refactor: move MiniApp host plans and developer tooling

Move MiniApp host call planning into product-domain decisions while keeping runtime execution and permission-sensitive IO in core.

Streamline root contributor guidance, move DeepReview-specific rules to local AGENTS files, and guard desktop DevTools shortcuts behind backend availability.

Author: limityan

AGENTS-CN.md

@@ -164,40 +164,6 @@ await api.invoke('your_command', { request: { ... } });
 - 产品表面可以有差异；共享稳定 facts 或 ports，不共享 UI、protocol、lifecycle 或平台实现。
 - 迁移 runtime owner 必须有评审过的 port/provider 设计、旧路径兼容、行为等价测试；如果可能改变行为边界，还需要先确认。
 
-### DeepReview 护栏
-
-Deep Review / 代码审核团队横跨 core runtime 与 Web UI。target resolution 与
-manifest construction 保持在前端；policy validation、queue/retry state 和
-report enrichment 保持在 shared core。
-
-### 后端链路
-
-大多数功能建议按这个顺序追踪：
-
-1. `src/web-ui` 或应用入口
-2. `src/apps/desktop/src/api/*` 或 server routes
-3. `src/crates/api-layer`
-4. `src/crates/transport`
-5. `src/crates/core`
-
-### `bitfun-core`
-
-`src/crates/core` 是代码库中心。
-
-主要区域：
-
-- `agentic/`：agents、prompts、tools、sessions、execution、persistence
-- `service/`：config、filesystem、terminal、git、LSP、MCP、remote connect、project context、AI memory
-- `infrastructure/`：AI clients、app paths、event system、storage、debug log server
-
-Agent 运行时心智模型：
-
-```text
-SessionManager → Session → DialogTurn → ModelRound
-```
-
-会话数据保存在 `.bitfun/sessions/{session_id}/`。
-
 ## 验证
 
 按触及文件选择最小本地预检。完整构建和大范围测试默认由 CI 保护；只有改动直接影响构建、
@@ -210,7 +176,6 @@ SessionManager → Session → DialogTurn → ModelRound
 | Locale contract 或 shared terms | `pnpm run i18n:generate && pnpm run i18n:contract:test && pnpm run i18n:audit` |
 | Web UI i18n runtime、namespace loading 或直接 `i18nService.t(...)` 调用 | `pnpm run i18n:contract:test && pnpm run type-check:web && pnpm --dir src/web-ui run test:run src/infrastructure/i18n/core/I18nService.test.ts` |
 | Mobile web UI、状态、配对、断开或重连行为 | `pnpm --dir src/mobile-web run type-check`；行为变化还需要在 PR 中说明手动配对 / 重连验证 |
-| Deep Review / 代码审核团队行为 | 运行最近的 Web UI 检查，再运行 `cargo test -p bitfun-core deep_review -- --nocapture`；如果触及后端或 Tauri API，还需要运行对应 Rust / 桌面端检查 |
 | `core`、`transport`、`api-layer` 或共享服务中的 Rust 逻辑 | `cargo check --workspace`；行为变化时再加最近的 focused `cargo test` |
 | 桌面端集成、Tauri API、browser/computer-use 或桌面专属行为 | `cargo check -p bitfun-desktop`；行为变化时再加 focused desktop tests |
 | 被桌面端 smoke/functional 流覆盖的行为 | 优先运行最近的 focused E2E/smoke check；除非改动影响构建，否则 broad build/test 交给 CI |
@@ -219,20 +184,6 @@ SessionManager → Session → DialogTurn → ModelRound
 | 安装器 Tauri/Rust 改动 | `cargo check --manifest-path BitFun-Installer/src-tauri/Cargo.toml` |
 | 安装器打包、payload、安装/卸载流程或 native bundling | `pnpm run installer:build` |
 
