问、自动批准或完全访问权限模式，并确认高风险警告",
-      "titleEn": "Choose Ask, Auto-approve, or Full Access permission mode and acknowledge high-risk warnings",
+      "titleZh": "选择询问、自动审批或完全访问权限模式，并确认高风险警告",
+      "titleEn": "Choose Ask, Automatic approval, or Full Access permission mode and acknowledge high-risk warnings",
       "reasonCode": "unstructuredInteraction",
-      "reasonZh": "“选择询问、自动批准或完全访问权限模式，并确认高风险警告”由多个实时状态相关步骤组成，目前没有一个能确定完成整个流程的单一结构化 Command；智能体会打开精确入口，并把后续交互保留在用户可见界面。",
-      "reasonEn": "“Choose Ask, Auto-approve, or Full Access permission mode and acknowledge high-risk warnings” spans multiple live-state-dependent steps and currently has no single structured Command that can deterministically complete the whole workflow; the Agent opens the exact entry and keeps the remaining interaction visible to the user.",
+      "reasonZh": "“选择询问、自动审批或完全访问权限模式，并确认高风险警告”由多个实时状态相关步骤组成，目前没有一个能确定完成整个流程的单一结构化 Command；智能体会打开精确入口，并把后续交互保留在用户可见界面。",
+      "reasonEn": "“Choose Ask, Automatic approval, or Full Access permission mode and acknowledge high-risk warnings” spans multiple live-state-dependent steps and currently has no single structured Command that can deterministically complete the whole workflow; the Agent opens the exact entry and keeps the remaining interaction visible to the user.",
       "presentationTarget": {
         "kind": "settings",
         "pageId": "tools.execution",

docs/interactive-capabilities/technical/product-control-open-audit.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": 2,
   "generatedFrom": "src/shared/interactive-capabilities/catalog.json",
-  "catalogDigest": "5370adbf2ff3746a6d89704d38498047e3430850234e4abc1cd6bb5eea2aac49",
-  "commandCount": 699,
+  "catalogDigest": "778506ae9a8c979c4cea4de5c575be1bde0517def6ee5854dba203665098fa29",
+  "commandCount": 702,
   "coverage": {
-    "commandCount": 699,
+    "commandCount": 702,
     "documentedCommandCount": 637,
-    "implementationCommandCount": 62,
-    "implementationDigest": "39288402985a24c84852570c8137b888b15b3d9e1b40448d974085b25c0fcf46"
+    "implementationCommandCount": 65,
+    "implementationDigest": "1e1e2b424a391bd866585162da35a043dcca3d6f67e0a770a8f8c886007b677a"
   },
   "commands": [
     {
@@ -1074,6 +1074,20 @@
       "signature": "fn cleanup_invalid_workspaces( state: State<'_, AppState>, app: tauri::AppHandle, startup_trace: State<'_, DesktopStartupTrace>, ) -> Result<usize, String>",
       "remoteWorkspacePolicy": "LegacyUnaudited"
     },
+    {
+      "id": "clear_decision_model_credential",
+      "moduleId": "config",
+      "capabilityId": "setting.application.general",
+      "capabilityIds": [
+        "setting.application.general"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "clear_decision_model_credential",
+      "sourceFile": "src/apps/desktop/src/api/config_api.rs",
+      "signature": "fn clear_decision_model_credential( _state: State<'_, AppState>, _request: GetDecisionModelCredentialStatusRequest, ) -> Result<openbitfun_core::service::decision_model::DecisionModelCredentialStatus, String>",
+      "remoteWorkspacePolicy": "WorkspaceAgnostic"
+    },
     {
       "id": "clear_mcp_remote_auth",
       "moduleId": "mcp",
@@ -3107,6 +3121,20 @@
       "signature": "fn get_custom_agent_detail( state: State<'_, AppState>, request: GetCustomAgentDetailRequest, ) -> Result<CustomAgentDetail, String>",
       "remoteWorkspacePolicy": "LegacyUnaudited"
     },
+    {
+      "id": "get_decision_model_credential_status",
+      "moduleId": "config",
+      "capabilityId": "setting.application.general",
+      "capabilityIds": [
+        "setting.application.general"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "get_decision_model_credential_status",
+      "sourceFile": "src/apps/desktop/src/api/config_api.rs",
+      "signature": "fn get_decision_model_credential_status( _state: State<'_, AppState>, _request: GetDecisionModelCredentialStatusRequest, ) -> Result<openbitfun_core::service::decision_model::DecisionModelCredentialStatus, String>",
+      "remoteWorkspacePolicy": "WorkspaceAgnostic"
+    },
     {
       "id": "get_default_review_team_definition",
       "moduleId": "agentic",
@@ -8606,6 +8634,20 @@
       "signature": "fn save_cloud_speech_config( state: State<'_, AppState>, request: SaveCloudSpeechConfigRequest, ) -> Result<SaveCloudSpeechConfigResult, String>",
       "remoteWorkspacePolicy": "WorkspaceAgnostic"
     },
+    {
+      "id": "save_decision_model_credential",
+      "moduleId": "config",
+      "capabilityId": "setting.application.general",
+      "capabilityIds": [
+        "setting.application.general"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "save_decision_model_credential",
+      "sourceFile": "src/apps/desktop/src/api/config_api.rs",
+      "signature": "fn save_decision_model_credential( _state: State<'_, AppState>, request: openbitfun_core::service::decision_model::SaveDecisionModelCredentialRequest, ) -> Result<openbitfun_core::service::decision_model::DecisionModelCredentialStatus, String>",
+      "remoteWorkspacePolicy": "WorkspaceAgnostic"
+    },
     {
       "id": "save_git_repo_history",
       "moduleId": "git",