-## 先看哪里
-
-| 功能 | 关键路径 |
-|---|---|
-| Agent mode | `src/crates/core/src/agentic/agents/`、`src/crates/core/src/agentic/agents/prompts/`、`src/web-ui/src/locales/*/scenes/agents.json` |
-| Deep Review / 代码审核团队 | `src/crates/core/src/agentic/deep_review/`、`src/crates/core/src/agentic/deep_review_policy.rs`、`src/crates/core/src/agentic/agents/definitions/hidden/deep_review.rs`、`src/crates/core/src/agentic/tools/implementations/{task_tool.rs,code_review_tool.rs}`、`src/web-ui/src/shared/services/review-team/`、`src/web-ui/src/flow_chat/deep-review/`、`src/web-ui/src/app/scenes/agents/components/ReviewTeamPage.tsx` |
-| Mobile web 配对 / 远程控制 | `src/mobile-web/src/pages/PairingPage.tsx`、`src/mobile-web/src/pages/SessionListPage.tsx`、`src/mobile-web/src/pages/ChatPage.tsx`、`src/mobile-web/src/services/RemoteSessionManager.ts`、`src/mobile-web/src/services/RelayHttpClient.ts`、`src/mobile-web/src/services/store.ts` |
-| 会话用量报告（`/usage`） | `src/crates/core/src/service/session_usage/`、`src/web-ui/src/flow_chat/components/usage/`、`src/web-ui/src/locales/*/flow-chat.json` |
-| Tool | `src/crates/core/src/agentic/tools/implementations/`、`src/crates/core/src/agentic/tools/registry.rs` |
-| MCP / LSP / remote | `src/crates/core/src/service/mcp/`、`src/crates/core/src/service/lsp/`、`src/crates/core/src/service/remote_connect/`、`src/crates/core/src/service/remote_ssh/` |
-| 桌面端 API | `src/apps/desktop/src/api/`、`src/crates/api-layer/src/`、`src/crates/transport/src/adapters/tauri.rs` |
-| 中继服务器 | `src/apps/relay-server/` |
-| Web/server 通信 | `src/web-ui/src/infrastructure/api/`、`src/crates/transport/src/adapters/websocket.rs`、`src/apps/server/src/routes/`、`src/apps/server/src/main.rs` |
-
 ## Agent 文档优先级
 
 进入具体目录后，优先遵循离目标文件最近的 `AGENTS.md` / `AGENTS-CN.md`。如果局部文档与本文件冲突，以更具体、更近的文档为准。

AGENTS.md

@@ -174,40 +174,6 @@ Repository-level decomposition rules:
   compatibility, behavior equivalence tests, and explicit confirmation when a
   behavior boundary could change.
 
-### DeepReview guardrails
-
-Deep Review / Code Review Team work spans the core runtime and web UI. Keep
-target resolution and manifest construction on the frontend; keep policy
-validation, queue/retry state, and report enrichment in shared core.
-
-### Backend flow
-
-Trace most features in this order:
-
-1. `src/web-ui` or app entrypoint
-2. `src/apps/desktop/src/api/*` or server routes
-3. `src/crates/api-layer`
-4. `src/crates/transport`
-5. `src/crates/core`
-
-### `bitfun-core`
-
-`src/crates/core` is the center of the codebase.
-
-Important areas:
-
-- `agentic/`: agents, prompts, tools, sessions, execution, persistence
-- `service/`: config, filesystem, terminal, git, LSP, MCP, remote connect, project context, AI memory
-- `infrastructure/`: AI clients, app paths, event system, storage, debug log server
-
-Agent runtime mental model:
-
-```text
-SessionManager → Session → DialogTurn → ModelRound
-```
-
-Session data is stored under `.bitfun/sessions/{session_id}/`.
-
 ## Verification
 
 Run the smallest local precheck that matches the touched files. CI is expected to
@@ -221,7 +187,6 @@ change directly affects build, packaging, or CI cannot protect the path.
 | Locale contract or shared terms | `pnpm run i18n:generate && pnpm run i18n:contract:test && pnpm run i18n:audit` |
 | Web UI i18n runtime, namespace loading, or direct `i18nService.t(...)` usage | `pnpm run i18n:contract:test && pnpm run type-check:web && pnpm --dir src/web-ui run test:run src/infrastructure/i18n/core/I18nService.test.ts` |
 | Mobile web UI, state, pairing, disconnect, or reconnect behavior | `pnpm --dir src/mobile-web run type-check`; include manual pairing / reconnect notes when behavior changes |
-| Deep Review / Code Review Team behavior | Nearest Web UI check above, plus `cargo test -p bitfun-core deep_review -- --nocapture`; also run Rust / desktop checks when backend or Tauri APIs are touched |
 | Shared Rust logic in `core`, `transport`, `api-layer`, or services | `cargo check --workspace`, plus the nearest focused `cargo test` when behavior changed |
 | Desktop integration, Tauri APIs, browser/computer-use, or desktop-only behavior | `cargo check -p bitfun-desktop`, plus focused desktop tests when behavior changed |
 | Behavior covered by desktop smoke/functional flows | Prefer the nearest focused E2E/smoke check; rely on CI for broad build/test coverage unless build behavior changed |
@@ -230,20 +195,6 @@ change directly affects build, packaging, or CI cannot protect the path.
 | Installer Tauri/Rust changes | `cargo check --manifest-path BitFun-Installer/src-tauri/Cargo.toml` |
 | Installer packaging, payload, install/uninstall flow, or native bundling | `pnpm run installer:build` |
 
-## Where to look first
-
-| Feature | Key paths |
-|---|---|
-| Agent modes | `src/crates/core/src/agentic/agents/`, `src/crates/core/src/agentic/agents/prompts/`, `src/web-ui/src/locales/*/scenes/agents.json` |
-| Deep Review / Code Review Team | `src/crates/core/src/agentic/deep_review/`, `src/crates/core/src/agentic/deep_review_policy.rs`, `src/crates/core/src/agentic/agents/definitions/hidden/deep_review.rs`, `src/crates/core/src/agentic/tools/implementations/{task_tool.rs,code_review_tool.rs}`, `src/web-ui/src/shared/services/review-team/`, `src/web-ui/src/flow_chat/deep-review/`, `src/web-ui/src/app/scenes/agents/components/ReviewTeamPage.tsx` |
-| Mobile web pairing / remote control | `src/mobile-web/src/pages/PairingPage.tsx`, `src/mobile-web/src/pages/SessionListPage.tsx`, `src/mobile-web/src/pages/ChatPage.tsx`, `src/mobile-web/src/services/RemoteSessionManager.ts`, `src/mobile-web/src/services/RelayHttpClient.ts`, `src/mobile-web/src/services/store.ts` |
-| Session usage report (`/usage`) | `src/crates/core/src/service/session_usage/`, `src/web-ui/src/flow_chat/components/usage/`, `src/web-ui/src/locales/*/flow-chat.json` |
-| Tools | `src/crates/core/src/agentic/tools/implementations/`, `src/crates/core/src/agentic/tools/registry.rs` |
-| MCP / LSP / remote | `src/crates/core/src/service/mcp/`, `src/crates/core/src/service/lsp/`, `src/crates/core/src/service/remote_connect/`, `src/crates/core/src/service/remote_ssh/` |
-| Desktop APIs | `src/apps/desktop/src/api/`, `src/crates/api-layer/src/`, `src/crates/transport/src/adapters/tauri.rs` |
-| Relay server | `src/apps/relay-server/` |
-| Web/server communication | `src/web-ui/src/infrastructure/api/`, `src/crates/transport/src/adapters/websocket.rs`, `src/apps/server/src/routes/`, `src/apps/server/src/main.rs` |
-
 ## Agent-doc priority
 
 Prefer the nearest matching `AGENTS.md` / `AGENTS-CN.md` for the directory you are changing. If local guidance conflicts with this file, follow the more specific, nearer document.

CONTRIBUTING.md

@@ -19,12 +19,14 @@ Be respectful, kind, and constructive. We welcome contributors of all background
 
 #### Windows: OpenSSL Setup
 
-The desktop app includes SSH remote support, which pulls in OpenSSL. On Windows the workspace **does not use vendored OpenSSL**; link against **pre-built** binaries (no Perl/NASM/OpenSSL source build).
+Most Windows contributors do not need to configure OpenSSL manually. Use
+`pnpm run desktop:dev` or the normal `desktop:build*` scripts; they bootstrap a
+pre-built OpenSSL package when needed.
 
-- **Default**: `pnpm run desktop:dev` calls `ensure-openssl-windows.mjs` on Windows. `pnpm run desktop:preview:debug` does the same whenever it needs to fast-rebuild `bitfun-desktop` before preview. Every `desktop:build*` script runs via `scripts/desktop-tauri-build.mjs`, which does the same before invoking Cargo.
-- **Manual / CI**: Download the [FireDaemon OpenSSL 3.5.5 LTS ZIP](https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip), extract, set `OPENSSL_DIR` to the `x64` folder, `OPENSSL_STATIC=1`, or run `scripts/ci/setup-openssl-windows.ps1`.
-- **Opt out of auto-download**: `BITFUN_SKIP_OPENSSL_BOOTSTRAP=1` and configure `OPENSSL_DIR` yourself.
-- **`desktop:dev:raw`** skips the dev script (no OpenSSL bootstrap); set `OPENSSL_DIR` yourself, run `scripts/ci/setup-openssl-windows.ps1`, or `node scripts/ensure-openssl-windows.mjs` (warms `.bitfun/cache/` and prints PowerShell `OPENSSL_*` lines to paste).
+Only handle OpenSSL yourself when the bootstrap fails, you are preparing CI, or
+you intentionally use `pnpm run desktop:dev:raw`. In that case, run
+`scripts/ci/setup-openssl-windows.ps1`, or set `OPENSSL_DIR` to a pre-built x64
+OpenSSL directory and set `OPENSSL_STATIC=1`.
 