docs/interactive-capabilities/technical/tauri-command-map.json

@@ -640,7 +640,7 @@ test('runtime-ports async dependencies stay behind their exact port owners', ()
   );
   assert.deepEqual(
     ownersByDependency.get('tokio-util'),
-    new Set(['workspace-ports']),
+    new Set(['permission', 'ts', 'workspace-ports']),
   );
   assert.deepEqual(
     ownersByDependency.get('tokio'),
@@ -815,7 +815,7 @@ const RUNTIME_PORT_FEATURE_PROFILES = {
   'agent-api': ['dep:openbitfun-core-types'],
   'git-port': [],
   'hook-function-runtime': [],
-  permission: ['dep:openbitfun-product-domains'],
+  permission: ['dep:openbitfun-product-domains', 'dep:tokio-util'],
   'plugin-runtime': [],
   'product-search': ['dep:openbitfun-product-domains'],
   'ptc-runtime': [],
@@ -827,6 +827,7 @@ const RUNTIME_PORT_FEATURE_PROFILES = {
   'tool-runtime-handles': ['workspace-ports', 'terminal-port', 'remote-exec-port'],
   ts: [
     'dep:ts-rs',
+    'dep:tokio-util',
     'agent-api',
     'permission',
     'openbitfun-core-types/ts',
@@ -1914,6 +1915,7 @@ const CLI_REVIEWED_CORE_FEATURES = [
   'workspace-icons',
   'tools-pages',
   ...ACP_REVIEWED_CORE_FEATURES,
+  'decision-model-credentials',
   'product-search',
   'remote-connect',
   'file-watch',

scripts/check-core-boundaries.test.mjs

@@ -1456,6 +1456,7 @@ export function findProductEntrypointCoreFeatureViolations(
       'workspace-icons',
       'tools-pages',
       ...coreCompatibilityReviewedFeatures,
+      'decision-model-credentials',
       'product-search',
       'remote-connect',
       // The CLI Peer Host answers `start_file_watch` / `stop_file_watch` for an
@@ -1529,6 +1530,7 @@ export function findProductEntrypointCoreFeatureViolations(
       'workspace-icons',
       'tools-pages',
       ...acpActiveCoreFeatures,
+      'decision-model-credentials',
       'i18n-runtime',
       'plugin-runtime',
       'product-search',

scripts/core-boundaries/cargo-dependency-boundaries.mjs

@@ -127,7 +127,7 @@ export const optionalDependencyFeatureOwnerRules = [
       { depName: 'openbitfun-core-types', ownerFeatures: ['agent-api', 'remote-workspace-ports', 'ts'] },
       { depName: 'openbitfun-product-domains', ownerFeatures: ['permission', 'product-search', 'ts'] },
       { depName: 'tokio', ownerFeatures: ['remote-exec-port', 'terminal-port', 'workspace-ports'] },
-      { depName: 'tokio-util', ownerFeatures: ['workspace-ports'] },
+      { depName: 'tokio-util', ownerFeatures: ['permission', 'ts', 'workspace-ports'] },
       { depName: 'ts-rs', ownerFeatures: ['ts'] },
     ],
   },
@@ -405,7 +405,7 @@ export const capabilityContractDependencyRules = [
       'agent-api': ['dep:openbitfun-core-types'],
       'git-port': [],
       'hook-function-runtime': [],
-      permission: ['dep:openbitfun-product-domains'],
+      permission: ['dep:openbitfun-product-domains', 'dep:tokio-util'],
       'plugin-runtime': [],
       'product-search': ['dep:openbitfun-product-domains'],
       'ptc-runtime': [],
@@ -418,6 +418,7 @@ export const capabilityContractDependencyRules = [
       'web-search-port': [],
       ts: [
         'dep:ts-rs',
+        'dep:tokio-util',
         'agent-api',
         'permission',
         'openbitfun-core-types/ts',
@@ -481,6 +482,9 @@ export const capabilityContractDependencyRules = [
         capabilityEdge(['hook-function-runtime', 'plugin-runtime']),
         capabilityEdge(['script-tool-runtime'], { kind: 'dev' }),
       ])],
+      ['openbitfun-ai-adapters', capabilityConsumer([
+        capabilityEdge(['permission']),
+      ])],
       ['openbitfun-opencode-plugin-host', capabilityConsumer([
         capabilityEdge(['hook-function-runtime']),
       ])],
@@ -729,6 +733,7 @@ export const coreProductFullFeatureAssemblyRule = {
   featureName: 'product-full',
   requiredFeatureRefs: [
     'agent-runtime',
+    'decision-model-credentials',
     'product-search',
     'diagnostics',
     'diff',
@@ -955,6 +960,13 @@ export const coreClosedFeatureProfileRules = [
     reason:
       'openbitfun-core agent-runtime is the reviewed Core Agent Runtime owner closure, not a product-full alias',
   },
+  {
+    manifestPath: 'src/crates/assembly/core/Cargo.toml',
+    featureName: 'decision-model-credentials',
+    requiredFeatureRefs: ['openbitfun-services-core/credential-vault'],
+    exact: true,
+    reason: 'decision-model-credentials must be the only Core owner of decision-model secrets',
+  },
   {
     manifestPath: 'src/crates/assembly/core/Cargo.toml',
     featureName: 'product-search',

scripts/core-boundaries/rules/feature-rules.mjs

@@ -33,6 +33,7 @@ openbitfun-computer-use = { path = "../../crates/services/computer-use" }
 # Internal crates
 openbitfun-core = { path = "../../crates/assembly/core", features = [
     "agent-runtime",
+    "decision-model-credentials",
     "workspace-icons",
     "product-search",
     "document-read",