 ### Install dependencies
 
@@ -54,9 +56,10 @@ pnpm run e2e:test
 
 ### Desktop debugging tools
 
-Desktop dev builds enable the `devtools` Cargo feature. Use
-`Cmd/Ctrl + Shift + I` for the element inspector and `Cmd/Ctrl + Shift + J` for
-native webview DevTools. These tools are disabled in end-user `release` builds.
+Desktop dev builds enable the `devtools` Cargo feature. Use `F12` for native
+webview DevTools. `Cmd/Ctrl + Shift + I` toggles the BitFun element inspector,
+and `Cmd/Ctrl + Shift + J` also opens native DevTools. These tools are disabled
+in end-user `release` builds.
 
 ## Code Standards and Architecture Constraints
 
@@ -73,8 +76,7 @@ terms:
   payloads.
 - Core decomposition, feature-boundary, dependency-boundary, and build-speed
   work must follow `docs/architecture/core-decomposition.md`.
-- Deep Review / Code Review Team changes must keep the core and Web UI guidance
-  aligned with the implementation.
+- Feature-specific rules belong in the nearest module `AGENTS.md`.
 
 ## Key Contribution Focus Areas
 

CONTRIBUTING_CN.md

@@ -19,12 +19,12 @@
 
 #### Windows：OpenSSL 配置
 
-桌面端包含 SSH 远程功能，会链接 OpenSSL。Windows 上**不使用 OpenSSL 源码编译（vendored）**，需使用**预编译**库。
+大多数 Windows 贡献者不需要手动配置 OpenSSL。使用 `pnpm run desktop:dev`
+或常规 `desktop:build*` 脚本即可；脚本会在需要时自动引导预编译的 OpenSSL 包。
 
-- **默认**：Windows 下 `pnpm run desktop:dev` 会调用 `ensure-openssl-windows.mjs`；`pnpm run desktop:preview:debug` 在需要为预览执行快速本地 `cargo build -p bitfun-desktop` 时，也会做同样的 OpenSSL 引导。所有 `desktop:build*` 均通过 `scripts/desktop-tauri-build.mjs` 执行，在 `tauri build` 前做相同引导（首次下载到 `.bitfun/cache/`，之后走缓存）。
-- **手动 / CI**：下载 [FireDaemon ZIP](https://download.firedaemon.com/FireDaemon-OpenSSL/openssl-3.5.5.zip)，解压后将 `OPENSSL_DIR` 指向 `x64`，并设 `OPENSSL_STATIC=1`，或运行 `scripts/ci/setup-openssl-windows.ps1`。
-- **关闭自动下载**：设置 `BITFUN_SKIP_OPENSSL_BOOTSTRAP=1` 并自行配置 `OPENSSL_DIR`。
-- **`desktop:dev:raw`** 不经过 `dev.cjs`（无 OpenSSL 引导）；请自行设置 `OPENSSL_DIR`、运行 `scripts/ci/setup-openssl-windows.ps1`，或执行 `node scripts/ensure-openssl-windows.mjs`（会预热 `.bitfun/cache/` 并打印可在 PowerShell 中粘贴的 `OPENSSL_*` 命令）。
+只有在自动引导失败、准备 CI 环境，或你明确使用 `pnpm run desktop:dev:raw`
+时才需要手动处理。此时运行 `scripts/ci/setup-openssl-windows.ps1`，或将
+`OPENSSL_DIR` 指向预编译的 x64 OpenSSL 目录，并设置 `OPENSSL_STATIC=1`。
 
 ### 安装依赖
 
@@ -54,8 +54,9 @@ pnpm run e2e:test
 
 ### 桌面端调试工具
 
-桌面端 dev 构建会启用 `devtools` Cargo feature。`Cmd/Ctrl + Shift + I` 打开元素检查器，
-`Cmd/Ctrl + Shift + J` 打开原生 webview DevTools；面向最终用户的 `release` 构建不会启用这些工具。
+桌面端 dev 构建会启用 `devtools` Cargo feature。`F12` 打开原生 webview
+DevTools；`Cmd/Ctrl + Shift + I` 切换 BitFun 元素检查器，`Cmd/Ctrl + Shift + J`
+也可以打开原生 DevTools。面向最终用户的 `release` 构建不会启用这些工具。
 
 ## 代码规范与架构约束
 
@@ -67,7 +68,7 @@ pnpm run e2e:test
 - Tauri command 使用 `snake_case` 命令名和结构化 `request` 参数。
 - core 拆解、feature 边界、依赖边界和构建提速重构必须遵循
   `docs/architecture/core-decomposition.md`。
-- Deep Review / 代码审核团队改动需要保持 core 与 Web UI 指南和实现一致。
+- 功能级规则应放在离代码最近的模块 `AGENTS.md` 中。
 
 ## 重点关注的贡献方向
 

docs/plans/core-decomposition-completed.md

@@ -64,12 +64,13 @@
 ### 1.5 Product Domain 与 function-agent / MiniApp 边界
 
 - `product-domains` 已承接 MiniApp 的纯状态、runtime detection policy、worker capacity / idle / LRU policy、
-  host method / fs access / shell token / env 等纯决策，以及 function-agent prompt / parser / response policy / ports。
+  host method、`fs.*` / `shell.exec` host call plan、fs access / shell token / cwd / timeout / env 等纯决策，
+  以及 function-agent prompt / parser / response policy / ports。
 - 内置 MiniApp bundle identity、版本和 embedded source assets 已归入 `product-domains`。
 - function-agent Git concrete snapshot、no-HEAD diff fallback、非 Git workspace fallback、ahead/behind/last-commit
   fallback 和 project context lookup 已迁入 `services-integrations::function_agents`。
-- function-agent AI provider acquisition、AI transport error mapping、MiniApp worker process、host dispatch、
-  PathManager integration、marker IO 和 seed 写盘仍留在 core concrete path。
+- function-agent AI provider acquisition、AI transport error mapping、MiniApp worker process、host side-effect dispatch、
+  `net.fetch` / `os.info` runtime execution、PathManager integration、marker IO 和 seed 写盘仍留在 core concrete path。
 
 ## 2. 已建立的保护
 

docs/plans/core-decomposition-plan.md

@@ -120,11 +120,15 @@ prompt-visible manifest、GetToolSpec、readonly/enabled filtering、expanded/co
 
 目标：让 Harness / Product Domains 不再停留在 descriptor 或 pure policy 层，而是接管符合设计边界的工作流和 domain owner。
 
-- 为 Deep Review、DeepResearch、MiniApp、function-agent 明确哪些属于 Harness workflow、哪些属于 Product Domain policy、
-  哪些属于 Concrete Integration provider。
-- 迁移 MiniApp worker/host/seed/marker IO 中可被 Runtime Services / provider port 保护的主体。
-- 为 function-agent AI provider acquisition 抽稳定 AI runtime/provider port，避免 integration crate 依赖回 core 或复制 AI client runtime。
-- Harness provider 从 legacy route plan 逐步转向可执行 workflow owner；无法迁移的 concrete 副作用必须明确保留在 Product Assembly adapter。
+- MiniApp host primitive 的 `fs.*` / `shell.exec` 纯调用计划、参数默认值、错误契约和权限检查计划归入
+  Product Domain；core 仅消费计划并继续负责权限 policy resolution、路径规范化、文件 IO、进程执行和输出映射。
+- `net.fetch` / `os.info` 不迁入 Product Domain：前者依赖 `reqwest::Url` 与 HTTP client 语义，后者依赖平台 runtime facts，
+  保留在 core concrete path 更符合最小依赖原则。
+- MiniApp seed / marker 的 bundle、hash、marker wire format 与 seed decision 已由 Product Domain 持有；core 仍负责磁盘读写、
+  customization metadata、PathManager integration 和 recompile。
+- function-agent 已通过 Product Domain facade 与 core adapter 隔离 Git/AI 端口；AI provider acquisition 和 transport error mapping
+  仍留在 core，除非后续单独评审稳定 AI runtime/provider 边界。
+- Harness provider 继续保持 legacy route plan / descriptor owner；Deep Review / DeepResearch concrete execution 不混入本阶段。
 
 **不混入：** 改变 MiniApp storage layout、worker 生命周期、host primitive 权限、Deep Review report 语义、function-agent prompt/response policy。
 
@@ -155,7 +159,7 @@ prompt-visible manifest、GetToolSpec、readonly/enabled filtering、expanded/co
 
 ## 5. 执行节奏
 
-后续按 M2 -> M3 -> M4 -> M5 推进。每个里程碑原则上对应一个大 PR；如果发现风险超过单 PR 可控范围，只允许按 owner 边界拆分，
+后续按 M4 收尾 -> M5 推进。每个里程碑原则上对应一个大 PR；如果发现风险超过单 PR 可控范围，只允许按 owner 边界拆分，
 不允许拆成 facade / guard / helper 小 PR。
 
 每个里程碑固定流程：